Skip to main content

No-Code Workflow Certification

Certification is Pavri's automated approval system for no-code workflows. Before a workflow is allowed to run in production, it must pass four checks: policy assigned, proxy enabled, risk below threshold, connectors classified. If any check fails, certification is blocked. If a certified workflow drifts from its baseline (new connector, changed permission, etc.), certification is automatically revoked.

The Four Checks​

CheckDescription
policy_assignedThe workflow has at least one active Pavri policy assigned
proxy_enabledThe workflow routes outbound HTTP calls through the Pavri proxy
risk_below_thresholdThe workflow's composite risk score is below your tenant threshold (default 60)
connectors_classifiedEvery connector/step in the workflow has been classified (risk level, data classes, domains contacted)

Certifying a Workflow​

From the dashboard:

  1. Go to Agents and open the workflow's detail page
  2. Click Certify
  3. Pavri runs all four checks
  4. If all pass → workflow is marked CERTIFIED with a timestamp and operator ID
  5. If any fail → certification is blocked; you see which checks failed and what to fix

Certification Drift​

Every time the discovery worker polls and observes a workflow, it compares the current fingerprint against the certified baseline:

  • New connector added → severity critical → certification auto-revoked
  • Permission escalated → severity critical → certification auto-revoked
  • Configuration changed (step count, step sequence) → severity warning → flagged but not revoked
  • Minor metadata change → severity info → logged only

When a certification is revoked, Pavri emits a ThreatDetectionEvent with threat_type: "certification_drift", which flows through your alert rules.

Bulk Certification​

For platforms where you onboard many workflows at once, use bulk certification:

POST /v1/store/certifications/bulk
X-Api-Key: <tenant-api-key>

{
  "org_id": "<org-id>",
  "workflow_ids": ["wf-1", "wf-2", "wf-3"],
  "platform": "make",
  "certified_by": "security-admin@company.com"
}

Response returns a record per workflow with its individual certification status.

Revoking Certification​

Manually revoke a certification via the API:

POST /v1/store/certifications/{cert_id}/revoke
Content-Type: application/json

{ "revoked_by": "security-admin@company.com", "reason": "failed quarterly review" }

Compliance Evidence​

The certification table is append-only and audit-retained. It is your compliance evidence for answering: "Which workflows are approved for production, and who approved them, and when?"

Export the full certification history for your compliance team:

GET /v1/store/certifications?org_id=<org-id>

See Also​