Workato Recipe Capabilities: Task-Based Pricing, Trigger Limits & Recipe Architecture
Type: ERP Integration
System: Workato (2025-2026 platform release)
Confidence: 0.88
Sources: 8
Verified: 2026-03-02
Freshness: evolving
TL;DR
- Bottom line: Workato is a cloud-native iPaaS using recipe-based architecture (trigger + actions); pricing is usage-based with every eligible action step counting as a "business action" (task). Expect $15K-$50K+/year depending on task volume and edition.
- Key limit: 1,000 events per single poll in SDK triggers (enforced since June 2025) — recipe stops if exceeded. Design pagination into all high-volume triggers.
- Watch out for: Loop iterations multiply task consumption — a 3-action loop processing 1,000 records = 3,000 business actions per job, not 3.
- Best for: Low-code/no-code enterprise integration with 1,000+ pre-built connectors, especially when business users need to build and manage their own automations.
- Authentication: OAuth 2.0, JWT tokens, and OpenID Connect via API Platform; per-connector auth varies (OAuth, API key, basic auth).
System Profile
Workato is a cloud-native integration and automation platform (iPaaS) that enables teams to build workflows called "recipes" connecting SaaS apps, databases, APIs, and on-premise systems. Unlike code-first platforms like MuleSoft, Workato emphasizes a low-code/no-code approach. The platform has four editions: Standard, Business, Enterprise, and Workato One (top tier with agentic AI capabilities).
This card covers core recipe architecture, task-based pricing, platform-wide limits (including the critical 1,000-event trigger limit), and API Platform capabilities. It does NOT cover specific connector behavior for individual ERP systems.
| Property | Value |
| Vendor | Workato (operates as SAP subsidiary since 2024) |
| System | Workato iPaaS Platform (2025-2026 release) |
| API Surface | REST, Webhooks, SDK Connectors, API Platform (Gateway) |
| Editions Covered | Standard, Business, Enterprise, Workato One |
| Deployment | Cloud (SaaS) with on-premise agent (OPA) option |
| API Docs | Workato Documentation |
| Status | GA |
API Surfaces & Capabilities
Workato exposes multiple integration surfaces depending on the use case. The recipe engine is the core, but the API Platform, webhook gateway, and connector SDK each serve different patterns.
| API Surface | Protocol | Best For | Max Throughput | Rate Limit | Real-time? | Bulk? |
| Recipe Engine | Internal orchestration | All integration patterns | 30 concurrent jobs/workspace | 5,000 recipes/workspace | Yes | Yes (batch triggers) |
| Webhook Gateway | HTTPS/JSON | Real-time inbound events | 20 events/sec steady, 9K burst | 72,000 events/hour | Yes | No |
| API Platform | REST (HTTPS/JSON) | Exposing recipes as API endpoints | Workspace concurrency limit | Configurable per access policy | Yes (30s sync) | No |
| Connector SDK | Custom HTTP | Building custom connectors | 3-min HTTP timeout/request | 1,000 events/poll | Depends | Depends |
| On-Prem Agent (OPA) | Tunneled HTTPS | Secure on-prem access | 500s request timeout | 20 groups, 10 agents/group | Yes | Limited |
| Event Streams | Internal pub/sub | Cross-recipe event routing | 512 KB/message | 20 topics/workspace | Yes | No |
Rate Limits & Quotas
Per-Request Limits
| Limit Type | Value | Applies To | Notes |
| Max trigger event payload | 50 MB | All triggers | Exceeding silently truncates |
| Max callable recipe payload | 1 MB (compressed) | Callable/API recipes | Use file storage for larger payloads |
| Max events per single poll | 1,000 | SDK connector triggers | Recipe STOPS if exceeded — implement pagination |
| API Platform sync timeout | 30 seconds | API endpoint recipes | Use async pattern for longer operations |
| API Platform async timeout | 240 seconds | API endpoint recipes | Job must complete within this window |
| API Platform max payload | 5 MB | API endpoints | Inbound request body limit |
