POST `/api/v1/workflow/items/{id}/actions`

Claim, release, reassign, escalate, set the priority, move to a desk, comment, watch (never approve).

Scope workflow:act
Idempotency-Key
operationId workflowAct

The token needs the scope workflow:act, and the person or service account behind it needs the matching privileges and account permissions, exactly as on the screens. See Scopes.

Idempotency-Key. Send a unique Idempotency-Key (up to 255 characters, e.g. a UUID) with every POST. Retrying with the same key and body replays the first answer for 24 hours, so a timeout never creates a second order; the same key with a different body is refused (idempotency_key_reused).

Request

POST /api/v1/workflow/items/{id}/actions

Path parameters

Name	Description	Example
`id`	The id of the item.	`42`

Headers

Header	Required	Value
`Authorization`	yes	`Bearer <token>`: an OAuth access token (`vat_…`) or a personal access token (`vpt_…`). Get a token
`Idempotency-Key`	yes	A unique string up to 255 characters (a UUID). Idempotency
`Content-Type`	yes	`application/json`

Body: `WorkflowAction`

Field	Type	Required	Description
`action`	string	yes	claim, release, reassign, escalate, priority, move, comment, watch or unwatch.
`user_id`	any	no	For reassign: the new owner.
`desk_id`	any	no	For move: the desk.
`priority`	any	no	For priority: 1 to 4.
`why`	string	no	A reason (required to escalate).
`body`	string	no	For comment: the text.

Decimals (money, prices, quantities, percentages) are sent as strings, ids as strings, times as ISO 8601 UTC.

Examples

Keep the token in an environment variable (VESTORIS_TOKEN), never in the script.

curl

curl -X POST "https://vestoris.com/api/v1/workflow/items/42/actions" \
  -H "Authorization: Bearer $VESTORIS_TOKEN" \
  -H 'Idempotency-Key: 7f9c2b1e-4d0a-4a7e-9a51-3c2f0b8d6e11' \
  -H "Content-Type: application/json" \
  -d '{"action":"reassign","user_id":"9","why":"Taylor is off desk today"}'

Python (requests)

import os, requests

r = requests.post(
    "https://vestoris.com/api/v1/workflow/items/42/actions",
    headers={
        "Authorization": f"Bearer {os.environ['VESTORIS_TOKEN']}",
        "Idempotency-Key": "7f9c2b1e-4d0a-4a7e-9a51-3c2f0b8d6e11",
    },
    json={
        "action": "reassign",
        "user_id": "9",
        "why": "Taylor is off desk today"
    },
    timeout=30,
)
r.raise_for_status()  # errors are application/problem+json with a stable "code"
print(r.json())

JavaScript (fetch)

const res = await fetch("https://vestoris.com/api/v1/workflow/items/42/actions", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.VESTORIS_TOKEN}`,
    "Idempotency-Key": "7f9c2b1e-4d0a-4a7e-9a51-3c2f0b8d6e11",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
      "action": "reassign",
      "user_id": "9",
      "why": "Taylor is off desk today"
  }),
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.code}: ${data.detail}`); // problem+json
console.log(data);

