Alteryx Gallery API running as an account

[michael_renwick]

In the Alteryx Gallery UI, it's possible to set up workflow credentials so that a workflow published to the gallery runs as a specific user.  

Unfortunately when that workflow is run from the Alteryx Gallery API, it appears to only ever run as the Alteryx Server Run-As account. 

Our developers in working with this figured out that if they called the (undocumented) API that runs the actual Alteryx Gallery directly, they can achieve what they want, but it seems a risky strategy.

The idea would be:

-Either unify the APIs so that the Gallery itself uses the same API to run workflows as what you present as the "Gallery API" (the eat your own dogfood way)

-Alter the Gallery API to enable us to run as a different workflow credential

Without this, we're forced to permission the run-as account to access anything that uses this method, which in turn then becomes a bit of a security hole (any workflow run will have access to everything that the run-as account uses) 

[cam_w]

Thanks @KylieF and product team! I look forward to checking this out when we upgrade to 2020.2!

[Anuj]

@KylieF is there any documentation on this feature, was going through the release notes didnt find anything. maybe i missed it . 

[KylieF]

Hi @Anuj,

Our What's New in 2020.2 Server documentation touches on this new feature, however I would recommend checking out the full API documentation that's built into our server product at the following URL: http(s)://YourServerName/gallery/api-docs 

[garfieldlau]

Current REST API cannot use individual credential to run the workflow in Studio. All REST API are running with use: SYSTEM instead.

Can we allow to run workflow with individual credential.

[CiaranA]

We also have this requirement as we opt to use the Gallery with default credentials option, where each studio has unique credentials running all workflows per studio. 

[KevinP]

@garfieldlau  and @CiaranA  This functionality was added to Server with version 2020.2. You will need to be on this version or a newer version of Server to access this functionality. To enable this functionality Server has added two new endpoints to the User v2 API. To use this API each user you want to allow access will need to have their permission toggle set to allow API Access. This will allow the user to access a user level API key instead of just a studio/subscription level key. User level keys replace the former admin key and can be used to access both the admin and user API. These user keys have also been allowed access to the older subscription/studio API.

Once you have access to a user API key there are two new User v2 endpoints of interest. The first is a GET request to /user/v2/credentials. This endpoint will return Workflow Credentials shared with the user including an unique ID. The ID is needed as part of the payload when triggering the job via the API. The second endpoint is a POST request to /user/v2/workflows/{appId}/jobs/. This request provides identical functionality to it's Subscription API counterpart, but extends that functionality to allow providing an optional credentialId. If the credentialId is provide the job will be executed with the provided credential. If the credentialId isn't provide the workflow will run with the default system account or Run As user depending on your Server configuration.

For more details please ensure your Server is on a version that contains this functionality and reference your local API Documentation typically available at http(s)://YourServerName/gallery/api-docs. 

[CiaranA]

@KevinP Interesting - I must have missed this as we haven't fully tested out 2020.2 Thanks for confirming. We look forward to trying this out. 

Ciaran

[Anuj]

hi @KevinP @KylieF , the documentation you have on the server is quite limited either on the release versions(https://help.alteryx.com/release-notes/server/server-20202-release-notes) 

or on my 2020.2 version

Kevin's explanation gives me much better idea on how to get the credential id and use it in the  /user/v2/workflows/{appId}/jobs/. 

I dont see any documentation on the /user/v2/workflows/{appId}/jobs/. on my server , can you let me know what would the payload look like , i figure i am passing the credential id but what would be the name of the attribute whose value is the Credentialid. 

Anuj 

[santhoshvijay]

Hi All, @KevinP and Anuj,

I am trying to trigger/start a Alteryx Job via API (POST) Call (/v2/workflows/{appId}/jobs/) and we got a response of "200 OK" along with valid "Job ID" and "Status" as Queued. But we don't see the Job actually kicking-off on the Alteryx Gallery.

To Mitigate the above issue, I went through the steps described by @KevinP (https://community.alteryx.com/t5/Alteryx-Server-Ideas/Alteryx-Gallery-API-running-as-an-account/idc-...)
and performed the following,

1. I have Curator Access. I enabled "API Access" flag on my profile settings
2. I used the "API Access" keys instead of the "Private Studio API" keys on my Keys section
3. As described on the thread, I triggered the GET Request to "/user/v2/credentials/" to retrieve Credentials which I can then pass to run the Job, But I get a 200 Response from server with blank response body "[]"

I am not sure how to retrieve credentials for my API Keys in order to trigger the Job via POST API call. I would really appreciate any guidance / help in this regard. Thanks.

[brianturner]

@santhoshvijay  At least in V1, this is by design.  Workflows run through the APi do not show up in the Gallery.  Instead keep monitoring the job via the above API, it should come back with Complete when done, but also check the disposition (ex: Success ).