---
title: "List Automations"
method: GET
path: "/api/v1/automations"
tags: ["Automations"]
---

# List Automations

`GET /api/v1/automations`

List all automations in the tenant with pagination support.

## Response `200`

Successful response

- C1ApiAutomationsV1ListAutomationsResponse — The ListAutomationsResponse message.
  - `list` C1ApiAutomationsV1Automation[], nullable — The page of automations.
    - `annotations` object — Bounded key/value metadata bag for IaC marking and customer tags. See .rfcs/object-annotations.md §2. Limits: ≤16 entries; keys 1–128 chars matching ^[A-Za-z][A-Za-z0-9._/-]{0,127}$; values 0–256 chars URL-safe ASCII; total serialized ≤ 4096 bytes. Keys matching ^c1/ are reserved. Well-known keys: `managed_by`, `iac_workspace`, `iac_resource_address`, `iac_tool_version`.
    - `appId` string — the app id this workflow_template belongs to
    - `automationSteps` C1ApiAutomationsV1AutomationStep[], nullable — The automationSteps field.
      - `accountLifecycleAction` C1ApiAutomationsV1AccountLifecycleAction, nullable — The AccountLifecycleAction message. This message contains a oneof named account_identifier. Only a single field of the following list may be set at a time: - accountRef - accountInContext
        - `accountInContext` C1ApiAutomationsV1AccountInContext, nullable — The AccountInContext message.
        - `accountRef` C1ApiAutomationsV1AccountRef, nullable — The AccountRef message.
          - `accountIdCel` string — The accountIdCel field.
        - `actionName` string — The actionName field.
        - `connectorRef` C1ApiAppV1ConnectorRef, nullable — The ConnectorRef message.
          - `appId` string — The appId field.
          - `id` string — The id field.
      - `callFunction` C1ApiAutomationsV1CallFunction, nullable — The CallFunction message.
        - `args` object — The args field.
        - `functionId` string — The functionId field.
      - `connectorAction` C1ApiAutomationsV1ConnectorAction, nullable — The ConnectorAction message. This message contains a oneof named connector_identifier. Only a single field of the following list may be set at a time: - connectorRef
        - `actionName` string — The actionName field.
        - `argsTemplate` object
        - `connectorRef` C1ApiAppV1ConnectorRef, nullable — The ConnectorRef message.
          - `appId` string — The appId field.
          - `id` string — The id field.
        - `resourceTypeId` string — The resourceTypeId field.
      - `connectorCreateAccount` C1ApiAutomationsV1ConnectorCreateAccount, nullable — The ConnectorCreateAccount message. This message contains a oneof named create_account_arguments. Only a single field of the following list may be set at a time: - userIdCel - userProperties
        - `connectorRef` C1ApiAppV1ConnectorRef, nullable — The ConnectorRef message.
          - `appId` string — The appId field.
          - `id` string — The id field.
        - `passwordCel` string — CEL expression referencing a GeneratePassword step output (e.g. "genStep.password"). When set, the resolved password is encrypted for the connector and sent as CredentialOptions.EncryptedPassword.
        - `userIdCel` string, nullable — The userIdCel field. This field is part of the `create_account_arguments` oneof. See the documentation for `c1.api.automations.v1.ConnectorCreateAccount` for more details.
        - `userProperties` C1ApiAutomationsV1UserProperties, nullable — The UserProperties message.
          - `displayNameCel` string — The displayNameCel field.
          - `emailCel` string — The emailCel field.
          - `profileAttributeCel` string — The profileAttributeCel field.
          - `usernameCel` string — The usernameCel field.
      - `createAccessReview` C1ApiAutomationsV1CreateAccessReview, nullable — The CreateAccessReview message.
        - `accessReviewTemplateCel` string — The accessReviewTemplateCel field.
        - `accessReviewTemplateId` string — The accessReviewTemplateId field.
        - `campaignName` string — Optional campaign name. If not provided, the campaign name will be the access review template name.
        - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `userIdsCel` string — The userIdsCel field.
        - `userRefs` C1ApiUserV1UserRef[], nullable — The userRefs field.
          - `id` string — The id of the user.
      - `createRevokeTasks` C1ApiAutomationsV1CreateRevokeTasks, nullable — The CreateRevokeTasks message.
        - `appEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The appEntitlementRefs field.
          - `appId` string — The appId field.
          - `id` string — The id field.
        - `appEntitlementRefsCel` string — The appEntitlementRefsCel field.
        - `excludedAppEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The excludedAppEntitlementRefs field.
          - `appId` string — The appId field.
          - `id` string — The id field.
        - `excludedAppEntitlementRefsCel` string — The excludedAppEntitlementRefsCel field.
        - `revokeAll` boolean — The revokeAll field.
        - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `userIdCel` string — The userIdCel field.
        - `userRef` C1ApiUserV1UserRef — A reference to a user.
          - `id` string — The id of the user.
      - `createRevokeTasksV2` C1ApiAutomationsV1CreateRevokeTasksV2, nullable — The CreateRevokeTasksV2 message. This message contains a oneof named user. Only a single field of the following list may be set at a time: - userIdCel - userRef - useSubjectUser This message contains a oneof named inclusion. Only a single field of the following list may be set at a time: - inclusionList - inclusionAll - inclusionCriteria - inclusionListCel - inclusionAccessOnly This message contains a oneof named exclusion. Only a single field of the following list may be set at a time: - exclusionNone - exclusionList - exclusionCriteria - exclusionListCel
        - `exclusionCriteria` C1ApiAutomationsV1EntitlementExclusionCriteria, nullable — The EntitlementExclusionCriteria message.
          - `excludedAppIds` string[], nullable — The excludedAppIds field.
          - `excludedComplianceFrameworkIds` string[], nullable — The excludedComplianceFrameworkIds field.
          - `excludedResourceTypeIds` string[], nullable — The excludedResourceTypeIds field.
          - `excludedRiskLevelIds` string[], nullable — The excludedRiskLevelIds field.
        - `exclusionList` C1ApiAutomationsV1EntitlementExclusionList, nullable — The EntitlementExclusionList message.
          - `excludedAppEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The excludedAppEntitlementRefs field.
            - `appId` string — The appId field.
            - `id` string — The id field.
        - `exclusionListCel` C1ApiAutomationsV1EntitlementExclusionListCel, nullable — The EntitlementExclusionListCel message.
          - `excludedAppEntitlementRefsCel` string — The excludedAppEntitlementRefsCel field.
        - `exclusionNone` C1ApiAutomationsV1EntitlementExclusionNone, nullable — The EntitlementExclusionNone message.
        - `inclusionAccessOnly` C1ApiAutomationsV1EntitlementInclusionAccessOnly, nullable — EntitlementInclusionAccessOnly resolves to the system-managed access entitlement on every app the subject user has an AppUser on. Use this to deprovision app accounts without fanning out to every group, role, or permission inside each app — produces at most one revoke ticket per app.
        - `inclusionAll` C1ApiAutomationsV1EntitlementInclusionAll, nullable — The EntitlementInclusionAll message.
        - `inclusionCriteria` C1ApiAutomationsV1EntitlementInclusionCriteria, nullable — The EntitlementInclusionCriteria message.
          - `appIds` string[], nullable — The appIds field.
          - `complianceFrameworkIds` string[], nullable — The complianceFrameworkIds field.
          - `resourceTypeIds` string[], nullable — The resourceTypeIds field.
          - `riskLevelIds` string[], nullable — The riskLevelIds field.
        - `inclusionList` C1ApiAutomationsV1EntitlementInclusionList, nullable — The EntitlementInclusionList message.
          - `appEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The appEntitlementRefs field.
            - `appId` string — The appId field.
            - `id` string — The id field.
        - `inclusionListCel` C1ApiAutomationsV1EntitlementInclusionListCel, nullable — The EntitlementInclusionListCel message.
          - `appEntitlementRefsCel` string — The appEntitlementRefsCel field.
        - `useSubjectUser` boolean, nullable — The useSubjectUser field. This field is part of the `user` oneof. See the documentation for `c1.api.automations.v1.CreateRevokeTasksV2` for more details.
        - `userIdCel` string, nullable — The userIdCel field. This field is part of the `user` oneof. See the documentation for `c1.api.automations.v1.CreateRevokeTasksV2` for more details.
        - `userRef` C1ApiUserV1UserRef — A reference to a user.
          - `id` string — The id of the user.
      - `evaluateExpressions` C1ApiAutomationsV1EvaluateExpressions, nullable — The EvaluateExpressions message.
        - `expressions` C1ApiAutomationsV1Expression[], nullable — The expressions field.
          - `expressionCel` string — The expressionCel field.
          - `isSecret` boolean — The isSecret field.
          - `key` string — The key field.
      - `generatePassword` C1ApiAutomationsV1GeneratePassword, nullable — The GeneratePassword message.
