From d6c642b170b9547fe1d8db190affa35b305c9c8a Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Thu, 23 Apr 2026 18:30:18 +0200
Subject: [PATCH] feat: add Azure Event Grid triggers (#8888)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat: add Azure Event Grid triggers (EE)

Introduces a new enterprise trigger kind `azure` that supports three
modes via a single unified trigger type:
- basic_push: Azure Event Grid basic — custom topics, system topics
  (Storage, Resource Manager, Key Vault, etc.), domains (push only)
- namespace_push: Event Grid Namespace topics (CloudEvents over HTTP push)
- namespace_pull: Event Grid Namespace topics (HTTP pull with lock-token
  ack/reject for dead-lettering)

Auth uses a Service Principal resource (tenant_id, client_id,
client_secret, subscription_id). Subscriptions are created in
CloudEvents 1.0 schema so the push webhook handler and the pull listener
share one payload parser.

Backend
- New crate `windmill-trigger-azure` (OSS stubs + EE impl symlinked from
  windmill-ee-private)
- Migration `azure_trigger` table with CHECK constraints enforcing
  mode/columns coherence
- `TriggerKind::Azure`, `JobTriggerKind::Azure`,
  `DeployedObject::AzureTrigger` variants
- Push route `/api/azure/w/{workspace}/*path` handles classic
  Event Grid SubscriptionValidation handshake and CloudEvents 1.0
  abuse-protection OPTIONS handshake
- Optional inbound JWT validation (audience check only for v1)
- Feature flag `azure_trigger` propagated through windmill-api,
  windmill-store (resource helper), and added to ee_core

Frontend
- `triggers/azure/` editor with mode toggle (basic/namespace-push/
  namespace-pull) and per-mode config (topic ARM id / namespace +
  topic name / subscription / filters / push auth / pull options)
- Registered in icon map, display names, save functions, badge,
  wrapper, editor, add-trigger menu

OpenAPI
- `AzureTrigger`, `AzureTriggerData`, `AzureMode`,
  `AzureSubscriptionMode`, `AzureDeliveryConfig`, `TestAzureConnection`
  schemas; `/azure_triggers/*` endpoints; client regenerated

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to eaa7c3a9cb37a9ccc93f10a2535d929365acd2d8

This commit updates the EE repository reference after PR #541 was merged in windmill-ee-private.

Previous ee-repo-ref: 9689014e8c12c36c1059fd8fa5758d550b8b8bc9

New ee-repo-ref: eaa7c3a9cb37a9ccc93f10a2535d929365acd2d8

Automated by sync-ee-ref workflow.

* feat(azure-trigger): secret-auth push, ARM discovery, capture isolation, CLI + parity

Frontend:
- Split mode selector into Namespace/Basic + Pull/Push
- ARM resource dropdowns (namespaces, Basic topics, namespace topics)
  populated from the service principal; cascade with stale-selection
  reset on SP / edition change
- Remove stale authenticate toggle + audience input (server-managed
  push_auth_config has replaced them)
- Azure listing page: "Create from template" button; "Also delete Azure
  subscription" toggle in the delete modal; simplified trigger label
  falling back to path
- AzureCapture.svelte: "Test subscription name" with -wm-capture suffix
- CompareWorkspaces.svelte: wire Azure for fork/compare
- Drop Trigger-deployed/event-loss warning (capture subscription is
  isolated with -wm-capture)

Backend:
- Shared-secret push auth (see EE crate for detail)
- JSONB push_auth_config column (renamed from delivery_config), #[serde(skip)]
  so clients/CLI/exports never see it
- Drop redundant enabled column; mode supersedes
- Azure capture infra: AzureTriggerConfig + set_azure_trigger_config +
  azure_payload route + TriggerKind::Azure arm; PT15M queue TTL on
  capture subscriptions so they bound storage after tab close
- Granular ACLs, users offboarding, trash, git-sync deployed-object:
  all include azure_trigger

