Skip to main content

Workflow API Limitations

Summary​

The native API exposes functional authoring and approval operations with material security, execution, validation, routing, compatibility, versioning and testing gaps.

Authentication​

  • Bearer support is configured, but endpoints do not require authentication.
  • Some validation switches depend on effective configuration.

Authorization​

  • Policy catalog is empty.
  • No backend permission or task-assignment enforcement.
  • Diagnostic operations are unprotected.

Workflow execution​

  • No cancellation, archive, notification execution, timeout, retry or callback API.
  • No standalone version operations.

Task processing​

  • No completed/all-task search, detail/history, claim, bulk decision or pagination.
  • Rejection leaves sibling tasks pending.

Validation​

  • No dedicated validator or standardized validation detail.
  • Limited step, condition, assignment and concurrency validation.

Gateway and compatibility​

  • No Workflow Gateway route or compatibility endpoint was found.
  • Portal transport in deployed environments requires confirmation.

Versioning​

  • HTTP API versioning is Not implemented.

Testing​

  • One running-service smoke script exists.
  • Unit, isolated integration, security, tenant and contract suites were not found.

Requires Confirmation​

Production access controls, diagnostic exposure, Gateway ownership, contract evolution, concurrency and test remediation require confirmation.

Source References​

  • microservices/src/workflow-service/Api/WorkflowEndpoints.cs
  • microservices/src/workflow-service/Api/Policies.cs
  • microservices/src/workflow-service/Application/Commands/WorkflowInstanceCommands.cs
  • microservices/src/workflow-service/Infrastructure/WorkflowDbContext.cs
  • microservices/scripts/smoke-workflow.ps1

See Also​

Keywords​

Workflow API, approval endpoint, Workflow Service.

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-20
  • Next review: 2026-10-20