        - `passwordPolicyId` string — Deprecated: password policy ID lookup is no longer used.
        - `policy` C1ApiAutomationsV1GeneratePasswordPolicy — GeneratePasswordPolicy defines inline password generation rules. This message contains a oneof named character_rules. Only a single field of the following list may be set at a time: - noRestrictions - customCharacters - excludedCharacters
          - `customCharacters` string, nullable — The customCharacters field. This field is part of the `character_rules` oneof. See the documentation for `c1.api.automations.v1.GeneratePasswordPolicy` for more details.
          - `excludedCharacters` string, nullable — The excludedCharacters field. This field is part of the `character_rules` oneof. See the documentation for `c1.api.automations.v1.GeneratePasswordPolicy` for more details.
          - `maxCharacterCount` integer — The maxCharacterCount field.
          - `minCharacterCount` integer — The minCharacterCount field.
          - `noRestrictions` boolean, nullable — The noRestrictions field. This field is part of the `character_rules` oneof. See the documentation for `c1.api.automations.v1.GeneratePasswordPolicy` for more details.
          - `requireLowercase` boolean — The requireLowercase field.
          - `requireNumbers` boolean — The requireNumbers field.
          - `requireSpecialCharacters` boolean — The requireSpecialCharacters field.
          - `requireUppercase` boolean — The requireUppercase field.
      - `grantEntitlements` C1ApiAutomationsV1GrantEntitlements, nullable — The GrantEntitlements message. This message contains a oneof named inclusion. Only a single field of the following list may be set at a time: - inclusionList - inclusionCriteria - inclusionListCel This message contains a oneof named exclusion. Only a single field of the following list may be set at a time: - exclusionNone - exclusionList - exclusionCriteria - exclusionListCel
        - `exclusionCriteria` C1ApiAutomationsV1GrantEntitlementExclusionCriteria, nullable — The GrantEntitlementExclusionCriteria message.
          - `excludedAppIds` string[], nullable — The excludedAppIds field.
          - `excludedComplianceFrameworkIds` string[], nullable — The excludedComplianceFrameworkIds field.
          - `excludedRiskLevelIds` string[], nullable — The excludedRiskLevelIds field.
        - `exclusionList` C1ApiAutomationsV1GrantEntitlementExclusionList, nullable — The GrantEntitlementExclusionList message.
          - `excludedAppEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The excludedAppEntitlementRefs field.
            - `appId` string — The appId field.
            - `id` string — The id field.
        - `exclusionListCel` C1ApiAutomationsV1GrantEntitlementExclusionListCel, nullable — The GrantEntitlementExclusionListCel message.
          - `excludedAppEntitlementRefsCel` string — The excludedAppEntitlementRefsCel field.
        - `exclusionNone` C1ApiAutomationsV1GrantEntitlementExclusionNone, nullable — The GrantEntitlementExclusionNone message.
        - `inclusionCriteria` C1ApiAutomationsV1GrantEntitlementInclusionCriteria, nullable — The GrantEntitlementInclusionCriteria message.
          - `appIds` string[], nullable — The appIds field.
          - `complianceFrameworkIds` string[], nullable — The complianceFrameworkIds field.
          - `riskLevelIds` string[], nullable — The riskLevelIds field.
        - `inclusionList` C1ApiAutomationsV1GrantEntitlementInclusionList, nullable — The GrantEntitlementInclusionList message.
          - `appEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The appEntitlementRefs field.
            - `appId` string — The appId field.
            - `id` string — The id field.
        - `inclusionListCel` C1ApiAutomationsV1GrantEntitlementInclusionListCel, nullable — The GrantEntitlementInclusionListCel message.
          - `appEntitlementRefsCel` string — The appEntitlementRefsCel field.
        - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `userIdCel` string — The userIdCel field.
        - `userRef` C1ApiUserV1UserRef — A reference to a user.
          - `id` string — The id of the user.
      - `removeFromDelegation` C1ApiAutomationsV1RemoveFromDelegation, nullable — RemoveFromDelegation: find all users that have the target user as their delegated user, and modify the delegation. This message contains a oneof named replacement_user. Only a single field of the following list may be set at a time: - replacementUserIdCel - replacementUserRef
        - `replacementUserIdCel` string, nullable — The user who will replace the target user's delegation This field is part of the `replacement_user` oneof. See the documentation for `c1.api.automations.v1.RemoveFromDelegation` for more details.
        - `replacementUserRef` C1ApiUserV1UserRef — A reference to a user.
          - `id` string — The id of the user.
        - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `userIdCel` string — The userIdCel field.
        - `userRef` C1ApiUserV1UserRef — A reference to a user.
          - `id` string — The id of the user.
      - `runAutomation` C1ApiAutomationsV1RunAutomation, nullable — RunAutomation: kick off the execution of an automation template. This message contains a oneof named automation_template. Only a single field of the following list may be set at a time: - automationTemplateRef - automationTemplateIdCel
        - `automationTemplateIdCel` string, nullable — The automationTemplateIdCel field. This field is part of the `automation_template` oneof. See the documentation for `c1.api.automations.v1.RunAutomation` for more details.
        - `automationTemplateRef` C1ApiAutomationsV1AutomationTemplateRef, nullable — The AutomationTemplateRef message.
          - `id` string — The id field.
        - `context` C1ApiAutomationsV1AutomationContext — The AutomationContext message.
          - `context` object
      - `sendEmail` C1ApiAutomationsV1SendEmail, nullable — The SendEmail message.
        - `body` string — The body field.
        - `email` string — Deprecated: use email_cel instead. Static email field shipped behind FF 541 (SKU_MANUAL) with zero tenant enablement. CEL subsumes static: '"ops@example.com"' is valid CEL.
        - `emailCel` string — CEL expression resolving to one or more email addresses (string or list<string>). Evaluated against the workflow execution context (trigger + completed steps). Static emails work too: '"ops@example.com"' is valid CEL. Supports list<string> for multiple recipients: '["a@x.com", "b@x.com"]'. Requires the tenant to have a TenantEmailProvider configured.
        - `subject` string — The subject field.
        - `title` string — The title field.
        - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `userIdsCel` string — The userIdsCel field.
        - `userRefs` C1ApiUserV1UserRef[], nullable — The userRefs field.
          - `id` string — The id of the user.
      - `sendSlackMessage` C1ApiAutomationsV1SendSlackMessage, nullable — SendSlackMessage posts to a channel or DMs one or more users. Delivery mode is inferred from which fields are populated: DM if any user field is set (use_subject_user, user_ids_cel, user_refs), otherwise channel. Priority for DM recipient resolution: use_subject_user > user_ids_cel > user_refs. This message contains a oneof named channel. Only a single field of the following list may be set at a time: - channelName - channelNameCel
        - `body` string — The body field.
        - `channelName` string, nullable — The channelName field. This field is part of the `channel` oneof. See the documentation for `c1.api.automations.v1.SendSlackMessage` for more details.
        - `channelNameCel` string, nullable — The channelNameCel field. This field is part of the `channel` oneof. See the documentation for `c1.api.automations.v1.SendSlackMessage` for more details.
        - `useSubjectUser` boolean — The useSubjectUser field.
        - `userIdsCel` string — The userIdsCel field.
        - `userRefs` C1ApiUserV1UserRef[], nullable — The userRefs field.
          - `id` string — The id of the user.
      - `setCredential` C1ApiAutomationsV1SetCredential, nullable — SetCredential submits a RotateCredentials baton task to the target connector, re-encrypting the given password CEL expression with the connector's public JWK. This message contains a oneof named connector_identifier. Only a single field of the following list may be set at a time: - connectorRef
        - `accountIdCel` string — The accountIdCel field.
        - `connectorRef` C1ApiAppV1ConnectorRef, nullable — The ConnectorRef message.
          - `appId` string — The appId field.
          - `id` string — The id field.
        - `passwordCel` string — The passwordCel field.
      - `skipIfTrueCel` string — The skipIfTrueCel field.
      - `stepDisplayName` string — The stepDisplayName field.
      - `stepName` string — The stepName field.
      - `storeCredential` C1ApiAutomationsV1StoreCredential, nullable — StoreCredential stores a credential from GeneratePassword in a vault. Supports Paper Vault (SSO/email) and App Vault (entitlement-bound).