Response

200 OK, application/json: WorkflowItem. Rate-limit headers: RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset.

Response fields

Field	Type	Description
`id`	id (string)	The record's id (a string of digits).
`type`	string	order, override, rule, violation, batch, feed_run, access_review or exception.
`item_id`	id (string)	The id of the underlying record (order, override, rule…).
`title`	string	A short title.
`status`	string	open or closed.
`outcome`	string or null	How it ended.
`stage`	string	The workflow stage.
`stage_label`	string	The stage as screens show it.
`priority`	integer	1 (urgent) to 4 (low); for rules, lower numbers are evaluated first.
`owner_id`	id (string) or null	The owner (null: in a queue).
`owner`	string	The owner's name ("" in a queue).
`desk_id`	id (string) or null	The desk's id.
`desk`	string	The desk's name.
`requester_id`	id (string) or null	Who requested the item (never its approver).
`accounts`	list	Account codes the item touches (only those you may see).
`symbol`	string or null	The security, for orders.
`notional`	decimal string or null	Value of the item (shares x price).
`origin`	string	Where the item came from: "manual" or "ai" (proposed through the pipeline or a command).
`age_seconds`	integer	How long the item has been in flight, in seconds.
`in_stage_seconds`	integer	Seconds in the current stage.
`sla`	string	SLA status: green, amber, red or escalated.
`sla_minutes`	integer or null	The SLA of the current stage, in minutes.
`sla_due_at`	date-time or null	When the SLA is breached.
`escalation_level`	integer	How many times it has been escalated.
`blocking`	string or null	What keeps the item from moving on, in plain words (null: nothing).
`next_action`	string or null	What should happen next, and by whom.
`can`	object	What you may do with the item now (claim, release, reassign, escalate, comment…).
`why`	string	Why it is stuck, from facts.
`decision`	object	"approve" or "reject".
`progress`	any	Progress of a long operation.
`your_approval_counts`	boolean	Whether your approval would count (four eyes).
`stages`	list	Each stage with its result.
`comments`	list	Comments on the item, oldest first.
`watching`	boolean	Items you watch, or whether you watch this one.
`note`	string	A note in plain words.

Example response

HTTP/1.1 200 OK
Content-Type: application/json

{
    "id": "1042",
    "type": "order",
    "item_id": "5301",
    "title": "Buy 1,800 AAPL (block, 2 accounts)",
    "status": "open",
    "outcome": null,
    "stage": "approval",
    "stage_label": "Waiting for approval",
    "priority": 2,
    "owner_id": "7",
    "owner": "Taylor Brooks",
    "desk_id": "3",
    "desk": "Equity desk",
    "requester_id": "7",
    "accounts": [
        "GRW-A",
        "GRW-B"
    ],
    "symbol": "AAPL",
    "notional": "1250000.00",
    "origin": "manual",
    "age_seconds": 1260,
    "in_stage_seconds": 600,
    "sla": "green",
    "sla_minutes": 30,
    "sla_due_at": null,
    "escalation_level": 0,
    "blocking": "Waiting for an approver with \"approve\" on Growth Fund A",
    "next_action": "Approve (Portfolio Manager or Compliance)",
    "can": {
        "claim": true,
        "reassign": false,
        "escalate": true,
        "comment": true
    },
    "why": "No approver with \"approve\" on GRW-B is on desk.",
    "decision": "approve",
    "progress": null,
    "your_approval_counts": false,
    "stages": [],
    "comments": [],
    "watching": false,
    "note": ""
}

Example values. Your values depend on your firm's data; prices, orders and fills are simulated.

Status codes and errors

Errors are application/problem+json (RFC 9457) with a stable code to program against; the detail says what to fix. See Errors.

Status	When	Problem codes
200	Success
200 / 201	The same Idempotency-Key again: the first answer is replayed (24 hours)
400	The request is malformed	`invalid_request` `invalid_json`
401	No token, or it is invalid or expired	`invalid_token`
403	The token lacks the scope, or the person or service account behind it lacks the privilege or account permission	`insufficient_scope` `forbidden` `ip_not_allowed`
404	Not found, or not visible to you (the API never confirms what you may not see)	`not_found`
409	Not possible in the current state	`invalid_transition` `conflict` `idempotency_in_progress`
422	Validation failed (the detail says which field), or blocked	`validation_failed` `idempotency_key_reused`
428	A required header is missing	`idempotency_key_required`
429	Rate limited: wait for Retry-After seconds	`rate_limited`

{
    "type": "https://vestoris.com/developers/errors#validation_failed",
    "title": "Validation failed",
    "status": 422,
    "detail": "Quantity must be greater than zero.",
    "code": "validation_failed",
    "instance": "/api/v1/workflow/items/42/actions"
}

On the screens

The same thing in the app is explained in:

The workflow monitor

POST /api/v1/workflow/items/{id}/actions