chore: import upstream snapshot with attribution

apps/sim/app/api/v1/admin/workflows/[id]/deploy/route.ts

@@ -0,0 +1,122 @@
+import { createLogger } from '@sim/logger'
+import { getActiveWorkflowRecord } from '@sim/platform-authz/workflow'
+import {
+  adminV1DeployWorkflowContract,
+  adminV1UndeployWorkflowContract,
+} from '@/lib/api/contracts/v1/admin'
+import { parseRequest } from '@/lib/api/server'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { performFullDeploy, performFullUndeploy } from '@/lib/workflows/orchestration'
+import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
+import {
+  badRequestResponse,
+  internalErrorResponse,
+  notFoundResponse,
+  singleResponse,
+} from '@/app/api/v1/admin/responses'
+import type { AdminDeployResult, AdminUndeployResult } from '@/app/api/v1/admin/types'
+
+const logger = createLogger('AdminWorkflowDeployAPI')
+export const maxDuration = 120
+
+interface RouteParams {
+  id: string
+}
+
+/**
+ * POST — Deploy a workflow via admin API.
+ *
+ * `userId` is set to the workflow owner so that webhook credential resolution
+ * (OAuth token lookups for providers like Airtable, Attio, etc.) uses a real
+ * user. `actorId` is set to `'admin-api'` so that the `deployedBy` field on
+ * the deployment version and audit log entries are correctly attributed to an
+ * admin action rather than the workflow owner.
+ */
+export const POST = withRouteHandler(
+  withAdminAuthParams<RouteParams>(async (request, context) => {
+    const parsed = await parseRequest(adminV1DeployWorkflowContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { id: workflowId } = parsed.data.params
+    const requestId = generateRequestId()
+
+    try {
+      const workflowRecord = await getActiveWorkflowRecord(workflowId)
+
+      if (!workflowRecord) {
+        return notFoundResponse('Workflow')
+      }
+
+      const result = await performFullDeploy({
+        workflowId,
+        userId: workflowRecord.userId,
+        workflowName: workflowRecord.name,
+        requestId,
+        request,
+        actorId: 'admin-api',
+      })
+
+      if (!result.success) {
+        if (result.errorCode === 'not_found') return notFoundResponse('Workflow state')
+        if (result.errorCode === 'validation') return badRequestResponse(result.error!)
+        return internalErrorResponse(result.error || 'Failed to deploy workflow')
+      }
+
+      logger.info(`[${requestId}] Admin API: Deployed workflow ${workflowId} as v${result.version}`)
+
+      const response: AdminDeployResult = {
+        isDeployed: true,
+        version: result.version!,
+        deployedAt: result.deployedAt!.toISOString(),
+        warnings: result.warnings,
+      }
+
+      return singleResponse(response)
+    } catch (error) {
+      logger.error(`Admin API: Failed to deploy workflow ${workflowId}`, { error })
+      return internalErrorResponse('Failed to deploy workflow')
+    }
+  })
+)
+
+export const DELETE = withRouteHandler(
+  withAdminAuthParams<RouteParams>(async (request, context) => {
+    const parsed = await parseRequest(adminV1UndeployWorkflowContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { id: workflowId } = parsed.data.params
+    const requestId = generateRequestId()
+
+    try {
+      const workflowRecord = await getActiveWorkflowRecord(workflowId)
+
+      if (!workflowRecord) {
+        return notFoundResponse('Workflow')
+      }
+
+      const result = await performFullUndeploy({
+        workflowId,
+        userId: workflowRecord.userId,
+        requestId,
+        actorId: 'admin-api',
+      })
+
+      if (!result.success) {
+        return internalErrorResponse(result.error || 'Failed to undeploy workflow')
+      }
+
+      logger.info(`Admin API: Undeployed workflow ${workflowId}`)
+
+      const response: AdminUndeployResult = {
+        isDeployed: false,
+        warnings: result.warnings,
+      }
+
+      return singleResponse(response)
+    } catch (error) {
+      logger.error(`Admin API: Failed to undeploy workflow ${workflowId}`, { error })
+      return internalErrorResponse('Failed to undeploy workflow')
+    }
+  })
+)

