{ "openapi": "3.0.1", "info": { "title": "n8n Workflow Auditor - Linter & Security Review", "description": "Audit n8n workflows for hardcoded credentials, unauthenticated webhooks, expression-injection exposure, missing error handling, deprecated nodes, and unreachable branches. Paste workflow JSON or connect an n8n instance and get one ranked finding per row, plus a health score out of 100 per workflow.", "version": "1.0", "x-build-id": "cA6KkLnoaYhdTUJfa" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/mediocre_interest~n8n-workflow-auditor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-mediocre_interest-n8n-workflow-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/mediocre_interest~n8n-workflow-auditor/runs": { "post": { "operationId": "runs-sync-mediocre_interest-n8n-workflow-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/mediocre_interest~n8n-workflow-auditor/run-sync": { "post": { "operationId": "run-sync-mediocre_interest-n8n-workflow-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "workflowJson": { "title": "Workflow JSON", "type": "object", "description": "Paste one exported n8n workflow. In n8n use Workflow menu > Download, or select the nodes on the canvas and press Ctrl+C. To audit several at once, paste them wrapped as `{\"workflows\": [ ... ]}` - an `n8n export:workflow` bundle or a raw public-API response already has that shape. For many workflows, use Workflow JSON URLs or an n8n instance connection instead." }, "workflowUrls": { "title": "Workflow JSON URLs", "type": "array", "description": "Fetch exported workflow JSON from these URLs - a raw Gist, a file in a Git repo, or any public link. A URL that returns several workflows is audited as several workflows.", "default": [], "items": { "type": "string" } }, "n8nBaseUrl": { "title": "n8n instance URL", "type": "string", "description": "The base URL of your n8n instance, for example `https://n8n.example.com`. The `/api/v1` suffix is added automatically if you leave it off." }, "n8nApiKey": { "title": "n8n API key", "type": "string", "description": "An n8n public API key, created under Settings > n8n API. Needs the `workflow:list` and `workflow:read` scopes. Stored encrypted, never written to the dataset, and redacted from the run log." }, "workflowIds": { "title": "Workflow IDs", "type": "array", "description": "Audit only these workflow IDs. Leave empty to audit every workflow on the instance.", "default": [], "items": { "type": "string" } }, "activeOnly": { "title": "Active workflows only", "type": "boolean", "description": "Skip deactivated workflows, so the audit covers only what is running. Turning it on is also the simplest way to control what an instance sweep costs, since every workflow audited is billed - drafts and retired workflows are skipped. Ignored when Workflow IDs is set.", "default": false }, "ruleSet": { "title": "Rule set", "enum": [ "all", "security", "reliability", "maintainability" ], "type": "string", "description": "`security` covers hardcoded credentials, unauthenticated webhooks, expression injection, and SQL interpolation. `reliability` covers error handling, timeouts, loops, and unreachable nodes. `maintainability` covers deprecated nodes, stale type versions, and community-node supply chain.", "default": "all" }, "minSeverity": { "title": "Minimum severity", "enum": [ "info", "low", "medium", "high", "critical" ], "type": "string", "description": "Findings below this level are not reported. Raise it to `medium` for a shorter report; drop it to `info` to include advisory findings such as missing pagination.", "default": "low" }, "ignoreRules": { "title": "Ignore rules", "type": "array", "description": "Rule IDs to suppress, for example `http-no-timeout` or `stale-type-version`. Every finding row carries its rule ID, so you can copy one from a previous run.", "default": [], "items": { "type": "string" } }, "includeReport": { "title": "HTML audit report", "type": "boolean", "description": "Build a shareable HTML page for this run - every workflow's score, then the findings grouped by severity - and link it from the run's Output tab. **Billed as its own event, once per run, on top of the per-workflow charge.** Leave it off and you still get every finding and every score in the datasets; only the page is skipped.", "default": false } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } }