Service users for workflows
Workflows triggered by a schedule, a webhook, or a query, can now run as a service user. Service users for workflows are available on Business and Enterprise plans. Previously these runs defaulted to running as the first admin in your organization.
Select a permission group in the Triggers panel of the workflow IDE. Retool creates a service user for the group, and triggered workflows run as that service user. Only members of the group and admins can edit workflows running as a service user, and run logs are limited to people in the service user group.
Key features of this release include:
- Service users allow workflows run against resources with data access enforcement turned on. Scheduled and webhook-triggered workflows no longer need a separate unenforced resource. Grant the service user group access in your access policies.
- Service users do not count toward your user seats.
- Audit logs record actions that a service user performs under the existing event types, with the service user's ID as the actor.
- Source control includes a workflow's run identity in its YAML file. On deploy, Retool matches the service user by ID, then by group name.
If an admin deletes a service user group, workflows set to run as that group will fail until you choose a new group.
To get started, refer to Run a workflow as a service user. For details on how run identities work, refer to Service users for workflows.