| CSV parse max rows | 50,000 | CSV parser action | Use batch/streaming for larger files |
| XML parse limit | 100 MB | XML parser action | Split larger documents |
| JSON parse limit | 700 MB | JSON parser action | Large but can cause timeouts |
Rolling / Daily Limits
| Limit Type | Value | Window | Edition Differences |
| Recipes per workspace | 5,000 | Permanent | Same across editions |
| Recipe concurrency | 30 | Per workspace, concurrent | Expandable via Customer Success |
| Webhook steady rate | 20 events/sec (72K/hour) | Per environment | Same across editions |
| Webhook burst allowance | 9,000 events | Beyond steady rate | One-time burst buffer |
| AI by Workato | 60 req/min (direct) | Per workspace | Embedded: 10 req/min; Sandbox: 5 req/min |
| PDF operations | 1,000/day | Per workspace | Large file ops: 10/hour |
| Developer API rate | 60 req/min (standard) | Per user | High-volume GET: 1K-2K req/min |
Execution Limits
| Limit Type | Value | Notes |
| Standard job timeout | 90 minutes | Entire recipe execution |
| HTTP action timeout (wait=true) | 1 hour | Blocks until response |
| Polling trigger timeout | 5 minutes | Per poll cycle |
| JavaScript execution | 30 seconds, 256 MB | 1 MB max code size |
| Python execution | 90 seconds, 256 MB | 1 MB max code size |
| Database action timeout | 500 seconds | Deferred actions: 2 hours |
| Consecutive empty polls | 600 (decreasing to 50) | Before 5-minute pause |
| Max recipe steps | 1,000 | Includes all actions, conditionals, loops |
Authentication
| Flow | Use When | Token Lifetime | Refresh? | Notes |
| OAuth 2.0 (per-connector) | Connecting to SaaS apps | Varies by app | Yes (automatic) | Most common; Workato handles refresh |
| API Token | Exposing recipes via API Platform | Until revoked | N/A | Passed in api-token header |
| OAuth 2.0 (API Platform) | External clients calling endpoints | Configurable | Yes | Token introspection (2025+) |
| JWT Token (API Platform) | Server-to-server API calls | Configurable | New JWT per request | JWKS validation (max 64 KB) |
| Mutual TLS (mTLS) | High-security API access | Certificate-based | N/A | Two-way authentication (2025+) |
| On-Prem Agent (OPA) | Behind-firewall systems | Session-based | Automatic | Outbound-only, no inbound firewall rules |
Authentication Gotchas
- Each connection is workspace-scoped — recipes in different workspaces cannot share connections. [src3]
- If a connected app's OAuth refresh token expires (e.g., Salesforce 90-day policy), all recipes using that connection fail silently. [src3]
- API Platform tokens do not auto-rotate. Implement a rotation schedule and scope tokens to specific API collections. [src7]
- On-prem agent outage queues up to 10,000 events before dropping. [src2]
Constraints
- 1,000-event trigger limit: SDK connector triggers cannot return more than 1,000 events per single poll. Recipe STOPS if exceeded. Enforced since June 9, 2025. Implement pagination.
- 30 concurrent jobs: Default workspace concurrency is 30 simultaneous recipe executions. All recipes share this pool.
- Task-based billing on loops: Every eligible action inside a loop counts per iteration. 5 actions x 1,000 rows = 5,000 business actions.
- 50 MB trigger payload: Exceeding truncates silently — no error, no notification. Data disappears.
- 1,000 step recipe limit: Decompose complex orchestrations into callable sub-recipes.
- 5,000 recipe workspace limit: Plan workspace architecture for large deployments.
- 90-minute job timeout: Chain recipes via callable recipes or event streams for longer processes.
- Data retention: 30 days (Standard/Business) or 90 days (Enterprise). Plan external logging for audits.
Integration Pattern Decision Tree
START -- User needs to build an integration on Workato
|-- What's the integration pattern?
| |-- Real-time (individual records, <1s)
| | |-- Source supports webhooks?
| | | |-- YES --> Webhook trigger (20 events/sec, 9K burst)
| | | +-- NO --> Polling trigger (5-min minimum interval)
| | +-- Need to expose an API?