apps/sim/app/api/v1/admin/workflows/[id]/export/route.ts

@@ -0,0 +1,95 @@
+/**
+ * GET /api/v1/admin/workflows/[id]/export
+ *
+ * Export a single workflow as JSON (raw, unsanitized for admin backup/restore).
+ *
+ * Response: AdminSingleResponse<WorkflowExportPayload>
+ */
+
+import { db } from '@sim/db'
+import { workflow } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { eq } from 'drizzle-orm'
+import { adminV1ExportWorkflowContract } from '@/lib/api/contracts/v1/admin'
+import { parseRequest } from '@/lib/api/server'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { loadWorkflowFromNormalizedTables } from '@/lib/workflows/persistence/utils'
+import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
+import {
+  internalErrorResponse,
+  notFoundResponse,
+  singleResponse,
+} from '@/app/api/v1/admin/responses'
+import {
+  parseWorkflowVariables,
+  type WorkflowExportPayload,
+  type WorkflowExportState,
+} from '@/app/api/v1/admin/types'
+
+const logger = createLogger('AdminWorkflowExportAPI')
+
+interface RouteParams {
+  id: string
+}
+
+export const GET = withRouteHandler(
+  withAdminAuthParams<RouteParams>(async (request, context) => {
+    const parsed = await parseRequest(adminV1ExportWorkflowContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { id: workflowId } = parsed.data.params
+
+    try {
+      const [workflowData] = await db
+        .select()
+        .from(workflow)
+        .where(eq(workflow.id, workflowId))
+        .limit(1)
+
+      if (!workflowData) {
+        return notFoundResponse('Workflow')
+      }
+
+      const normalizedData = await loadWorkflowFromNormalizedTables(workflowId)
+
+      if (!normalizedData) {
+        return notFoundResponse('Workflow state')
+      }
+
+      const variables = parseWorkflowVariables(workflowData.variables)
+
+      const state: WorkflowExportState = {
+        blocks: normalizedData.blocks,
+        edges: normalizedData.edges,
+        loops: normalizedData.loops,
+        parallels: normalizedData.parallels,
+        metadata: {
+          name: workflowData.name,
+          description: workflowData.description ?? undefined,
+          exportedAt: new Date().toISOString(),
+        },
+        variables,
+      }
+
+      const exportPayload: WorkflowExportPayload = {
+        version: '1.0',
+        exportedAt: new Date().toISOString(),
+        workflow: {
+          id: workflowData.id,
+          name: workflowData.name,
+          description: workflowData.description,
+          workspaceId: workflowData.workspaceId,
+          folderId: workflowData.folderId,
+        },
+        state,
+      }
+
+      logger.info(`Admin API: Exported workflow ${workflowId}`)
+
+      return singleResponse(exportPayload)
+    } catch (error) {
+      logger.error('Admin API: Failed to export workflow', { error, workflowId })
+      return internalErrorResponse('Failed to export workflow')
+    }
+  })
+)

