> ## Documentation Index > Fetch the complete documentation index at: https://docs.cyberun.cloud/llms.txt > Use this file to discover all available pages before exploring further. # Export a workflow > Returns the full workflow configuration in an importable format. The response body is identical to CreateWorkflowRequest so it can be directly POSTed to the import endpoint on another team or environment. ## OpenAPI ````yaml /api-reference/core-openapi.yaml get /workflows/{workflowId}/export openapi: 3.0.3 info: title: Cyberun API version: 1.0.0 description: > Multi-tenant GPU orchestration platform for enterprise private deployments. ## Authentication Two authentication families are supported: - **JWT Bearer** (`Authorization: Bearer `) — Used by team owners/admins/members for management endpoints and user sessions. JWT-authenticated requests that operate on a team **must** include the `X-Team-ID` header to select which team the request applies to (a user can belong to multiple teams). - **Credential Bearer** (`Authorization: Bearer `) — Unified machine credential. The credential is always scoped to a single team derived from the credential row, and any `X-Team-ID` header is **ignored**. The three kinds differ in identity and routing: | Kind | Prefix | Identity | Allowed surfaces | | ------------- | ------ | ------------------------- | --- | | `integration` | `sk-` | Team only | Runtime API (`/r/`) + the Web MCP endpoint. Rejected on every management endpoint because the authorization layer needs a user identity and `sk-` has none. | | `agent` | `ak-` | Team only | the platform's WebSocket handshake **only** — rejected by the REST surface at the middleware layer. | | `device` | `dk-` | Team + user (per-device) | Runtime API and scoped management endpoints — behaves like a JWT for the underlying user. Issued by the desktop pairing flow only (`POST /desktop/pair/confirm`). | the authorization layer runs against the user identity carried by JWT and `dk-`. `sk-` and `ak-` bypass the authorization layer; service-layer checks enforce team scope for them. Runtime endpoints under `/r/` accept **JWT (with `X-Team-ID`)**, `sk-`, and `dk-`. `ak-` is rejected at the middleware (it is only meaningful on the the platform's WebSocket handshake). Scoped management endpoints accept **JWT (with `X-Team-ID`)** or `dk-`; `sk-` is rejected on management because the the authorization layer authorize layer requires a user identity. The Web MCP endpoint accepts `sk-` only. Multipart upload endpoints (`/uploads/multipart/*`) remain JWT-only. Credential-bearing callers (`sk-`, `dk-`) should use single-part presign (`POST /r/files/presign`) instead — that returns a vanilla S3 PUT URL (≤ 5 GB by S3, subject to the server's configured request cap; default 500 MB). Files beyond the cap currently require the JWT-only multipart flow. ## Task Lifecycle Tasks follow this state machine: `pending → waiting → queued → running → completed | failed | cancelled`. Submit tasks via workflow run endpoints, poll status via GET /r/tasks/{taskId}, and retrieve results via GET /r/tasks/{taskId}/result. ## Pagination All list endpoints support pagination via `current_page` (default: 1) and `per_page` (default: 20, max: 100) query parameters. Responses include a `page_meta` object with `current_page`, `per_page`, and `total_count`. servers: - url: https://core.cyberun.cloud/api/v1 description: Cyberun Cloud API security: [] tags: - name: Auth description: > Authentication and account lifecycle: register, login, logout, token refresh, password reset, and email verification. - name: User description: | Current user profile management: view and update profile, change password. - name: Team description: > Team management: create, update, delete teams, leave, and transfer ownership. Each user gets a personal team on registration. - name: Member description: | Team member management: list members, update roles, and remove members. - name: Invitation description: > Team invitation management: invite users by email, accept/decline invitations, list pending invitations, and cancel invitations. - name: Credential description: | Unified credential management: integration keys (`sk-`) for programmatic API access, agent keys (`ak-`) for headless workers, and device keys (`dk-`) for paired desktop installs. All three share storage and revocation flow; the `kind` field selects behaviour. - name: DevicePair description: > Desktop device pairing flow. Three endpoints — start (anonymous), confirm (JWT, called from the Cyberun dashboard), poll (anonymous, called from desktop) — exchange a short user-visible code for a `dk-` credential without the user ever typing the secret. - name: Workflow description: > ComfyUI workflow template management: create, update, delete, and list workflow templates with configurable parameters, labels, timeout, and retry settings. - name: Task description: | Task execution and monitoring: submit workflow runs, poll task status, retrieve results, and cancel tasks. Tasks follow the lifecycle: `pending → waiting → queued → running → completed | failed | cancelled`. - name: Webhook description: > Webhook management: register HTTPS endpoints to receive event notifications (task.completed, task.failed) with HMAC-SHA256 signed payloads. - name: Container description: > Container