Test a workflow step

In the visual workflow composer, each action has Test this step, an editable input JSON context and an output/plan/error view. Pin input to reuse it in this browser; unpin to remove it. Pins are scoped by organization, caller authority, workflow and node. They never change production runs. Select a saved workflow and use Load from run to choose from its last 20 executions. Only predecessors before the selected node enter the context; changing the input tests the edited JSON.

POST /v1/orgs/:orgId/automations/step-test accepts {action, context, live?} or {action, fromRun: {workflowId, runId, position}, live?}. Position is zero-based. Exactly one context source is required. The response contains redacted resolvedInput (the resolved action), output or plan, durationMs, and optional error. Expression failures include their code and path. Input JSON uses the canonical trigger, steps, run, now context; e.g. {"steps":{"s1":{"output":{"x":42}}}} resolves {{ steps.s1.output.x }}. Historical trigger/record reconstruction follows buildRunContext; it does not promise an immutable snapshot of a CRM record subsequently edited.

Code actions use {kind:"code", language:"javascript", source:"return {x: $input.steps.s1.output.x};"} with the existing QuickJS sandbox limits. set_data uses the existing field-mapping helper. HTTP uses the existing public HTTPS/DNS-pinned client and vault reference authorization. It returns a plan by default; select Send live HTTP request for a real request with crm:edit. HTTP status failures respect failOnStatus. CRM writes, remote commands, sends and other action kinds always return a plan. No runs, run steps, waits or CRM rows are created or changed.

GET /v1/orgs/:orgId/automations/step-test/input?workflowId=…&runId=…&position=… returns a redacted {context} for editing, with org/workflow/run binding checked first. Both routes send Cache-Control: no-store.

The automation_step_test MCP tool calls the same REST route and labels returned data untrusted. Automations and CRM feature gates, authentication and crm:read apply. Live HTTP additionally requires crm:edit. API keys need CRM and write scopes for POST; runner keys are refused. The per-user limit is 30 tests per minute across organizations and API processes. Admission and completion audits contain only kind, live flag and outcome, never input/output payloads. A crash after admission still consumes its minute's slot.

References: n8n partial executions, pinning, and debugging previous executions. These are UX references; GoodQA's execution permissions and plan-only actions above define this feature's contract.