| | |-- YES --> API Platform recipe endpoint (30s sync)
| | +-- NO --> Standard recipe with real-time trigger
| |-- Batch/Bulk (scheduled, high volume)
| | |-- < 1,000 records --> Standard batch trigger
| | |-- < 50,000 records --> Batch trigger with CSV streaming
| | +-- > 50,000 records --> Bulk trigger (CSV streaming)
| |-- Event-driven (cross-recipe, pub/sub)
| | |-- Same workspace --> Callable recipes (1 MB, 10K queue)
| | +-- Cross-workspace --> Event Streams (512 KB, 20 topics)
| +-- File-based --> File connector + parse action
|-- Data volume?
| |-- < 1K/day --> Standard pricing
| |-- 1K-100K/day --> Watch task consumption
| +-- > 100K/day --> High-Volume Recipe (HVR)
+-- Error tolerance?
|-- Zero-loss --> Error handling + retry + dead letter recipe
+-- Best-effort --> Standard RecipeOps monitoring
Quick Reference
Recipe Architecture Components
| Component | Definition | Task Impact | Limit |
| Recipe | Complete workflow: 1 trigger + N actions | Container (no direct cost) | 5,000/workspace |
| Trigger | Event that starts execution | Not counted | 1 per recipe |
| Action | Step that does work (CRUD, transform) | 1 business action per eligible step | 1,000 steps/recipe |
| Conditional (IF) | Branch logic | NOT counted | Part of 1,000 limit |
| Repeat loop | Iteration over a list | Actions inside x iterations | Part of 1,000 limit |
| Callable recipe | Sub-recipe invoked by another | Not counted (utility) | 10,000 queue depth |
| Error handler | Try/catch block | NOT counted | Part of 1,000 limit |
| Variables | Set/get workspace variables | NOT counted | Part of 1,000 limit |
Task-Based Pricing: What Counts vs. What Doesn't
| Counts as Business Action | Does NOT Count |
| Third-party connector actions (Salesforce, Workday, Slack, etc.) | Triggers (any type) |
| Community connector actions | Conditional logic (IF/ELSE) |
| AI by Workato actions | Callable Recipe invocations |
| HTTP connector actions | Variables (set/get) |
| JavaScript/Python/Ruby snippets | Scheduler |
| FTP/SFTP actions | RecipeOps actions |
| SMS / RPA actions | Logger |
| CSV/XML/JSON parser actions | Workato Data Tables actions |
| API Platform by Workato |
Pricing Tiers Overview
| Edition | Capabilities | Estimated Annual Cost | Key Differentiator |
| Standard | Core integration, workspace management | ~$15K-$25K | Entry-level enterprise iPaaS |
| Business | + Advanced orchestration, enhanced connectivity | ~$25K-$50K | Most common for mid-market |
| Enterprise | + Advanced security, governance, 90-day retention | ~$50K-$100K+ | Full enterprise feature set |
| Workato One | + Agent Studio, AI agents, MCP Gateway | Custom | Agentic AI capabilities (2025+) |
Workato does not publish pricing publicly. Costs are custom-quoted. Task packages start at 1M business actions minimum. High-Volume Recipes (HVRs) available for flat-rate pricing. Typical enterprise discounts: 53-65% off list.
Step-by-Step Integration Guide
1. Create a connection to your target application
Connections authorize recipes to interact with external apps. Each connection is workspace-scoped and reusable. [src3]
Workato UI: Settings > Connections > Create connection
1. Select application (e.g., Salesforce, NetSuite)
2. Choose authentication method (OAuth 2.0 recommended)
3. Authorize access via the app's login flow
4. Test connection — verify green "Connected" status
Verify: Connection shows "Connected" in Connections panel.
2. Build a recipe with trigger and actions
Recipes follow a trigger-action pattern. One trigger starts the recipe; one or more actions execute in sequence. [src3]
Workato UI: Projects > New Recipe
1. Select trigger type (Polling, Real-time, Scheduled)
2. Add actions and map datapills from trigger output
3. Add conditional logic (IF blocks) for branching
4. Add error handling (Try/Catch) for production resilience
5. Test recipe with sample data before starting
Verify: Test recipe — job completes with expected output in Job Details.
3. Handle high-volume data with batch/bulk triggers
For volumes exceeding 1,000 records, use batch or bulk triggers to avoid hitting the 1,000-event poll limit. [src4, src6]
Batch trigger: configurable batch size (100-1,000 typical)
- Each batch = 1 job, not 1 job per record
- Task consumption = actions inside loop x batch size
Bulk trigger: CSV streaming, no per-record access
- No upper limit on records per job
- Best for data migration and daily syncs
Verify: Check Job Details for expected record count. Monitor Usage dashboard.
