# createOrReturnWorkflowDraft

Idempotent "edit": return the existing DRAFT version under this workflow, or clone the live (or most recently paused) version into a fresh DRAFT. Use the returned id with updateWorkflowGraph. WEBHOOK SECRETS ARE REDACTED. A `send_webhook_action` step's `config.auth.secret` reads as the literal `__GOLIATH_WEBHOOK_SECRET_REDACTED__`: never the credential, never a value to quote or reason about. Send it BACK UNCHANGED in updateWorkflowGraph to keep the stored secret, and a different string only when the user is deliberately rotating it. Never invent, guess or complete a replacement: that overwrites a working credential. The sentinel on a step with no stored secret behind it (a step you just added, or a graph read so long ago its node ids rotated) is REFUSED: re-read the graph and carry it from the fresh copy.

- Call: `POST https://server.goliathdata.com/api/v1/call` with `{ "operationId": "createOrReturnWorkflowDraft", "variables": {...} }`
- Scope: `WRITE`
- Type: mutation
- Idempotency: honors `Idempotency-Key` (24 h)
- Rate-limited: no

## Variables

- `workflowGroupId`: `ID!` (required)

## Response (data, an example)

```json
{
  "workflowAutomationsMutation": {
    "createOrReturnWorkflowGroupDraft": {
      "id": "<ID>",
      "workflowGroupId": "<ID>",
      "name": "…",
      "status": "DRAFT",
      "stepKinds": [
        "…"
      ],
      "updatedAt": "2026-01-01T00:00:00.000Z",
      "graph": "…"
    }
  }
}
```

## Example

```bash
curl https://server.goliathdata.com/api/v1/call \
  -H "Authorization: Bearer $GOLIATH_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "operationId": "createOrReturnWorkflowDraft",
    "variables": {
      "workflowGroupId": "<workflowGroupId>"
    }
  }'
```