        - `appIdCel` string — CEL expression that resolves to app ID (App Vault only)
        - `authType` 'STORE_CREDENTIAL_AUTH_TYPE_UNSPECIFIED' | 'STORE_CREDENTIAL_AUTH_TYPE_SSO_INTERNAL' | 'STORE_CREDENTIAL_AUTH_TYPE_VERIFY_EMAIL' — Authentication type for the paper vault recipient (Paper Vault only)
        - `credentialCel` string — CEL expression that resolves to the encrypted credential from GeneratePassword
        - `expiry` string, duration
        - `labelCel` string — Optional display label for the vault
        - `maxViews` integer — Maximum number of views (0 = unlimited, default 1) (Paper Vault only)
        - `recipientCel` string — CEL expression resolving to the C1 user ID of the recipient (SSO_INTERNAL / App Vault)
        - `recipientEmailCel` string — CEL expression resolving to a recipient email address (Paper Vault + VERIFY_EMAIL only)
        - `ttl` string, duration
        - `vaultType` 'STORE_CREDENTIAL_VAULT_TYPE_UNSPECIFIED' | 'STORE_CREDENTIAL_VAULT_TYPE_PAPER_VAULT' | 'STORE_CREDENTIAL_VAULT_TYPE_APP_VAULT' — Vault type selector (default: PAPER_VAULT for backward compatibility)
      - `taskAction` C1ApiAutomationsV1TaskAction, nullable — The TaskAction message. This message contains a oneof named action. Only a single field of the following list may be set at a time: - close - reassign
        - `close` C1ApiAutomationsV1CloseAction, nullable — The CloseAction message. This message contains a oneof named user_identifier. Only a single field of the following list may be set at a time: - userIdCel - userRef
          - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
          - `userIdCel` string, nullable — The userIdCel field. This field is part of the `user_identifier` oneof. See the documentation for `c1.api.automations.v1.CloseAction` for more details.
          - `userRef` C1ApiUserV1UserRef — A reference to a user.
            - `id` string — The id of the user.
        - `reassign` C1ApiAutomationsV1ReassignAction, nullable — The ReassignAction message. This message contains a oneof named assignee_user_identifier. Only a single field of the following list may be set at a time: - assigneeUserIdCel - assigneeUserRef This message contains a oneof named subject_user_identifier. Only a single field of the following list may be set at a time: - subjectUserIdCel - subjectUserRef
          - `assigneeUserIdCel` string, nullable — The assigneeUserIdCel field. This field is part of the `assignee_user_identifier` oneof. See the documentation for `c1.api.automations.v1.ReassignAction` for more details.
          - `assigneeUserRef` C1ApiUserV1UserRef — A reference to a user.
            - `id` string — The id of the user.
          - `subjectUserIdCel` string, nullable — The subjectUserIdCel field. This field is part of the `subject_user_identifier` oneof. See the documentation for `c1.api.automations.v1.ReassignAction` for more details.
          - `subjectUserRef` C1ApiUserV1UserRef — A reference to a user.
            - `id` string — The id of the user.
          - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `taskTypes` string[], nullable — The taskTypes field.
        - `taskUserRelation` 'TASK_USER_RELATION_UNSPECIFIED' | 'TASK_USER_RELATION_ASSIGNEE' | 'TASK_USER_RELATION_SUBJECT' — The taskUserRelation field.
      - `unenrollFromAllAccessProfiles` C1ApiAutomationsV1UnenrollFromAllAccessProfiles, nullable — The UnenrollFromAllAccessProfiles message.
        - `catalogIds` string[], nullable — Optional list of catalog IDs to unenroll from. If empty, unenroll from all catalogs.
        - `catalogIdsCel` string — CEL expression to dynamically select catalog IDs. If provided, overrides catalog_ids.
        - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `userIdsCel` string — The userIdsCel field.
        - `userRefs` C1ApiUserV1UserRef[], nullable — The userRefs field.
          - `id` string — The id of the user.
      - `updateUser` C1ApiAutomationsV1UpdateUser, nullable — The UpdateUser message. This message contains a oneof named user. Only a single field of the following list may be set at a time: - userIdCel - userRef This message contains a oneof named user_status. Only a single field of the following list may be set at a time: - userStatusEnum - userStatusCel
        - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `userIdCel` string, nullable — The userIdCel field. This field is part of the `user` oneof. See the documentation for `c1.api.automations.v1.UpdateUser` for more details.
        - `userRef` C1ApiUserV1UserRef — A reference to a user.
          - `id` string — The id of the user.
        - `userStatusCel` string, nullable — The userStatusCel field. This field is part of the `user_status` oneof. See the documentation for `c1.api.automations.v1.UpdateUser` for more details.
        - `userStatusEnum` 'UNKNOWN' | 'ENABLED' | 'DISABLED' | 'DELETED', nullable — The userStatusEnum field. This field is part of the `user_status` oneof. See the documentation for `c1.api.automations.v1.UpdateUser` for more details.
      - `waitForDuration` C1ApiAutomationsV1WaitForDuration, nullable — The WaitForDuration message.
        - `duration` string, duration
      - `webhook` C1ApiAutomationsV1Webhook, nullable — The Webhook message. This message contains a oneof named webhook_identifier. Only a single field of the following list may be set at a time: - webhookId - webhookIdCel
        - `payload` object
        - `webhookId` string, nullable — The webhookId field. This field is part of the `webhook_identifier` oneof. See the documentation for `c1.api.automations.v1.Webhook` for more details.
        - `webhookIdCel` string, nullable — The webhookIdCel field. This field is part of the `webhook_identifier` oneof. See the documentation for `c1.api.automations.v1.Webhook` for more details.
    - `circuitBreaker` C1ApiAutomationsV1DisabledReasonCircuitBreaker, nullable — DisabledReasonCircuitBreaker carries the trip context when an automation has been auto-disabled by its rate cap. Returned on the parent Automation when read; not directly settable.
      - `observedCount` integer — Observed execution count in the period at trip time.
      - `period` 'CIRCUIT_BREAKER_PERIOD_UNSPECIFIED' | 'CIRCUIT_BREAKER_PERIOD_HOUR' | 'CIRCUIT_BREAKER_PERIOD_DAY' | 'CIRCUIT_BREAKER_PERIOD_WEEK' | 'CIRCUIT_BREAKER_PERIOD_MONTH' — Snapshot of the period at trip time.
      - `threshold` integer — Snapshot of the threshold at trip time.
      - `trippedAt` string, date-time
    - `circuitBreakerMax` integer — Circuit breaker rate cap: disable this automation if it executes more than circuit_breaker_max times in the trailing circuit_breaker_period. 0 = circuit breaker off (default).
    - `circuitBreakerPeriod` 'CIRCUIT_BREAKER_PERIOD_UNSPECIFIED' | 'CIRCUIT_BREAKER_PERIOD_HOUR' | 'CIRCUIT_BREAKER_PERIOD_DAY' | 'CIRCUIT_BREAKER_PERIOD_WEEK' | 'CIRCUIT_BREAKER_PERIOD_MONTH' — The circuitBreakerPeriod field.
    - `context` C1ApiAutomationsV1AutomationContext — The AutomationContext message.
      - `context` object
    - `createdAt` string, date-time
    - `currentVersion` string, int64 — The currentVersion field.
    - `description` string — The description field.
    - `displayName` string — The displayName field.
    - `draftAutomationSteps` C1ApiAutomationsV1AutomationStep[], nullable — The draftAutomationSteps field.
      - `accountLifecycleAction` C1ApiAutomationsV1AccountLifecycleAction, nullable — The AccountLifecycleAction message. This message contains a oneof named account_identifier. Only a single field of the following list may be set at a time: - accountRef - accountInContext
        - `accountInContext` C1ApiAutomationsV1AccountInContext, nullable — The AccountInContext message.
        - `accountRef` C1ApiAutomationsV1AccountRef, nullable — The AccountRef message.
          - `accountIdCel` string — The accountIdCel field.
        - `actionName` string — The actionName field.
        - `connectorRef` C1ApiAppV1ConnectorRef, nullable — The ConnectorRef message.
          - `appId` string — The appId field.
          - `id` string — The id field.
      - `callFunction` C1ApiAutomationsV1CallFunction, nullable — The CallFunction message.
        - `args` object — The args field.
        - `functionId` string — The functionId field.
      - `connectorAction` C1ApiAutomationsV1ConnectorAction, nullable — The ConnectorAction message. This message contains a oneof named connector_identifier. Only a single field of the following list may be set at a time: - connectorRef
        - `actionName` string — The actionName field.
        - `argsTemplate` object
        - `connectorRef` C1ApiAppV1ConnectorRef, nullable — The ConnectorRef message.
          - `appId` string — The appId field.
          - `id` string — The id field.
        - `resourceTypeId` string — The resourceTypeId field.
      - `connectorCreateAccount` C1ApiAutomationsV1ConnectorCreateAccount, nullable — The ConnectorCreateAccount message. This message contains a oneof named create_account_arguments. Only a single field of the following list may be set at a time: - userIdCel - userProperties
        - `connectorRef` C1ApiAppV1ConnectorRef, nullable — The ConnectorRef message.
          - `appId` string — The appId field.
          - `id` string — The id field.
        - `passwordCel` string — CEL expression referencing a GeneratePassword step output (e.g. "genStep.password"). When set, the resolved password is encrypted for the connector and sent as CredentialOptions.EncryptedPassword.
