API Reference
Complete REST API reference for Zafeguard — all SDK, workflow, workspace, and authentication endpoints.
API Reference
Base URL: https://api.zafeguard.com
API version: v1
All request bodies are JSON. All responses are JSON. Dates are ISO 8601 strings.
Authentication headers
| Header | Scope |
|---|---|
X-Api-Key: ws_... | All SDK endpoints when called through @zafeguard/caller-sdk (which sends this header alone) |
X-Api-Key + X-Sdk-Timestamp + X-Sdk-Signature | Raw HTTP callers — see Authentication → REST request signing |
X-Mcp-Token: zmcp_... | The /v1/mcp endpoint only — see MCP Server |
Authorization: Bearer <jwt> | Dashboard/UI session endpoints (workspace settings, user profile, etc.) |
TypeScript SDK types
All types are exported from @zafeguard/caller-sdk:
import type {
// WorkspaceClient — component execution
ClientOptions,
ExecuteOptions,
PromiseOptions,
ExecuteComponentResponse,
ExecutionStreamEvent,
ExecutionStreamHandlers,
ExecutionStreamSubscription,
// WorkflowClient
TriggerRunResponse,
WorkflowRunDetail,
WorkflowRunStatus,
RunStage,
StageStatus,
RunStreamEvent,
RunStreamStage,
RunStreamHandlers,
RunStreamSubscription,
UpdateComponentRequest,
UpdateComponentResponse,
} from '@zafeguard/caller-sdk';WorkspaceClient
ClientOptions
interface ClientOptions {
/** Workspace API key (ws_...) */
apiKey: string;
/** Override API base URL. Defaults to https://api.zafeguard.com */
baseUrl?: string;
}WorkflowClientOptions
Options for WorkflowClient constructor.
interface WorkflowClientOptions {
/** Workspace API key (ws_...) */
apiKey: string;
/** UUID of the workflow to trigger. */
workflowId: string;
/** Override API base URL. Defaults to https://api.zafeguard.com */
baseUrl?: string;
}ExecuteOptions
Options for .execute() — fire and return the execution record.
interface ExecuteOptions {
/** Execution attempts on failure, 1–3. @default 1 */
attempts?: number;
/** Wait up to N ms for inline result. Max 15000. */
waitForMs?: number;
/** HTTPS URL to receive completion webhook. */
callbackUrl?: string;
/** HMAC-SHA256 key for webhook signature. */
callbackSecret?: string;
/** Custom HTTP headers added to the webhook request. */
callbackHeaders?: Record<string, string>;
}PromiseOptions
Options for .promise() — wait for result via SSE stream.
interface PromiseOptions {
/** Execution attempts on failure, 1–3. @default 1 */
attempts?: number;
/**
* Max wait time in ms. Rejects with CallerSDKError("Execution timed out")
* if the execution doesn't complete in time.
* @default 60_000
*/
timeoutMs?: number;
}ExecuteComponentResponse
Returned by .execute() and workspace.execution.get().
interface ExecuteComponentResponse {
id: string;
module: string;
status: 'CREATED' | 'RUNNING' | 'COMPLETED' | 'FAILED';
completed: boolean;
output: unknown | null;
error: unknown | null;
/**
* Credits billed for this call.
*
* `0` indicates this was a free repeat call within the cache window
* (your workspace's first call within the window for these exact
* inputs bills normally; subsequent identical calls are free). See
* "Cache hits and credit usage" in the Execute Component page.
*/
totalUsage: number;
callback: {
url: string | null;
signed: boolean;
signatureAlgorithm: 'hmac-sha256-v1' | null;
headerNames: string[];
lastAttemptAt: string | null;
deliveredAt: string | null;
attemptCount: number;
lastError: unknown | null;
};
createdAt: string;
updatedAt: string;
}ExecutionStreamEvent
Events emitted by workspace.execution.stream().
interface ExecutionStreamEvent {
id: string;
status: 'CREATED' | 'RUNNING' | 'COMPLETED' | 'FAILED';
// `output` and `error` are optional — the server omits them from the wire
// JSON on non-terminal events.