apps/sim/app/api/v1/admin/workflows/[id]/route.ts

@@ -0,0 +1,117 @@
+/**
+ * GET /api/v1/admin/workflows/[id]
+ *
+ * Get workflow details including block and edge counts.
+ *
+ * Response: AdminSingleResponse<AdminWorkflowDetail>
+ *
+ * DELETE /api/v1/admin/workflows/[id]
+ *
+ * Delete a workflow and all its associated data.
+ *
+ * Response: { success: true, workflowId: string }
+ */
+
+import { db } from '@sim/db'
+import { workflowBlocks, workflowEdges } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { getActiveWorkflowRecord } from '@sim/platform-authz/workflow'
+import { count, eq } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import {
+  adminV1DeleteWorkflowContract,
+  adminV1GetWorkflowContract,
+} from '@/lib/api/contracts/v1/admin'
+import { parseRequest } from '@/lib/api/server'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { performDeleteWorkflow } from '@/lib/workflows/orchestration'
+import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
+import {
+  internalErrorResponse,
+  notFoundResponse,
+  singleResponse,
+} from '@/app/api/v1/admin/responses'
+import { type AdminWorkflowDetail, toAdminWorkflow } from '@/app/api/v1/admin/types'
+
+const logger = createLogger('AdminWorkflowDetailAPI')
+
+interface RouteParams {
+  id: string
+}
+
+export const GET = withRouteHandler(
+  withAdminAuthParams<RouteParams>(async (request, context) => {
+    const parsed = await parseRequest(adminV1GetWorkflowContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { id: workflowId } = parsed.data.params
+
+    try {
+      const workflowData = await getActiveWorkflowRecord(workflowId)
+
+      if (!workflowData) {
+        return notFoundResponse('Workflow')
+      }
+
+      const [blockCountResult, edgeCountResult] = await Promise.all([
+        db
+          .select({ count: count() })
+          .from(workflowBlocks)
+          .where(eq(workflowBlocks.workflowId, workflowId)),
+        db
+          .select({ count: count() })
+          .from(workflowEdges)
+          .where(eq(workflowEdges.workflowId, workflowId)),
+      ])
+
+      const data: AdminWorkflowDetail = {
+        ...toAdminWorkflow(workflowData),
+        blockCount: blockCountResult[0].count,
+        edgeCount: edgeCountResult[0].count,
+      }
+
+      logger.info(`Admin API: Retrieved workflow ${workflowId}`)
+
+      return singleResponse(data)
+    } catch (error) {
+      logger.error('Admin API: Failed to get workflow', { error, workflowId })
+      return internalErrorResponse('Failed to get workflow')
+    }
+  })
+)
+
+export const DELETE = withRouteHandler(
+  withAdminAuthParams<RouteParams>(async (request, context) => {
+    const parsed = await parseRequest(adminV1DeleteWorkflowContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { id: workflowId } = parsed.data.params
+
+    try {
+      const workflowData = await getActiveWorkflowRecord(workflowId)
+
+      if (!workflowData) {
+        return notFoundResponse('Workflow')
+      }
+
+      const result = await performDeleteWorkflow({
+        workflowId,
+        userId: workflowData.userId,
+        skipLastWorkflowGuard: true,
+        requestId: `admin-workflow-${workflowId}`,
+        actorId: 'admin-api',
+      })
+
+      if (!result.success) {
+        return internalErrorResponse(result.error || 'Failed to delete workflow')
+      }
+
+      logger.info(`Admin API: Deleted workflow ${workflowId} (${workflowData.name})`)
+
+      return NextResponse.json({ success: true, workflowId })
+    } catch (error) {
+      logger.error('Admin API: Failed to delete workflow', { error, workflowId })
+      return internalErrorResponse('Failed to delete workflow')
+    }
+  })
+)

apps/sim/app/api/v1/admin/workflows/[id]/versions/[versionId]/activate/route.ts

@@ -0,0 +1,73 @@
+import { createLogger } from '@sim/logger'
+import { getActiveWorkflowRecord } from '@sim/platform-authz/workflow'
+import { adminV1ActivateWorkflowVersionContract } from '@/lib/api/contracts/v1/admin'
+import { parseRequest } from '@/lib/api/server'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { performActivateVersion } from '@/lib/workflows/orchestration'
+import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
+import {
+  badRequestResponse,
+  internalErrorResponse,
+  notFoundResponse,
+  singleResponse,
+} from '@/app/api/v1/admin/responses'
+
+const logger = createLogger('AdminWorkflowActivateVersionAPI')
+export const maxDuration = 120
+
+interface RouteParams {
+  id: string
+  versionId: string
+}
+
+export const POST = withRouteHandler(
+  withAdminAuthParams<RouteParams>(async (request, context) => {
+    const requestId = generateRequestId()
+    const parsed = await parseRequest(adminV1ActivateWorkflowVersionContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { id: workflowId, versionId: versionNum } = parsed.data.params
+
+    try {
+      const workflowRecord = await getActiveWorkflowRecord(workflowId)
+
+      if (!workflowRecord) {
+        return notFoundResponse('Workflow')
+      }
+
+      const result = await performActivateVersion({
+        workflowId,
+        version: versionNum,
+        userId: workflowRecord.userId,
+        workflow: workflowRecord as Record<string, unknown>,
+        requestId,
+        request,
+        actorId: 'admin-api',
+      })
+
+      if (!result.success) {
+        if (result.errorCode === 'not_found') return notFoundResponse('Deployment version')
+        if (result.errorCode === 'validation') return badRequestResponse(result.error!)
+        return internalErrorResponse(result.error || 'Failed to activate version')
+      }
+
+      logger.info(
+        `[${requestId}] Admin API: Activated version ${versionNum} for workflow ${workflowId}`
+      )
+
+      return singleResponse({
+        success: true,
+        version: versionNum,
+        deployedAt: result.deployedAt!.toISOString(),
+        warnings: result.warnings,
+      })
+    } catch (error) {
+      logger.error(
+        `[${requestId}] Admin API: Failed to activate version for workflow ${workflowId}`,
+        { error }
+      )
+      return internalErrorResponse('Failed to activate deployment version')
+    }
+  })
+)