        - `userIdCel` string, nullable — The userIdCel field. This field is part of the `create_account_arguments` oneof. See the documentation for `c1.api.automations.v1.ConnectorCreateAccount` for more details.
        - `userProperties` C1ApiAutomationsV1UserProperties, nullable — The UserProperties message.
          - `displayNameCel` string — The displayNameCel field.
          - `emailCel` string — The emailCel field.
          - `profileAttributeCel` string — The profileAttributeCel field.
          - `usernameCel` string — The usernameCel field.
      - `createAccessReview` C1ApiAutomationsV1CreateAccessReview, nullable — The CreateAccessReview message.
        - `accessReviewTemplateCel` string — The accessReviewTemplateCel field.
        - `accessReviewTemplateId` string — The accessReviewTemplateId field.
        - `campaignName` string — Optional campaign name. If not provided, the campaign name will be the access review template name.
        - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `userIdsCel` string — The userIdsCel field.
        - `userRefs` C1ApiUserV1UserRef[], nullable — The userRefs field.
          - `id` string — The id of the user.
      - `createRevokeTasks` C1ApiAutomationsV1CreateRevokeTasks, nullable — The CreateRevokeTasks message.
        - `appEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The appEntitlementRefs field.
          - `appId` string — The appId field.
          - `id` string — The id field.
        - `appEntitlementRefsCel` string — The appEntitlementRefsCel field.
        - `excludedAppEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The excludedAppEntitlementRefs field.
          - `appId` string — The appId field.
          - `id` string — The id field.
        - `excludedAppEntitlementRefsCel` string — The excludedAppEntitlementRefsCel field.
        - `revokeAll` boolean — The revokeAll field.
        - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `userIdCel` string — The userIdCel field.
        - `userRef` C1ApiUserV1UserRef — A reference to a user.
          - `id` string — The id of the user.
      - `createRevokeTasksV2` C1ApiAutomationsV1CreateRevokeTasksV2, nullable — The CreateRevokeTasksV2 message. This message contains a oneof named user. Only a single field of the following list may be set at a time: - userIdCel - userRef - useSubjectUser This message contains a oneof named inclusion. Only a single field of the following list may be set at a time: - inclusionList - inclusionAll - inclusionCriteria - inclusionListCel - inclusionAccessOnly This message contains a oneof named exclusion. Only a single field of the following list may be set at a time: - exclusionNone - exclusionList - exclusionCriteria - exclusionListCel
        - `exclusionCriteria` C1ApiAutomationsV1EntitlementExclusionCriteria, nullable — The EntitlementExclusionCriteria message.
          - `excludedAppIds` string[], nullable — The excludedAppIds field.
          - `excludedComplianceFrameworkIds` string[], nullable — The excludedComplianceFrameworkIds field.
          - `excludedResourceTypeIds` string[], nullable — The excludedResourceTypeIds field.
          - `excludedRiskLevelIds` string[], nullable — The excludedRiskLevelIds field.
        - `exclusionList` C1ApiAutomationsV1EntitlementExclusionList, nullable — The EntitlementExclusionList message.
          - `excludedAppEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The excludedAppEntitlementRefs field.
            - `appId` string — The appId field.
            - `id` string — The id field.
        - `exclusionListCel` C1ApiAutomationsV1EntitlementExclusionListCel, nullable — The EntitlementExclusionListCel message.
          - `excludedAppEntitlementRefsCel` string — The excludedAppEntitlementRefsCel field.
        - `exclusionNone` C1ApiAutomationsV1EntitlementExclusionNone, nullable — The EntitlementExclusionNone message.
        - `inclusionAccessOnly` C1ApiAutomationsV1EntitlementInclusionAccessOnly, nullable — EntitlementInclusionAccessOnly resolves to the system-managed access entitlement on every app the subject user has an AppUser on. Use this to deprovision app accounts without fanning out to every group, role, or permission inside each app — produces at most one revoke ticket per app.
        - `inclusionAll` C1ApiAutomationsV1EntitlementInclusionAll, nullable — The EntitlementInclusionAll message.
        - `inclusionCriteria` C1ApiAutomationsV1EntitlementInclusionCriteria, nullable — The EntitlementInclusionCriteria message.
          - `appIds` string[], nullable — The appIds field.
          - `complianceFrameworkIds` string[], nullable — The complianceFrameworkIds field.
          - `resourceTypeIds` string[], nullable — The resourceTypeIds field.
          - `riskLevelIds` string[], nullable — The riskLevelIds field.
        - `inclusionList` C1ApiAutomationsV1EntitlementInclusionList, nullable — The EntitlementInclusionList message.
          - `appEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The appEntitlementRefs field.
            - `appId` string — The appId field.
            - `id` string — The id field.
        - `inclusionListCel` C1ApiAutomationsV1EntitlementInclusionListCel, nullable — The EntitlementInclusionListCel message.
          - `appEntitlementRefsCel` string — The appEntitlementRefsCel field.
        - `useSubjectUser` boolean, nullable — The useSubjectUser field. This field is part of the `user` oneof. See the documentation for `c1.api.automations.v1.CreateRevokeTasksV2` for more details.
        - `userIdCel` string, nullable — The userIdCel field. This field is part of the `user` oneof. See the documentation for `c1.api.automations.v1.CreateRevokeTasksV2` for more details.
        - `userRef` C1ApiUserV1UserRef — A reference to a user.
          - `id` string — The id of the user.
      - `evaluateExpressions` C1ApiAutomationsV1EvaluateExpressions, nullable — The EvaluateExpressions message.
        - `expressions` C1ApiAutomationsV1Expression[], nullable — The expressions field.
          - `expressionCel` string — The expressionCel field.
          - `isSecret` boolean — The isSecret field.
          - `key` string — The key field.
      - `generatePassword` C1ApiAutomationsV1GeneratePassword, nullable — The GeneratePassword message.
        - `passwordPolicyId` string — Deprecated: password policy ID lookup is no longer used.
        - `policy` C1ApiAutomationsV1GeneratePasswordPolicy — GeneratePasswordPolicy defines inline password generation rules. This message contains a oneof named character_rules. Only a single field of the following list may be set at a time: - noRestrictions - customCharacters - excludedCharacters
          - `customCharacters` string, nullable — The customCharacters field. This field is part of the `character_rules` oneof. See the documentation for `c1.api.automations.v1.GeneratePasswordPolicy` for more details.
          - `excludedCharacters` string, nullable — The excludedCharacters field. This field is part of the `character_rules` oneof. See the documentation for `c1.api.automations.v1.GeneratePasswordPolicy` for more details.
          - `maxCharacterCount` integer — The maxCharacterCount field.
          - `minCharacterCount` integer — The minCharacterCount field.
          - `noRestrictions` boolean, nullable — The noRestrictions field. This field is part of the `character_rules` oneof. See the documentation for `c1.api.automations.v1.GeneratePasswordPolicy` for more details.
          - `requireLowercase` boolean — The requireLowercase field.
          - `requireNumbers` boolean — The requireNumbers field.
          - `requireSpecialCharacters` boolean — The requireSpecialCharacters field.
          - `requireUppercase` boolean — The requireUppercase field.
      - `grantEntitlements` C1ApiAutomationsV1GrantEntitlements, nullable — The GrantEntitlements message. This message contains a oneof named inclusion. Only a single field of the following list may be set at a time: - inclusionList - inclusionCriteria - inclusionListCel This message contains a oneof named exclusion. Only a single field of the following list may be set at a time: - exclusionNone - exclusionList - exclusionCriteria - exclusionListCel
        - `exclusionCriteria` C1ApiAutomationsV1GrantEntitlementExclusionCriteria, nullable — The GrantEntitlementExclusionCriteria message.
          - `excludedAppIds` string[], nullable — The excludedAppIds field.
          - `excludedComplianceFrameworkIds` string[], nullable — The excludedComplianceFrameworkIds field.
          - `excludedRiskLevelIds` string[], nullable — The excludedRiskLevelIds field.
        - `exclusionList` C1ApiAutomationsV1GrantEntitlementExclusionList, nullable — The GrantEntitlementExclusionList message.
          - `excludedAppEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The excludedAppEntitlementRefs field.
            - `appId` string — The appId field.
            - `id` string — The id field.
        - `exclusionListCel` C1ApiAutomationsV1GrantEntitlementExclusionListCel, nullable — The GrantEntitlementExclusionListCel message.
          - `excludedAppEntitlementRefsCel` string — The excludedAppEntitlementRefsCel field.
        - `exclusionNone` C1ApiAutomationsV1GrantEntitlementExclusionNone, nullable — The GrantEntitlementExclusionNone message.
        - `inclusionCriteria` C1ApiAutomationsV1GrantEntitlementInclusionCriteria, nullable — The GrantEntitlementInclusionCriteria message.
