Publish an onboarding flow

POST/onboarding-flows/{id}/actions/publish

onboarding:write publish_onboarding_flowIdempotent

Moves a draft flow to published and returns it. Publishing a flow that is already published returns it unchanged and emits no event. Respondents can only be put through a published flow, and a published flow cannot be deleted. Emits onboarding_flow.published and sends no email. POST /onboarding-flows/{id}/actions/unpublish undoes it.

Path parameters

idstring (uuid)Required#
The onboarding flow's id, a uuid. An unknown or deleted id returns 404.

Query parameters

dry_runboolean#
Validate and run the call without committing it, returning what the real call would return with meta.dry_run set.

Headers

Idempotency-Keystring#
Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.

Responses

200

The onboarding flow, now published.

OnboardingFlow

{
  "data": {
    "id": "48e0c1a6-6f3b-4d44-9d49-0a5a0b8f2d11",
    "name": "Investor suitability",
    "status": "published",
    "expiry_type": "twelve_month",
    "mode_type": "continuous",
    "user_types": [
      "investor"
    ],
    "routes": [
      {
        "from_form_id": "0b6c7c0e-1f0a-4b6c-8d0e-5f0f4a7a3c21",
        "to_form_id": "6d8f3a52-9a41-4d6c-b7a1-2c9e5d1b7f33",
        "condition_sets": [
          {
            "condition_type": "AND",
            "condition_value": null,
            "conditions": [
              {
                "form_field_id": "2f1d9a77-3c1e-4e85-a0b3-7d6c4e8b9a55",
                "operator": "=",
                "value": "yes"
              }
            ],
            "custom_conditions": []
          },
          {
            "condition_type": "OTHER",
            "condition_value": null,
            "conditions": [],
            "custom_conditions": []
          }
        ]
      }
    ],
    "definition": null,
    "form_count": 2,
    "start_form_id": "0b6c7c0e-1f0a-4b6c-8d0e-5f0f4a7a3c21",
    "created_at": "2026-11-08T10:30:00Z",
    "updated_at": "2026-11-08T10:30:00Z"
  }
}

401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error

403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error

404

Resource not found (error.code = not_found).

Error

409

The request conflicts with existing state (error.code = conflict), e.g. a compliance flow with the requested name already exists.

Error

422

The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per problem, or a code documented on the operation.

Error

429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/onboarding-flows/{id}/actions/publish\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"