output?: unknown | null; // populated on COMPLETED
error?: unknown | null; // populated on FAILED
timestamp: string;
}ExecutionStreamHandlers
interface ExecutionStreamHandlers {
/** Called for every status event pushed by the stream. */
onUpdate(event: ExecutionStreamEvent): void;
/** Called when the stream closes due to a network error. */
onError?(err: Error): void;
}ExecutionStreamSubscription
interface ExecutionStreamSubscription {
/** Unsubscribe and tear down the SSE connection. */
close(): void;
}workspace.execution namespace
interface ExecutionNamespace {
/** Fetch current state of an execution by ID. */
get(executionId: string): Promise<ExecuteComponentResponse>;
/** Subscribe to live status events for an execution via SSE. */
stream(
executionId: string,
handlers: ExecutionStreamHandlers,
): ExecutionStreamSubscription;
}workspace.webhook namespace
interface WebhookNamespace {
/** Re-deliver the completion webhook for an execution. Idempotent. */
redeliver(executionId: string): Promise<void>;
}WorkflowClient
TriggerRunResponse
workflow.trigger() returns Promise<TriggerRunResponse[]> — one entry per ON_API_CALLED component on the workflow. Workflows usually have exactly one, so destructuring [0] is the common-case access pattern. Each entry has this shape:
interface TriggerRunResponse {
/** UUID identifying the new run. */
runId: string;
/** Internal job ID for the run. */
jobId: string;
}WorkflowRunStatus
type WorkflowRunStatus =
| 'CREATED'
| 'EXECUTING'
| 'COMPLETED'
| 'FAILED';Cancellation surfaces as a FAILED run with cancelRequestedAt set — there is no separate CANCELED status.
StageStatus
type StageStatus =
| 'CREATED'
| 'RUNNING'
| 'COMPLETED'
| 'FAILED';RunStage
A single component stage within a workflow run.
interface RunStage {
id: string;
module: string;
status: StageStatus;
output: unknown | null;
error: unknown | null;
creditUsage: number;
executionEventId: string | null;
executionDispatchedAt: string | null;
/** 1-based retry counter. 1 = first attempt. */
executionAttempt: number;
updatedAt: string;
}WorkflowRunDetail
Returned by workflow.execution.get() and workflow.waitForRun().
interface WorkflowRunDetail {
id: string;
status: WorkflowRunStatus;
pendingStageCount: number;
failedStageCount: number;
cancelRequestedAt: string | null;
cancelReason: string | null;
totalUsage: number;
createdAt: string;
updatedAt: string;
runStages: RunStage[];
}RunStreamEvent
Events emitted by workflow.stream().
interface RunStreamEvent {
id: string;
status: WorkflowRunStatus;
output: {
totalUsage?: number;
pendingStageCount?: number;
failedStageCount?: number;
cancelRequestedAt?: string | null;
cancelReason?: string | null;
nonTerminalStages?: RunStreamStage[];
};
timestamp: string;
}
interface RunStreamStage {
id: string;
module: string;
status: 'CREATED' | 'RUNNING';
referenceId: string;
/** -1 for non-FOR_EACH stages, otherwise the iteration index. */
iteration: number;
parentStageId: string | null;
executionEventId: string | null;
executionDispatchedAt: string | null;
executionAttempt: number;
updatedAt: string;
}RunStreamHandlers
interface RunStreamHandlers {
/** Called for every status event emitted by the stream. */
onUpdate(event: RunStreamEvent): void;
/** Called when the stream closes due to a connection error. */
onError?(err: Error): void;
}RunStreamSubscription
interface RunStreamSubscription {
/** Unsubscribe and release the SSE connection. */
close(): void;
}UpdateComponentRequest
Payload for workflow.component.update().
interface UpdateComponentRequest {
/** New component config (merged with existing values on the server). */
config?: Record<string, unknown>;
/** New display name for the component on the canvas. */
name?: string;
/** Canvas position [x, y]. */
position?: [number, number];
}UpdateComponentResponse
Returned by workflow.component.update() — the updated component snapshot from the server.
interface UpdateComponentResponse {
id: string;
name: string;
position: [number, number];
config: Record<string, unknown>;
updatedAt: string;
}SDK — Components
Execute component
POST /v1/sdk/components
Auth: X-Api-Key · Rate: 2×
Execute any component standalone. Without waitForMs, returns immediately with status: "CREATED". Set waitForMs (max 15000 ms) for an inline result, or use callbackUrl for async webhook delivery.