          - `appIds` string[], nullable — The appIds field.
          - `complianceFrameworkIds` string[], nullable — The complianceFrameworkIds field.
          - `riskLevelIds` string[], nullable — The riskLevelIds field.
        - `inclusionList` C1ApiAutomationsV1GrantEntitlementInclusionList, nullable — The GrantEntitlementInclusionList message.
          - `appEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The appEntitlementRefs field.
            - `appId` string — The appId field.
            - `id` string — The id field.
        - `inclusionListCel` C1ApiAutomationsV1GrantEntitlementInclusionListCel, nullable — The GrantEntitlementInclusionListCel message.
          - `appEntitlementRefsCel` string — The appEntitlementRefsCel field.
        - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `userIdCel` string — The userIdCel field.
        - `userRef` C1ApiUserV1UserRef — A reference to a user.
          - `id` string — The id of the user.
      - `removeFromDelegation` C1ApiAutomationsV1RemoveFromDelegation, nullable — RemoveFromDelegation: find all users that have the target user as their delegated user, and modify the delegation. This message contains a oneof named replacement_user. Only a single field of the following list may be set at a time: - replacementUserIdCel - replacementUserRef
        - `replacementUserIdCel` string, nullable — The user who will replace the target user's delegation This field is part of the `replacement_user` oneof. See the documentation for `c1.api.automations.v1.RemoveFromDelegation` for more details.
        - `replacementUserRef` C1ApiUserV1UserRef — A reference to a user.
          - `id` string — The id of the user.
        - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `userIdCel` string — The userIdCel field.
        - `userRef` C1ApiUserV1UserRef — A reference to a user.
          - `id` string — The id of the user.
      - `runAutomation` C1ApiAutomationsV1RunAutomation, nullable — RunAutomation: kick off the execution of an automation template. This message contains a oneof named automation_template. Only a single field of the following list may be set at a time: - automationTemplateRef - automationTemplateIdCel
        - `automationTemplateIdCel` string, nullable — The automationTemplateIdCel field. This field is part of the `automation_template` oneof. See the documentation for `c1.api.automations.v1.RunAutomation` for more details.
        - `automationTemplateRef` C1ApiAutomationsV1AutomationTemplateRef, nullable — The AutomationTemplateRef message.
          - `id` string — The id field.
        - `context` C1ApiAutomationsV1AutomationContext — The AutomationContext message.
          - `context` object
      - `sendEmail` C1ApiAutomationsV1SendEmail, nullable — The SendEmail message.
        - `body` string — The body field.
        - `email` string — Deprecated: use email_cel instead. Static email field shipped behind FF 541 (SKU_MANUAL) with zero tenant enablement. CEL subsumes static: '"ops@example.com"' is valid CEL.
        - `emailCel` string — CEL expression resolving to one or more email addresses (string or list<string>). Evaluated against the workflow execution context (trigger + completed steps). Static emails work too: '"ops@example.com"' is valid CEL. Supports list<string> for multiple recipients: '["a@x.com", "b@x.com"]'. Requires the tenant to have a TenantEmailProvider configured.
        - `subject` string — The subject field.
        - `title` string — The title field.
        - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `userIdsCel` string — The userIdsCel field.
        - `userRefs` C1ApiUserV1UserRef[], nullable — The userRefs field.
          - `id` string — The id of the user.
      - `sendSlackMessage` C1ApiAutomationsV1SendSlackMessage, nullable — SendSlackMessage posts to a channel or DMs one or more users. Delivery mode is inferred from which fields are populated: DM if any user field is set (use_subject_user, user_ids_cel, user_refs), otherwise channel. Priority for DM recipient resolution: use_subject_user > user_ids_cel > user_refs. This message contains a oneof named channel. Only a single field of the following list may be set at a time: - channelName - channelNameCel
        - `body` string — The body field.
        - `channelName` string, nullable — The channelName field. This field is part of the `channel` oneof. See the documentation for `c1.api.automations.v1.SendSlackMessage` for more details.
        - `channelNameCel` string, nullable — The channelNameCel field. This field is part of the `channel` oneof. See the documentation for `c1.api.automations.v1.SendSlackMessage` for more details.
        - `useSubjectUser` boolean — The useSubjectUser field.
        - `userIdsCel` string — The userIdsCel field.
        - `userRefs` C1ApiUserV1UserRef[], nullable — The userRefs field.
          - `id` string — The id of the user.
      - `setCredential` C1ApiAutomationsV1SetCredential, nullable — SetCredential submits a RotateCredentials baton task to the target connector, re-encrypting the given password CEL expression with the connector's public JWK. This message contains a oneof named connector_identifier. Only a single field of the following list may be set at a time: - connectorRef
        - `accountIdCel` string — The accountIdCel field.
        - `connectorRef` C1ApiAppV1ConnectorRef, nullable — The ConnectorRef message.
          - `appId` string — The appId field.
          - `id` string — The id field.
        - `passwordCel` string — The passwordCel field.
      - `skipIfTrueCel` string — The skipIfTrueCel field.
      - `stepDisplayName` string — The stepDisplayName field.
      - `stepName` string — The stepName field.
      - `storeCredential` C1ApiAutomationsV1StoreCredential, nullable — StoreCredential stores a credential from GeneratePassword in a vault. Supports Paper Vault (SSO/email) and App Vault (entitlement-bound).
        - `appIdCel` string — CEL expression that resolves to app ID (App Vault only)
        - `authType` 'STORE_CREDENTIAL_AUTH_TYPE_UNSPECIFIED' | 'STORE_CREDENTIAL_AUTH_TYPE_SSO_INTERNAL' | 'STORE_CREDENTIAL_AUTH_TYPE_VERIFY_EMAIL' — Authentication type for the paper vault recipient (Paper Vault only)
        - `credentialCel` string — CEL expression that resolves to the encrypted credential from GeneratePassword
        - `expiry` string, duration
        - `labelCel` string — Optional display label for the vault
        - `maxViews` integer — Maximum number of views (0 = unlimited, default 1) (Paper Vault only)
        - `recipientCel` string — CEL expression resolving to the C1 user ID of the recipient (SSO_INTERNAL / App Vault)
        - `recipientEmailCel` string — CEL expression resolving to a recipient email address (Paper Vault + VERIFY_EMAIL only)
        - `ttl` string, duration
        - `vaultType` 'STORE_CREDENTIAL_VAULT_TYPE_UNSPECIFIED' | 'STORE_CREDENTIAL_VAULT_TYPE_PAPER_VAULT' | 'STORE_CREDENTIAL_VAULT_TYPE_APP_VAULT' — Vault type selector (default: PAPER_VAULT for backward compatibility)
      - `taskAction` C1ApiAutomationsV1TaskAction, nullable — The TaskAction message. This message contains a oneof named action. Only a single field of the following list may be set at a time: - close - reassign
        - `close` C1ApiAutomationsV1CloseAction, nullable — The CloseAction message. This message contains a oneof named user_identifier. Only a single field of the following list may be set at a time: - userIdCel - userRef
          - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
          - `userIdCel` string, nullable — The userIdCel field. This field is part of the `user_identifier` oneof. See the documentation for `c1.api.automations.v1.CloseAction` for more details.
          - `userRef` C1ApiUserV1UserRef — A reference to a user.
            - `id` string — The id of the user.
        - `reassign` C1ApiAutomationsV1ReassignAction, nullable — The ReassignAction message. This message contains a oneof named assignee_user_identifier. Only a single field of the following list may be set at a time: - assigneeUserIdCel - assigneeUserRef This message contains a oneof named subject_user_identifier. Only a single field of the following list may be set at a time: - subjectUserIdCel - subjectUserRef
          - `assigneeUserIdCel` string, nullable — The assigneeUserIdCel field. This field is part of the `assignee_user_identifier` oneof. See the documentation for `c1.api.automations.v1.ReassignAction` for more details.
          - `assigneeUserRef` C1ApiUserV1UserRef — A reference to a user.
            - `id` string — The id of the user.
          - `subjectUserIdCel` string, nullable — The subjectUserIdCel field. This field is part of the `subject_user_identifier` oneof. See the documentation for `c1.api.automations.v1.ReassignAction` for more details.
          - `subjectUserRef` C1ApiUserV1UserRef — A reference to a user.
            - `id` string — The id of the user.
          - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `taskTypes` string[], nullable — The taskTypes field.
        - `taskUserRelation` 'TASK_USER_RELATION_UNSPECIFIED' | 'TASK_USER_RELATION_ASSIGNEE' | 'TASK_USER_RELATION_SUBJECT' — The taskUserRelation field.
      - `unenrollFromAllAccessProfiles` C1ApiAutomationsV1UnenrollFromAllAccessProfiles, nullable — The UnenrollFromAllAccessProfiles message.
