> ## Documentation Index > Fetch the complete documentation index at: https://vaquill.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # List available workflows > The workflows this API can run. Paged through the same envelope as every other collection even though the catalogue is small and in memory. A bare array would be the one endpoint a customer had to special-case, and the day the catalogue outgrows one page there would be no compatible way to say so. ## OpenAPI ````yaml https://api.vaquill.ai/workspace/openapi/v1.json get /v1/workflows openapi: 3.1.0 info: title: Vaquill Legal Workspace API description: >- Organization-scoped API for driving your legal workspace from your own backend: matters, documents, drafting, review, compare and matrices. **Authentication**: `Authorization: Bearer vq_ws_...`. Credentials are issued by an organization owner from the automation console at `/automation` and are shown once. The organization is resolved from the credential and can never be named in a request, so there is no `organizationId` field anywhere in this API and sending one is refused. This is NOT the Vaquill Data API. That one holds a `vq_key_` credential and serves the public legal corpus; the two share no credential, host or endpoint, and sending a `vq_key_` here is refused with an error naming the other product. ## Long-running work Anything that costs real work answers `202` with an **operation**. Poll `GET /v1/operations/{operationId}` until `status` is `succeeded`, `failed` or `cancelled`, honouring `Retry-After` between polls. There are no webhooks, so polling is the only completion signal. The five statuses are `queued`, `running`, `succeeded`, `failed`, `cancelled`, and there is no sixth: every capability reports through the same envelope. Send an `Idempotency-Key` on any launch. A retry with the same key and the same body returns the FIRST operation rather than starting a second billable job, which is what makes recovering from a timeout free. ## Identifiers Every public id is `_<32 lowercase hex>`, for example `mat_9f2c8b1e4a7d43c9b6e0f1a2c3d4e5f6`. The prefix names the resource type. Ids are opaque: take them from responses rather than building them, and never pass a bare database uuid. ## Lists Every collection answers `{data, pagination}`, never a bare array. Page with `limit` and `offset`, and read `pagination.total` to size a job before running it. `pagination.hasMore` is the reliable signal that rows remain. ## Errors Errors are RFC 9457 problem documents (`application/problem+json`), including for a wrong path and a wrong method. Branch on `type`; it is the stable identifier and it resolves to a page describing the failure. `title` and `detail` are written for people and may be reworded at any time. Every response carries `X-Request-ID`, and every error repeats it as `requestId`: quote it when contacting support. A `404` is returned identically for a resource that does not exist, one belonging to another organization, and one outside your installation's matter allowlist. That is deliberate, so the status code cannot be used to discover which ids exist elsewhere. ## Rate limits Limits are per credential and are set by what an operation COSTS rather than by its HTTP method, so a `GET` that runs a retrieval is not a read. Each operation's tier is fixed; a `429` carries `Retry-After`. | Tier | Per minute | Per hour | Per day | |---|---|---|---| | `poll` | 120 | 3000 | 30000 | | `read` | 60 | 1200 | 15000 | | `write` | 30 | 600 | 5000 | | `launch` | 10 | 200 | 2000 | | `download` | 20 | 300 | 3000 | | `upload` | 5 | 100 | 500 | ## Scopes A credential carries an explicit scope set, chosen when it is issued. A call outside them is `403` with `insufficient-scope`, naming the scopes the operation needed. Read and run are separate throughout, so a credential can be allowed to read results without being allowed to spend money producing them. `chronology:read`, `chronology:write`, `clients:read`, `clients:write`, `compare:read`, `compare:run`, `compliance:read`, `compliance:run`, `credentials:rotate`, `documents:download`, `documents:read`, `documents:write`, `drafting:read`, `drafting:run`, `exports:create`, `exports:read`, `facts:read`, `facts:run`, `matrices:read`, `matrices:run`, `matrices:write`, `matters:read`, `matters:write`, `nda:read`, `nda:run`, `operations:read`, `playbooks:read`, `playbooks:run`, `playbooks:write`, `research:read`, `research:run`, `review:read`, `review:run`, `summaries:read`, `summaries:run`, `webhooks:read`, `webhooks:write`, `workflows:read`, `workflows:run`, `workflows:write` version: 1.0.0 servers: - url: https://api.vaquill.ai/workspace description: Vaquill Legal Workspace API (production) - url: /workspace description: Vaquill Legal Workspace API (relative to the mount) security: - WorkspaceAuth: [] tags: - name: Operations description: >- The one job envelope. Every long-running call answers `202` with an operation, and