n8n 2.31.5 → 2.32.1

package/dist/public-api/v1/openapi.yml

@@ -11,44 +11,54 @@ info:
   version: 1.1.1
 servers:
   - url: /api/v1
+    description: Current n8n instance (self-hosted built-in playground)
+  - url: '{url}/api/v1'
+    description: Self-hosted n8n instance
+    variables:
+      url:
+        default: https://example.com
 security:
   - ApiKeyAuth: []
   - BearerAuth: []
 tags:
-  - name: User
-    description: Operations about users
   - name: Audit
     description: Operations about security audit
-  - name: SecurityPolicy
-    description: Operations about the instance security policy settings
-  - name: Execution
-    description: Operations about executions
-  - name: Workflow
-    description: Operations about workflows
-  - name: Evaluation
-    description: Operations about evaluation test runs
+  - name: CommunityPackage
+    description: Operations about community packages
   - name: Credential
     description: Operations about credentials
-  - name: Tags
-    description: Operations about tags
-  - name: SourceControl
-    description: Operations about source control
-  - name: Variables
-    description: Operations about variables
   - name: DataTable
     description: Operations about data tables and their rows
-  - name: Projects
-    description: Operations about projects
-  - name: CommunityPackage
-    description: Operations about community packages
   - name: Discover
     description: API capability discovery
-  - name: Insights
-    description: Operations about insights
+  - name: Evaluation
+    description: Operations about evaluation test runs
+  - name: Execution
+    description: Operations about executions
   - name: Folders
     description: Operations about folders
+  - name: Insights
+    description: Operations about insights
+  - name: LogStreaming
+    description: Operations about log streaming destinations
   - name: N8nPackage
     description: Beta — breaking changes may still occur without major version bump.
+  - name: Projects
+    description: Operations about projects
+  - name: SecurityPolicy
+    description: Operations about the instance security policy settings
+  - name: SettingsSsoSaml
+    description: Operations about SAML SSO settings
+  - name: SourceControl
+    description: Operations about source control
+  - name: Tags
+    description: Operations about tags
+  - name: User
+    description: Operations about users
+  - name: Variables
+    description: Operations about variables
+  - name: Workflow
+    description: Operations about workflows
 externalDocs:
   description: n8n API documentation
   url: https://docs.n8n.io/api/
@@ -123,11 +133,11 @@ paths:
       x-eov-operation-handler: v1/handlers/security-policy/security-policy.handler
       tags:
         - SecurityPolicy
-      summary: Update the security policy
+      summary: Set the security policy
       description: |
-        Update the instance security policy. Only the provided fields are changed and the update takes effect exactly as it would from the UI, using the same validation. Requires the `securitySettings:manage` scope and the Personal Space Policy feature to be licensed. When the group is managed via environment variables, the write is rejected with 409 and no changes are made; a read still returns the current values.
+        Replace the instance security policy with the provided full object. Every writable field must be sent. Read-only usage counts from GET are ignored if included, so a GET response can be sent back as a PUT body. The update takes effect exactly as it would from the UI, using the same validation. Requires the `securitySettings:manage` scope and the Personal Space Policy feature to be licensed. When the group is managed via environment variables, the write is rejected with 409 and no changes are made; a read still returns the current values.
       requestBody:
-        description: The security policy fields to update.
+        description: The full security policy to set.
         required: true
         content:
           application/json:
@@ -148,6 +158,58 @@ paths:
           $ref: '#/components/responses/forbidden'
         '409':
           $ref: '#/components/responses/conflict'
+  /settings/sso/saml:
+    get:
+      x-eov-operation-id: getSamlConfiguration
+      x-required-scope: saml:manage
+      x-eov-operation-handler: v1/handlers/sso-saml/sso-saml.handler
+      tags:
+        - SettingsSsoSaml
+      summary: Retrieve the SAML SSO configuration
+      description: |
+        Retrieve the current SAML SSO configuration, including every field exposed in the UI plus the service provider entity ID and ACS return URL. Signing private keys, signing certificates, and identity provider metadata are redacted on read. Requires the `saml:manage` scope and the SAML feature to be licensed.
+      responses:
+        '200':
+          description: Operation successful.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/saml-configuration'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
+    put:
+      x-eov-operation-id: updateSamlConfiguration
+      x-required-scope: saml:manage
+      x-eov-operation-handler: v1/handlers/sso-saml/sso-saml.handler
+      tags:
+        - SettingsSsoSaml
+      summary: Set the SAML SSO configuration
+      description: |
+        Replace the SAML SSO configuration with the provided full object. Every writable field must be sent; use empty strings or empty arrays when a value is unset. Read-only `entityID` / `returnUrl` from GET are ignored if included, so a GET response can be sent back as a PUT body. Redacted secret placeholders keep the stored values unchanged. The update takes effect exactly as it would from the UI, using the same validation. Requires the `saml:manage` scope and the SAML feature to be licensed. When the configuration is managed via environment variables, the write is rejected with 409 and no changes are made.
+      requestBody:
+        description: The full SAML SSO configuration to set.
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/saml-configuration.update'
+      responses:
+        '200':
+          description: Operation successful.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/saml-configuration'
+        '400':
+          $ref: '#/components/responses/badRequest'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
+        '409':
+          $ref: '#/components/responses/conflict'
   /credentials:
     get:
       operationId: getCredentials
@@ -1258,6 +1320,33 @@ paths:
           $ref: '#/components/responses/forbidden'
         '404':
           $ref: '#/components/responses/notFound'
+    post:
+      x-eov-operation-id: createTestRun
+      x-required-scope: testRun:create
+      x-eov-operation-handler: v1/handlers/evaluations/evaluations.handler
+      tags:
+        - Evaluation
+      summary: Trigger a test run
+      description: Start a new evaluation test run for a workflow. The workflow must contain a configured evaluation trigger. Requires the `workflow:execute` project scope in addition to the `testRun:create` API key scope.