CLI:
- Add azure to TRIGGER_TYPES, pushObj dispatch, getTypeStrFromPath,
  trigger commands (get/update/create/list/template), sync delete
  switch + regex; e2e test for `trigger new --kind azure`
- system_prompts: SCHEMA_MAPPINGS + schema_names include AzureTrigger;
  auto-generated/* regenerated

Skill:
- .claude/skills/adding-a-trigger/ checklist covering every file that
  needs editing when wiring a new trigger type (learned from this PR)

ee-repo-ref bumped to b0e490cbf3724b7b64c6a5b010e3bdf24acd873c.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(azure-trigger): ci — ShareModal Kind + regenerated system_prompts

- frontend/src/lib/components/ShareModal.svelte: add 'azure_trigger'
  to the Kind type so the listing page's "Permissions" action compiles
  (ts2345 — caught by npm_check on CI, missed by fast-check locally).
- system_prompts/auto-generated/: regenerate to drop the stale
  delivery_config / AzureDeliveryConfig fields from the Azure schema
  (check-freshness on CI).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(azure-trigger): use workspace constant_time_eq crate

Drop hand-rolled constant-time compare in favour of the workspace
constant_time_eq crate (same one used by http_trigger_auth).

ee-repo-ref bumped to 9659382d47286e7f7f66d01b6f5dd8d4ed34848b.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(azure-trigger): pass placeholder + disabled via inputProps

`TextInput`'s `placeholder` and `disabled` go through its `inputProps`
prop — CI's `npm run check` caught the stale top-level passing that
`npm run check:fast` missed. Align with the DefaultEmailConfigSection
pattern.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(azure-trigger): correct LATEST_GIT_SYNC_SCRIPT_PATH version to 28213

The hub deploy of the azure-aware sync-script is version 28213, not
28214. Backend was pinning a non-existent hub script, which broke the
git_sync_e2e suite (every deploy's sync step 404'd).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(azure-trigger): add azure_triggers to token scope selector + skill

- windmill-api/src/token.rs: `build_trigger_scope_domains` was missing
  `("azure_triggers", "Azure Event Grid")`, so the CreateToken UI's scope
  selector didn't surface azure_triggers:read/write. Backend already had
  `ScopeDomain::AzureTriggers` wired (scopes.rs), this just exposes it.
- .claude/skills/adding-a-trigger/SKILL.md: capture both scope-related
  files under the hardcoded-arrays section so future triggers don't miss
  the UI surface.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(adding-a-trigger-skill): clarify token.rs scope effect

Not a regression — nothing was working before. Skipping TRIGGER_DOMAINS
just means the scope works via API/CLI but has no UI checkbox.

* docs(adding-a-trigger-skill): trim token.rs bullet

* fix(azure-trigger): regen openapi-deref + swap textarea for TextInput

- Run build_openapi.sh to regenerate openapi-deref.{yaml,json} with the
  12 azure_triggers paths + schemas. These files are served by the
  runtime (include_str! in windmill-api/src/lib.rs) to external SDK
  consumers; without this regen the new endpoints wouldn't be advertised.
- Replace the raw <textarea> for event type filters with the
  design-system TextInput in textarea mode (frontend/CLAUDE.md bans raw
  HTML elements).

