GoliathDevelopersGet an API key
Reference/Workflowsgenerated from the gateway manifest

patchWorkflowGraph

Edit a workflow version's graph by sending ONLY THE CHANGE.

POST/api/v1/callWRITEidempotent · 24 hruns as the key's owner
View as Markdown

Edit a workflow version's graph by sending ONLY THE CHANGE (updateWorkflowGraph writes a whole new graph). Ids come from getWorkflowVersionGraph and CHANGE ON EVERY SAVE: patch again from the response's graph. graphPatch: ops applied in order, all or nothing. Ops: {op:"updateNode", id, config?, edits?} | {op:"addNode", node:{type, config}, after?: nodeId, onEdge?: edgeId} | {op:"removeNode", id, keepChild?} | {op:"addEdge", edge:{parentNodeId, childNodeId, config?}} | {op:"updateEdge", id, parentNodeId?, childNodeId?, config?} | {op:"removeEdge", id} | {op:"updateConfig", config} (graph.config) | {op:"addTrigger", trigger:{config}} | {op:"updateTrigger", id, config} | {op:"removeTrigger", id}. A config is a JSON merge patch: objects merge, null deletes a key, other values (arrays too) replace; {op:"updateNode", id, config:{seconds:86400}} makes a wait one day. edits: [{field:"textBody", find, replace}], each find exactly once in that text. after inserts after a step with one path out, onEdge on a branch edge; with neither the step is unconnected. A new edge out of a condition sets its config (eval/path). removeNode rejoins the flow; a condition needs keepChild (its other paths go). New step types: updateWorkflowGraph's NODE VOCABULARY. Saves like updateWorkflowGraph (same refusals, flags, draftValidation); a no-op patch is refused.

curl https://server.goliathdata.com/api/v1/call \
  -H "Authorization: Bearer $GOLIATH_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "operationId": "patchWorkflowGraph",
    "variables": {
      "workflowAutomationId": "<workflowAutomationId>",
      "graphPatch": "<JSON>"
    }
  }'
import { GoliathClient } from '@goliath-data/sdk'

const goliath = new GoliathClient({
  apiKey: process.env.GOLIATH_API_KEY!,
  baseUrl: 'https://server.goliathdata.com',
})

const result = await goliath.workflows.patchWorkflowGraph(
  {
    workflowAutomationId: '<workflowAutomationId>',
    graphPatch: '<JSON>'
  },
  { idempotencyKey: crypto.randomUUID() },
)
const res = await fetch('https://server.goliathdata.com/api/v1/call', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.GOLIATH_API_KEY}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({
    operationId: 'patchWorkflowGraph',
    variables: {
      workflowAutomationId: '<workflowAutomationId>',
      graphPatch: '<JSON>'
    }
  }),
})
const { data, errors } = await res.json()

Variables

The example sends only what the schema requires. Some operations also need one of several optional variables (one filter or another, say); the description above says which.

workflowAutomationIdID!required
graphPatchJSON!required
expectedUpdatedAtDateTime
acknowledgeGraphWeakeningBoolean

Response

What comes back under data: a list shows as one entry, and a value as its type.

response shape
{
  "data": {
    "workflowAutomationsMutation": {
      "updateWorkflowAutomationGraph": {
        "id": "<ID>",
        "workflowGroupId": "<ID>",
        "status": "DRAFT",
        "stepKinds": [
          "…"
        ],
        "updatedAt": "2026-01-01T00:00:00.000Z",
        "graph": "…",
        "workflowGroup": {
          "id": "<ID>",
          "draftValidation": {
            "isValid": true,
            "errors": [
              "…"
            ]
          }
        }
      }
    }
  }
}

Errors

400unknown_variable

A variable the operation does not declare. A typo is refused rather than silently dropped.

401unauthorized

No bearer header, or the key is invalid or revoked.

403insufficient_scope

The key lacks the scope the operation requires.

403forbidden

A referenced record does not exist, was deleted, or is outside your organization. The gateway cannot tell those apart.

409idempotency_conflict

A request with this Idempotency-Key is still in flight.

Idempotency

Send an Idempotency-Key of 1 to 255 characters. A finished request retried with the same key replays its stored response, marked Idempotency-Replayed: true; one still in flight returns 409 idempotency_conflict. Keys expire after 24 hours. Write without fear →

READlistWorkflowsREADgetWorkflowREADgetWorkflowVersionGraphREADlistWorkflowRunsREADgetContentTemplateREADlistContentTemplates