Import and export workflows

Workflows can be exported as portable JSON files and imported into another open·kritt installation. The file contains the workflow name, description, depths, prompts, execution flags, and output formats. It does not contain database IDs, scan history, findings, or timestamps.

Export a workflow

On the Workflows page, select Export on a workflow card. You can also open the workflow and select Export JSON. The downloaded file uses the versioned open-kritt-workflow format.

Import a workflow

Select Import JSON on the Workflows page, or choose Import JSON file from the new-workflow dialog. After you choose a file, open·kritt validates it with the same rules as the workflow builder and creates a new workflow. The imported workflow opens when the import completes.

The importer accepts both versioned workflow files and bare workflow JSON containing either levels or the flat steps returned by the workflow API. Files must be 2 MB or smaller.

Warning

Review imported prompts before running them. A workflow controls what repository and scan context an agent sends to the configured model provider.

Portable format

{
  "kind": "open-kritt-workflow",
  "version": 1,
  "workflow": {
    "name": "example-workflow",
    "description": "A reusable analysis workflow.",
    "levels": [
      {
        "depth": 0,
        "multiOutput": true,
        "consumesAll": false,
        "outputFormat": {
          "explanation": "string",
          "file_path": "string",
          "line": "number",
          "malicious_input_example": "string",
          "summary": "string",
          "trigger_flow": "array",
          "vulnerability_type": "string",
          "malicious_actor": "string"
        },
        "steps": [
          {
            "name": "Analyze vulnerabilities",
            "content": "Analyze {{repo_full}} for concrete vulnerabilities."
          }
        ]
      }
    ]
  }
}

The deepest level must still provide the required terminal finding fields described in What are steps?. Server-side validation rejects unsupported schemas, missing depths, invalid prompt references, and incomplete terminal output formats.