+      parameters:
+        - $ref: '#/components/parameters/testRunWorkflowId'
+      responses:
+        '201':
+          description: Test run triggered.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/testRun'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '402':
+          $ref: '#/components/responses/paymentRequired'
+        '403':
+          $ref: '#/components/responses/forbidden'
+        '404':
+          $ref: '#/components/responses/notFound'
+        '409':
+          $ref: '#/components/responses/conflict'
   /workflows/{id}/test-runs/{runId}:
     get:
       x-eov-operation-id: getTestRun
@@ -1283,6 +1372,33 @@ paths:
           $ref: '#/components/responses/forbidden'
         '404':
           $ref: '#/components/responses/notFound'
+  /workflows/{id}/test-runs/{runId}/cancel:
+    post:
+      x-eov-operation-id: cancelTestRun
+      x-required-scope: testRun:cancel
+      x-eov-operation-handler: v1/handlers/evaluations/evaluations.handler
+      tags:
+        - Evaluation
+      summary: Cancel a test run
+      description: Cancel a running evaluation test run of a workflow. Requires the `workflow:execute` project scope in addition to the `testRun:cancel` API key scope.
+      parameters:
+        - $ref: '#/components/parameters/testRunWorkflowId'
+        - $ref: '#/components/parameters/testRunId'
+      responses:
+        '202':
+          description: Cancellation requested.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/testRunCancel'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
+        '404':
+          $ref: '#/components/responses/notFound'
+        '409':
+          $ref: '#/components/responses/conflict'
   /workflows/{id}/test-runs/{runId}/test-cases:
     get:
       x-eov-operation-id: getTestCases
@@ -2708,7 +2824,7 @@ paths:
       parameters:
         - name: projectId
           in: path
-          description: The ID of the project.
+          description: The ID of the project, or `personal` to create the folder in the calling user's own personal project.
           required: true
           schema:
             type: string
@@ -2965,11 +3081,12 @@ paths:
         Export workflows and/or folders, or projects, as a gzipped tar archive
         (.n8np). Provide `workflowIds`/`folderIds`, or `projectIds`, but not both
         groups. Each exported folder includes its nested folders. Empty projects
-        export project metadata only. The response is streamed as `application/gzip`
-        with a `Content-Disposition` attachment header. Requires the n8n Packages
-        feature to be licensed.
+        export project metadata only. Statically referenced sub-workflows must also
+        be included in the resulting package, otherwise the export is rejected. The
+        response is streamed as `application/gzip` with a `Content-Disposition`
+        attachment header. Requires the n8n Packages feature to be licensed.
 
-        API key scopes: `workflow:export` is required when exporting workflows or folders, and `project:export` is required when exporting projects.
+        API key scopes: `workflow:export` is required when exporting workflows or folders, and `project:export` is required when exporting projects. When `includeVariableValues` is true (the default) and the exported workflows reference variables, `variable:list` is also required; exports that reference no variables never need it.
       requestBody:
         description: Workflows, folders, or projects to include in the exported package.
         required: true
@@ -3099,6 +3216,30 @@ paths:
                   default: merge
                   description: |
                     Controls what happens when a package folder (matched by id in the target project) already exists at the same position. `merge` (default) reuses the existing folder as-is and merges the package's children into it; `fail` rejects the import. A folder whose id exists under a different parent, or belongs to another project, always blocks the import. Requires the `folder:create` scope and a license that supports folders when the package contains folders.
+                dataTableMatchingMode:
+                  type: string
+                  enum:
+                    - by-id
+                  default: by-id
+                  description: |
+                    How data tables referenced by the package's workflows are matched against the target project. `by-id` matches the target-project table with the same id (imported tables keep their source id) and never falls back to name matching, so a match survives a rename on the target. Currently the only mode.
+                dataTableMissingMode:
+                  type: string
+                  enum:
+                    - create
+                    - must-preexist
+                    - do-nothing
+                  default: create
+                  description: |
+                    Controls what happens when a referenced data table has no match in the target project. `create` (default) creates it from the package schema, keeping the source id, with no rows; requires the `dataTable:create` scope. `must-preexist` rejects the import. `do-nothing` skips creation of missing tables — matched tables are still validated for schema compatibility and can still block the import. Matched tables are always used as-is: never renamed, altered, or filled.
+                dataTableSchemaConflictPolicy:
+                  type: string
+                  enum:
+                    - keep-existing
+                    - fail
+                  default: keep-existing
+                  description: |
+                    How strictly a matched data table's schema is compared. `keep-existing` (default) accepts a target table that has every package column with the same name and type, even when the target table also has additional columns of its own. `fail` is the strict drift-detection choice: any difference, including such target-only columns, rejects the import. A missing package column or a type mismatch always rejects. Both policies are non-destructive — the matched target table is never altered, and package columns are never added to it.
       responses:
         '200':
           description: Import succeeded; the listed workflows were written to the target project.
@@ -3337,156 +3478,681 @@ paths:
                     type: array
                     items:
                       $ref: '#/components/schemas/importBlockingIssue'
-components:
-  schemas:
-    audit:
-      type: object
-      properties:
-        Credentials Risk Report:
-          type: object
-          example:
-            risk: credentials
-            sections:
-              - title: Credentials not used in any workflow
-                description: These credentials are not used in any workflow. Keeping unused credentials in your instance is an unneeded security risk.
-                recommendation: Consider deleting these credentials if you no longer need them.
-                location:
-                  - kind: credential
-                    id: '1'
-                    name: My Test Account
-        Database Risk Report:
-          type: object
-          example:
-            risk: database
-            sections:
-              - title: Expressions in "Execute Query" fields in SQL nodes
-                description: This SQL node has an expression in the "Query" field of an "Execute Query" operation. Building a SQL query with an expression may lead to a SQL injection attack.