polling this resource is the only way to learn it finished: there are no webhooks. Five statuses, no synonyms. - name: Clients description: The people and companies matters are filed under. Synchronous CRUD. - name: Matters description: >- The unit of work everything else hangs off. A matter scopes documents, drafts, reviews, comparisons and matrices, and it is what a credential's access is checked against. - name: Folders description: >- Organization inside and across matters. The same folders the web app shows, so one created here appears in the customer's browser. - name: Documents description: >- Files in a matter: their metadata, their ingested text, and the original bytes. A document is only usable by retrieval, drafting and review once its status is `succeeded`. - name: Uploads description: >- Getting files in. One presigned multipart flow at every size, with the bytes going straight to storage and never through this API. Initiate, PUT each part, then complete. - name: Research description: >- Asking legal questions and getting grounded, cited answers. This API does NOT stream: an ask answers `202` and you poll the operation, then read the answer off the message it points at. Conversation state is kept here, so you hold a chat id rather than replaying a transcript. Also covers the matter settings behind an answer, the skills you can ask through, and the standalone web-research tools. - name: Drafting description: >- Generating, revising and exporting draft documents. Bodies come out as sections and go in as markdown; the editor's own format is never on the wire. Rendered files come from the export route. - name: Playbooks description: >- The organization's negotiating positions, per contract type, and the starter templates to build them from. A playbook is the input a contract review is measured against. - name: Reviews description: >- Reviewing one contract against a playbook: clause analysis, redlines, flags, liability exposure and a reported sign-off gate. Export applies the redlines as native Word tracked changes. - name: Facts description: >- The cross-document fact ledger for a matter: what every document in it asserts, coalesced and cited back to its source passages. - name: Matter summary description: >- A citation-backed summary of everything filed to a matter, generated on demand and readable claim by claim. - name: Chronology description: >- The dated events across a matter's documents, as one timeline, with duplicate and date-conflict flags. - name: NDA triage description: >- Screening one inbound NDA against ten standard criteria and, where you name one, your own NDA playbook. Answers `green`, `yellow` or `red` with the reasoning per criterion, plus a report you can forward. - name: Compliance description: >- Checking one document against one regulation's requirement checklist: a verdict per requirement with the article it comes from, the gaps, and what to do about them. Only regulations with a real checklist behind them are accepted. - name: Comparisons description: >- Diffing two documents in a matter into structural changes, with a substantive-versus-cosmetic judgment and a downloadable redline. - name: Matrices description: >- Spreadsheet-style extraction across many documents: rows are documents, columns are questions, cells are answers with verified citations. Building a grid is free; running it is what costs. - name: Workflows description: >- Multi-step analyses from a fixed catalogue. Read a definition to learn what documents and inputs it takes, launch a run inside a matter, then download the artifacts it produces. externalDocs: description: Getting started guide and error reference url: https://vaquill.ai/docs/workspace-api paths: /v1/workflows: get: tags: - Workflows summary: List available workflows description: >- The workflows this API can run. Paged through the same envelope as every other collection even though the catalogue is small and in memory. A bare array would be the one endpoint a customer had to special-case, and the day the catalogue outgrows one page there would be no compatible way to say so. operationId: workflows.list parameters: - name: limit in: query required: false schema: type: integer maximum: 200 minimum: 1 description: How many rows to return, 1 to 200. Defaults to 50. default: 50 title: Limit description: How many rows to return, 1 to 200. Defaults to 50. - name: offset in: query required: false schema: type: integer minimum: 0 description: >- How many rows to skip before returning any. Combine with `limit` to page: `offset=0`, then `offset=50`, and so on. Offsets are positional, not stable, so a set that changes while you page can show a row twice or not at all. default: 0 title: Offset description: >- How many rows to skip before returning any. Combine with `limit` to page: `offset=0`, then `offset=50`, and so on. Offsets are positional, not stable, so a set that changes while you page can show a