List library playbooks

GET

/playbooks

GET

/playbooks

1 curl https:/https://api/playbooks \
2      -H "Authorization: Bearer <token>" \
3      -H "Content-Type: application/json"

1 {
2   "playbooks": [
3     {
4       "_id": "63f9a2b4e4b0c72a1d8f9e3c",
5       "scope": "library",
6       "templateId": "tpl_9f8e7d6c5b4a3210",
7       "projectId": null,
8       "sourceDefinitionId": "def_123abc456def7890",
9       "sourceVersion": 2.3,
10       "slug": "incident-response-basic",
11       "name": "Incident Response Basic",
12       "description": "A foundational playbook for handling security incidents with step-by-step guidance.",
13       "icon": "🛡️",
14       "color": "#007ACC",
15       "status": "draft",
16       "numbering": {
17         "steps": "1.0",
18         "substeps": "1.1"
19       },
20       "startableByUsers": true,
21       "webhookEnabled": true,
22       "webhookSecret": "whsec_4f3e2d1c",
23       "orchestrator": {
24         "type": "sequential",
25         "retryPolicy": "exponentialBackoff"
26       },
27       "startForm": {
28         "title": "Incident Details",
29         "fields": [
30           {
31             "name": "incident_type",
32             "type": "dropdown",
33             "options": [
34               "phishing",
35               "malware",
36               "data_breach"
37             ]
38           }
39         ]
40       },
41       "tasks": [
42         {
43           "task1": {
44             "name": "Identify Incident",
45             "type": "manual"
46           }
47         }
48       ],
49       "dependencies": [
50         {
51           "dependency1": {
52             "type": "external_service",
53             "name": "SIEM Integration"
54           }
55         }
56       ],
57       "version": 1.1,
58       "archivedAt": null,
59       "briefId": null,
60       "createdAt": "2024-05-10T09:15:00Z",
61       "updatedAt": "2024-06-01T16:45:00Z",
62       "createdBy": "user_7a8b9c0d"
63     }
64   ]
65 }

Lists the organization’s library-scope playbooks, most recently updated first. Optionally filter by status.

Authentication

AuthorizationBearer

WorkOS session JWT or an organization API key, sent as Authorization: Bearer <token>.

Query parameters

statusenumOptional

Filter to a single playbook status.

Allowed values:

Response

The library playbooks.

playbookslist of objects

Errors

401

Unauthorized Error

403

Forbidden Error