> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Partners in Flowker > Confine a partner's Flowker credential to the workflows you choose, tell it how to name those workflows, and read the refusals it receives. A [partner](https://docs.lerian.studio/en/platform/access-manager/features/partners/overview) can call Flowker with its own credential. In Flowker, you confine that credential to some workflows. This page shows how to choose that scope, what it reaches, and what the partner receives when it goes outside it. Every Flowker partner needs a scope. ## Step by step *** **1. Choose the partner's workflows** Flowker has one restriction. The **API field** is the `field` of a scope entry; the Console shows the name in the first column. | Restriction | API field | What the partner reaches | What is refused | | - | - | - | - | | **Workflow** (one or more values) | `workflowId` | The listed workflows: reading, changing, cloning, activating, deactivating, moving them back to draft, deleting them, reading and operating their schedule, executing them, and reading their executions and results. All within what its permissions give. | The other workflows, listing or creating workflows, reading an execution through a route that does not name the workflow, and the catalog, executors, provider configurations, dashboards, schemas, and webhooks. | The scope catalog lists the Flowker restriction. Read it with [Retrieve a product's scope catalog](https://docs.lerian.studio/en/reference/platform/access-manager/retrieve-a-product-s-scope-catalog.md) for `flowker`. Some rules apply to every scope: * A request that does not name a workflow is refused. For example, a partner cannot list executions without filtering by its workflow. * A request that lists several workflows in a query is refused when any of them is outside the scope. **2. Give the partner its permissions and scope** Create the partner, or change it, in the [Console](https://docs.lerian.studio/en/platform/access-manager/features/partners/console.md) or with the [Identity API](https://docs.lerian.studio/en/platform/access-manager/features/partners/api.md). The product slug is `flowker`. * Add the `workflowId` scope entry, with one or more workflows. Without it, Access Manager refuses the partner with `400` and `IDE-1060`. * Check the resources and actions. The most you can give is what the `flowker-editor-role` role holds in your tenant. Above that, Access Manager refuses with `IDE-1043`. For example, `catalog` with `create` is above that role. A partner receives only the permissions that act on a workflow: | Resource | Actions | | - | - | | `workflows` | `read`, `update`, `clone`, `activate`, `deactivate`, `draft`, `delete` | | `executions` | `read`, `list`, `create` | Every other Flowker permission acts on the whole tenant, and is never given to a partner, not even the read ones, such as `workflows` with `list` or `executors` with `read`. Access Manager refuses with `400` and `IDE-1056`. **3. Create its Flowker application** Create the partner's application with the product `flowker`. See [Create the partner's applications](https://docs.lerian.studio/en/platform/access-manager/features/partners/api.md#create-the-partners-applications) in the API guide, or [in the Console](https://docs.lerian.studio/en/platform/access-manager/features/partners/console.md#create-the-partners-applications). Send the client ID and the client secret to the partner through a secure channel. **4. Tell the partner how to name its workflows** In almost every route the partner reaches, the workflow is already in the path, in `/v1/workflows/{workflowId}`, so the partner sends nothing extra. Only the execution list names the workflow in a query. Every value must be inside the partner's scope. | Routes | Writes | Reads and routes by ID | | - | - | - | | Workflows: `/v1/workflows/{workflowId}`, `…/clone`, `…/activate`, `…/deactivate`, `…/draft` | Path `workflowId` to change, delete, clone, activate, deactivate, or move back to draft | Path `workflowId` | | Schedule: `/v1/workflows/{workflowId}/schedule/…` | Path `workflowId` to discard the missed occurrences (`missed/discard-all`), and `workflowId` with `occurrenceId` to run or discard one (`missed/{occurrenceId}/run`, `missed/{occurrenceId}/discard`) | Path `workflowId` for `upcoming`, `missed`, and `skipped` | | Executions of a workflow: `/v1/workflows/{workflowId}/executions`, `…/executions/{executionId}`, `…/executions/{executionId}/results` | Path `workflowId` to execute, with the `Idempotency-Key` header | Path `workflowId` and `executionId`, for the status and the result of an execution | | Execution list: `GET /v1/executions` | None: the route only reads | Query `workflowId`, required for the partner. The answer holds only that workflow's executions | > [!WARNING] > > To read an execution, use the routes under the workflow: `/v1/workflows/{workflowId}/executions/{executionId}` and `…/results`. The routes `/v1/executions/{id}` and `/v1/executions/{id}/results` do not name the workflow, and are refused to every partner. An execution of another workflow, asked for under the path of one of the partner's workflows, answers `404` with `FLK-0500`. Nothing is read, and the answer does not say which workflow the execution belongs to. An `Idempotency-Key` already used to execute another workflow answers `409` with `FLK-0511`. Nothing is executed, and the answer carries nothing of the other execution. A new key executes the workflow, and the same key repeated on the same workflow returns the same execution. These routes do not name a workflow, and are refused to every partner: listing and creating workflows (`GET /v1/workflows`, `POST /v1/workflows`, `POST /v1/workflows/from-template`), `GET /v1/workflows/schedule/pending-review-counts`, `POST /v1/workflows/preview-request`, and the routes of the catalog, executors, provider configurations, dashboards, schemas, and webhooks. Use an application of your own institution for those routes. **5. Confirm that it works** This check assumes the partner has the `workflows` resource with the `read` action on Flowker, and a scope restricted to one or more workflows. Use the partner's credential. Read a workflow inside its scope. The answer is `200`: ```bash theme={null} FLOWKER_BASE_URL="https://your-flowker-host" # your Flowker base URL FLOWKER_BEARER_TOKEN="paste-the-partner-access-token-here" WORKFLOW_ID="paste-a-workflow-id-in-the-scope-here" curl -s -o /dev/null -w '%{http_code}\n' \ -H "Authorization: Bearer ${FLOWKER_BEARER_TOKEN}" \ "${FLOWKER_BASE_URL}/v1/workflows/${WORKFLOW_ID}" ``` Send the same request with a workflow outside the scope. The answer is `403` with code `FLK-0004`. ## If something fails *** | Code | Status | What it means | What to do | | - | - | - | - | | `FLK-0004` | 403 | The request is outside the partner's permissions or outside its scope, or it does not name the workflow. | Check that the request names a workflow in the partner's scope, in the path or in the `workflowId` query. Check also that the partner has the permission for that route. | | `FLK-0500` | 404 | The execution does not exist under the workflow the request names. | Check the execution ID and the workflow in the path. | | `FLK-0511` | 409 | The `Idempotency-Key` was already used to execute another workflow. | Send a new key. | | `FLK-0003` | 401 | The partner is suspended, or the request carries no valid token. | Reactivate the partner, or send a new token. | The answer does not say whether the permissions or the scope refused the request. This is on purpose: a partner cannot use a refusal to learn which workflows exist outside its scope. For every other code, see the [Flowker error list](https://docs.lerian.studio/en/reference/products/flowker/flowker-error-list.md). For the refusals when you create or change a partner, see [Error codes](https://docs.lerian.studio/en/platform/access-manager/features/partners/api.md#error-codes) in the API guide. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.