-                recommendation: Consider using the "Query Parameters" field to pass parameters to the query
-                or validating the input of the expression in the "Query" field.: null
-                location:
-                  - kind: node
-                    workflowId: '1'
-                    workflowName: My Workflow
-                    nodeId: 51eb5852-ce0b-4806-b4ff-e41322a4041a
-                    nodeName: MySQL
-                    nodeType: n8n-nodes-base.mySql
-        Filesystem Risk Report:
-          type: object
-          example:
-            risk: filesystem
-            sections:
-              - title: Nodes that interact with the filesystem
-                description: This node reads from and writes to any accessible file in the host filesystem. Sensitive file content may be manipulated through a node operation.
-                recommendation: Consider protecting any sensitive files in the host filesystem
-                or refactoring the workflow so that it does not require host filesystem interaction.: null
-                location:
-                  - kind: node
-                    workflowId: '1'
-                    workflowName: My Workflow
-                    nodeId: 51eb5852-ce0b-4806-b4ff-e41322a4041a
-                    nodeName: Ready Binary file
-                    nodeType: n8n-nodes-base.readBinaryFile
-        Nodes Risk Report:
-          type: object
-          example:
-            risk: nodes
-            sections:
-              - title: Community nodes
-                description: This node is sourced from the community. Community nodes are not vetted by the n8n team and have full access to the host system.
-                recommendation: Consider reviewing the source code in any community nodes installed in this n8n instance
-                and uninstalling any community nodes no longer used.: null
-                location:
-                  - kind: community
-                    nodeType: n8n-nodes-test.test
-                    packageUrl: https://www.npmjs.com/package/n8n-nodes-test
-        Instance Risk Report:
-          type: object
-          example:
-            risk: execution
-            sections:
-              - title: Unprotected webhooks in instance
-                description: These webhook nodes have the "Authentication" field set to "None" and are not directly connected to a node to validate the payload. Every unprotected webhook allows your workflow to be called by any third party who knows the webhook URL.
-                recommendation: Consider setting the "Authentication" field to an option other than "None"
-                or validating the payload with one of the following nodes.: null
-                location:
-                  - kind: community
-                    nodeType: n8n-nodes-test.test
-                    packageUrl: https://www.npmjs.com/package/n8n-nodes-test
-    security-policy:
-      type: object
-      additionalProperties: false
-      required:
-        - personalSpacePublishing
-        - personalSpaceSharing
-        - publishedPersonalWorkflowsCount
-        - sharedPersonalWorkflowsCount
-        - sharedPersonalCredentialsCount
-        - redactionEnforcement
-      properties:
-        personalSpacePublishing:
-          type: boolean
-          description: Whether members may publish workflows and agents from their personal space.
-          example: true
-        personalSpaceSharing:
-          type: boolean
-          description: Whether members may share workflows and credentials from their personal space.
-          example: true
-        publishedPersonalWorkflowsCount:
-          type: integer
-          readOnly: true
-          description: Number of currently published personal workflows, shown for awareness before tightening the policy.
-          example: 3
-        sharedPersonalWorkflowsCount:
-          type: integer
-          readOnly: true
-          description: Number of personal workflows currently shared with other users.
-          example: 5
-        sharedPersonalCredentialsCount:
-          type: integer
-          readOnly: true
-          description: Number of personal credentials currently shared with other users.
-          example: 2
-        redactionEnforcement:
-          type: object
-          additionalProperties: false
-          required:
-            - floor
-          properties:
-            floor:
-              type: string
-              enum:
-                - 'off'
-                - production
-                - all
-              description: Minimum execution-data redaction level enforced across the instance.
-              example: production
-    security-policy.update:
-      type: object
-      additionalProperties: false
-      description: Security policy fields to update. Omitted fields are left unchanged.
-      properties:
+  /settings/log-streaming/event-types:
+    get:
+      x-eov-operation-id: getEventTypes
+      x-required-scope: eventBusDestination:list
+      x-eov-operation-handler: v1/handlers/log-streaming/log-streaming.handler
+      tags:
+        - LogStreaming
+      summary: List streamable event types
+      description: |
+        List the event types that can be streamed to a log streaming destination. Requires the `eventBusDestination:list` scope and the Log Streaming feature to be licensed.
+      responses:
+        '200':
+          description: Operation successful.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/event-types'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
+  /settings/log-streaming/destinations:
+    get:
+      x-eov-operation-id: getDestinations
+      x-required-scope: eventBusDestination:list
+      x-eov-operation-handler: v1/handlers/log-streaming/log-streaming.handler
+      tags:
+        - LogStreaming
+      summary: List log streaming destinations
+      description: |
+        List the configured log streaming destinations. Requires the `eventBusDestination:list` scope and the Log Streaming feature to be licensed.
+      responses:
+        '200':
+          description: Operation successful.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/destination.list'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
+    post:
+      x-eov-operation-id: createDestination
+      x-required-scope: eventBusDestination:create
+      x-eov-operation-handler: v1/handlers/log-streaming/log-streaming.handler
+      tags:
+        - LogStreaming
+      summary: Create a log streaming destination
+      description: |
+        Create a log streaming destination. The destination takes effect exactly as it would from the UI, using the same validation. Requires the `eventBusDestination:create` scope and the Log Streaming feature to be licensed. When destinations are managed via environment variables, the write is rejected with 409 and nothing is created; reads still return the current values.
+      requestBody:
+        description: The destination to create.
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/destination'
+      responses:
+        '200':
+          description: Operation successful.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/destination'
+        '400':
+          $ref: '#/components/responses/badRequest'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
+        '409':
+          $ref: '#/components/responses/conflict'
+  /settings/log-streaming/destinations/{id}/test:
+    post:
+      x-eov-operation-id: testDestination
+      x-required-scope: eventBusDestination:test
+      x-eov-operation-handler: v1/handlers/log-streaming/log-streaming.handler
+      tags:
+        - LogStreaming
+      summary: Send a test message to a log streaming destination
+      description: |
+        Send a test message to the destination to verify it is reachable and configured correctly. Requires the `eventBusDestination:test` scope and the Log Streaming feature to be licensed.