Addresses cubic + claude PR review items.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 .claude/skills/adding-a-trigger/SKILL.md      |  265 ++
 ...bc7e9ee85289ff5c52af43166928337c257e7.json |    1 +
 ...7b23d6dcf2e5364852a5e85b3c41c417bace2.json |    1 +
 ...66f38ffe2f3a0958adea53e67757c6ac463ec.json |    1 +
 ...243ad2e0aef485a780daea5d76b0be2bb2ea2.json |    1 +
 ...adbb2860ce52d37a56b2861de1215260ecff8.json |    2 +
 ...fbe7db4887c4ac5295052c796bd78a7edc50b.json |    1 +
 ...f518b42f4cdb33e034441015494bd26c172d2.json |    1 +
 ...cad6d8995242dc20a4e14c1a8fae4fc6a9fd2.json |    1 +
 ...2f7175cc6f2e02d9c565bb5159cae3e0b6835.json |    1 +
 ...08532a1020cabaf5e22325a1e05f0491d785c.json |    1 +
 ...e35adf640d44d607e62a1fb296e38ac3fdd36.json |    2 +
 ...1a803e1bced2f8e1a12f8933b7598ee85a147.json |    1 +
 ...04af5a7eb488c76f783e690af0c2153b1d6a8.json |    1 +
 ...4f412c57af931f80621aee5012e9cb3535626.json |    1 +
 ...8d92a983470adcd3cc850734960c905e61e83.json |    1 +
 ...d2d390604f4fc4cb330842a88d5764cbcf0c6.json |    1 +
 ...ca846dd5e7fe7ceb1aa8b3fcd26a2bd30eb2c.json |    1 +
 ...a22e4276c1da653475628889ce17dc904fbaa.json |    1 +
 ...6eb9016207975af1e37042d81df8cb6ae2c53.json |    1 +
 ...214dc62651c8ae4ffa2be8b5aa68d8f8e791.json} |   16 +-
 ...506bf08c28efe82b68b3d44bafbd3d0e91c29.json |    1 +
 ...d2393e297043e4e58555d872b5c4dd89c196a.json |    1 +
 ...3a960b89e02ec40b292f3b5198baf2a1d3dbf.json |    1 +
 ...fbafe5dc3cdecc17a3d5a7476b160c1b6e7e1.json |    1 +
 ...e33244fe8ab9a803248fc23f334034d24aad4.json |    1 +
 ...95d8cd99fc26e5bd466942423cbd09efcebe4.json |   53 +
 ...bb6a8f961c119516e4c33dc928cd3b4f4edbc.json |    1 +
 ...9e637e9e156cd85b69126c87dfff89a47711d.json |    1 +
 ...9746147aa9b8d0a81642a7b7cb4738a0cad66.json |    1 +
 ...d434f860922fbc021185beffb9827647feb8e.json |    1 +
 ...13f1f882b695f896f94e5cf91d205633355a1.json |    1 +
 ...e1ea2fe96a1b94f5a92953fb1c1642d15c016.json |    1 +
 ...120e5b0f629f9f04e08a2982df33ff23ac7a9.json |    1 +
 ...1a8a9cc35f362197c0766a5787436af141106.json |    1 +
 ...9b9f6877de8bc7d4714915bbd572946d9270a.json |   53 +
 ...9352d4d1e3cb3a8a08f1c9c03055a1cab1235.json |    1 +
 ...f03f72ef81db302d727e18e63a307ac902022.json |    1 +
 ...c35c7342ac9a814c73f6290e1d6ebd3a55423.json |    1 +
 ...50d6a6935420fbedc83aa3ad1e9be7465c8dd.json |    1 +
 ...ffeb7a8dc5632043b6bf4a3dd680c9b99b5df.json |  100 +
 backend/Cargo.lock                            |   35 +
 backend/Cargo.toml                            |    8 +-
 backend/ee-repo-ref.txt                       |    2 +-
 .../20260420162905_add_azure_trigger.down.sql |    5 +
 .../20260420162905_add_azure_trigger.up.sql   |   95 +
 backend/windmill-api-auth/src/scopes.rs       |    3 +
 .../windmill-api-groups/src/granular_acls.rs  |    3 +-
 backend/windmill-api-users/src/users.rs       |    1 +
 .../windmill-api-workspaces/src/workspaces.rs |    2 +
 backend/windmill-api/Cargo.toml               |    6 +-
 backend/windmill-api/openapi-deref.json       |  944 ++++-
 backend/windmill-api/openapi-deref.yaml       | 3495 ++++++++++-------
 backend/windmill-api/openapi.yaml             |  465 +++
 backend/windmill-api/src/capture.rs           |  168 +-
 backend/windmill-api/src/lib.rs               |   18 +
 backend/windmill-api/src/offboarding.rs       |    3 +