row twice or not at all. responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/Page_WorkflowDefinition_' example: data: - id: contract-diligence title: Contract diligence review description: >- Master services agreement with Acme for the 2026 platform rollout. category: commercial practiceAreas: - commercial estimatedMinutesMin: 4 estimatedMinutesMax: 9 documentSlots: - role: subject label: Liability cap description: >- Master services agreement with Acme for the 2026 platform rollout. minCount: 1 maxCount: 3 required: false inputs: - key: redline label: Liability cap fieldType: string required: false options: - 'yes' - 'no' - not addressed placeholder: Acme Corporation helpText: The counterparty's full legal entity name. artifacts: - key: redline label: Liability cap contentType: application/pdf description: >- Master services agreement with Acme for the 2026 platform rollout. bestFor: A first pass over a counterparty's standard form. limitations: - Does not assess data-protection adequacy. pagination: limit: 50 offset: 0 total: 128 hasMore: false '401': description: >- The credential is missing, malformed, unknown, revoked or expired. `type` is `invalid-credential`, or `wrong-product-credential` when a `vq_key_` Data API key was sent to this API. headers: X-Request-ID: description: >- The id of this request. The same value appears as `requestId` in the body. Quote it when contacting support. schema: type: string examples: - req_5f2c8b1e4a7d43c9b6e0f1a2c3d4e5f6 WWW-Authenticate: description: RFC 9110 authentication challenge. schema: type: string content: application/problem+json: schema: $ref: '#/components/schemas/Problem' '403': description: >- The credential does not carry a scope this operation requires (`insufficient-scope`), or the organization's installation is suspended (`installation-inactive`). headers: X-Request-ID: description: >- The id of this request. The same value appears as `requestId` in the body. Quote it when contacting support. schema: type: string examples: - req_5f2c8b1e4a7d43c9b6e0f1a2c3d4e5f6 WWW-Authenticate: description: RFC 9110 authentication challenge. schema: type: string content: application/problem+json: schema: $ref: '#/components/schemas/Problem' '422': description: >- The request does not match the published schema. `errors` names each rejected field and why. The submitted value is never echoed back. headers: X-Request-ID: description: >- The id of this request. The same value appears as `requestId` in the body. Quote it when contacting support. schema: type: string examples: - req_5f2c8b1e4a7d43c9b6e0f1a2c3d4e5f6 content: application/problem+json: schema: $ref: '#/components/schemas/ValidationProblem' '429': description: Too many requests for this credential's tier. Honour `Retry-After`. headers: X-Request-ID: description: >- The id of this request. The same value appears as `requestId` in the body. Quote it when contacting support. schema: type: string examples: - req_5f2c8b1e4a7d43c9b6e0f1a2c3d4e5f6 Retry-After: description: Seconds to wait before retrying. schema: type: integer content: application/problem+json: schema: $ref: '#/components/schemas/Problem' '500': description: >- An unexpected error on our side. The body carries a stable `type` and the request id and nothing else; the cause is in our logs. headers: X-Request-ID: description: >- The id of this request. The same value appears as `requestId` in the body. Quote it when contacting support. schema: type: string examples: - req_5f2c8b1e4a7d43c9b6e0f1a2c3d4e5f6 content: application/problem+json: schema: $ref: '#/components/schemas/Problem' '503': description: >- A dependency this request needs is unavailable, so nothing was done. Retryable. Authentication fails closed rather than admitting the request, so this is never a statement about your credential. headers: X-Request-ID: description: >- The id of this request. The same value appears as `requestId` in the body. Quote it when contacting support. schema: type: string examples: - req_5f2c8b1e4a7d43c9b6e0f1a2c3d4e5f6 content: application/problem+json: schema: $ref: '#/components/schemas/Problem' components: schemas: Page_WorkflowDefinition_: properties: data: items: $ref: '#/components/schemas/WorkflowDefinition' type: array title: Data description: The rows in this window, in the collection's default order. pagination: $ref: '#/components/schemas/Pagination' description: Where this window sits in the full result set. additionalProperties: false type: object required: - data - pagination title: Page[WorkflowDefinition] Problem: type: object title: Problem description: >- An RFC 9457 problem document. Branch on `type`, which is stable; `title` and `detail` are written for people and may be reworded. Some problems carry extra members (`requiredScopes`, `limit`, `expectedVersion`), which is why this object is open. required: - type - title - status - detail - instance properties: type: type: string format: