Publishing a Workflow

This article covers how to restrict access to a Workflow and how to publish one. You may want to restrict access to limit who can run Workflows that touch production systems, modify infrastructure, or should only be available to specific teams, for example, an SRE team’s incident response Workflow or a platform team’s provisioning Workflow. Publishing controls visibility in the Cortex UI: draft Workflows are hidden and only accessible to their authors and collaborators, while published Workflows appear throughout Cortex where any user with access can discover and run them. A Workflow can be run in either state, so you can test and iterate in draft mode, then publish once it’s ready for broader use.

Restricting access to a Workflow

By default, published workflows are visible to anyone in your organization who has permission to view them. To restrict access, follow the steps below.

When a Workflow is saved as a draft, it’s only visible to users with the Edit Workflow permission.

From the main sidebar, select Workflows.
Do one of the following:
- Select the All tab to search and filter across all of your organization’s Workflows.
- Select the Mine tab to search and filter only the Workflows you own.
- Note that Cortex saves your selection and restores it the next time you open this page.
Locate the Workflow, then click the overflow menu icon next to it.
Select Edit Workflow.
In the upper-right corner, click Access.
Toggle off Organization run access.
To set access for specific users, teams, or roles, do any the following:
1. From the Select users drop-down menu, select the users who should have access to view the workflow. Note that users must have the Execute Workflow Runs permission and they must match at least one of the users, teams, or roles specified.
2. From the Select teams drop-down menu, select the teams who should have access to view the workflow.
3. From the Roles drop-down menu, select the roles who should have access to view the workflow.
Click Apply.

Enabling API access

Users with a personal access token or a global API key, with the Execute Workflow Runs permission, can run a Workflow via the API or the Cortex MCP. Follow the steps below to allow a Workflow to be triggered through the Workflow Runs API.

From the main sidebar, select Workflows.
Do one of the following:
- Select the All tab to search and filter across all of your organization’s Workflows.
- Select the Mine tab to search and filter only the Workflows you own.
- Note that Cortex saves your selection and restores it the next time you open this page.
Locate the Workflow, then click the overflow menu icon next to it.
Select Edit Workflow.
In the upper‑right corner, click Access.
Toggle on Runnable via API.
Click Apply. The Workflow can now be run via the API.
Repeat these steps for each Workflow you want to run via the API.