On this page0
Unfamiliar word? See Glossary: words used in these docs. Looking for the tasks in order? Begin at Start Here.
Reference
Included in: All plans. Which Plan Includes What
Visual Workflow Builder
Lay out your onboarding and offboarding pipelines as an ordered list of steps, then put them live behind an approval.
The Builder At A Glance
An Ordered Pipeline
A pipeline is a straight sequence of steps, top to bottom. Add a step from the palette, drag it by its handle to reorder, or insert one between two existing steps. The steps are connected in order for you — there are no connectors to draw and no branches. The step order, the required step settings and, on an onboarding pipeline, a manager for any Manager Approval are checked when you send it for approval, and the whole pipeline is checked again before it is approved.
- Validated before approval
- Each step added once, except IT Task
- Versioned with an approval gate
- Audit log integration
What It Does
The builder designs two kinds of pipeline: onboarding (joiner) and offboarding (leaver). It is not a general-purpose process designer. Every pipeline starts with the HR trigger — the intake form a person fills in to start a run — followed by the steps you choose from a fixed palette: IT Setup, Manager Approval, a dated IT Task, Create Zonitix Account, Assign Hardware or Hardware Recovery, Assign Persona, and adding to or removing from a directory group. Account and app steps for each person are not drawn here; they are generated per run from that person’s persona.
The palette on the left has a search box (Search steps and apps) and two shelves. Steps holds the step types; the main ones are in the table below. Fixed apps lists your connected systems: adding one gives that app to everyone who runs the pipeline, whatever their persona, so the builder asks you to confirm first. If the person’s persona also lists the app, the run can try to set it up twice and stall, so in most cases leave apps to the persona. The information icon beside the tabs opens a short guide to how onboarding or offboarding is usually laid out, and the third tab, Runs, lists the runs.
| Step | What it does | Offered on |
|---|---|---|
| HR Trigger | Starts the run. Always first. | Both |
| IT Setup | IT reviews the run. | Both |
| Manager Approval | Routed to the person’s own manager. | Both |
| Create Zonitix Account | A Zonitix sign-in and an emailed invite. | Onboarding |
| Assign Hardware | Assigns a device from inventory. | Onboarding |
| Hardware Recovery | IT confirms each assigned device was collected. | Offboarding |
| Assign Persona | Sets the role’s app bundle. | Onboarding |
| Add to Directory Group | Adds the person to a Microsoft Entra ID, Okta, Google Workspace or AWS IAM group. | Onboarding |
| Remove from Directory Group | Removes the person from a Microsoft Entra ID, Okta, Google Workspace or AWS IAM group. | Offboarding |
| IT Task (dated) | A task due relative to the start date. The only step you can add more than once. | Both |
No Code To Write
Checked Before It Goes Live
Draft It From A Description
More Than One Pipeline
On Capacity And Automation
Workflows execute on your dedicated instance, which is a fixed-size VPS — it does not scale itself up under load. If your automation volume outgrows your instance size, we resize it for you (see How We Size Your Instance on How We Provision Your Instance). How much runs unattended is set per pipeline under Manage → Automation. A new instance ships Master Onboarding as Accounts automatic (account steps run on their own once the human approvals are done) and Master Offboarding as Runs manually (each revoke step waits for an administrator to run it).
What Validation Checks
When you choose Submit for approval, the builder checks four things and refuses to send the pipeline until they are fixed: the HR trigger is the first step, there is at least one step after it, an onboarding pipeline with a Manager Approval collects the hire’s manager at the HR trigger (an offboarding pipeline has no Manager field and uses the leaver’s manager on record), and the required step settings are filled in. Saving a draft skips these checks. The fuller check below — which adds connections, reachability and step types — runs when the pipeline is approved, and in the dry run over the API. It reports errors (which block approval) and warnings (which do not):
- There is an HR trigger, and at least one step after it.
- Every step after the trigger has an incoming connection, so nothing is unreachable.
- Each step has a recognised type; an unknown type is rejected.
- A step that drives an external system has an active connection under Identity Hooks; without one, approval is refused. If the connection is active but has never passed validation, you get a warning asking you to run Validate on it — approval is not blocked.
- Required step settings are filled in.
There is no conditional or branching step, so a pipeline cannot route differently based on data: a run moves forward one step at a time, and a rejection stops it.
If something here is not working as you expect, start with When something goes wrong.
The plain explanation is above. This part is for IT and developers: the exact settings, permission names, API addresses and data fields behind it. Closed: select the heading above to open it. While it is closed, your browser’s find-on-page (Ctrl+F or Cmd+F) does not search this part.
How A Pipeline Is Stored
A pipeline is stored as a list of step nodes plus the edges that chain them in order, and is run by the workflow service (`workflow-service`). Each node carries its step type in data.type; the first node is the HR trigger:
// The shipped Master Onboarding pipeline (abridged):
{
"nodes": [
{ "id": "node-onb-hr", "type": "custom", "data": { "type": "HR", "label": "HR Trigger", "isTrigger": true } },
{ "id": "node-onb-it", "type": "custom", "data": { "type": "IT", "label": "IT Setup" } },
{ "id": "node-onb-mgr", "type": "custom", "data": { "type": "Manager", "label": "Manager Approval" } }
],
"edges": [
{ "id": "edge-onb-1", "source": "node-onb-hr", "target": "node-onb-it" },
{ "id": "edge-onb-2", "source": "node-onb-it", "target": "node-onb-mgr" }
]
}
The value of data.type for each step in the palette, and the provider a step is stored with where it has one:
| Step | data.type | Stored with provider |
|---|---|---|
| HR Trigger | HR | — |
| IT Setup | IT | — |
| Manager Approval | Manager | — |
| Create Zonitix Account | AddUser | local |
| Assign Hardware | OnboardDevice | DEVICE |
| Hardware Recovery | DeleteDevice | DEVICE |
| Assign Persona | AssignPersona | — |
| Add to Directory Group | AddToGroup | — |
| Remove from Directory Group | RemoveFromGroup | — |
| IT Task (dated) | ITTask | — |
API-Only Today: Dry Run, Export And Import
Three operations have no button in the builder and are reached over the API. All three need manage_workflows; import also asks you to confirm your identity again. Request and response details are in the API Reference.
// Validate a pipeline without running anything:
POST /api/v1/user-management/workflows/:id/dry-run
// Download a pipeline definition, or load one:
GET /api/v1/user-management/workflows/:id/export
POST /api/v1/user-management/workflows/import
Retiring A Pipeline
Manage → Retire pipeline switches off every version of that pipeline, so it is no longer offered when a run is started; runs already under way continue. The server refuses with 400 if the pipeline is the default for its type (make another one the default first) or if it is the only approved, active pipeline of its type.