Run a Governed Approval Workflow
Use VaultWorkflow to collect structured data from a participant, run schema-driven validation, route to an approver, and seal the final PDF on approval.
This tutorial covers a governed approval workflow: a participant fills a structured form across one or more steps, validation runs against the submitted data, the submission routes to an approver, and the final PDF is sealed automatically on approval.
Products used: VaultWorkflow, VaultESign (optional post-seal)
What You'll Need
- A VaultPDF licence with the
vaultWorkflowfeature gate enabled - A workflow schema YAML stored in your
workflow-schemasAzure Blob Storage container - The schema's blob path
- Participant and approver email addresses
Using a VaultPack schema
The Payables, Receivables, and Order Management VaultPacks each include ready-to-use governance workflow schemas such as po-approval, invoice-approval, and quote-approval. Reference the schema blob path directly when creating a session.
Step 1: Create a Workflow Session
POST to /api/workflow with the schema path and participant details. The Dispatcher generates a portal access token for the participant and sends them an invitation email.
POST /api/workflow
Authorization: Bearer <Entra ID JWT>
Content-Type: application/json{
"schemaPath": "workflow-schemas/po-approval.yaml",
"title": "PO-2026-0042",
"participantEmail": "[email protected]",
"participantName": "Procurement Officer",
"requireOtp": false
}The response returns a workflowId and participant portal URL:
{
"workflowId": "wf-xxxx...",
"portalUrl": "https://portal.vaultpdf.io/workflow/wf-xxxx...?token=...",
"state": "draft"
}Step 2: Participant Fills the Form
The participant opens their portal link and fills each step in sequence. Steps are defined in the schema YAML and may include vendor details, line items, cost centres, and any other fields declared in the schema.
Participants can save progress and return. Each step is submitted independently before the workflow advances to the next.
Step 3: Validation Runs
When the participant submits the final step, schema-driven validation evaluates all collected data. For governance-type workflows, validation also runs at session creation.
If validation passes, the workflow transitions to pending-approval and the designated approver receives a notification email.
Error vs. warning severity
error-severity rules block advancement; the participant must correct the data before resubmitting. warning-severity rules surface to the approver as advisory flags but do not block approval.
Step 4: Approver Reviews and Decides
The approver opens the submission via their portal link or the VaultLifecycle workspace. They can:
- Approve — the workflow seals the final PDF immediately
- Reject — the workflow closes; no PDF is produced
- Request changes — the submission returns to the participant with structured correction instructions
Step 5: PDF is Sealed
On approval, VaultWorkflow enqueues a seal message. The Dispatcher renders the final PDF using the workflow template and the complete collected data snapshot. The sealed document is stored in Azure Blob Storage and the correlationId is recorded in the VaultLifecycle workspace.
Optional: Trigger Post-Seal Actions
Include postSealActions in the workflow session request to automatically trigger VaultESign or VaultDelivery after sealing, with no additional API calls required:
{
"schemaPath": "workflow-schemas/po-approval.yaml",
"title": "PO-2026-0042",
"participantEmail": "[email protected]",
"postSealActions": {
"esign": {
"signers": [
{ "slotIndex": 0, "role": "manager", "email": "[email protected]" }
],
"signingMode": "single",
"expiresInHours": 48
}
}
}What Happens Next
The complete approval trail — each step submission, validation outcome, approver decision, and seal event — is recorded in the VaultLifecycle workspace under the document's correlationId. The Workflow tab shows validation results, change request history, and approval stage progress.
VaultWorkflow Reference
Schema reference, API endpoints, validation rule types, and approval routing configuration.
Send a Document for Electronic Signing
Render a signing document and create a VaultESign session to collect legally binding electronic signatures from one or more signers via the centrally hosted signing portal.
Batch Document Dispatch
Render multiple documents from a single payload, get an intake receipt, route through an approver, and deliver each PDF to its recipient via VaultDelivery.