apps/sim/app/api/v1/admin/workflows/[id]/versions/route.ts

@@ -0,0 +1,55 @@
+import { createLogger } from '@sim/logger'
+import { getActiveWorkflowRecord } from '@sim/platform-authz/workflow'
+import { adminV1ListWorkflowVersionsContract } from '@/lib/api/contracts/v1/admin'
+import { parseRequest } from '@/lib/api/server'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { listWorkflowVersions } from '@/lib/workflows/persistence/utils'
+import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
+import {
+  internalErrorResponse,
+  notFoundResponse,
+  singleResponse,
+} from '@/app/api/v1/admin/responses'
+import type { AdminDeploymentVersion } from '@/app/api/v1/admin/types'
+
+const logger = createLogger('AdminWorkflowVersionsAPI')
+
+interface RouteParams {
+  id: string
+}
+
+export const GET = withRouteHandler(
+  withAdminAuthParams<RouteParams>(async (request, context) => {
+    const parsed = await parseRequest(adminV1ListWorkflowVersionsContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { id: workflowId } = parsed.data.params
+
+    try {
+      const workflowRecord = await getActiveWorkflowRecord(workflowId)
+
+      if (!workflowRecord) {
+        return notFoundResponse('Workflow')
+      }
+
+      const { versions } = await listWorkflowVersions(workflowId)
+
+      const response: AdminDeploymentVersion[] = versions.map((v) => ({
+        id: v.id,
+        version: v.version,
+        name: v.name,
+        isActive: v.isActive,
+        createdAt: v.createdAt.toISOString(),
+        createdBy: v.createdBy,
+        deployedByName: v.deployedByName,
+      }))
+
+      logger.info(`Admin API: Listed ${versions.length} versions for workflow ${workflowId}`)
+
+      return singleResponse({ versions: response })
+    } catch (error) {
+      logger.error(`Admin API: Failed to list versions for workflow ${workflowId}`, { error })
+      return internalErrorResponse('Failed to list deployment versions')
+    }
+  })
+)

