The CloudFlow API lets you do this programmatically: discover flows, manage cloud provider connections, browse templates, trigger published webhook flows, and build or refine flows from natural language.

This is a task-oriented guide, not a field-by-field specification. For every field, parameter, and status code, use the CloudFlow API reference. For CloudFlow in the DoiT console, see the CloudFlow help docs.

Permissions

CloudFlow Manager on the user or service account that owns the token. Every CloudFlow API endpoint requires Manager, including list and get. CloudFlow Editor is not sufficient. A failed check returns 403. See CloudFlow permissions.

For a personal API token, include CloudFlow Manager in the token's permission scope as well as on the user's role. A Manager user whose token uses Read-only or a custom scope that omits Manager still gets 403. Service account tokens inherit the service account's permissions, so grant Manager on the service account.

Automate and integrate

Use the table below to pick an integration pattern, then follow the linked example.

API operations

The public CloudFlow API does not cover every console action (for example, publish/unpublish, stop execution, or full flow CRUD). Use the console for those steps, or watch the API changelog as more endpoints ship.

Schema

The CloudFlow API exposes three main resources: flows, connections, and templates.

• Build creates a new flow and streams the AI builder output. You do not supply a flowId.
• Refine updates an existing flow identified by flowId and streams the same style of builder events.
• Trigger starts an execution for a published flow whose first node is a webhook trigger. Draft flows and non-webhook triggers cannot be started with this endpoint.
• Connections hold the AWS or GCP credentials that flow nodes use. Deleting a connection that is still referenced by a flow returns 409.
• Templates are a read-only catalogue. Creating a runnable flow from a template is done in the DoiT console, not through a public create-flow API today.

CloudFlow object

Returned in the items array of GET /cloudflow/v1/flows.

List responses also include:

Connection object

Returned by the Connections operations. Exactly one of gcpConfig or awsConfig is set on create.

Template object

Returned by GET /cloudflow/v1/templates and GET /cloudflow/v1/templates/{templateId}.

Build and refine request

Used by POST /cloudflow/v1/flows/actions/build and POST /cloudflow/v1/flows/{flowId}/actions/refine.

Both operations are SSE-only. Send Accept: text/event-stream. If the header does not includetext/event-stream, the API returns 406.

Trigger response

Returned by POST /cloudflow/v1/trigger/{flowId} with status 202.

The request body is arbitrary JSON. Properties become the webhook payload for the flow.

Examples

List CloudFlows

The List CloudFlows method returns a cursor-paginated list of CloudFlows.

Sample request:

curl -G "https://api.doit.com/cloudflow/v1/flows" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json" \
  --data-urlencode "maxResults=5"

Sample response:

{
  "items": [
    {
      "id": "abc123",
      "name": "Weekly tagging check",
      "published": true,
      "triggerType": "webhook",
      "createTime": "2026-06-01T12:00:00Z",
      "lastExecutionStatus": "complete"
    }
  ],
  "pageToken": null,
  "rowCount": null
}

Use pageToken from the response as the pageToken query parameter to fetch the next page. rowCount is always null for this endpoint.

Build a CloudFlow

The Build a CloudFlow method creates a new flow from a natural-language description and streams incremental build events, including the ID of the newly created flow.

Use an HTTP client that supports streaming responses (curl -N, or an SSE-capable library). Do not buffer the entire response as a single JSON object.

• Treat 406 as a client bug: the Accept header did not include text/event-stream.
• Treat 502 as an upstream builder failure. Retry with backoff when appropriate; do not assume the flow was fully created.
• After the build completes, confirm the flow with List CloudFlows before automating further steps.

Sample request:

curl -N -X POST "https://api.doit.com/cloudflow/v1/flows/actions/build" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: text/event-stream" \
  -d '{
    "question": "Create a flow that lists untagged EC2 instances and posts a Slack summary"
  }'

The response is a text/event-stream of incremental build events. Keep the connection open until the stream ends, then note the new flow ID from the events.

To continue the same build conversation (for example, to adjust the draft), call build or refine again with the same conversationId from the session.

Find the new id in a subsequent list response. Open the flow in the DoiT console to review nodes, publish it, or attach a webhook trigger before you call the trigger endpoint.