4. Implement error handling and retry logic
Production recipes must handle failures gracefully. [src1, src3]
1. Wrap critical actions in Handle errors (Try/Catch) block
2. In Catch branch: log error (Logger, free), send alert (1 task)
3. For retries: create separate "retry recipe" with exponential backoff
4. For dead letter: write failed records to Data Table (free)
5. Monitor via RecipeOps triggers for systematic failure detection
Verify: Force error in test — verify Catch branch executes and alert sends.
Code Examples
Python: Call a Workato API Platform Endpoint
# Input: Workato API Platform endpoint URL + API token
# Output: API response from the recipe endpoint
import requests # requests>=2.31.0
WORKATO_API_URL = "https://apim.workato.com/your-prefix/your-endpoint"
API_TOKEN = "your-api-token"
headers = {
"api-token": API_TOKEN,
"Content-Type": "application/json"
}
response = requests.post(
WORKATO_API_URL,
headers=headers,
json={"customer_id": "CUST-001", "action": "sync_order"},
timeout=35 # Client timeout > Workato's 30s sync limit
)
if response.status_code == 200:
print(f"Success: {response.json()}")
elif response.status_code == 429:
retry_after = int(response.headers.get("Retry-After", 60))
print(f"Rate limited. Retry after {retry_after}s")
JavaScript/Node.js: Trigger a Recipe via Webhook
// Input: Workato webhook URL from a webhook trigger recipe
// Output: Acknowledgment that event was received
const WEBHOOK_URL = "https://www.workato.com/webhooks/rest/your-webhook-id";
async function sendEvent(payload) {
const response = await fetch(WEBHOOK_URL, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify(payload),
});
if (response.status === 200) {
console.log("Event accepted by Workato");
} else if (response.status === 429) {
console.log("Rate limited - reduce frequency (20 events/sec max)");
}
}
await sendEvent({
event_type: "order_created",
order_id: "ORD-12345",
timestamp: new Date().toISOString(),
});
cURL: Test API Platform Endpoint
# Sync call — must complete within 30 seconds
curl -X POST "https://apim.workato.com/your-prefix/your-endpoint" \
-H "api-token: YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{"customer_id": "CUST-001"}' \
--max-time 35
# Test webhook trigger
curl -X POST "https://www.workato.com/webhooks/rest/YOUR_WEBHOOK_ID" \
-H "Content-Type: application/json" \
-d '{"event": "test", "timestamp": "2026-03-02T10:00:00Z"}'
Data Mapping
Recipe Data Flow Model
| Source | Target | Type | Transform | Gotcha |
| Trigger output datapills | Action input fields | Dynamic | Direct mapping via drag-drop | Types must match — no implicit coercion |
| Formula functions | Action input fields | Computed | String/date/number transforms | Formula errors abort entire job |
| Lookup Tables | Action input fields | Reference | Key-value lookup | Max 100K rows; miss returns null |
| Data Tables | Action/trigger fields | Stored | CRUD operations | 1M row limit; 100 tables/workspace |
| Environment properties | Any field | Config | Variable substitution per env | 1,024 char value limit |
| Callable recipe output | Parent recipe actions | Cross-recipe | Return values from sub-recipes | 1 MB compressed payload limit |
Data Type Gotchas
- Workato stores timestamps in UTC internally. When mapping to timezone-aware fields, explicitly convert with
.in_time_zone(). [src3]
- Workato treats
null and "" differently. Some connectors treat empty string as "clear field" while null means "don't update." [src3]
- Currency values from APIs as floats may lose precision. Use string-to-decimal conversion for financial data. [src3]
- List datapills mapped to single-value fields silently use only the first element. Always use inside Repeat loops. [src3]
Error Handling & Failure Points
Common Error Codes
| Code | Meaning | Cause | Resolution |
| 429 | Rate limit exceeded | Exceeding 20 events/sec webhook rate | Backoff; spread events; request increase |
| 408 | Job timeout | Execution exceeded 90 minutes | Break into callable sub-recipes |
