This is the surface an API key can call — 170 of the engine’s 208 operations. Not listed: the
26 inbound webhook receivers (Shopify, Zendesk and others POST to those; you register the URL on
the platform side and the engine verifies the signature), and the WorkOS console session
endpoints. A brand-scoped key covers everything except the Fleet group, which needs a global
credential and refuses a brand key with
Operation requires global credential scope.The workflows
Every workflow family has a/start, a /{id}/status, and — where the workflow supports it —
review and cancel signals.
Start with
POST /v1/workflows/response-automation-v2/start;
the workflow page explains the phases and the review gate it runs through.
Brands are the unit of configuration
A brand carries the deterministic config, connectors, policies and workflow bindings that every workflow for that tenant reads. The Brands group is the largest for that reason: validate a config before applying it, read the scorecard that says how the brand is performing, dry-run a change against logged decisions, and only then activate.Related
- Temporal Engine overview — what the engine is for
- Workflow anatomy — phases, signals, the review gate
- Control plane — multi-tenancy, outbox, DLQ, migration
- Operations and runbooks