Workfront Event Subscription (Independent Publisher) (Preview)

Custom connector for Adobe Workfront.

This connector is available in the following products and regions:

Service Class Regions
Copilot Studio Premium All Power Automate regions except the following:
     -   US Government (GCC)
     -   US Government (GCC High)
     -   China Cloud operated by 21Vianet
     -   US Department of Defense (DoD)
Logic Apps Standard All Logic Apps regions except the following:
     -   Azure Government regions
     -   Azure China regions
     -   US Department of Defense (DoD)
Power Apps Premium All Power Apps regions except the following:
     -   US Government (GCC)
     -   US Government (GCC High)
     -   China Cloud operated by 21Vianet
     -   US Department of Defense (DoD)
Power Automate Premium All Power Automate regions except the following:
     -   US Government (GCC)
     -   US Government (GCC High)
     -   China Cloud operated by 21Vianet
     -   US Department of Defense (DoD)
Contact
Name P-Product
Email partners@p-product.com
Connector Metadata
Publisher axltweek
Website https://business.adobe.com/products/workfront.html
Privacy policy https://www.adobe.com/privacy.html
Categories Productivity;Collaboration

Adobe Workfront Event Subscriber Connector

This repository contains a Power Automate custom connector for Adobe Workfront event subscription API.

The connector exposes a trigger for Workfront event subscriptions and handles Workfront authentication inside the custom connector policy script. It supports two authentication modes:

  • API key to sessionID exchange
  • JWT exchange to OAuth access token

The trigger creates a Workfront event subscription and receives webhook payloads from Workfront when supported objects are created, updated, or deleted.

Connector idea

The connector is designed to bridge Adobe Workfront event subscriptions into Power Automate.

At a high level it works like this:

  1. A flow uses the custom trigger When a Workfront event occurs.
  2. The trigger creates a Workfront event subscription against /attask/eventsubscription/api/v1/subscriptions.
  3. Power Automate provides the callback URL that Workfront should call.
  4. Workfront sends event payloads to the flow when matching events happen.
  5. The policy script in script.csx converts connector credentials into the authentication artifacts expected by Workfront.

Supported authentication modes:

  • api-auth: uses a Workfront API key and exchanges it for sessionID
  • jwt-exchange: signs a JWT with an RSA private key, exchanges it for an access token, and sends that token to Workfront as sessionID

How to set up Workfront

General prerequisites

  • You must know your Workfront domain, for example mycompany.my.workfront.com
  • The user behind the connector must have enough rights to work with Event Subscriptions
  • For Event Subscription API operations, Adobe documents that a Workfront administrator account is required
  • Your Power Automate callback endpoint must be reachable by Workfront

Adobe Workfront documentation:

Option 1. API key authentication

This connector still supports API key authentication for legacy environments.

Workfront API key setup

  1. Generate or retrieve an API key for the Workfront user that will own the subscription.
  2. Create a connector connection with:
    • Workfront Domain
    • API Key
  3. The policy script exchanges the API key for a Workfront sessionID.

Adobe notes that API keys are legacy and recommends JWT or OAuth2-based authentication for newer setups:

Option 2. JWT exchange authentication

This is the preferred setup for machine-to-machine integrations.

Workfront OAuth JWT setup

  1. In Workfront, open Setup -> System -> OAuth2 Applications.
  2. Create a new Machine to Machine Application.
  3. Save the generated values:
    • Client ID
    • Client Secret
  4. Add a public key to the app.
    • You can either paste a public key generated outside Workfront, or
    • use Workfront to generate a keypair and then securely export/store the private key
  5. Note the Customer ID from the app details.
  6. Identify the Workfront user ID that the JWT should impersonate as sub.
  7. Create a connector connection with:
    • Workfront Domain
    • Client ID
    • Client Secret
    • Customer ID
    • Subject User
    • RSA Private Key (Base64 JSON)

Adobe Workfront documentation:

How to generate keys for JWT exchange

The connector code in script.csx does not expect a PEM file directly. It expects a base64-encoded JSON object containing RSA parameters:

  • modulus
  • exponent
  • d
  • p
  • q
  • dp
  • dq
  • inverseQ

Each value must itself be standard base64, and then the full JSON must be UTF-8 encoded and base64-encoded again before being pasted into the connector connection.

  1. Generate an RSA keypair.
  2. Upload the public key to the Workfront OAuth2 application.
  3. Convert the private key into RSA parameters JSON.
  4. Minify the JSON.
  5. Base64-encode the full JSON string.
  6. Paste the final single-line value into RSA Private Key (Base64 JSON).

Example scripts

You can find scripts with detailed instructions in this repository: https://github.com/P-Product-Inc/AdobeWorkfrontEventSubscriberPreparationScripts

JWT payload used by this connector

The policy script generates a short-lived JWT with:

  • alg = RS256
  • iss = clientId
  • sub = subjectUserId
  • iat = current unix time
  • exp = current unix time + 60 seconds

It then posts the signed token to:

  • https://<workfront-domain>/integrations/oauth2/api/v1/jwt/exchange

Known issues

Private key must be serialized as base64 JSON

The connector stores the private key as base64-encoded JSON with RSA parameters instead of a PEM block.

Reason:

  • The Power Automate custom connector runtime produced errors when the private key was passed in a more conventional PEM-like representation
  • Serializing the RSA parameters into JSON and then wrapping that JSON in base64 avoids the runtime parsing problem and allows the policy script to reconstruct RSAParameters reliably

This behavior is implemented in script.csx in ParseRsaParamsFromB64Json.