Refine a CloudFlow

The Refine a CloudFlow method updates an existing flow from a natural-language description. It uses the same SSE contract as build: Content-Type: application/json and Accept: text/event-stream.

Sample request:

curl -N -X POST "https://api.doit.com/cloudflow/v1/flows/{flowId}/actions/refine" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: text/event-stream" \
  -d '{
    "question": "Add a Slack notification when the check fails",
    "conversationId": "OPTIONAL_EXISTING_CONVERSATION_ID"
  }'

Trigger a webhook flow

The Trigger a webhook flow method starts a published CloudFlow and passes a JSON payload into the webhook trigger node.

Requirements:

• The flow must be published (published: true on list).
• The flow’s first node must be a webhook trigger (triggerType is typically webhook when listed).
• The request body must be valid JSON. Properties are arbitrary; they become the webhook payload for the flow.

Sample request:

curl -X POST "https://api.doit.com/cloudflow/v1/trigger/{flowId}" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "alertId": "7jyrczd6CSh3M8TuQ6Qq",
    "severity": "critical"
  }'

Sample response (202):

{
  "executionLink": "https://console.doit.com/customers/customer-id/cloudflow/history/execution-id"
}

If the flow already has an active execution, the API returns 409. Wait for that run to finish (or stop it in the console) before triggering again.

See CloudFlow triggers in the Help Center.

Create a connection

The Create a connection method stores AWS or GCP credentials that CloudFlow nodes use. Exactly one of gcpConfig or awsConfig is required. Sending both or neither returns 400 with code invalid_connection_config.

For console setup details, see CloudFlow connections.

Minimal GCP example (project-level):

curl -X POST "https://api.doit.com/cloudflow/v1/connections" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "name": "Prod GCP project",
    "description": "Billing and ops automation",
    "enabled": true,
    "gcpConfig": {
      "level": "project",
      "projectId": "my-gcp-project",
      "serviceAccountName": "cloudflow-runner"
    }
  }'

Minimal AWS example:

curl -X POST "https://api.doit.com/cloudflow/v1/connections" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "name": "Prod AWS accounts",
    "enabled": true,
    "awsConfig": {
      "roleName": "DoiTCloudFlowRole",
      "context": [
        {
          "accountId": "123456789012",
          "regions": ["us-east-1", "eu-west-1"]
        }
      ]
    }
  }'

A successful create returns 201 and a Connection object, including connectionId and server-managed status fields.

Optional collaborators entries use email plus role (owner, editor, or user).

List, get, update, or delete a connection

# List
curl -G "https://api.doit.com/cloudflow/v1/connections" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  --data-urlencode "maxResults=50"

# Get
curl "https://api.doit.com/cloudflow/v1/connections/{connectionId}" \
  -H "Authorization: Bearer YOUR_API_KEY"

# Partial update (at most one of gcpConfig or awsConfig)
curl -X PATCH "https://api.doit.com/cloudflow/v1/connections/{connectionId}" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"enabled": false}'

# Delete
curl -X DELETE "https://api.doit.com/cloudflow/v1/connections/{connectionId}" \
  -H "Authorization: Bearer YOUR_API_KEY"

Delete returns 204 on success. If any flow still references the connection, Delete returns 409.

Browse templates

The List templates and Retrieve a template methods return read-only blueprints. Use them to discover supported patterns and configuration guidance.

curl -G "https://api.doit.com/cloudflow/v1/templates" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  --data-urlencode "maxResults=50"

curl "https://api.doit.com/cloudflow/v1/templates/{templateId}" \
  -H "Authorization: Bearer YOUR_API_KEY"

Each template includes id, name, optional description andinstructions, and timestamps.

Creating a flow from a template is not available on the public API today. Use the CloudFlow templates experience in the console, or build a new flow with POST /cloudflow/v1/flows/actions/build.

Troubleshooting

Related docs

• Get Started: Tokens, tenant header, first request.
• CloudFlow API reference: OpenAPI-backed endpoint pages.
• CloudFlow changelog. Recent CloudFlow API additions.
• CloudFlow Help Center: Console workflows.