apps/sim/app/api/v1/admin/workflows/export/route.ts

@@ -0,0 +1,158 @@
+/**
+ * POST /api/v1/admin/workflows/export
+ *
+ * Export multiple workflows as a ZIP file or JSON array (raw, unsanitized for admin backup/restore).
+ *
+ * Request Body:
+ *   - ids: string[] - Array of workflow IDs to export
+ *
+ * Query Parameters:
+ *   - format: 'zip' (default) or 'json'
+ *
+ * Response:
+ *   - ZIP file download (Content-Type: application/zip) - each workflow as JSON in root
+ *   - JSON: AdminListResponse<WorkflowExportPayload[]>
+ */
+
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { db } from '@sim/db'
+import { workflow } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { inArray } from 'drizzle-orm'
+import JSZip from 'jszip'
+import { NextResponse } from 'next/server'
+import { adminV1ExportWorkflowsContract } from '@/lib/api/contracts/v1/admin'
+import { parseRequest } from '@/lib/api/server'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { sanitizePathSegment } from '@/lib/workflows/operations/import-export'
+import { loadWorkflowFromNormalizedTables } from '@/lib/workflows/persistence/utils'
+import { withAdminAuth } from '@/app/api/v1/admin/middleware'
+import {
+  badRequestResponse,
+  internalErrorResponse,
+  listResponse,
+} from '@/app/api/v1/admin/responses'
+import {
+  parseWorkflowVariables,
+  type WorkflowExportPayload,
+  type WorkflowExportState,
+} from '@/app/api/v1/admin/types'
+
+const logger = createLogger('AdminWorkflowsExportAPI')
+
+export const POST = withRouteHandler(
+  withAdminAuth(async (request) => {
+    const parsed = await parseRequest(adminV1ExportWorkflowsContract, request, {})
+    if (!parsed.success) return parsed.response
+
+    const { format } = parsed.data.query
+    const body = parsed.data.body
+
+    try {
+      const workflows = await db.select().from(workflow).where(inArray(workflow.id, body.ids))
+
+      if (workflows.length === 0) {
+        return badRequestResponse('No workflows found with the provided IDs')
+      }
+
+      const workflowExports: WorkflowExportPayload[] = []
+
+      for (const wf of workflows) {
+        try {
+          const normalizedData = await loadWorkflowFromNormalizedTables(wf.id)
+
+          if (!normalizedData) {
+            logger.warn(`Skipping workflow ${wf.id} - no normalized data found`)
+            continue
+          }
+
+          const variables = parseWorkflowVariables(wf.variables)
+
+          const state: WorkflowExportState = {
+            blocks: normalizedData.blocks,
+            edges: normalizedData.edges,
+            loops: normalizedData.loops,
+            parallels: normalizedData.parallels,
+            metadata: {
+              name: wf.name,
+              description: wf.description ?? undefined,
+              exportedAt: new Date().toISOString(),
+            },
+            variables,
+          }
+
+          const exportPayload: WorkflowExportPayload = {
+            version: '1.0',
+            exportedAt: new Date().toISOString(),
+            workflow: {
+              id: wf.id,
+              name: wf.name,
+              description: wf.description,
+              workspaceId: wf.workspaceId,
+              folderId: wf.folderId,
+            },
+            state,
+          }
+
+          workflowExports.push(exportPayload)
+        } catch (error) {
+          logger.error(`Failed to load workflow ${wf.id}:`, { error })
+        }
+      }
+
+      logger.info(`Admin API: Exporting ${workflowExports.length} workflows`)
+
+      const auditExport = () => {
+        if (workflowExports.length === 0) return
+        recordAudit({
+          actorId: 'admin-api',
+          action: AuditAction.WORKFLOW_EXPORTED,
+          resourceType: AuditResourceType.WORKFLOW,
+          description: `Admin API exported ${workflowExports.length} workflow(s)`,
+          metadata: {
+            format,
+            requestedCount: body.ids.length,
+            exportedCount: workflowExports.length,
+            requestedIds: body.ids,
+          },
+          request,
+        })
+      }
+
+      if (format === 'json') {
+        auditExport()
+        return listResponse(workflowExports, {
+          total: workflowExports.length,
+          limit: workflowExports.length,
+          offset: 0,
+          hasMore: false,
+        })
+      }
+
+      const zip = new JSZip()
+
+      for (const exportPayload of workflowExports) {
+        const filename = `${sanitizePathSegment(exportPayload.workflow.name)}.json`
+        zip.file(filename, JSON.stringify(exportPayload, null, 2))
+      }
+
+      const zipBlob = await zip.generateAsync({ type: 'blob' })
+      const arrayBuffer = await zipBlob.arrayBuffer()
+
+      const filename = `workflows-export-${new Date().toISOString().split('T')[0]}.zip`
+
+      auditExport()
+      return new NextResponse(arrayBuffer, {
+        status: 200,
+        headers: {
+          'Content-Type': 'application/zip',
+          'Content-Disposition': `attachment; filename="${filename}"`,
+          'Content-Length': arrayBuffer.byteLength.toString(),
+        },
+      })
+    } catch (error) {
+      logger.error('Admin API: Failed to export workflows', { error, ids: body.ids })
+      return internalErrorResponse('Failed to export workflows')
+    }
+  })
+)

