Update a workflow a workspace manages

PATCH/workspaces/{workspace}/actions/managed-workflows/{workflow}

Giving source, or refresh: true, copies the source again at the commit its ref names now. Owners only. Returns the workflow.

refresh copies the source again at the commit its ref names now. Fields left out stay as they are.

• Authentication: Required. Send an access token as Authorization: Bearer.
• MCP tool: workflow with action update_managed_workflow, and the same inputs
• Scope: An access token needs workspace:admin.

Path parameters

Name	Type	Required	Description
workspace	string	Yes	The workspace’s name, e.g. “acme”.
workflow	string	Yes	The managed workflow’s name, as in managed/<name>.yml.

Body parameters

Send a JSON object. Names are snake_case, as in responses; the camelCase spelling is accepted too.

Name	Type	Required	Description
source	string	No	A workflow file in one of the workspace’s repositories: owner/repo/.g1t/workflows/file.yml@ref.
mode	string	No	required: a repository cannot take its place or turn it off. default: a repository’s workflow of the same name takes its place. One of required, default.
repositories	array of strings	No	Repository names and patterns (* matches any characters, ! excludes); empty is every repository.
visibility	string	No	Which repositories, by visibility. A private source needs private. One of all, public, private.
refresh	boolean	No	Copy the source again, at the commit its ref names now.

Example request

curl -X PATCH https://api.g1t.sh/workspaces/flagon-io/actions/managed-workflows/security-scan \
  -H "Authorization: Bearer $G1T_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "refresh": true
  }'

Example response

A successful request answers 200 with:

{
  "name": "security-scan",
  "path": "managed/security-scan.yml",
  "workflow_name": "Security scan",
  "source": "flagon-io/policies/.g1t/workflows/security-scan.yml@main",
  "source_sha": "4f1c2a9e0b7d3c5a8e6f1b2d4c7a9e0f3b5d8c1a",
  "source_private": false,
  "mode": "required",
  "repositories": [
    "*",
    "!sandbox-*"
  ],
  "visibility": "all",
  "content": "name: Security scan\non: [push, pull_request]\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - run: ./scripts/scan.sh\n",
  "created_at": "2026-10-12T09:30:00Z",
  "updated_at": "2026-10-12T09:30:00Z",
  "updated_by": "ada"
}

Errors

A failed request answers with one of these statuses and a body like {"error": {"code": "not_found", "message": "Repository not found."}}. See errors.

Status	Code	When
401	unauthenticated	A token is required, or the one sent is not valid.
403	forbidden	The token is valid but not allowed to do this, such as a member-only change or an agent token outside its repository.
404	not_found	It does not exist, or you cannot see it.
409	conflict	The request conflicts with the current state.
422	invalid	The input is not valid. message says which field and why.