identity.composition.set-audience

Set which access groups may invoke an exposed composition

Set who can call an exposed composition: All app users | Selected groups | Nobody.

Inputs:

• actor: Cognito sub or user UUID (required)
• organization_uuid: owning organization — tenant check (required)
• identity_app_uuid: the app's identity tenant (required)
• composition_uuid: the exposed composition's lineage uuid (required)
• audience: "all" | "groups" | "none" (required)
• groups: access-group slugs to grant — required and non-empty when audience="groups"

Outputs (terminal state_data):

• composition_uuid, capability, audience, groups (the slugs granted), managed
• reopened: True when this call took the composition from managed → unmanaged (a silent re-open to all end-users); audited as composition.audience.reopened

Overview

Property	Value
Workflow type	Atomic
Library	App-identity
Version	1.0

Input Schema

Field	Type	Required	Default	Description
actor	string	Yes	—	—
organization_uuid	uuid	Yes	—	—
identity_app_uuid	uuid	Yes	—	—
composition_uuid	string	Yes	—	—
audience	string	Yes	—	—
groups	list	No	—	—

Output Schema

Field	Type	Required	Default	Description
composition_uuid	string	No	—	—
capability	string	No	—	—
audience	string	No	—	—
groups	list	No	—	—
managed	boolean	No	—	—
reopened	boolean	No	—	—
identity_app_uuid	uuid	No	—	—
failure_reason	string	No	—	—
failure_type	string	No	—	—
failed_action	string	No	—	—
failed_at_state	string	No	—	—
reason	string	No	—	—

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	execute	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	execute	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "identity.composition.set-audience",
  "initial_data": {
    "actor": "value",
    "organization_uuid": "value",
    "identity_app_uuid": "value",
    "composition_uuid": "value"
  }
}