apps/sim/app/api/v1/admin/workflows/import/route.ts

@@ -0,0 +1,178 @@
+/**
+ * POST /api/v1/admin/workflows/import
+ *
+ * Import a single workflow into a workspace.
+ *
+ * Request Body:
+ *   {
+ *     workspaceId: string,           // Required: target workspace
+ *     folderId?: string,             // Optional: target folder
+ *     name?: string,                 // Optional: override workflow name
+ *     workflow: object | string      // The workflow JSON (from export or raw state)
+ *   }
+ *
+ * Response: { workflowId: string, name: string, success: true }
+ */
+
+import { db } from '@sim/db'
+import { workflow, workspace } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { generateId } from '@sim/utils/id'
+import { and, eq, isNull } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { adminV1ImportWorkflowContract } from '@/lib/api/contracts/v1/admin'
+import { parseRequest } from '@/lib/api/server'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { parseWorkflowJson } from '@/lib/workflows/operations/import-export'
+import { saveWorkflowToNormalizedTables } from '@/lib/workflows/persistence/utils'
+import { deduplicateWorkflowName } from '@/lib/workflows/utils'
+import { withAdminAuth } from '@/app/api/v1/admin/middleware'
+import {
+  badRequestResponse,
+  internalErrorResponse,
+  notFoundResponse,
+} from '@/app/api/v1/admin/responses'
+import {
+  extractWorkflowMetadata,
+  type VariableType,
+  type WorkflowImportRequest,
+  type WorkflowVariable,
+} from '@/app/api/v1/admin/types'
+
+const logger = createLogger('AdminWorkflowImportAPI')
+
+interface ImportSuccessResponse {
+  workflowId: string
+  name: string
+  success: true
+}
+
+export const POST = withRouteHandler(
+  withAdminAuth(async (request) => {
+    try {
+      const parsed = await parseRequest(adminV1ImportWorkflowContract, request, {})
+      if (!parsed.success) return parsed.response
+
+      const body = parsed.data.body as WorkflowImportRequest
+      const { workspaceId, folderId, name: overrideName } = body
+
+      const [workspaceData] = await db
+        .select({ id: workspace.id, ownerId: workspace.ownerId })
+        .from(workspace)
+        .where(and(eq(workspace.id, workspaceId), isNull(workspace.archivedAt)))
+        .limit(1)
+
+      if (!workspaceData) {
+        return notFoundResponse('Workspace')
+      }
+
+      const workflowContent =
+        typeof body.workflow === 'string' ? body.workflow : JSON.stringify(body.workflow)
+
+      const { data: workflowData, errors } = parseWorkflowJson(workflowContent)
+
+      if (!workflowData || errors.length > 0) {
+        return badRequestResponse(`Invalid workflow: ${errors.join(', ')}`)
+      }
+
+      const parsedWorkflow =
+        typeof body.workflow === 'string'
+          ? (() => {
+              try {
+                return JSON.parse(body.workflow)
+              } catch {
+                return null
+              }
+            })()
+          : body.workflow
+
+      const { name: workflowName, description: workflowDescription } = extractWorkflowMetadata(
+        parsedWorkflow,
+        overrideName
+      )
+
+      const workflowId = generateId()
+      const now = new Date()
+      const dedupedName = await deduplicateWorkflowName(workflowName, workspaceId, folderId || null)
+
+      await db.insert(workflow).values({
+        id: workflowId,
+        userId: workspaceData.ownerId,
+        workspaceId,
+        folderId: folderId || null,
+        name: dedupedName,
+        description: workflowDescription,
+        lastSynced: now,
+        createdAt: now,
+        updatedAt: now,
+        isDeployed: false,
+        runCount: 0,
+        variables: {},
+      })
+
+      const saveResult = await saveWorkflowToNormalizedTables(workflowId, workflowData)
+
+      if (!saveResult.success) {
+        await db.delete(workflow).where(eq(workflow.id, workflowId))
+        return internalErrorResponse(`Failed to save workflow state: ${saveResult.error}`)
+      }
+
+      if (
+        workflowData.variables &&
+        typeof workflowData.variables === 'object' &&
+        !Array.isArray(workflowData.variables)
+      ) {
+        const variablesRecord: Record<string, WorkflowVariable> = {}
+        const vars = workflowData.variables as Record<
+          string,
+          { id?: string; name: string; type?: VariableType; value: unknown }
+        >
+        Object.entries(vars).forEach(([key, v]) => {
+          const varId = v.id || key
+          variablesRecord[varId] = {
+            id: varId,
+            name: v.name,
+            type: v.type ?? 'string',
+            value: v.value,
+          }
+        })
+
+        await db
+          .update(workflow)
+          .set({ variables: variablesRecord, updatedAt: new Date() })
+          .where(eq(workflow.id, workflowId))
+      } else if (workflowData.variables && Array.isArray(workflowData.variables)) {
+        const variablesRecord: Record<string, WorkflowVariable> = {}
+        workflowData.variables.forEach((v) => {
+          const varId = v.id || generateId()
+          variablesRecord[varId] = {
+            id: varId,
+            name: v.name,
+            type: (v.type as VariableType) ?? 'string',
+            value: v.value,
+          }
+        })
+
+        await db
+          .update(workflow)
+          .set({ variables: variablesRecord, updatedAt: new Date() })
+          .where(eq(workflow.id, workflowId))
+      }
+
+      logger.info(
+        `Admin API: Imported workflow ${workflowId} (${dedupedName}) into workspace ${workspaceId}`
+      )
+
+      const response: ImportSuccessResponse = {
+        workflowId,
+        name: dedupedName,
+        success: true,
+      }
+
+      return NextResponse.json(response)
+    } catch (error) {
+      logger.error('Admin API: Failed to import workflow', { error })
+      return internalErrorResponse('Failed to import workflow')
+    }
+  })
+)