| Recipe stopped | Trigger limit exceeded | SDK trigger returned >1,000 events | Implement pagination with cursor |
| PAYLOAD_TOO_LARGE | Payload exceeded limit | Trigger >50 MB or callable >1 MB | Stream via file storage; chunk payloads |
| CONNECTION_ERROR | Authentication failure | OAuth token expired | Re-authorize; monitor connection health |
| CONCURRENCY_LIMIT | All 30 slots occupied | Too many simultaneous jobs | Increase via CS; stagger schedules |
Failure Points in Production
- Silent trigger data loss: Payload >50 MB truncates silently — no error. Fix:
Validate payload size at source; implement checksums. [src1]
- Loop-based task explosion: 5 actions x 10,000 rows = 50,000 business actions per job. Fix:
Use batch/bulk triggers; convert to HVR for flat-rate pricing. [src5]
- Consecutive empty poll throttling: After 600 polls with no events, Workato pauses 5 minutes. Fix:
Use webhook triggers for event-driven patterns. [src6]
- Callable recipe queue overflow: 10,000 queue fills during spikes, dropping invocations. Fix:
Monitor queue via RecipeOps; use Event Streams for critical comms. [src2]
- OAuth refresh token expiry: Connections fail silently after token expiry. Fix:
Schedule weekly lightweight API calls to keep tokens active. [src3]
- Workspace concurrency starvation: 30 slots consumed by long-running recipes block new jobs. Fix:
Optimize execution time; reserve slots for critical recipes; request increase. [src1]
Anti-Patterns
Wrong: Processing every record individually in a loop
// BAD -- Creates massive task consumption, hits concurrency limits
// Trigger: New rows (5,000 rows)
// For each row -> Create record in Salesforce
// Result: 5,000 business actions for 1 job
Correct: Use batch trigger with bulk actions
// GOOD -- Single batch action for all records
// Trigger: New rows (batch of 1,000)
// Action: Bulk create in Salesforce (1 task per batch)
// Result: 5 jobs x 1 task = 5 tasks instead of 5,000
Wrong: Hardcoding environment-specific values
// BAD -- Breaks when promoted from dev to staging to prod
// Action: HTTP POST to "https://api.prod.example.com/orders"
// Connection: "Salesforce Production" (hardcoded)
Correct: Use environment properties and connection aliases
// GOOD -- Same recipe works across all environments
// Action: HTTP POST to ENV["API_BASE_URL"] + "/orders"
// Connection: environment-specific (auto-swapped on promote)
Wrong: Building one massive recipe with 500+ steps
// BAD -- Approaches 1,000 step limit; impossible to debug
// One recipe: 500 actions covering entire order-to-cash
Correct: Decompose into callable sub-recipes
// GOOD -- Focused, testable, reusable
// Main: trigger -> call "Create Invoice" -> call "Update Inventory"
// Each sub-recipe: 20-50 steps, independently testable
// Callable invocations do NOT count as business actions
Common Pitfalls
- Misunderstanding task metering in loops: 3 actions in loop x 1,000 records = 3,000 business actions, not 3. Fix:
Calculate (eligible actions) x (iterations) x (frequency) before deploying. [src5]
- Ignoring the 1,000-event poll limit: Post-June 2025, recipes stop immediately when exceeding. Fix:
Implement cursor-based pagination in all SDK triggers. [src6]
- Concurrency contention: 30 slots sounds enough until 200 recipes run every 5 minutes. Fix:
Stagger polling intervals; consolidate into callable chains; request increase. [src1]
- Treating Data Tables as a database: 1M row limit, 100 tables, limited queries. Fix:
Use for lookups and dead letter queues — not primary data store. [src2]
- Skipping error handling: Default: one failed action stops entire job, no notification. Fix:
Wrap all production recipes in Try/Catch; add RecipeOps alerting. [src3]
- Promoting without testing environment properties: Missing properties cause runtime errors after promotion. Fix:
Maintain property checklist per environment; test in staging first. [src2]
Diagnostic Commands
# Check recipe job history (Developer API)
curl -X GET "https://www.workato.com/api/recipes/{recipe_id}/jobs" \
-H "Authorization: Bearer YOUR_API_TOKEN"