+      parameters:
+        - name: id
+          in: path
+          description: The id of the log streaming destination.
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Operation successful.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/test-result'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
+        '404':
+          $ref: '#/components/responses/notFound'
+  /settings/log-streaming/destinations/{id}:
+    get:
+      x-eov-operation-id: getDestination
+      x-required-scope: eventBusDestination:read
+      x-eov-operation-handler: v1/handlers/log-streaming/log-streaming.handler
+      tags:
+        - LogStreaming
+      summary: Retrieve a log streaming destination
+      description: |
+        Retrieve a single log streaming destination by id. Requires the `eventBusDestination:read` scope and the Log Streaming feature to be licensed.
+      parameters:
+        - name: id
+          in: path
+          description: The id of the log streaming destination.
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Operation successful.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/destination'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
+        '404':
+          $ref: '#/components/responses/notFound'
+    put:
+      x-eov-operation-id: updateDestination
+      x-required-scope: eventBusDestination:update
+      x-eov-operation-handler: v1/handlers/log-streaming/log-streaming.handler
+      tags:
+        - LogStreaming
+      summary: Update a log streaming destination
+      description: |
+        Replace an existing log streaming destination. The update takes effect exactly as it would from the UI, using the same validation. Requires the `eventBusDestination:update` scope and the Log Streaming feature to be licensed. When destinations are managed via environment variables, the write is rejected with 409 and nothing is changed; reads still return the current values.
+      parameters:
+        - name: id
+          in: path
+          description: The id of the log streaming destination.
+          required: true
+          schema:
+            type: string
+      requestBody:
+        description: The destination fields to apply.
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/destination'
+      responses:
+        '200':
+          description: Operation successful.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/destination'
+        '400':
+          $ref: '#/components/responses/badRequest'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
+        '404':
+          $ref: '#/components/responses/notFound'
+        '409':
+          $ref: '#/components/responses/conflict'
+    delete:
+      x-eov-operation-id: deleteDestination
+      x-required-scope: eventBusDestination:delete
+      x-eov-operation-handler: v1/handlers/log-streaming/log-streaming.handler
+      tags:
+        - LogStreaming
+      summary: Delete a log streaming destination
+      description: |
+        Remove a log streaming destination. Requires the `eventBusDestination:delete` scope and the Log Streaming feature to be licensed. When destinations are managed via environment variables, the delete is rejected with 409 and nothing is removed; reads still return the current values.
+      parameters:
+        - name: id
+          in: path
+          description: The id of the log streaming destination.
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Operation successful.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/destination'
+        '401':
+          $ref: '#/components/responses/unauthorized'
+        '403':
+          $ref: '#/components/responses/forbidden'
+        '404':
+          $ref: '#/components/responses/notFound'
+        '409':
+          $ref: '#/components/responses/conflict'
+components:
+  schemas:
+    audit:
+      type: object
+      properties:
+        Credentials Risk Report:
+          type: object
+          example:
+            risk: credentials
+            sections:
+              - title: Credentials not used in any workflow
+                description: These credentials are not used in any workflow. Keeping unused credentials in your instance is an unneeded security risk.
+                recommendation: Consider deleting these credentials if you no longer need them.
+                location:
+                  - kind: credential
+                    id: '1'
+                    name: My Test Account
+        Database Risk Report:
+          type: object
+          example:
+            risk: database
+            sections:
+              - title: Expressions in "Execute Query" fields in SQL nodes
+                description: This SQL node has an expression in the "Query" field of an "Execute Query" operation. Building a SQL query with an expression may lead to a SQL injection attack.
+                recommendation: Consider using the "Query Parameters" field to pass parameters to the query
+                or validating the input of the expression in the "Query" field.: null
+                location:
+                  - kind: node
+                    workflowId: '1'
+                    workflowName: My Workflow
+                    nodeId: 51eb5852-ce0b-4806-b4ff-e41322a4041a
+                    nodeName: MySQL
+                    nodeType: n8n-nodes-base.mySql
+        Filesystem Risk Report:
+          type: object
+          example:
+            risk: filesystem
+            sections:
+              - title: Nodes that interact with the filesystem
+                description: This node reads from and writes to any accessible file in the host filesystem. Sensitive file content may be manipulated through a node operation.
+                recommendation: Consider protecting any sensitive files in the host filesystem
+                or refactoring the workflow so that it does not require host filesystem interaction.: null
+                location:
+                  - kind: node
+                    workflowId: '1'
+                    workflowName: My Workflow
+                    nodeId: 51eb5852-ce0b-4806-b4ff-e41322a4041a
+                    nodeName: Ready Binary file
+                    nodeType: n8n-nodes-base.readBinaryFile
+        Nodes Risk Report:
+          type: object
+          example:
+            risk: nodes
+            sections:
+              - title: Community nodes
+                description: This node is sourced from the community. Community nodes are not vetted by the n8n team and have full access to the host system.
+                recommendation: Consider reviewing the source code in any community nodes installed in this n8n instance
+                and uninstalling any community nodes no longer used.: null
+                location:
+                  - kind: community
+                    nodeType: n8n-nodes-test.test
+                    packageUrl: https://www.npmjs.com/package/n8n-nodes-test
+        Instance Risk Report:
+          type: object
+          example:
+            risk: execution
+            sections:
+              - title: Unprotected webhooks in instance
+                description: These webhook nodes have the "Authentication" field set to "None" and are not directly connected to a node to validate the payload. Every unprotected webhook allows your workflow to be called by any third party who knows the webhook URL.