service orchestration: deploy arbitrary Docker containers (vLLM, Ollama, custom services) to agents, manage lifecycle, and proxy HTTP requests through the gateway with load balancing. - name: CloudProvider description: > Cloud compute provider management: configure third-party cloud GPU provider API keys (e.g. ComfyUI Cloud) for teams without local GPU agents, and manage automatic cloud fallback settings. - name: Notifications description: | In-app notification center: list, read, and manage notifications for status changes and system alerts. - name: Agent description: > Agent monitoring: view connected agents for a team, including their status, labels, and current task. Data is read from the the platform's runtime state. - name: Node description: | Custom node management: upload, register, update, and delete ComfyUI custom node packages (zip archives) for team-scoped agents. - name: Model description: | Model management: upload, register, update, and delete AI model files (checkpoints, LoRAs, etc.) for team-scoped agents. - name: File description: > File upload for workflow inputs: request presigned upload URLs to stage files (images, videos, audio) in S3, then reference them as `type: file` parameters when running workflows. - name: Upload description: > Multipart upload support for large files: initiate, presign parts, complete, and abort multipart uploads. Used alongside domain-specific presign endpoints for files exceeding ~100 MB. - name: Server description: | Public server information: registration status and other configuration visible to unauthenticated clients. paths: /workflows/{workflowId}/export: parameters: - $ref: '#/components/parameters/TeamIdHeaderOptional' - $ref: '#/components/parameters/WorkflowId' get: tags: - Workflow summary: Export a workflow description: | Returns the full workflow configuration in an importable format. The response body is identical to CreateWorkflowRequest so it can be directly POSTed to the import endpoint on another team or environment. operationId: exportWorkflow responses: '200': description: Workflow export data content: application/json: schema: $ref: '#/components/schemas/CreateWorkflowRequest' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' security: - bearerAuth: [] - DeviceAuth: [] components: parameters: TeamIdHeaderOptional: name: X-Team-ID in: header required: false description: | UUID of the team to scope the request to. Used by dual-auth endpoints (runtime + scoped management): - **JWT callers** MUST send it — a user may belong to multiple teams and the runtime cannot otherwise know which one to operate on. Missing header → 400. - **Credential callers** (`sk-`, `dk-`) can omit it because the team is derived from the credential row itself. Any value sent is ignored. schema: type: string format: uuid example: 019abc12-4567-7890-abcd-ef1234567891 WorkflowId: name: workflowId in: path required: true description: UUID of the workflow. schema: type: string format: uuid example: 019abc12-8901-7890-abcd-ef1234567895 schemas: CreateWorkflowRequest: type: object required: - workflow_slug - display_name - workflow_json properties: workflow_slug: type: string pattern: ^[a-z0-9]+(?:-[a-z0-9]+)*$ minLength: 2 maxLength: 100 description: >- Globally unique URL-friendly identifier for the workflow. Lowercase letters, numbers, and hyphens only. example: sd-portrait-v2 display_name: type: string minLength: 1 maxLength: 255 description: Human-readable name for this workflow template. example: SD 1.5 Portrait Generator description: type: string maxLength: 2000 description: Optional description of what this workflow does. workflow_json: type: object description: > Tool-specific workflow definition. For `tool_type=comfyui`, this is a ComfyUI API workflow JSON object. For `tool_type=nerfstudio`, this is a Nerfstudio 3DGS pipeline spec. example: '5': class_type: EmptyLatentImage inputs: width: 512 height: 512 batch_size: 1 '6': class_type: CLIPTextEncode inputs: text: a portrait photo clip: - '4' - 0 parameters: type: array description: > Configurable parameters that can be overridden at run time. Each parameter maps a user-facing key to a tool-specific injection target. See ParameterDefInput for the mapping mechanism. items: $ref: '#/components/schemas/ParameterDefInput' tool_type: $ref: '#/components/schemas/ToolType' required_labels: type: array description: > Labels that an agent must have in order to receive tasks from this workflow. All labels must match (AND logic). If empty or omitted, any agent can execute it. items: type: string example: - gpu - sd15 task_timeout: type: integer minimum: 0 default: 0 description: > Maximum execution time in seconds after agent ACK. If the agent does not report completion within this time, the task is marked as failed and may be retried. 0 means use the gateway's default max timeout (typically 24 hours). max_retries: type: integer minimum: 0 default: 0 description: > Maximum number of automatic retries on failure. When a task fails (agent disconnect, timeout, ComfyUI error), a new retry task is created automatically up to this limit. 