waitForInput

The waitForInput step pauses workflow execution until a human submits input. It's the human-in-the-loop primitive for collecting structured input, such as escalation checkpoints, review steps, and multi-field decisions.

For the end-to-end pattern, including the Inbox app, external Slack delivery, and design guidance, refer to Human-in-the-loop. For a fixed approve/reject decision without a custom schema, use waitForApproval instead.

Schema convention. In each schema table on this page, the Location column indicates where each parameter sits in the YAML:

• top level: Alongside type and name, at the top of the step or trigger definition.
• `with`: Inside the step's with: block.
• `on`: Inside the trigger's on: block.

Use with.channels to notify responders outside Kibana. Slack is the only built-in channel. Responders can act without a Kibana session, either by opening a hosted HTML form or by using a query link.

Both channel configs accept an optional message template. Use {{ context.hitl.externalFormLink }} for the hosted form URL and {{ context.hitl.externalQueryLink }} for the query link. If you omit message, the notification includes the form link by default.

The query link is a base URL that carries the resume token. To resume through it, responders must append at least one schema field as a query parameter (for example, &approved=true). A query link with no schema field parameters returns an error and directs the caller to use the form link instead. When in doubt, use the hosted form link.

To turn off external resume, set both hitlExternalResume.enabled keys in kibana.yml (both default to true). For the exact settings, refer to Human-in-the-loop.

How the resume payload appears on the step output depends on the Stack version:

response:
  approved: true
  notes: "..."
respondedBy: "..."
		

approved: true
notes: "..."
		

• While waiting, the execution state is WAITING_FOR_INPUT.
• There is no step-level default timeout. The workflow waits until someone responds, or until a workflow-level settings.timeout cancels the run.
• By default, the step times out after 72h. This default applies whether you configure an external channel. Override it with a top-level timeout on the step. If no one responds before the timeout, the step fails.

- name: review
  type: waitForInput
  timeout: 24h
  with:
    message: |
      ## Confirm host isolation

      Host `{{ event.alerts[0].host.name }}` was flagged by rule {{ event.rule.name }}.

      AI classification: **{{ steps.classify.output.category }}**

      Proceed with isolation?
    schema:
      type: object
      properties:
        approved:
          type: boolean
          title: "Isolate the host"
        notes:
          type: string
          title: "Reviewer notes"
      required: ["approved"]

- name: isolate
  type: http
  if: "steps.review.output.response.approved : true"
  connector-id: "edr-connector"
  with:
    method: "POST"
    url: "https://edr.example.com/isolate"
    body:
      host: "{{ event.alerts[0].host.name }}"
      reason: "{{ steps.review.output.response.notes }}"
		

1. overrides the 72h default

- name: review
  type: waitForInput
  timeout: 72h
  with:
    message: "Review this escalation and submit your decision."
    schema:
      type: object
      properties:
        approved:
          type: boolean
          title: "Approve"
        notes:
          type: string
          title: "Notes"
      required: ["approved"]
    channels:
      slack:
        connector-id: my-slack-webhook-connector
      slack_api:
        connector-id: my-slack-api-connector
        channels: ["C0123456789"]
		

• Human-in-the-loop pattern: The full HITL pattern, including Inbox and external resume.
• waitForApproval step : Approve/reject without a custom schema.
• Flow control steps: Other flow-control types you'll often combine with waitForInput.
• If step: Typical gate around the post-review action.