+                recommendation: Consider setting the "Authentication" field to an option other than "None"
+                or validating the payload with one of the following nodes.: null
+                location:
+                  - kind: community
+                    nodeType: n8n-nodes-test.test
+                    packageUrl: https://www.npmjs.com/package/n8n-nodes-test
+    security-policy:
+      type: object
+      additionalProperties: false
+      required:
+        - personalSpacePublishing
+        - personalSpaceSharing
+        - publishedPersonalWorkflowsCount
+        - sharedPersonalWorkflowsCount
+        - sharedPersonalCredentialsCount
+        - redactionEnforcement
+      properties:
+        personalSpacePublishing:
+          type: boolean
+          description: Whether members may publish workflows and agents from their personal space.
+          example: true
+        personalSpaceSharing:
+          type: boolean
+          description: Whether members may share workflows and credentials from their personal space.
+          example: true
+        publishedPersonalWorkflowsCount:
+          type: integer
+          readOnly: true
+          description: Number of currently published personal workflows, shown for awareness before tightening the policy.
+          example: 3
+        sharedPersonalWorkflowsCount:
+          type: integer
+          readOnly: true
+          description: Number of personal workflows currently shared with other users.
+          example: 5
+        sharedPersonalCredentialsCount:
+          type: integer
+          readOnly: true
+          description: Number of personal credentials currently shared with other users.
+          example: 2
+        redactionEnforcement:
+          type: object
+          additionalProperties: false
+          required:
+            - floor
+          properties:
+            floor:
+              type: string
+              enum:
+                - 'off'
+                - production
+                - all
+              description: Minimum execution-data redaction level enforced across the instance.
+              example: production
+    security-policy.update:
+      type: object
+      additionalProperties: false
+      description: Full security policy. All writable fields must be provided; partial updates are not supported.
+      required:
+        - personalSpacePublishing
+        - personalSpaceSharing
+        - redactionEnforcement
+      properties:
         personalSpacePublishing:
           type: boolean
-          description: Whether members may publish workflows and agents from their personal space.
+          description: Whether members may publish workflows and agents from their personal space.
+          example: false
+        personalSpaceSharing:
+          type: boolean
+          description: Whether members may share workflows and credentials from their personal space.
+          example: false
+        redactionEnforcement:
+          type: object
+          additionalProperties: false
+          required:
+            - floor
+          properties:
+            floor:
+              type: string
+              enum:
+                - 'off'
+                - production
+                - all
+              description: Minimum execution-data redaction level enforced across the instance.
+              example: production
+        publishedPersonalWorkflowsCount:
+          type: integer
+          description: |
+            Read-only usage count returned by GET. Ignored on write so a GET response can be sent back as a PUT body.
+        sharedPersonalWorkflowsCount:
+          type: integer
+          description: |
+            Read-only usage count returned by GET. Ignored on write so a GET response can be sent back as a PUT body.
+        sharedPersonalCredentialsCount:
+          type: integer
+          description: |
+            Read-only usage count returned by GET. Ignored on write so a GET response can be sent back as a PUT body.
+    saml-configuration:
+      type: object
+      additionalProperties: false
+      required:
+        - entityID
+        - returnUrl
+        - mapping
+        - metadata
+        - metadataUrl
+        - ignoreSSL
+        - loginBinding
+        - loginEnabled
+        - loginLabel
+        - authnRequestsSigned
+        - wantAssertionsSigned
+        - wantMessageSigned
+        - signingPrivateKey
+        - signingCertificate
+        - acsBinding
+        - signatureConfig
+        - relayState
+      properties:
+        entityID:
+          type: string
+          readOnly: true
+          description: Service provider entity ID (metadata URL).
+          example: https://n8n.example.com/rest/sso/saml/metadata
+        returnUrl:
+          type: string
+          readOnly: true
+          description: Assertion Consumer Service (ACS) return URL.
+          example: https://n8n.example.com/rest/sso/saml/acs
+        mapping:
+          type: object
+          description: Mapping of SAML attributes to n8n user fields.
+          additionalProperties: false
+          required:
+            - email
+            - firstName
+            - lastName
+            - userPrincipalName
+            - n8nInstanceRole
+            - n8nProjectRoles
+          properties:
+            email:
+              type: string
+              description: SAML attribute mapped to the user's email.
+            firstName:
+              type: string
+              description: SAML attribute mapped to the user's first name.
+            lastName:
+              type: string
+              description: SAML attribute mapped to the user's last name.
+            userPrincipalName:
+              type: string
+              description: SAML attribute mapped to the user's principal name.
+            n8nInstanceRole:
+              type: string
+              description: SAML attribute mapped to the n8n instance role.
+            n8nProjectRoles:
+              type: array
+              items:
+                type: string
+              description: SAML attributes mapped to n8n project roles, formatted as `<projectId>:<role>`.
+        metadata:
+          type: string
+          description: |
+            Identity provider metadata in XML format. Redacted on read when set because it contains IdP certificates; never echoed back in plaintext. Use an empty string when unset.
+          example: '**hidden**'
+        metadataUrl:
+          type: string
+          description: URL to fetch identity provider metadata from. Use an empty string when unset.
+        ignoreSSL:
+          type: boolean
+          description: Whether to ignore SSL certificate errors when fetching metadata from a URL.
           example: false
-        personalSpaceSharing:
+        loginBinding:
+          type: string
+          enum:
+            - redirect
+            - post
+          description: SAML login request binding.
+          example: redirect
+        loginEnabled:
           type: boolean
-          description: Whether members may share workflows and credentials from their personal space.
+          description: Whether SAML login is enabled.
           example: false
-        redactionEnforcement:
+        loginLabel:
+          type: string
+          description: Label shown on the SAML login button.
+          example: SAML
+        authnRequestsSigned:
+          type: boolean
+          description: Whether authentication requests are signed.
+          example: false
+        wantAssertionsSigned:
+          type: boolean
+          description: Whether signed assertions are required.
