VaultWorkflow

{
  "postSealActions": {
    "esign": {
      "signers": [
        { "slotIndex": 0, "role": "manager", "email": "[email protected]" }
      ],
      "signingMode": "sequential",
      "expiresInHours": 72
    },
    "delivery": {
      "mode": "secure-email",
      "recipients": [
        { "email": "[email protected]", "name": "Vendor Contact" }
      ],
      "expiresInHours": 168
    }
  }
}

Business context: Sales team creates a vendor contract workflow from Dynamics 365.
Vendor fills three steps over the portal; Finance Lead approves; sealed PDF
auto-triggers VaultESign for counter-signature.

Step 1: Vendor Contact Details (name, email, company, ABN/EIN)
Step 2: Contract Terms (value, start date, payment terms)
Step 3: Compliance Declaration (sanctions check, insurance confirmation, T&C acceptance)

Create session:
POST /api/workflow
{
  "templatePath": "templates/vendor-contract.vpdf",
  "correlationId": "vc-2026-0601-acme",
  "templateSettings": {
    "workflow": {
      "recipients": [{ "email": "[email protected]", "displayName": "ACME Contact" }],
      "organizationName": "Contoso Ltd",
      "message": "Please complete and submit the vendor contract form."
    },
    "esign": {
      "enabled": true,
      "signers": [{ "slotIndex": 0, "role": "vendor", "email": "[email protected]" }],
      "signingMode": "single"
    }
  },
  "options": { "documentId": "VC-2026-0601", "docType": "vendor-contract" }
}

Flow:
  Vendor receives portal link → fills 3 steps → submits
  ├─ Form field data (text, selects, dates): browser → your Dispatcher (portal token auth)
  │   → stored in your Azure Table Storage; portal server not in data path
  ├─ File attachments (e.g. business registration, insurance certificate):
  │   browser requests pre-signed SAS URL from your Dispatcher
  │   → browser uploads directly to your Azure Blob Storage via SAS
  │   → portal server never in file byte path; bytes stay in your subscription
  Validation passes → Finance Lead receives approval notification
  Finance Lead approves → Processor seals PDF
  Post-seal: VaultESign auto-triggers → vendor receives signing invitation
  Vendor signs → evidence certificate appended → complete

Business context: D365 Finance triggers a 3-way match check on receipt of an invoice.
All data is pre-populated; no portal interaction required from the submitter.
Validation runs immediately; AP Manager (or Finance Director for high-value) approves.

POST /api/workflow
{
  "templatePath": "templates/ap-3way-match.vpdf",
  "correlationId": "inv-2026-0601-8821",
  "initialData": {
    "po_number": "PO-2026-0412",
    "po_amount": 42500.00,
    "po_quantity": 100,
    "po_vendor_id": "VEND-0098",
    "gr_number": "GRN-2026-0187",
    "gr_quantity": 100,
    "invoice_number": "INV-2026-8821",
    "invoice_total": 43200.00,
    "invoice_quantity": 100,
    "invoice_vendor_id": "VEND-0098",
    "lines_all_price_match": true,
    "lines_all_qty_match": true
  },
  "options": { "documentId": "INV-2026-8821", "docType": "ap-invoice" }
}

Flow:
  Session created → validation runs immediately (autoValidateOnCreate: true in schema)
  invoice_total ($43,200) within 5% of po_amount ($42,500) → tolerance warning surfaced
  All error rules pass → AP Manager receives approval notification with variance panel
  AP Manager approves → Processor seals PDF with Governance Validation page
  Sealed PDF stored → WORKFLOW_SEALED audit event emitted

Business context: Employee submits an expense claim via the portal.
Approver requests a correction (receipt amount mismatch); employee corrects and resubmits.

Create session:
POST /api/workflow
{
  "templatePath": "templates/expense-claim.vpdf",
  "correlationId": "exp-2026-0601-jsmith",
  "templateSettings": {
    "workflow": {
      "recipients": [{ "email": "[email protected]", "displayName": "J. Smith" }],
      "organizationName": "Contoso Ltd"
    },
    "delivery": {
      "enabled": true,
      "recipients": [{ "email": "[email protected]" }]
    }
  },
  "options": { "documentId": "EXP-2026-0601", "docType": "expense-claim" }
}

Flow:
  Employee receives portal link → fills expense details, uploads receipts
  ├─ Expense receipt attachments: browser requests pre-signed SAS URL from your Dispatcher
  │   → browser uploads directly to your Azure Blob Storage via SAS
  │   → portal server never in file byte path; attachment bytes stay in your subscription
  ├─ Form field data (amounts, dates, categories): browser → your Dispatcher
  │   → stored in your Azure Table Storage; portal server not in data path
  Employee submits → validation passes → Line Manager notified
  Line Manager reviews → requests change: "Receipt for lunch on Jun 3 is $85.50, not $95.50"
  Employee corrects field → resubmits
  Line Manager approves → Processor seals PDF
  Post-seal: VaultDelivery delivers approved expense PDF to employee inbox