Allow app authentication for the workflow designer REST API

Berend Veldkamp

October 28, 2026 09:07

We are using the Workflow REST API to automate execution of workflows, but also to download and upload the workflow JSON, for automated backup or migration purposes. Currently, this works with user credentials (username + password).

But rather than having to store user credentials somewhere, I'd like to use an app login (i.e. an app defined in Portal with a clientId and clientSecret). This works for running a workflow, but not for accessing the /designer endpoints. I can see that a designer token is successfully created, but the /service/designer/workflows?id=[ID] endpoint returns GW001.403: Access Denied.

 

0

• 

  Ken Lyon

  October 28, 2026 15:29

  Hi Berend,

  Make sure you're including the Authorization header. Here's how it looks when we fetch a server workflow from within the designer:

  const response = await fetch(openWorkflowUrl, {
     method: "GET",
     headers: {
         Authorization: `Bearer ${this._designerToken}`,
         Accept: "application/json",
     },
  });

  Also, you might be interested to know that this endpoint accepts an optional querystring parameter called “revision” which is an integer number ≥ 1 that returns a particular version of that workflow. By default we return the latest save, but we keep every saved version. You can see the revision numbers included in the file names saved within C:\ProgramData\Geocortex\Workflow\Workflows.  We never fully implemented the feature but you're welcome to experiment with it if it interests you.

  0
• 

  Berend Veldkamp

  October 29, 2026 13:24 Edited

  Ken Lyon Thanks, that is what I do already, but the result depends on how the ArcGIS token is generated. 

  A (ArcGIS) token generated through the interactive OAuth user login flow works, but an app token generated from the /oauth2/token endpoint does not. With both options I can successfully get a Workflow designer token, but only the first one works for downloading a workflow.

  If I create a token using the /generateToken endpoint, I can't get a Workflow designer token at all.

  Getting a ‘run’ token and executing a workflow works in all three cases.

  Does the app I create in ArcGIS need to have certain privileges set?

  0
• 

  Ken Lyon

  October 29, 2026 21:04

  Berend Veldkamp This is getting a bit complicated. Let me try a table to see if I've understood what you're saying…

  Method                      Gets Designer Token      Downloads Workflow
  OAuth (Interactive)     Yes                                    Yes
  /oauth2/token              Yes                                    No
  /generateToken           No                                     No (implied)

  Firstly, there are a few reasons a token might be rejected when requesting a designer token:

  1. The access token was not generated using the correct App Id.
     It has to match the Portal settings in the Workflow Post Installer.
  2. The user does not have permission to access the app.
     I'm not clear on how you could generate a token for something you don't have access to, but we do check both things

  Some reasons why a designer token might be rejected when trying to download a workflow:

  1. The key embedded in the token doesn't match the one in Workflow Server.
     This might happen if it's expired. If you're using the token immediately after generation it should be fine.
  2. Again, the App Id needs to match.
     In your case, you wouldn't have got the designer token if it didn't. We do check for it here, though.
  3. You need write permission on the portal item associated with the workflow.

  If you are comfortable sharing the two designer tokens with me, I could dig into them and compare them. Maybe I could spot a difference between them which would explain why one works and the other doesn't.

  0

Please sign in to leave a comment.