        - `catalogIds` string[], nullable — Optional list of catalog IDs to unenroll from. If empty, unenroll from all catalogs.
        - `catalogIdsCel` string — CEL expression to dynamically select catalog IDs. If provided, overrides catalog_ids.
        - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `userIdsCel` string — The userIdsCel field.
        - `userRefs` C1ApiUserV1UserRef[], nullable — The userRefs field.
          - `id` string — The id of the user.
      - `updateUser` C1ApiAutomationsV1UpdateUser, nullable — The UpdateUser message. This message contains a oneof named user. Only a single field of the following list may be set at a time: - userIdCel - userRef This message contains a oneof named user_status. Only a single field of the following list may be set at a time: - userStatusEnum - userStatusCel
        - `useSubjectUser` boolean — If true, the step will use the subject user of the automation as the subject.
        - `userIdCel` string, nullable — The userIdCel field. This field is part of the `user` oneof. See the documentation for `c1.api.automations.v1.UpdateUser` for more details.
        - `userRef` C1ApiUserV1UserRef — A reference to a user.
          - `id` string — The id of the user.
        - `userStatusCel` string, nullable — The userStatusCel field. This field is part of the `user_status` oneof. See the documentation for `c1.api.automations.v1.UpdateUser` for more details.
        - `userStatusEnum` 'UNKNOWN' | 'ENABLED' | 'DISABLED' | 'DELETED', nullable — The userStatusEnum field. This field is part of the `user_status` oneof. See the documentation for `c1.api.automations.v1.UpdateUser` for more details.
      - `waitForDuration` C1ApiAutomationsV1WaitForDuration, nullable — The WaitForDuration message.
        - `duration` string, duration
      - `webhook` C1ApiAutomationsV1Webhook, nullable — The Webhook message. This message contains a oneof named webhook_identifier. Only a single field of the following list may be set at a time: - webhookId - webhookIdCel
        - `payload` object
        - `webhookId` string, nullable — The webhookId field. This field is part of the `webhook_identifier` oneof. See the documentation for `c1.api.automations.v1.Webhook` for more details.
        - `webhookIdCel` string, nullable — The webhookIdCel field. This field is part of the `webhook_identifier` oneof. See the documentation for `c1.api.automations.v1.Webhook` for more details.
    - `draftTriggers` C1ApiAutomationsV1AutomationTrigger[], nullable — The draftTriggers field.
      - `accessConflict` C1ApiAutomationsV1AccessConflictTrigger, nullable — The AccessConflictTrigger message. This message contains a oneof named conflict_monitor_selector. Only a single field of the following list may be set at a time: - conflictMonitorRefs - allConflictMonitors
        - `allConflictMonitors` boolean, nullable — The allConflictMonitors field. This field is part of the `conflict_monitor_selector` oneof. See the documentation for `c1.api.automations.v1.AccessConflictTrigger` for more details.
        - `conflictMonitorRefs` C1ApiAutomationsV1ConflictMonitorRefs, nullable — The ConflictMonitorRefs message.
          - `conflictMonitorRefs` C1ApiAccessconflictV1ConflictMonitorRef[], nullable — The conflictMonitorRefs field.
            - `id` string — The id field.
      - `appUserCreated` C1ApiAutomationsV1AppUserCreatedTrigger, nullable — The AppUserCreatedTrigger message. This message contains a oneof named app_identifier. Only a single field of the following list may be set at a time: - appId - appIdCel
        - `appId` string, nullable — The appId field. This field is part of the `app_identifier` oneof. See the documentation for `c1.api.automations.v1.AppUserCreatedTrigger` for more details.
        - `appIdCel` string, nullable — The appIdCel field. This field is part of the `app_identifier` oneof. See the documentation for `c1.api.automations.v1.AppUserCreatedTrigger` for more details.
        - `condition` string — The condition field.
      - `appUserUpdated` C1ApiAutomationsV1AppUserUpdatedTrigger, nullable — The AppUserUpdatedTrigger message. This message contains a oneof named app_identifier. Only a single field of the following list may be set at a time: - appId - appIdCel
        - `appId` string, nullable — The appId field. This field is part of the `app_identifier` oneof. See the documentation for `c1.api.automations.v1.AppUserUpdatedTrigger` for more details.
        - `appIdCel` string, nullable — The appIdCel field. This field is part of the `app_identifier` oneof. See the documentation for `c1.api.automations.v1.AppUserUpdatedTrigger` for more details.
        - `condition` string — The condition field.
      - `grantDeleted` C1ApiAutomationsV1GrantDeletedTrigger, nullable — The GrantDeletedTrigger message.
        - `grantTriggerFilter` C1ApiAutomationsV1GrantTriggerFilter — The GrantTriggerFilter message. This message contains a oneof named entitlement_inclusion. Only a single field of the following list may be set at a time: - inclusionList - inclusionAll - inclusionCriteria - inclusionListCel
          - `accountFilter` C1ApiAutomationsV1GrantTriggerFilterAccountFilter — The AccountFilter message.
            - `accountType` 'APP_USER_TYPE_UNSPECIFIED' | 'APP_USER_TYPE_USER' | 'APP_USER_TYPE_SERVICE_ACCOUNT' | 'APP_USER_TYPE_SYSTEM_ACCOUNT' — The accountType field.
          - `grantFilter` C1ApiAutomationsV1GrantTriggerFilterGrantFilter — The GrantFilter message.
            - `grantFilterType` 'GRANT_FILTER_TYPE_UNSPECIFIED' | 'GRANT_FILTER_TYPE_PERMANENT' | 'GRANT_FILTER_TYPE_TEMPORARY' — The grantFilterType field.
            - `grantJustificationType` 'GRANT_JUSTIFICATION_TYPE_UNSPECIFIED' | 'GRANT_JUSTIFICATION_TYPE_ALL' | 'GRANT_JUSTIFICATION_TYPE_CONDUCTOR_ONE' | 'GRANT_JUSTIFICATION_TYPE_DIRECT' — The grantJustificationType field.
            - `grantSourceFilter` 'GRANT_SOURCE_FILTER_UNSPECIFIED' | 'GRANT_SOURCE_FILTER_DIRECT' | 'GRANT_SOURCE_FILTER_INHERITED' — The grantSourceFilter field.
          - `inclusionAll` C1ApiAutomationsV1EntitlementInclusionAll, nullable — The EntitlementInclusionAll message.
          - `inclusionCriteria` C1ApiAutomationsV1EntitlementInclusionCriteria, nullable — The EntitlementInclusionCriteria message.
            - `appIds` string[], nullable — The appIds field.
            - `complianceFrameworkIds` string[], nullable — The complianceFrameworkIds field.
            - `resourceTypeIds` string[], nullable — The resourceTypeIds field.
            - `riskLevelIds` string[], nullable — The riskLevelIds field.
          - `inclusionList` C1ApiAutomationsV1EntitlementInclusionList, nullable — The EntitlementInclusionList message.
            - `appEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The appEntitlementRefs field.
              - …
          - `inclusionListCel` C1ApiAutomationsV1EntitlementInclusionListCel, nullable — The EntitlementInclusionListCel message.
            - `appEntitlementRefsCel` string — The appEntitlementRefsCel field.
      - `grantFound` C1ApiAutomationsV1GrantFoundTrigger, nullable — The GrantFoundTrigger message.
        - `grantTriggerFilter` C1ApiAutomationsV1GrantTriggerFilter — The GrantTriggerFilter message. This message contains a oneof named entitlement_inclusion. Only a single field of the following list may be set at a time: - inclusionList - inclusionAll - inclusionCriteria - inclusionListCel
          - `accountFilter` C1ApiAutomationsV1GrantTriggerFilterAccountFilter — The AccountFilter message.
            - `accountType` 'APP_USER_TYPE_UNSPECIFIED' | 'APP_USER_TYPE_USER' | 'APP_USER_TYPE_SERVICE_ACCOUNT' | 'APP_USER_TYPE_SYSTEM_ACCOUNT' — The accountType field.
          - `grantFilter` C1ApiAutomationsV1GrantTriggerFilterGrantFilter — The GrantFilter message.
            - `grantFilterType` 'GRANT_FILTER_TYPE_UNSPECIFIED' | 'GRANT_FILTER_TYPE_PERMANENT' | 'GRANT_FILTER_TYPE_TEMPORARY' — The grantFilterType field.
            - `grantJustificationType` 'GRANT_JUSTIFICATION_TYPE_UNSPECIFIED' | 'GRANT_JUSTIFICATION_TYPE_ALL' | 'GRANT_JUSTIFICATION_TYPE_CONDUCTOR_ONE' | 'GRANT_JUSTIFICATION_TYPE_DIRECT' — The grantJustificationType field.
            - `grantSourceFilter` 'GRANT_SOURCE_FILTER_UNSPECIFIED' | 'GRANT_SOURCE_FILTER_DIRECT' | 'GRANT_SOURCE_FILTER_INHERITED' — The grantSourceFilter field.