apps/sim/app/api/v1/admin/workflows/route.ts

@@ -0,0 +1,68 @@
+/**
+ * GET /api/v1/admin/workflows
+ *
+ * List all workflows across all workspaces with pagination.
+ *
+ * Query Parameters:
+ *   - limit: number (default: 50, max: 250)
+ *   - offset: number (default: 0)
+ *
+ * Response: AdminListResponse<AdminWorkflow>
+ */
+
+import { db } from '@sim/db'
+import { workflow } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { count } from 'drizzle-orm'
+import { adminV1ListWorkflowsContract } from '@/lib/api/contracts/v1/admin'
+import { parseRequest } from '@/lib/api/server'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { withAdminAuth } from '@/app/api/v1/admin/middleware'
+import { internalErrorResponse, listResponse } from '@/app/api/v1/admin/responses'
+import { type AdminWorkflow, createPaginationMeta, toAdminWorkflow } from '@/app/api/v1/admin/types'
+
+const logger = createLogger('AdminWorkflowsAPI')
+
+export const GET = withRouteHandler(
+  withAdminAuth(async (request) => {
+    const parsed = await parseRequest(adminV1ListWorkflowsContract, request, {})
+    if (!parsed.success) return parsed.response
+
+    const { limit, offset } = parsed.data.query
+
+    try {
+      const [countResult, workflows] = await Promise.all([
+        db.select({ total: count() }).from(workflow),
+        db
+          .select({
+            id: workflow.id,
+            name: workflow.name,
+            description: workflow.description,
+            workspaceId: workflow.workspaceId,
+            folderId: workflow.folderId,
+            isDeployed: workflow.isDeployed,
+            deployedAt: workflow.deployedAt,
+            runCount: workflow.runCount,
+            lastRunAt: workflow.lastRunAt,
+            createdAt: workflow.createdAt,
+            updatedAt: workflow.updatedAt,
+          })
+          .from(workflow)
+          .orderBy(workflow.name)
+          .limit(limit)
+          .offset(offset),
+      ])
+
+      const total = countResult[0].total
+      const data: AdminWorkflow[] = workflows.map(toAdminWorkflow)
+      const pagination = createPaginationMeta(total, limit, offset)
+
+      logger.info(`Admin API: Listed ${data.length} workflows (total: ${total})`)
+
+      return listResponse(data, pagination)
+    } catch (error) {
+      logger.error('Admin API: Failed to list workflows', { error })
+      return internalErrorResponse('Failed to list workflows')
+    }
+  })
+)