# Check workspace usage / task consumption
# UI: Settings > Usage > Business Actions
curl -X GET "https://www.workato.com/api/usage" \
-H "Authorization: Bearer YOUR_API_TOKEN"
# Test a connection
curl -X POST "https://www.workato.com/api/connections/{id}/test" \
-H "Authorization: Bearer YOUR_API_TOKEN"
# List active recipes
curl -X GET "https://www.workato.com/api/recipes?active=true" \
-H "Authorization: Bearer YOUR_API_TOKEN"
# Check API Platform endpoint health
curl -X GET "https://apim.workato.com/your-prefix/health" \
-H "api-token: YOUR_API_TOKEN"
Version History & Compatibility
| Release | Date | Status | Key Changes | Migration Notes |
| 2026 Q1 | 2026-01 | Current | Enterprise MCP, Data Pipelines GA | MCP Gateway requires Workato One |
| 2025 H2 | 2025-07 | Supported | Agent Studio GA, Custom Domains, mTLS | API Platform features require Business+ |
| 2025-06-09 | 2025-06 | Enforcement | 1,000-event trigger limit enforced | All SDK triggers must paginate |
| 2025 H1 | 2025-01 | Supported | Workato One launch, AI by Workato | New pricing tier |
| 2024 | 2024 | Supported | Data Tables, Event Streams enhancements | Lookup Tables still supported |
Workato does not follow numbered API versioning. Breaking changes are announced 3-6 months in advance via Product Hub. The Developer API maintains backward compatibility.
When to Use / When Not to Use
| Use When | Don't Use When | Use Instead |
| Business users need low-code integrations | Complex API transforms requiring full code | MuleSoft Anypoint |
| Mid-market/enterprise, 50-500 integrations | Startup with <10 simple integrations | Zapier, Make |
| Need 1,000+ pre-built SaaS connectors | Deep ERP customization (ABAP, SuiteScript) | Native ERP tools |
| Want AI agent capabilities (Agent Studio, MCP) | Pure batch ETL/data pipeline workload | Fivetran, Airbyte |
| Need on-premise connectivity via OPA | Sub-second latency streaming at scale | Kafka, Confluent |
| Exposing internal workflows as managed APIs | Full API lifecycle management (design-first) | Apigee, Kong |
Cross-System Comparison
| Capability | Workato | MuleSoft | Celigo | Boomi | Notes |
| Architecture | Recipe-based (low-code) | Flow/API-first (code-heavy) | Flow-based (low-code) | Process/flow (low-code) | |
| Pricing model | Task-based (business actions) | vCore-based (compute) | Flow-based (flat) | Connection-based | |
| Pre-built connectors | 1,000+ | 400+ (Exchange) | 200+ (pre-built flows) | 200+ | Workato largest |
| Max concurrent jobs | 30 (expandable) | Unlimited (vCore) | Plan-dependent | Plan-dependent | |
| Webhook throughput | 20 events/sec | Unlimited (vCore) | Plan-dependent | Plan-dependent | |
| On-premise | OPA (agent) | Runtime (full engine) | Agent-based | Atom (agent) | |
| AI/Agent capabilities | Agent Studio, MCP (2025+) | Einstein AI (limited) | AI Mapper | Boomi AI | Workato most advanced |
| Learning curve | Low (business users) | High (developers) | Low-Medium | Medium | |
| Best for | Business-led, mid-market | Enterprise API strategy | E-commerce, NetSuite | Broad integration | |
| Trigger event limit | 1,000 per poll | No per-poll limit | Connector-dependent | Connector-dependent | |
Important Caveats
- Pricing opacity: Workato does not publish pricing publicly. All estimates are based on third-party reports. Always request a custom quote.
- Task consumption surprises: Loop iterations multiply costs. Always model task usage before deploying high-volume recipes.
- 1,000-event limit is per-poll, not per-day: Pagination allows unlimited total events across multiple polls. Poorly designed triggers that return >1,000 per poll cause immediate recipe stoppage.
- Edition-gated features: Agent Studio, MCP Gateway, 90-day retention, and advanced security require Enterprise or Workato One editions.
- SAP acquisition impact: Workato operates independently under SAP. Monitor for changes in connector priorities and pricing.
- Platform limits change continuously: Always verify against Workato Docs before designing production integrations.
Related Units