+          example: true
+        wantMessageSigned:
+          type: boolean
+          description: Whether signed SAML messages are required.
+          example: true
+        signingPrivateKey:
+          type: string
+          description: |
+            PEM-encoded private key for signing SAML AuthnRequests. Redacted on read when set; never echoed back in plaintext. Use an empty string when unset.
+          example: '**hidden**'
+        signingCertificate:
+          type: string
+          description: |
+            PEM-encoded certificate containing the public key matching the signing private key. Redacted on read when set; never echoed back in plaintext. Use an empty string when unset.
+          example: '**hidden**'
+        acsBinding:
+          type: string
+          enum:
+            - redirect
+            - post
+          description: Assertion Consumer Service binding.
+          example: post
+        signatureConfig:
           type: object
+          description: Configuration for the signature in SAML requests and responses.
           additionalProperties: false
           required:
-            - floor
+            - prefix
+            - location
           properties:
-            floor:
+            prefix:
               type: string
-              enum:
-                - 'off'
-                - production
-                - all
-              description: Minimum execution-data redaction level enforced across the instance.
-              example: production
+              example: ds
+            location:
+              type: object
+              additionalProperties: false
+              required:
+                - reference
+                - action
+              properties:
+                reference:
+                  type: string
+                  example: /samlp:Response/saml:Issuer
+                action:
+                  type: string
+                  enum:
+                    - before
+                    - after
+                    - prepend
+                    - append
+                  example: after
+        relayState:
+          type: string
+          description: Default relay state value for SAML requests. Use an empty string when unset.
+          example: https://n8n.example.com
+    saml-configuration.update:
+      type: object
+      additionalProperties: false
+      description: |
+        Full SAML SSO configuration. Every field must be provided; use empty strings or empty arrays when a value is unset. Partial updates are not supported.
+      required:
+        - mapping
+        - metadata
+        - metadataUrl
+        - ignoreSSL
+        - loginBinding
+        - loginEnabled
+        - loginLabel
+        - authnRequestsSigned
+        - wantAssertionsSigned
+        - wantMessageSigned
+        - signingPrivateKey
+        - signingCertificate
+        - acsBinding
+        - signatureConfig
+        - relayState
+      properties:
+        mapping:
+          type: object
+          description: Mapping of SAML attributes to n8n user fields. Use empty strings / empty arrays for unused attributes.
+          additionalProperties: false
+          required:
+            - email
+            - firstName
+            - lastName
+            - userPrincipalName
+            - n8nInstanceRole
+            - n8nProjectRoles
+          properties:
+            email:
+              type: string
+              description: SAML attribute mapped to the user's email.
+            firstName:
+              type: string
+              description: SAML attribute mapped to the user's first name.
+            lastName:
+              type: string
+              description: SAML attribute mapped to the user's last name.
+            userPrincipalName:
+              type: string
+              description: SAML attribute mapped to the user's principal name.
+            n8nInstanceRole:
+              type: string
+              description: SAML attribute mapped to the n8n instance role. Use an empty string when unused.
+            n8nProjectRoles:
+              type: array
+              items:
+                type: string
+              description: |
+                SAML attributes mapped to n8n project roles, formatted as `<projectId>:<role>`. Use an empty array when unused.
+        metadata:
+          type: string
+          description: |
+            Identity provider metadata in XML format. Use an empty string to clear stored metadata (also clears metadataUrl when no URL is provided). Use the redaction placeholder from a prior GET to leave an existing value unchanged.
+        metadataUrl:
+          type: string
+          description: |
+            URL to fetch identity provider metadata from. Use an empty string to clear a stored URL.
+        ignoreSSL:
+          type: boolean
+          description: Whether to ignore SSL certificate errors when fetching metadata from a URL.
+          example: false
+        loginBinding:
+          type: string
+          enum:
+            - redirect
+            - post
+          description: SAML login request binding.
+          example: redirect
+        loginEnabled:
+          type: boolean
+          description: Whether SAML login is enabled.
+          example: false
+        loginLabel:
+          type: string
+          description: Label shown on the SAML login button.
+          example: SAML
+        authnRequestsSigned:
+          type: boolean
+          description: Whether authentication requests are signed.
+          example: false
+        wantAssertionsSigned:
+          type: boolean
+          description: Whether signed assertions are required.
+          example: true
+        wantMessageSigned:
+          type: boolean
+          description: Whether signed SAML messages are required.
+          example: true
+        signingPrivateKey:
+          type: string
+          description: |
+            PEM-encoded private key for signing SAML AuthnRequests. Use an empty string to clear an existing key, or the redaction placeholder from a prior GET to leave it unchanged.
+        signingCertificate:
+          type: string
+          description: |
+            PEM-encoded certificate containing the public key matching the signing private key. Use an empty string when unused or to clear an existing certificate.
+        acsBinding:
+          type: string
+          enum:
+            - redirect
+            - post
+          description: Assertion Consumer Service binding.
+          example: post
+        signatureConfig:
+          type: object
+          description: Configuration for the signature in SAML requests and responses.
+          additionalProperties: false
+          required:
+            - prefix
+            - location
+          properties:
+            prefix:
+              type: string
+              example: ds
+            location:
+              type: object
+              additionalProperties: false
+              required:
+                - reference
+                - action
+              properties:
+                reference:
+                  type: string
+                  example: /samlp:Response/saml:Issuer
+                action:
+                  type: string
+                  enum:
+                    - before
+                    - after
+                    - prepend
+                    - append
+                  example: after
+        relayState:
+          type: string
+          description: Default relay state value for SAML requests. Use an empty string when unused.
+          example: https://n8n.example.com
+        entityID:
+          type: string
+          description: |
+            Service provider entity ID. Returned by GET for convenience; ignored on write so a GET response can be sent back as a PUT body.
