[ENHANCEMENT] Can't enable workflow after `Import-FalconWorkflow`

[jraph77]

Describe the bug
When importing a workflow, by default it's disabled. Currently it's not possible to "enable" it using the API.

According to the Swagger API, enable a workflow is possible.

Improvement : Adding as well the possibility to "remove" a existing workflow using the psfalcon module

To Reproduce

1. Create a Draft workflow in an existing or new Workflow.
2. Export the workflow
3. Delete the workflow
4. Import the workflow using Import-FalconWorkflow -Name "xxx.yaml" -Path "C:\temp\xxx.yaml"
5. Check workflow status using GUI or Get-FalconWorkflow
6. Invoke-FalconWorkflow failed

Expected behavior
Be able to enable the imported workflow.
Add the possibility to remove the workflow as it's currently not possible

Environment (please complete the following information):

• OS: Windows 11 24H2
• PowerShell: 5.1.26100.7462
• PSFalcon: 2.2.9

Additional context
Enabling workflow

Transcript content

---

Windows`` PowerShell transcript start
Start time: 20260128110004
Username: Domain\toto
RunAs User: Domain\toto
Configuration Name: 
Machine: Toto-Computer (Microsoft Windows NT 10.0.26100.0)
Host Application: C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -Command Import-Module 'c:\Users\toto\.vscode\extensions\ms-vscode.powershell-2025.2.0\modules\PowerShellEditorServices\PowerShellEditorServices.psd1'; Start-EditorServices -HostName 'Visual Studio Code Host' -HostProfileId 'Microsoft.VSCode' -HostVersion '2025.2.0' -BundledModulesPath 'c:\Users\toto\.vscode\extensions\ms-vscode.powershell-2025.2.0\modules' -EnableConsoleRepl -StartupBanner "PowerShell Extension v2025.2.0
Copyright (c) Microsoft Corporation.

https://aka.ms/vscode-powershell
Type 'help' to get help.
" -LogLevel 'Warning' -LogPath 'c:\Users\toto\AppData\Roaming\Code\logs\20260120T102816\window1\exthost\ms-vscode.powershell' -SessionDetailsPath 'c:\Users\toto\AppData\Roaming\Code\User\globalStorage\ms-vscode.powershell\sessions\PSES-VSCode-38776-498633.json' -FeatureFlags @() 
Process ID: 50344
PSVersion: 5.1.26100.7462
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.26100.7462
BuildVersion: 10.0.26100.7462
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
PS>Show-FalconModule
PSVersion      : Desktop [5.1.26100.7462]
ModuleVersion  : v2.2.9 {d893eb9f-f6bb-4a40-9caf-aaff0e42acd1}
ModulePath     : C:\Users\toto\Documents\WindowsPowerShell\Modules\PSFalcon\2.2.9
UserModulePath : C:\Users\toto\Documents\WindowsPowerShell\Modules;C:\Program
                 Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules;C:\temp;c:\Users\toto\.vscode\extensions\ms-vscode.powershell-2025.2.0\modules
UserHome       : C:\Users\toto
UserAgent      : crowdstrike-psfalcon/2.2.9
PS>Import-FalconWorkflow -Name "Test.yaml" -Path "$Pathworklow"
>> CommandInvocation(Out-String): "Out-String"
>> ParameterBinding(Out-String): name="Stream"; value="True"
PS>ParameterBinding(Out-String): name="InputObject"; value="@{id=224061a311074023b30a4eb5e9064914; parameters=}"
Get-FalconWorkflow 
>> CommandInvocation(Out-String): "Out-String"
>> ParameterBinding(Out-String): name="Stream"; value="True"
ParameterBinding(Out-String): name="InputObject"; value="@{id=224061a311074023b30a4eb5e9064914; name=Test.yaml; description=Test Workflow; trigger=; loops=; enabled=False; has_validation_errors=False; last_modified_timestamp=2026-01-28T10:00:17.054729694Z; version=1}"
Invoke-FalconWorkflow -cid $h.cid -name "Test.yaml" -Json $body
>> CommandInvocation(Out-String): "Out-String"
>> ParameterBinding(Out-String): name="Stream"; value="True"
Write-Result : {"code":412,"message":"workflow definition \"224061a311074023b30a4eb5e9064914\" is disabled, re-enable 
to allow running on-demand"}
At C:\Users\toto\Documents\WindowsPowerShell\Modules\PSFalcon\2.2.9\private\Private.ps1:709 
char:11
+           Write-Result $Object
+           ~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidResult: (@{errors=System...ystem.Object[]}:PSObject) [Write-Result], Exception
    + FullyQualifiedErrorId : Write-Result
 
ParameterBinding(Out-String): name="InputObject"; value="{"code":412,"message":"workflow definition \"224061a311074023b30a4eb5e9064914\" is disabled, re-enable to allow running on-demand"}"
 CommandInvocation(Resolve-Path): "Resolve-Path"
>> ParameterBinding(Resolve-Path): name="ErrorAction"; value="Ignore"
>> ParameterBinding(Resolve-Path): name="WarningAction"; value="Ignore"
>> ParameterBinding(Resolve-Path): name="InformationAction"; value="Ignore"
>> ParameterBinding(Resolve-Path): name="Verbose"; value="False"
>> ParameterBinding(Resolve-Path): name="Debug"; value="False"
>> ParameterBinding(Resolve-Path): name="Path"; value="stop-tran*"
 CommandInvocation(Get-ChildItem): "Get-ChildItem"
>> ParameterBinding(Get-ChildItem): name="ErrorAction"; value="Ignore"
>> ParameterBinding(Get-ChildItem): name="WarningAction"; value="Ignore"
>> ParameterBinding(Get-ChildItem): name="InformationAction"; value="Ignore"
>> ParameterBinding(Get-ChildItem): name="Verbose"; value="False"
>> ParameterBinding(Get-ChildItem): name="Debug"; value="False"
>> ParameterBinding(Get-ChildItem): name="Path"; value="stop-tran*"
>> ParameterBinding(Get-ChildItem): name="Hidden"; value="True"
 Stop-Transcript
>> CommandInvocation(Out-String): "Out-String"
>> ParameterBinding(Out-String): name="Stream"; value="True"
**********************
Windows PowerShell transcript end
End time: 20260128110042
**********************

[bk-cs]

Based on documentation, it looks like the endpoint required for modifying a workflow is PUT /workflows/entities/definitions/v1. That's currently not part of PSFalcon. I'll take a look and see how it can be added.