From 8e10e6f317cda7cc98f3ab93c06db6377c944e85 Mon Sep 17 00:00:00 2001
From: Sai Asish Y <say.apm35@gmail.com>
Date: Sat, 18 Jul 2026 05:56:08 -0700
Subject: [PATCH] Return 422 instead of 500 when workflow create body omits
 edges, jobs, or triggers

Signed-off-by: Sai Asish Y <say.apm35@gmail.com>
---
 CHANGELOG.md                                  |  4 ++++
 .../controllers/api/workflows_controller.ex   |  8 ++++++++
 .../api/workflows_controller_test.exs         | 19 +++++++++++++++++++
 3 files changed, 31 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ca9996d0477..dfc6b889eb5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -58,6 +58,10 @@ and this project adheres to
 
 ### Fixed
 
+- The workflows REST API now returns a 422 validation error instead of a 500
+  when a create request omits `edges`, `jobs`, or `triggers` from the body
+  rather than sending them as empty lists.
+  [#4982](https://github.com/OpenFn/lightning/issues/4982)
 - Sandbox merge no longer deletes a workflow that was added to the project after
   the sandbox was branched. Such workflows were never part of the sandbox, so
   they are excluded from the merge screen entirely. Workflows deleted inside the
diff --git a/lib/lightning_web/controllers/api/workflows_controller.ex b/lib/lightning_web/controllers/api/workflows_controller.ex
index f42bca7b9d9..3ad834738a9 100644
--- a/lib/lightning_web/controllers/api/workflows_controller.ex
+++ b/lib/lightning_web/controllers/api/workflows_controller.ex
@@ -413,6 +413,14 @@ defmodule LightningWeb.API.WorkflowsController do
        ),
        do: validate_workflow(edges, jobs, triggers, ids_map)
 
+  defp validate_workflow(%{} = params, ids_map) do
+    edges = Map.get(params, "edges", [])
+    jobs = Map.get(params, "jobs", [])
+    triggers = Map.get(params, "triggers", [])
+
+    validate_workflow(edges, jobs, triggers, ids_map)
+  end
+
   defp validate_workflow(edges, jobs, triggers, ids_map) do
     # {:ok, _ids} <- validate_ids(edges),
     with {:ok, triggers_ids} <- validate_ids(triggers),
diff --git a/test/lightning_web/controllers/api/workflows_controller_test.exs b/test/lightning_web/controllers/api/workflows_controller_test.exs
index 62378626a74..d25febb23ae 100644
--- a/test/lightning_web/controllers/api/workflows_controller_test.exs
+++ b/test/lightning_web/controllers/api/workflows_controller_test.exs
@@ -745,6 +745,25 @@ defmodule LightningWeb.API.WorkflowsControllerTest do
              }
     end
 
+    test "returns 422 when edges, jobs and triggers are omitted", %{
+      conn: conn,
+      project: project
+    } do
+      conn =
+        post(
+          conn,
+          ~p"/api/projects/#{project.id}/workflows",
+          Jason.encode!(%{name: "workflow without children"})
+        )
+
+      assert json_response(conn, 422) == %{
+               "id" => nil,
+               "errors" => %{
+                 "edges" => ["Missing edge with source_trigger_id."]
+               }
+             }
+    end
+
     test "returns 422 when edges has multiple source triggers", %{
       conn: conn,
       project: project