          - `inclusionAll` C1ApiAutomationsV1EntitlementInclusionAll, nullable — The EntitlementInclusionAll message.
          - `inclusionCriteria` C1ApiAutomationsV1EntitlementInclusionCriteria, nullable — The EntitlementInclusionCriteria message.
            - `appIds` string[], nullable — The appIds field.
            - `complianceFrameworkIds` string[], nullable — The complianceFrameworkIds field.
            - `resourceTypeIds` string[], nullable — The resourceTypeIds field.
            - `riskLevelIds` string[], nullable — The riskLevelIds field.
          - `inclusionList` C1ApiAutomationsV1EntitlementInclusionList, nullable — The EntitlementInclusionList message.
            - `appEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The appEntitlementRefs field.
              - …
          - `inclusionListCel` C1ApiAutomationsV1EntitlementInclusionListCel, nullable — The EntitlementInclusionListCel message.
            - `appEntitlementRefsCel` string — The appEntitlementRefsCel field.
      - `schedule` C1ApiAutomationsV1ScheduleTrigger, nullable — The ScheduleTrigger message.
        - `advanced` boolean — The advanced field.
        - `condition` string — The condition field.
        - `cronSpec` string — The cronSpec field.
        - `skipIfTrueCel` string — The skipIfTrueCel field.
        - `start` string, date-time
        - `timezone` string — The timezone field.
      - `scheduleAppUser` C1ApiAutomationsV1ScheduleTriggerAppUser, nullable — The ScheduleTriggerAppUser message.
        - `appId` string — The appId field.
        - `condition` string — The condition field.
        - `cronSpec` string — The cronSpec field.
        - `start` string, date-time
        - `timezone` string — The timezone field.
      - `scheduleNoUser` C1ApiAutomationsV1ScheduleTriggerNoUser, nullable — ScheduleTriggerNoUser fires on a cron schedule with no subject user (e.g. reports, syncs, orchestration). Minimum cron interval is enforced at 1 hour in validation.
        - `advanced` boolean — The advanced field.
        - `cronSpec` string — The cronSpec field.
        - `start` string, date-time
        - `timezone` string — The timezone field.
      - `usageBasedRevocation` C1ApiAutomationsV1UsageBasedRevocationTrigger, nullable — The UsageBasedRevocationTrigger message. This message contains a oneof named cold_start_schedule. Only a single field of the following list may be set at a time: - runImmediately - runDelayed
        - `appId` string — The appId field.
        - `enabledAt` string, date-time
        - `excludedGroupRefs` C1ApiAppV1AppEntitlementRef[], nullable — The excludedGroupRefs field.
          - `appId` string — The appId field.
          - `id` string — The id field.
        - `excludedUserRefs` C1ApiUserV1UserRef[], nullable — The excludedUserRefs field.
          - `id` string — The id of the user.
        - `includeUsersWithNoActivity` boolean — The includeUsersWithNoActivity field.
        - `runDelayed` C1ApiAutomationsV1RunDelayed, nullable — The RunDelayed message.
          - `coldStartDelayDays` integer, required — The coldStartDelayDays field.
        - `runImmediately` C1ApiAutomationsV1RunImmediately, nullable — No fields needed; this just indicates the trigger should run immediately
        - `targetedAppUserTypes` string[], nullable — The targetedAppUserTypes field.
        - `targetedEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The targetedEntitlementRefs field.
          - `appId` string — The appId field.
          - `id` string — The id field.
        - `unusedForDays` integer — The unusedForDays field.
      - `userCreated` C1ApiAutomationsV1UserCreatedTrigger, nullable — The UserCreatedTrigger message.
        - `condition` string — The condition field.
      - `userProfileChange` C1ApiAutomationsV1UserProfileChangeTrigger, nullable — The UserProfileChangeTrigger message.
        - `condition` string — The condition field.
      - `webhook` C1ApiAutomationsV1WebhookAutomationTrigger, nullable — The WebhookAutomationTrigger message. This message contains a oneof named auth_config. Only a single field of the following list may be set at a time: - jwt - hmac - capabilityUrl
        - `capabilityUrl` C1ApiAutomationsV1WebhookListenerAuthCapabilityURL, nullable — Capability URL authentication: the URL itself contains an unguessable token that acts as the credential. This is simpler to integrate but less secure than JWT or HMAC because the token can leak via server logs, referrer headers, and URL sharing. See https://www.w3.org/TR/capability-urls/ for background.
        - `hmac` C1ApiAutomationsV1WebhookListenerAuthHMAC, nullable — The WebhookListenerAuthHMAC message.
        - `jwt` C1ApiAutomationsV1WebhookListenerAuthJWT, nullable — The WebhookListenerAuthJWT message.
          - `jwksUrl` string — The jwksUrl field.
        - `listenerId` string — Optional existing listener ID (hidden field from frontend)
    - `enabled` boolean — The enabled field.
    - `id` string — The id field.
    - `isDraft` boolean — The isDraft field.
    - `lastExecutedAt` string, date-time
    - `primaryTriggerType` 'TRIGGER_TYPE_UNSPECIFIED' | 'TRIGGER_TYPE_USER_PROFILE_CHANGE' | 'TRIGGER_TYPE_APP_USER_CREATE' | 'TRIGGER_TYPE_APP_USER_UPDATE' | 'TRIGGER_TYPE_UNUSED_ACCESS' | 'TRIGGER_TYPE_USER_CREATED' | 'TRIGGER_TYPE_GRANT_FOUND' | 'TRIGGER_TYPE_GRANT_DELETED' | 'TRIGGER_TYPE_WEBHOOK' | 'TRIGGER_TYPE_SCHEDULE' | 'TRIGGER_TYPE_FORM' | 'TRIGGER_TYPE_SCHEDULE_APP_USER' | 'TRIGGER_TYPE_ACCESS_CONFLICT' | 'TRIGGER_TYPE_SCHEDULE_NO_USER' — The primaryTriggerType field.
    - `triggers` C1ApiAutomationsV1AutomationTrigger[], nullable — The triggers field.
      - `accessConflict` C1ApiAutomationsV1AccessConflictTrigger, nullable — The AccessConflictTrigger message. This message contains a oneof named conflict_monitor_selector. Only a single field of the following list may be set at a time: - conflictMonitorRefs - allConflictMonitors
        - `allConflictMonitors` boolean, nullable — The allConflictMonitors field. This field is part of the `conflict_monitor_selector` oneof. See the documentation for `c1.api.automations.v1.AccessConflictTrigger` for more details.
        - `conflictMonitorRefs` C1ApiAutomationsV1ConflictMonitorRefs, nullable — The ConflictMonitorRefs message.
          - `conflictMonitorRefs` C1ApiAccessconflictV1ConflictMonitorRef[], nullable — The conflictMonitorRefs field.
            - `id` string — The id field.
      - `appUserCreated` C1ApiAutomationsV1AppUserCreatedTrigger, nullable — The AppUserCreatedTrigger message. This message contains a oneof named app_identifier. Only a single field of the following list may be set at a time: - appId - appIdCel
        - `appId` string, nullable — The appId field. This field is part of the `app_identifier` oneof. See the documentation for `c1.api.automations.v1.AppUserCreatedTrigger` for more details.
        - `appIdCel` string, nullable — The appIdCel field. This field is part of the `app_identifier` oneof. See the documentation for `c1.api.automations.v1.AppUserCreatedTrigger` for more details.
        - `condition` string — The condition field.
      - `appUserUpdated` C1ApiAutomationsV1AppUserUpdatedTrigger, nullable — The AppUserUpdatedTrigger message. This message contains a oneof named app_identifier. Only a single field of the following list may be set at a time: - appId - appIdCel
        - `appId` string, nullable — The appId field. This field is part of the `app_identifier` oneof. See the documentation for `c1.api.automations.v1.AppUserUpdatedTrigger` for more details.
        - `appIdCel` string, nullable — The appIdCel field. This field is part of the `app_identifier` oneof. See the documentation for `c1.api.automations.v1.AppUserUpdatedTrigger` for more details.
        - `condition` string — The condition field.
      - `grantDeleted` C1ApiAutomationsV1GrantDeletedTrigger, nullable — The GrantDeletedTrigger message.
        - `grantTriggerFilter` C1ApiAutomationsV1GrantTriggerFilter — The GrantTriggerFilter message. This message contains a oneof named entitlement_inclusion. Only a single field of the following list may be set at a time: - inclusionList - inclusionAll - inclusionCriteria - inclusionListCel
          - `accountFilter` C1ApiAutomationsV1GrantTriggerFilterAccountFilter — The AccountFilter message.
            - `accountType` 'APP_USER_TYPE_UNSPECIFIED' | 'APP_USER_TYPE_USER' | 'APP_USER_TYPE_SERVICE_ACCOUNT' | 'APP_USER_TYPE_SYSTEM_ACCOUNT' — The accountType field.