uri description: >- The stable identifier for this error, and the one field to branch on. Resolves to a page describing it. examples: - https://vaquill.ai/docs/workspace-api/errors/insufficient-scope title: type: string description: A short human-readable summary. examples: - Insufficient scope status: type: integer description: The HTTP status code, repeated. examples: - 403 detail: type: string description: >- What went wrong on this specific request. May be reworded at any time. examples: - >- This credential carries matters:read. This operation needs matters:write. instance: type: string description: The path this problem occurred on. examples: - /workspace/v1/matters/mat_9f2c8b1e4a7d43c9b6e0f1a2c3d4e5f6 requestId: type: string description: >- The id of this request, identical to the `X-Request-ID` response header. Quote it when contacting support. examples: - req_5f2c8b1e4a7d43c9b6e0f1a2c3d4e5f6 additionalProperties: true ValidationProblem: type: object title: ValidationProblem description: >- A problem document for a schema rejection. `errors` lists the fields that were refused. The value you submitted is deliberately not echoed, so a validation failure cannot copy your content into an error response or into either side's logs. required: - type - title - status - detail - instance - errors properties: type: type: string format: uri description: >- The stable identifier for this error, and the one field to branch on. Resolves to a page describing it. examples: - https://vaquill.ai/docs/workspace-api/errors/insufficient-scope title: type: string description: A short human-readable summary. examples: - Insufficient scope status: type: integer description: The HTTP status code, repeated. examples: - 403 detail: type: string description: >- What went wrong on this specific request. May be reworded at any time. examples: - >- This credential carries matters:read. This operation needs matters:write. instance: type: string description: The path this problem occurred on. examples: - /workspace/v1/matters/mat_9f2c8b1e4a7d43c9b6e0f1a2c3d4e5f6 requestId: type: string description: >- The id of this request, identical to the `X-Request-ID` response header. Quote it when contacting support. examples: - req_5f2c8b1e4a7d43c9b6e0f1a2c3d4e5f6 errors: type: array description: One entry per rejected field. items: type: object required: - location - message - type properties: location: type: string description: >- Dotted path to the rejected field, for example `body.contentMarkdown`. message: type: string description: Why it was rejected. type: type: string description: The validation rule that failed. additionalProperties: true WorkflowDefinition: properties: id: type: string title: Id description: >- Identifier of the workflow definition. Pass it in the path when launching a run. examples: - contract-diligence title: type: string title: Title description: The workflow's display name. examples: - Contract diligence review description: type: string title: Description description: What the workflow does. examples: - Master services agreement with Acme for the 2026 platform rollout. category: type: string title: Category description: Broad grouping for the catalogue. examples: - commercial practiceAreas: items: type: string type: array title: Practiceareas description: Practice areas this workflow suits. examples: - - commercial estimatedMinutesMin: type: integer title: Estimatedminutesmin description: >- Low end of the expected run time in minutes. Use it to size your polling interval. examples: - 4 estimatedMinutesMax: type: integer title: Estimatedminutesmax description: High end of the expected run time in minutes. examples: - 9 documentSlots: items: $ref: '#/components/schemas/WorkflowDocumentSlot' type: array title: Documentslots description: >- What documents the workflow accepts, and in which roles. Validate against this before launching rather than discovering the shape from 422s. inputs: items: $ref: '#/components/schemas/WorkflowInputField' type: array title: Inputs description: >- The questions this workflow asks. Their `key` values are the keys of the run request's `inputs` object. artifacts: items: $ref: '#/components/schemas/WorkflowArtifactSpec' type: array title: Artifacts description: The deliverables a finished run produces. bestFor: anyOf: - type: string - type: 'null' title: Bestfor description: When to reach for this workflow, in plain language. examples: - A first pass over a counterparty's standard form. limitations: items: type: string type: array title: Limitations description: >- What this workflow does not do. Worth reading before wiring it into an automated path. examples: - - Does not assess data-protection adequacy. additionalProperties: false type: object required: - id - title - description - category - estimatedMinutesMin - estimatedMinutesMax title: WorkflowDefinition description: >- One catalogue entry. Only active definitions are listed. A retired