Request
{
"module": "RANDOM_UUID",
"input": {},
"config": {},
"attempts": 1,
"waitForMs": 5000,
"callbackUrl": "https://your.app/webhook",
"callbackSecret": "hmac-secret",
"callbackHeaders": { "X-Source": "zafeguard" }
}Response 200 — default (no waitForMs): returns CREATED immediately
{
"id": "3f7a1b2c-...",
"module": "RANDOM_UUID",
"status": "CREATED",
"completed": false,
"output": null,
"totalUsage": 0,
"callback": {
"url": null, "signed": false, "signatureAlgorithm": null,
"headerNames": [], "attemptCount": 0,
"lastAttemptAt": null, "deliveredAt": null, "lastError": null
},
"createdAt": "2026-04-20T10:00:00Z",
"updatedAt": "2026-04-20T10:00:00Z"
}Response 200 — with waitForMs: may return COMPLETED if the component finishes in time
{
"id": "3f7a1b2c-...",
"module": "RANDOM_UUID",
"status": "COMPLETED",
"completed": true,
"output": { "uuid": "a4c2e8f1-..." },
"totalUsage": 1,
"callback": {
"url": null, "signed": false, "signatureAlgorithm": null,
"headerNames": [], "attemptCount": 0,
"lastAttemptAt": null, "deliveredAt": null, "lastError": null
},
"createdAt": "2026-04-20T10:00:00Z",
"updatedAt": "2026-04-20T10:00:01Z"
}Get execution status
GET /v1/sdk/components/executions/:executionId
Auth: X-Api-Key
Response 200 — same shape as Execute Component response above.
Stream execution status
SSE /v1/sdk/components/executions/:executionId/stream
Auth: X-Api-Key
Emits ExecutionStreamEvent objects until the execution reaches COMPLETED or FAILED, then closes. output and error are omitted from the wire JSON on non-terminal events.
interface ExecutionStreamEvent {
id: string;
status: 'CREATED' | 'RUNNING' | 'COMPLETED' | 'FAILED';
output?: unknown;
error?: unknown;
timestamp: string;
}Replay callback
POST /v1/sdk/components/executions/:executionId/replay-callback
Auth: X-Api-Key
Re-delivers the completion webhook. Idempotent.
Response 200 — same as execution response.
SDK — Workflows
Trigger workflow run
POST /v1/sdk/workflows/:workflowId
Auth: X-Api-Key
Response 200 — an array, one entry per ON_API_CALLED component on the workflow (usually exactly one).
[
{
"runId": "9e4c7b1a-...",
"jobId": "bull-12345"
}
]Get workflow run
GET /v1/sdk/workflows/executions/:runId
Auth: X-Api-Key
Response 200
{
"id": "9e4c7b1a-...",
"status": "COMPLETED",
"pendingStageCount": 0,
"failedStageCount": 0,
"totalUsage": 14,
"createdAt": "2026-04-20T10:00:00Z",
"updatedAt": "2026-04-20T10:00:08Z",
"runStages": [
{
"id": "stage-uuid",
"module": "GET_EVM_ACCOUNT_BALANCE",
"status": "COMPLETED",
"output": { "balance": "1000000" },
"creditUsage": 3,
"executionAttempt": 1,
"updatedAt": "2026-04-20T10:00:05Z"
}
]
}Stream workflow run
SSE /v1/sdk/workflows/executions/:runId/stream
Auth: X-Api-Key
Emits run status events including pendingStageCount and currently active stages. Closes on COMPLETED or FAILED. Cancellation surfaces as a FAILED terminal event with output.cancelRequestedAt set.
interface RunStreamEvent {
id: string;
status: 'CREATED' | 'EXECUTING' | 'COMPLETED' | 'FAILED';
output: {
totalUsage?: number;
pendingStageCount?: number;
failedStageCount?: number;
cancelRequestedAt?: string | null;
cancelReason?: string | null;
nonTerminalStages?: Array<{
id: string;
module: string;
status: 'CREATED' | 'RUNNING';
referenceId: string;
iteration: number; // -1 for non-FOR_EACH stages
parentStageId: string | null;
executionEventId: string | null;
executionDispatchedAt: string | null;
executionAttempt: number;
updatedAt: string;
}>;
};
timestamp: string;
}Update workflow component
POST /v1/sdk/workflows/:workflowId/components/:componentId
Auth: X-Api-Key
Request
{
"config": { "url": "https://new-endpoint.com" },
"name": "Updated Component",
"position": [120, 340]
}Error responses
All errors follow:
{
"message": "Human-readable description",
"statusCode": 400,
"error": "Bad Request"
}| Status | Meaning |
|---|---|
400 | Validation error |
401 | Missing or invalid API key |
402 | Insufficient credits |
403 | Missing workspace permission |
404 | Resource not found |
409 | Conflict (e.g. duplicate name) |
429 | Rate limit exceeded |
502 | Upstream service temporarily unavailable |
Execute Workflow
Trigger Zafeguard workflow runs, inspect stage results, stream live status, and manage components with the WorkflowClient SDK.
MCP Server
Connect Claude Desktop, Claude Code, or any MCP-compatible client to your Zafeguard workspace. Execute workflows and components, and let your AI assistant build workflows on the canvas directly.