+          example: https://n8n.example.com/rest/sso/saml/metadata
+        returnUrl:
+          type: string
+          description: |
+            Assertion Consumer Service return URL. Returned by GET for convenience; ignored on write so a GET response can be sent back as a PUT body.
+          example: https://n8n.example.com/rest/sso/saml/acs
     create-credential-response:
       required:
         - id
@@ -3956,6 +4622,11 @@ components:
           type: string
           description: Display name of the node group
           example: Data processing
+        description:
+          type: string
+          maxLength: 155
+          description: Optional plain-text description of the node group
+          example: Cleans and normalizes incoming records
         nodeIds:
           type: array
           description: IDs of the nodes that belong to this group
@@ -4176,6 +4847,12 @@ components:
           type: string
           description: Description of the workflow
           example: My workflow description
+        parentFolderId:
+          type: string
+          nullable: true
+          writeOnly: true
+          description: ID of the folder to move the workflow into. Pass null to move it to the project root; omit to leave its current folder unchanged.
+          example: X8ovzm8lTQjcXRZQ
         active:
           type: boolean
           readOnly: true
@@ -4341,6 +5018,11 @@ components:
           type: string
           description: Target project to create the workflow in. Defaults to the user's personal project.
           example: VmwOO9HeTEj20kxM
+        parentFolderId:
+          type: string
+          nullable: true
+          description: ID of the folder to place the workflow in. Omit or null to place at the project root.
+          example: X8ovzm8lTQjcXRZQ
         meta:
           type: object
           nullable: true
@@ -4499,6 +5181,33 @@ components:
           nullable: true
           description: Paginate through test runs by setting the cursor parameter to the nextCursor attribute returned by a previous request. Default value fetches the first "page" of the collection.
           example: MTIzZTQ1NjctZTg5Yi0xMmQzLWE0NTYtNDI2NjE0MTc0MDA
+    testRun:
+      type: object
+      properties:
+        id:
+          type: string
+          example: 9f8e7d6c5b4a3210
+        status:
+          type: string
+          enum:
+            - new
+            - running
+            - completed
+            - error
+            - cancelled
+        createdAt:
+          type: string
+          format: date-time
+    testRunCancel:
+      type: object
+      properties:
+        id:
+          type: string
+          example: 9f8e7d6c5b4a3210
+        status:
+          type: string
+          enum:
+            - cancelled
     testCaseExecution:
       type: object
       properties:
@@ -5419,6 +6128,19 @@ components:
             minLength: 1
           example:
             - Ox8O54VQrmBrb4qL
+        includeVariableValues:
+          type: boolean
+          default: true
+          description: Whether values of variables referenced by the exported workflows are bundled into the package. When `false`, variables still travel as name/type files and are listed in the package requirements, but no values travel with the package.
+        missingWorkflowDependencyPolicy:
+          type: string
+          enum:
+            - fail
+            - reference-only
+            - include-in-package
+          description: Policy for missing static sub-workflow dependencies. Currently only `fail` is supported; `reference-only` and `include-in-package` are reserved for upcoming export modes.
+          example: fail
+          default: fail
     importBlockingIssue:
       oneOf:
         - type: object
@@ -5569,6 +6291,293 @@ components:
               type: array
               items:
                 type: string
+    event-types:
+      type: object
+      additionalProperties: false
+      required:
+        - data
+      properties:
+        data:
+          type: array
+          description: Event names that can be streamed to a destination.
+          items:
+            type: string
+          example:
+            - n8n.workflow.started
+            - n8n.workflow.success
+            - n8n.workflow.failed
+    destination.common:
+      type: object
+      properties:
+        id:
+          type: string
+          readOnly: true
+          description: Server-generated unique id of the destination. Returned in responses; not accepted in requests.
+          example: 88be6560-bfb4-455c-8aa1-06971e9e5522
+        label:
+          type: string
+          description: Human-readable name shown in the UI.
+          example: My destination
+        enabled:
+          type: boolean
+          description: Whether the destination currently receives events.
+          example: true
+        subscribedEvents:
+          type: array
+          items:
+            type: string
+          description: |
+            Event names (or group prefixes, e.g. `n8n.workflow`, which matches all `n8n.workflow.*` events) this destination receives. Retrieve the full list of streamable event names from `GET /settings/log-streaming/event-types`.
+          example:
+            - n8n.workflow
+            - n8n.audit
+        anonymizeAuditMessages:
+          type: boolean
+          description: Whether audit message payloads are anonymized before being sent.
+          example: false
+        circuitBreaker:
+          type: object
+          additionalProperties: true
+          description: |
+            Circuit-breaker tuning for delivery. After repeated failures the destination stops sending for a cool-down window instead of hammering an unhealthy target. All fields are optional; sensible defaults apply when omitted.
+          properties:
+            maxFailures:
+              type: integer
+              description: Maximum failures within the sliding window before the breaker opens.
+            failureWindow:
+              type: integer
+              description: Sliding window, in milliseconds, over which failures are counted.
+    parameter-list:
+      type: object
+      additionalProperties: true
+      description: Key-value pairs used when the matching `specify*` field is `keypair`.
+      properties:
+        parameters:
+          type: array
+          items:
+            type: object
+            required:
+              - name
+              - value
+            properties:
+              name:
+                type: string
+                example: Authorization
+              value:
+                description: |
+                  Parameter value. Usually a string; numbers, booleans and null are also accepted.
+                example: Bearer <token>
+    destination.webhook:
+      allOf:
+        - $ref: '#/components/schemas/destination.common'
+        - type: object
+          additionalProperties: true
+          required:
+            - type
+            - url
+          properties:
+            type:
+              type: string
+              enum:
+                - webhook
+              description: Sends each event as an HTTP request to a URL.
+              example: webhook
+            url:
+              type: string
+              format: uri
+              description: Target URL that receives the event payload.
+              example: https://example.com/n8n-events
+            method:
+              type: string
+              description: HTTP method used for the request.