one still resolves in code so old runs stay readable, but offering it would be offering something the launch route refuses. Pagination: properties: limit: type: integer title: Limit description: The `limit` that was applied to this request. examples: - 50 offset: type: integer title: Offset description: The `offset` that was applied to this request. examples: - 0 total: type: integer title: Total description: >- Total rows matching the filter, not the number returned in `data`. Use it to size a job before running it. examples: - 128 hasMore: type: boolean title: Hasmore description: >- True when rows remain beyond this window. Derived from `offset + len(data) < total`, so a full final page correctly reports `false` rather than sending you after an empty page. examples: - false additionalProperties: false type: object required: - limit - offset - total - hasMore title: Pagination description: >- Where the caller is, and whether there is more. `total` is the count of rows matching the filter, not the count returned, so a caller can size a job before running it. WorkflowDocumentSlot: properties: role: type: string title: Role description: The role slug to pass as a document's `role` when launching a run. examples: - subject label: type: string title: Label description: Human-readable name for this slot. examples: - Liability cap description: anyOf: - type: string - type: 'null' title: Description description: What sort of document belongs in this slot. examples: - Master services agreement with Acme for the 2026 platform rollout. minCount: type: integer title: Mincount description: Fewest documents accepted in this role. examples: - 1 maxCount: type: integer title: Maxcount description: Most documents accepted in this role. examples: - 3 required: type: boolean title: Required description: >- True when a run cannot start without at least one document in this role. examples: - false additionalProperties: false type: object required: - role - label - minCount - maxCount - required title: WorkflowDocumentSlot description: >- What a definition will accept in one role, so a caller can validate first. Published because the alternative is a customer discovering the shape of a workflow by submitting runs and reading 422s. WorkflowInputField: properties: key: type: string title: Key description: >- The key to use for this field inside the run request's `inputs` object. examples: - redline label: type: string title: Label description: Human-readable question text. examples: - Liability cap fieldType: type: string title: Fieldtype description: >- What sort of value is expected, for example a string, a date or a choice. A plain string, since the internal vocabulary grows whenever the launcher gains a widget. examples: - string required: type: boolean title: Required description: True when a run is refused without this input. default: false examples: - false options: anyOf: - items: type: string type: array - type: 'null' title: Options description: Allowed values when the field is a choice. examples: - - 'yes' - 'no' - not addressed placeholder: anyOf: - type: string - type: 'null' title: Placeholder description: Example value, for display. examples: - Acme Corporation helpText: anyOf: - type: string - type: 'null' title: Helptext description: Extra guidance on what to supply. examples: - The counterparty's full legal entity name. additionalProperties: false type: object required: - key - label - fieldType title: WorkflowInputField description: One question the definition asks, and how it is answered. WorkflowArtifactSpec: properties: key: type: string title: Key description: >- Stable slug for this artifact. This is the value `workflowRuns.artifact` takes, so a download can be wired up before anything is run. examples: - redline label: type: string title: Label description: Human-readable name for the deliverable. examples: - Liability cap contentType: type: string title: Contenttype description: IANA media type the artifact will be produced in. examples: - application/pdf description: anyOf: - type: string - type: 'null' title: Description description: What the artifact contains. examples: - Master services agreement with Acme for the 2026 platform rollout. additionalProperties: false type: object required: - key - label - contentType title: WorkflowArtifactSpec description: >- A deliverable this workflow produces, named before it exists. `key` is what `workflowRuns.artifact` takes, so a customer can wire up the download before running anything. `sampleUrl` is not carried over: it points into the web app's static tree and means nothing to a backend. securitySchemes: WorkspaceAuth: type: http scheme: bearer bearerFormat: vq_ws_* description: >- Workspace credential issued from the automation console at `/automation`. Send it as `Authorization: Bearer vq_ws_...`. This is NOT a Data API key: a `vq_key_` credential is refused here and names the other product in the error. ````