          - `grantFilter` C1ApiAutomationsV1GrantTriggerFilterGrantFilter — The GrantFilter message.
            - `grantFilterType` 'GRANT_FILTER_TYPE_UNSPECIFIED' | 'GRANT_FILTER_TYPE_PERMANENT' | 'GRANT_FILTER_TYPE_TEMPORARY' — The grantFilterType field.
            - `grantJustificationType` 'GRANT_JUSTIFICATION_TYPE_UNSPECIFIED' | 'GRANT_JUSTIFICATION_TYPE_ALL' | 'GRANT_JUSTIFICATION_TYPE_CONDUCTOR_ONE' | 'GRANT_JUSTIFICATION_TYPE_DIRECT' — The grantJustificationType field.
            - `grantSourceFilter` 'GRANT_SOURCE_FILTER_UNSPECIFIED' | 'GRANT_SOURCE_FILTER_DIRECT' | 'GRANT_SOURCE_FILTER_INHERITED' — The grantSourceFilter field.
          - `inclusionAll` C1ApiAutomationsV1EntitlementInclusionAll, nullable — The EntitlementInclusionAll message.
          - `inclusionCriteria` C1ApiAutomationsV1EntitlementInclusionCriteria, nullable — The EntitlementInclusionCriteria message.
            - `appIds` string[], nullable — The appIds field.
            - `complianceFrameworkIds` string[], nullable — The complianceFrameworkIds field.
            - `resourceTypeIds` string[], nullable — The resourceTypeIds field.
            - `riskLevelIds` string[], nullable — The riskLevelIds field.
          - `inclusionList` C1ApiAutomationsV1EntitlementInclusionList, nullable — The EntitlementInclusionList message.
            - `appEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The appEntitlementRefs field.
              - …
          - `inclusionListCel` C1ApiAutomationsV1EntitlementInclusionListCel, nullable — The EntitlementInclusionListCel message.
            - `appEntitlementRefsCel` string — The appEntitlementRefsCel field.
      - `grantFound` C1ApiAutomationsV1GrantFoundTrigger, nullable — The GrantFoundTrigger message.
        - `grantTriggerFilter` C1ApiAutomationsV1GrantTriggerFilter — The GrantTriggerFilter message. This message contains a oneof named entitlement_inclusion. Only a single field of the following list may be set at a time: - inclusionList - inclusionAll - inclusionCriteria - inclusionListCel
          - `accountFilter` C1ApiAutomationsV1GrantTriggerFilterAccountFilter — The AccountFilter message.
            - `accountType` 'APP_USER_TYPE_UNSPECIFIED' | 'APP_USER_TYPE_USER' | 'APP_USER_TYPE_SERVICE_ACCOUNT' | 'APP_USER_TYPE_SYSTEM_ACCOUNT' — The accountType field.
          - `grantFilter` C1ApiAutomationsV1GrantTriggerFilterGrantFilter — The GrantFilter message.
            - `grantFilterType` 'GRANT_FILTER_TYPE_UNSPECIFIED' | 'GRANT_FILTER_TYPE_PERMANENT' | 'GRANT_FILTER_TYPE_TEMPORARY' — The grantFilterType field.
            - `grantJustificationType` 'GRANT_JUSTIFICATION_TYPE_UNSPECIFIED' | 'GRANT_JUSTIFICATION_TYPE_ALL' | 'GRANT_JUSTIFICATION_TYPE_CONDUCTOR_ONE' | 'GRANT_JUSTIFICATION_TYPE_DIRECT' — The grantJustificationType field.
            - `grantSourceFilter` 'GRANT_SOURCE_FILTER_UNSPECIFIED' | 'GRANT_SOURCE_FILTER_DIRECT' | 'GRANT_SOURCE_FILTER_INHERITED' — The grantSourceFilter field.
          - `inclusionAll` C1ApiAutomationsV1EntitlementInclusionAll, nullable — The EntitlementInclusionAll message.
          - `inclusionCriteria` C1ApiAutomationsV1EntitlementInclusionCriteria, nullable — The EntitlementInclusionCriteria message.
            - `appIds` string[], nullable — The appIds field.
            - `complianceFrameworkIds` string[], nullable — The complianceFrameworkIds field.
            - `resourceTypeIds` string[], nullable — The resourceTypeIds field.
            - `riskLevelIds` string[], nullable — The riskLevelIds field.
          - `inclusionList` C1ApiAutomationsV1EntitlementInclusionList, nullable — The EntitlementInclusionList message.
            - `appEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The appEntitlementRefs field.
              - …
          - `inclusionListCel` C1ApiAutomationsV1EntitlementInclusionListCel, nullable — The EntitlementInclusionListCel message.
            - `appEntitlementRefsCel` string — The appEntitlementRefsCel field.
      - `schedule` C1ApiAutomationsV1ScheduleTrigger, nullable — The ScheduleTrigger message.
        - `advanced` boolean — The advanced field.
        - `condition` string — The condition field.
        - `cronSpec` string — The cronSpec field.
        - `skipIfTrueCel` string — The skipIfTrueCel field.
        - `start` string, date-time
        - `timezone` string — The timezone field.
      - `scheduleAppUser` C1ApiAutomationsV1ScheduleTriggerAppUser, nullable — The ScheduleTriggerAppUser message.
        - `appId` string — The appId field.
        - `condition` string — The condition field.
        - `cronSpec` string — The cronSpec field.
        - `start` string, date-time
        - `timezone` string — The timezone field.
      - `scheduleNoUser` C1ApiAutomationsV1ScheduleTriggerNoUser, nullable — ScheduleTriggerNoUser fires on a cron schedule with no subject user (e.g. reports, syncs, orchestration). Minimum cron interval is enforced at 1 hour in validation.
        - `advanced` boolean — The advanced field.
        - `cronSpec` string — The cronSpec field.
        - `start` string, date-time
        - `timezone` string — The timezone field.
      - `usageBasedRevocation` C1ApiAutomationsV1UsageBasedRevocationTrigger, nullable — The UsageBasedRevocationTrigger message. This message contains a oneof named cold_start_schedule. Only a single field of the following list may be set at a time: - runImmediately - runDelayed
        - `appId` string — The appId field.
        - `enabledAt` string, date-time
        - `excludedGroupRefs` C1ApiAppV1AppEntitlementRef[], nullable — The excludedGroupRefs field.
          - `appId` string — The appId field.
          - `id` string — The id field.
        - `excludedUserRefs` C1ApiUserV1UserRef[], nullable — The excludedUserRefs field.
          - `id` string — The id of the user.
        - `includeUsersWithNoActivity` boolean — The includeUsersWithNoActivity field.
        - `runDelayed` C1ApiAutomationsV1RunDelayed, nullable — The RunDelayed message.
          - `coldStartDelayDays` integer, required — The coldStartDelayDays field.
        - `runImmediately` C1ApiAutomationsV1RunImmediately, nullable — No fields needed; this just indicates the trigger should run immediately
        - `targetedAppUserTypes` string[], nullable — The targetedAppUserTypes field.
        - `targetedEntitlementRefs` C1ApiAppV1AppEntitlementRef[], nullable — The targetedEntitlementRefs field.
          - `appId` string — The appId field.
          - `id` string — The id field.
        - `unusedForDays` integer — The unusedForDays field.
      - `userCreated` C1ApiAutomationsV1UserCreatedTrigger, nullable — The UserCreatedTrigger message.
        - `condition` string — The condition field.
      - `userProfileChange` C1ApiAutomationsV1UserProfileChangeTrigger, nullable — The UserProfileChangeTrigger message.
        - `condition` string — The condition field.
      - `webhook` C1ApiAutomationsV1WebhookAutomationTrigger, nullable — The WebhookAutomationTrigger message. This message contains a oneof named auth_config. Only a single field of the following list may be set at a time: - jwt - hmac - capabilityUrl
        - `capabilityUrl` C1ApiAutomationsV1WebhookListenerAuthCapabilityURL, nullable — Capability URL authentication: the URL itself contains an unguessable token that acts as the credential. This is simpler to integrate but less secure than JWT or HMAC because the token can leak via server logs, referrer headers, and URL sharing. See https://www.w3.org/TR/capability-urls/ for background.
        - `hmac` C1ApiAutomationsV1WebhookListenerAuthHMAC, nullable — The WebhookListenerAuthHMAC message.
        - `jwt` C1ApiAutomationsV1WebhookListenerAuthJWT, nullable — The WebhookListenerAuthJWT message.
          - `jwksUrl` string — The jwksUrl field.
        - `listenerId` string — Optional existing listener ID (hidden field from frontend)
  - `nextPageToken` string — Token to retrieve the next page of results, empty when no more results exist.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/d391405a35d3/schema)