Webhook delete does not work

Deleting the Workfront event subscription from Power Automate currently does not work reliably.

Power Automate Community thread: https://community.powerplatform.com/forums/thread/details/?threadid=ca556f3b-9e27-f111-8341-000d3a5747e9

Observed behavior:

  • Power Automate sends an unauthorized DELETE request when it attempts to remove the webhook subscription
  • Because of that, the Workfront subscription can remain orphaned and may need to be deleted manually from Workfront

Relevant Adobe reference for delete behavior:

OAuth 2.0 Authorization Code with PKCE is not practical for this connector

Using Authentication through OAuth 2.0 Authorization Code flow with Proof Key for Code Exchange (PKCE) is not practical for this connector because of the combination of Workfront tenant isolation and Power Automate custom connector deployment rules.

Workfront limitation:

  • Workfront is effectively tenant-specific by domain
  • Each tenant can require its own OAuth application registration and endpoints
  • That means the OAuth client configuration is not naturally shared across all customer tenants

Power Automate custom connector limitation:

  • For OAuth-based custom connector authentication, clientId, authorizationUrl, refreshUrl, and tokenUrl are defined statically in apiProperties.json
  • The client secret is provided separately during connector deployment
  • As a result, the OAuth configuration is effectively fixed for the connector deployment and cannot be varied dynamically per flow or per tenant connection

Impact:

  • We cannot reliably support a per-tenant OAuth Authorization Code with PKCE setup in a single reusable connector package
  • We cannot let each flow unit bring its own tenant-specific authorization endpoints and app registration details
  • Because of this, the connector uses API key exchange or JWT-based machine-to-machine authentication instead

Repository contents

Creating a connection

The connector supports the following authentication types:
Use Worfront API key for the authentication. You need to generate API key in the Workfront dashboard. All regions Not shareable
Use Workfront JWT exchange Use Workfront JWT exchange approach for the machine-to-machine communication All regions Not shareable
Default [DEPRECATED] This option is only for older connections without an explicit authentication type, and is only provided for backward compatibility. All regions Not shareable

Use Worfront API key for the authentication.

Auth ID: api-auth

Applicable: All regions

You need to generate API key in the Workfront dashboard.

This is not shareable connection. If the power app is shared with another user, another user will be prompted to create new connection explicitly.

Name Type Description Required
Workfront Domain string Your full Workfront domain (e.g., mycompany.my.workfront.com or dmeps.sb01.workfront.com) True
API Key securestring The API key True

Use Workfront JWT exchange

Auth ID: jwt-exchange

Applicable: All regions

Use Workfront JWT exchange approach for the machine-to-machine communication

This is not shareable connection. If the power app is shared with another user, another user will be prompted to create new connection explicitly.

Name Type Description Required
Workfront Domain string Your full Workfront domain (e.g., mycompany.my.workfront.com or dmeps.sb01.workfront.com) True
Client ID string Workfront Client ID True
Client Secret securestring Workfront Client Secret True
Customer ID string Workfront Customer ID True
Subject User string Workfront Subject User True
RSA Private Key (Base64 JSON) string Base64-encoded minified JSON containing RSA private key parameters (modulus, exponent, d, p, q, dp, dq, inverseQ). Generated by the setup script and used to sign Workfront JWT assertions at runtime. Single-line value; do not include line breaks. True

Default [DEPRECATED]

Applicable: All regions

This option is only for older connections without an explicit authentication type, and is only provided for backward compatibility.

This is not shareable connection. If the power app is shared with another user, another user will be prompted to create new connection explicitly.

Name Type Description Required
Workfront Domain string Your full Workfront domain (e.g., mycompany.my.workfront.com or dmeps.sb01.workfront.com). True
API Key securestring The API key. True
Client ID string Workfront Client ID. True
Client Secret securestring Workfront Client Secret. True
Customer ID string Workfront Customer ID. True
Subject User string Workfront Subject User. True
RSA Private Key (Base64 JSON) string Base64-encoded minified JSON containing RSA private key parameters (modulus, exponent, d, p, q, dp, dq, inverseQ). Generated by the setup script and used to sign Workfront JWT assertions at runtime. Single-line value; do not include line breaks. True

Triggers

When a Workfront event occurs

Triggers when a CREATE, UPDATE, or DELETE event occurs in Workfront

When a Workfront event occurs

Operation ID:
OnWorkfrontEvent

Triggers when a CREATE, UPDATE, or DELETE event occurs in Workfront

Parameters

Name Key Required Type Description
Object Type
 objCode True string

Workfront object type
Event Type
 eventType True string

Type of event to trigger on
Field Name
 fieldName True string

Field name to filter on (e.g., projectID, status, lastUpdatedByID)
Field Value
 fieldValue True string

Value to compare against
State
 state string

State to check (newState or oldState)
Comparison
 comparison string

Comparison operator
Filter Connector
 filterConnector string

Logical connector for multiple filters

Returns

Name Path Type Description
eventType
 eventType string

Type of event (CREATE, UPDATE, DELETE)
subscriptionId
 subscriptionId string

ID of the subscription
epochSecond
 eventTime.epochSecond integer

Unix timestamp in seconds
nano
 eventTime.nano integer

Nanosecond precision
newState
 newState object

New state of the object
oldState
 oldState object

Previous state of the object (empty for CREATE events)
customerId
 customerId string

Workfront customer ID
userId
 userId string

ID of the user who triggered the event
subscriptionVersion
 subscriptionVersion string

Version of the subscription (v1 or v2)
eventVersion
 eventVersion string

Version of the event format (v1 or v2)