+              example: POST
+            sendHeaders:
+              type: boolean
+              description: Whether to attach custom headers to the request.
+              example: false
+            specifyHeaders:
+              type: string
+              description: How custom headers are provided — `keypair` or `json`.
+              example: keypair
+            headerParameters:
+              $ref: '#/components/schemas/parameter-list'
+            jsonHeaders:
+              type: string
+              description: Custom headers as a JSON string when `specifyHeaders` is `json`.
+            sendQuery:
+              type: boolean
+              description: Whether to attach query parameters to the request.
+              example: false
+            specifyQuery:
+              type: string
+              description: How query parameters are provided — `keypair` or `json`.
+            queryParameters:
+              $ref: '#/components/schemas/parameter-list'
+            jsonQuery:
+              type: string
+              description: Query parameters as a JSON string when `specifyQuery` is `json`.
+            options:
+              type: object
+              additionalProperties: true
+              description: Additional HTTP request options.
+              properties:
+                timeout:
+                  type: integer
+                  description: Request timeout in milliseconds.
+                allowUnauthorizedCerts:
+                  type: boolean
+                  description: Accept self-signed or otherwise invalid TLS certificates.
+                queryParameterArrays:
+                  type: string
+                  enum:
+                    - indices
+                    - brackets
+                    - repeat
+                  description: How array-valued query parameters are serialized into the query string.
+                redirect:
+                  type: object
+                  additionalProperties: true
+                  description: Redirect-following behaviour.
+                  properties:
+                    redirect:
+                      type: object
+                      additionalProperties: true
+                      properties:
+                        followRedirects:
+                          type: boolean
+                          description: Whether to follow HTTP redirects.
+                        maxRedirects:
+                          type: integer
+                          description: Maximum number of redirects to follow.
+                proxy:
+                  type: object
+                  additionalProperties: true
+                  description: Outbound proxy configuration.
+                  properties:
+                    proxy:
+                      type: object
+                      additionalProperties: true
+                      properties:
+                        protocol:
+                          type: string
+                          enum:
+                            - https
+                            - http
+                          description: Proxy protocol.
+                        host:
+                          type: string
+                          description: Proxy host, without protocol or port.
+                        port:
+                          type: integer
+                          description: Proxy port.
+                socket:
+                  type: object
+                  additionalProperties: true
+                  description: Connection socket options.
+                  properties:
+                    keepAlive:
+                      type: boolean
+                      description: Whether to keep sockets open for reuse.
+                    maxSockets:
+                      type: integer
+                      description: Maximum sockets per host kept open at once.
+                    maxFreeSockets:
+                      type: integer
+                      description: Maximum idle sockets per host kept open.
+    destination.syslog:
+      allOf:
+        - $ref: '#/components/schemas/destination.common'
+        - type: object
+          additionalProperties: true
+          required:
+            - type
+            - host
+          properties:
+            type:
+              type: string
+              enum:
+                - syslog
+              description: Sends each event to a syslog server.
+              example: syslog
+            host:
+              type: string
+              description: Syslog server host.
+              example: syslog.example.com
+            port:
+              type: integer
+              description: Syslog server port.
+              example: 514
+            protocol:
+              type: string
+              enum:
+                - udp
+                - tcp
+                - tls
+              description: Transport protocol.
+              example: udp
+            facility:
+              type: integer
+              minimum: 0
+              maximum: 23
+              description: |
+                Syslog facility code (0–23, per RFC 5424). Common values: 0 Kernel, 1 User, 3 System, 13 Audit, 14 Alert, 16 Local0, 17 Local1, 18 Local2, 19 Local3, 20 Local4, 21 Local5, 22 Local6, 23 Local7.
+              example: 16
+            app_name:
+              type: string
+              description: Application name reported in the syslog message.
+              example: n8n
+            tlsCa:
+              type: string
+              description: PEM-encoded CA certificate used when `protocol` is `tls`.
+    destination.sentry:
+      allOf:
+        - $ref: '#/components/schemas/destination.common'
+        - type: object
+          additionalProperties: true
+          required:
+            - type
+            - dsn
+          properties:
+            type:
+              type: string
+              enum:
+                - sentry
+              description: Sends each event to a Sentry project.
+              example: sentry
+            dsn:
+              type: string
+              format: uri
+              description: Sentry DSN the events are sent to.
+              example: https://examplePublicKey@o0.ingest.sentry.io/0
+    destination:
+      type: object
+      oneOf:
+        - $ref: '#/components/schemas/destination.webhook'
+        - $ref: '#/components/schemas/destination.syslog'
+        - $ref: '#/components/schemas/destination.sentry'
+      description: |
+        A log streaming destination. The `type` field selects the variant and its type-specific fields: `webhook`, `syslog`, or `sentry`.
+    destination.list:
+      type: object
+      additionalProperties: false
+      required:
+        - data
+      properties:
+        data:
+          type: array
+          description: The configured log streaming destinations.
+          items:
+            $ref: '#/components/schemas/destination'
+    test-result:
+      type: object
+      additionalProperties: false
+      required:
+        - success
+      properties:
+        success:
+          type: boolean
+          description: Whether the test message was delivered to the destination successfully.
+          example: true
     error:
       required:
         - message
@@ -5672,6 +6681,8 @@ components:
       description: Conflict
     notFound:
       description: The specified resource was not found.
+    paymentRequired:
+      description: Payment required
     NotFound:
       $ref: '#/components/responses/notFound'
     Unauthorized:
@@ -5682,6 +6693,8 @@ components:
       $ref: '#/components/responses/conflict'
     Forbidden:
       $ref: '#/components/responses/forbidden'
+    PaymentRequired:
+      $ref: '#/components/responses/paymentRequired'
   parameters:
     limit:
       name: limit
@@ -5841,3 +6854,4 @@ components:
       type: http
       scheme: bearer
       bearerFormat: JWT
+x-enable-proxy: false