0 means no retry. preferred_gpu: type: string maxLength: 100 description: > Preferred GPU type for agent matching (e.g. "RTX_4090", "A100_80GB"). When set, the scheduler prioritises agents with this GPU type. If empty, any available GPU is accepted. example: RTX_4090 default_dispatch_target: type: string enum: - agent - comfy_cloud description: | Default compute source for tasks created from this workflow. Can be overridden per-run. If not set, defaults to `agent`. example: agent min_vram_gb: type: integer minimum: 0 maximum: 2048 description: | Minimum GPU VRAM required (decimal GB) for an agent to run this workflow. The dispatcher's hard filter excludes agents whose advertised `vram_total_gb` is below this number. 0 means no requirement (default). example: 24 required_models: type: array description: | Model paths the workflow needs (relative to the runtime's models root, e.g. `checkpoints/sdxl-base.safetensors`). The dispatcher's hard filter excludes any agent missing one or more of these files. Empty / omitted means no requirement. items: type: string maxLength: 512 example: - checkpoints/sdxl-base.safetensors - loras/style.safetensors ParameterDefInput: type: object description: > Input schema for defining a workflow parameter during create/update operations. For `tool_type=comfyui`, node_id and field are required. For `tool_type=nerfstudio`, target_path is required for non-file parameters and file/mask parameters may omit target_path when the tool spec references them by key. required: - key - type - label properties: key: type: string description: > Unique parameter identifier within this workflow. Used as the key in the RunWorkflowRequest.parameters map when submitting a task. example: prompt node_id: type: string description: > ComfyUI workflow node ID that this parameter targets. Must match a top-level key in workflow_json (e.g. "6" refers to workflow_json["6"]). example: '6' field: type: string description: > Input field name within the target node's inputs object. The parameter value replaces workflow_json[node_id]["inputs"][field]. example: text target_path: type: string description: > Dot-separated path within a non-ComfyUI tool spec. Used by Nerfstudio workflows for parameter injection, e.g. train.max_num_iterations. example: train.max_num_iterations type: type: string enum: - string - number - boolean - select - file - mask description: > Data type of the parameter value. Determines validation and UI widget: - string: free-text input - number: numeric input (optional min/max) - boolean: true/false toggle - select: dropdown from the options list - file: file upload (use accept to restrict MIME types) - mask: inpainting mask image tied to a file parameter via source_key label: type: string description: Human-readable label shown in the UI for this parameter. example: Positive Prompt description: type: string description: Optional help text explaining what this parameter does. required: type: boolean description: >- If true, a value must be provided when running the workflow. Defaults to false. default: description: >- Default value used when the parameter is not provided at run time. Type should match the parameter type. min: type: number format: double description: 'Minimum allowed value (inclusive). Only valid for type: number.' max: type: number format: double description: >- Maximum allowed value (inclusive). Only valid for type: number. Must be >= min. options: type: array description: 'List of allowed values. Required and only valid for type: select.' items: type: string accept: type: array description: >- Allowed MIME type patterns for file uploads. Only valid for type: file or mask. Example: ["image/*", "video/mp4"]. items: type: string source_key: type: string description: > Only valid for type: mask. References the key of another parameter (must be type: file) that provides the source image for the mask editor. example: input_image ToolType: type: string enum: - comfyui - nerfstudio description: | Tool runtime used by this workflow: - `comfyui`: ComfyUI API workflow JSON (default, backward compatible). - `nerfstudio`: Nerfstudio 3DGS pipeline spec. example: comfyui ErrorResponse: type: object required: - error_message properties: error_message: type: string description: Human-readable error message describing what went wrong. example: resource not found responses: BadRequest: description: >- Invalid request: missing required fields, validation failure, or malformed input. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: 'Authentication failed: missing, expired, or invalid JWT/API key.' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Insufficient permissions: the authenticated user does not have the required role or the authorization layer policy. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: 'Resource not found: the specified ID or slug does not exist.' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: | User session JWT (Bearer ). Must be paired with the `X-Team-ID` request header on team-scoped endpoints so the server knows which team's resources to operate on. DeviceAuth: type: http scheme: bearer description: > Device credential (Bearer dk-...) issued by the client device-pair flow (`POST /desktop/pair/confirm`). Carries the confirming user's identity, so it behaves like the user's JWT on team-scoped endpoints — the authorization layer runs against the user. Accepted on runtime + management endpoints. Never accepted on the platform's WebSocket. Team scope is bound at pair time; `X-Team-ID` is ignored. ````