 backend/windmill-api/src/token.rs             |    1 +
 backend/windmill-api/src/trash.rs             |    1 +
 .../windmill-api/src/triggers/azure/mod.rs    |    1 +
 backend/windmill-api/src/triggers/handler.rs  |   23 +
 backend/windmill-api/src/triggers/listener.rs |    8 +
 backend/windmill-api/src/triggers/mod.rs      |    2 +
 backend/windmill-api/src/workspaces_export.rs |   18 +
 backend/windmill-common/src/workspaces.rs     |    2 +-
 backend/windmill-git-sync/src/lib.rs          |    8 +
 backend/windmill-store/Cargo.toml             |    1 +
 backend/windmill-store/src/resources.rs       |    1 +
 backend/windmill-trigger-azure/Cargo.toml     |   43 +
 .../windmill-trigger-azure/src/handler_oss.rs |   65 +
 backend/windmill-trigger-azure/src/lib.rs     |   15 +
 .../src/listener_oss.rs                       |   52 +
 backend/windmill-types/src/jobs.rs            |    2 +
 backend/windmill-types/src/triggers.rs        |    3 +
 cli/bun.lock                                  |    1 +
 cli/src/commands/sync/sync.ts                 |   10 +-
 cli/src/commands/trigger/trigger.ts           |   23 +-
 cli/src/guidance/skills.ts                    |   92 +-
 cli/src/types.ts                              |    5 +
 cli/test/list_get_new_commands.test.ts        |   28 +
 .../lib/components/CompareWorkspaces.svelte   |   20 +
 frontend/src/lib/components/Path.svelte       |    7 +
 frontend/src/lib/components/ShareModal.svelte |    1 +
 .../renderers/triggers/TriggersBadge.svelte   |    3 +
 .../src/lib/components/icons/AzureIcon.svelte |   43 +-
 .../src/lib/components/offboarding-utils.ts   |    2 +
 .../search/GlobalSearchModal.svelte           |    9 +-
 .../components/sidebar/OperatorMenu.svelte    |    6 +
 .../components/sidebar/SidebarContent.svelte  |   10 +
 frontend/src/lib/components/triggers.ts       |    1 +
 .../triggers/AddTriggersButton.svelte         |    6 +
 .../components/triggers/CaptureWrapper.svelte |   22 +-
 .../components/triggers/TriggersEditor.svelte |   10 +
 .../triggers/TriggersWrapper.svelte           |   10 +
 .../triggers/azure/AzureCapture.svelte        |   63 +
 .../triggers/azure/AzureTriggerEditor.svelte  |   29 +
 .../AzureTriggerEditorConfigSection.svelte    |  351 ++
 .../azure/AzureTriggerEditorInner.svelte      |  480 +++
 .../triggers/azure/AzureTriggerPanel.svelte   |   67 +
 .../lib/components/triggers/azure/utils.ts    |   63 +
 .../components/triggers/triggers.svelte.ts    |   29 +
 frontend/src/lib/components/triggers/utils.ts |   27 +
 .../src/routes/(root)/(logged)/+layout.svelte |    4 +
 .../(logged)/azure_triggers/+page.svelte      |  635 +++
 .../auto-generated/cli/cli-commands.md        |    6 +-
 system_prompts/auto-generated/prompts.ts      |    6 +-
 .../schemas/azure_trigger.schema.yaml         |   84 +
 .../skills/cli-commands/SKILL.md              |    6 +-
 system_prompts/generate.py                    |    2 +
 system_prompts/utils.py                       |    1 +
 110 files changed, 6732 insertions(+), 1454 deletions(-)
 create mode 100644 .claude/skills/adding-a-trigger/SKILL.md
 rename backend/.sqlx/{query-952f244a06950ccfc70651cb48cdfb7766f7d62d34e68e65b975aaed9e104a5a.json => query-83d79dd52a708da7c0d55a171744214dc62651c8ae4ffa2be8b5aa68d8f8e791.json} (72%)
 create mode 100644 backend/.sqlx/query-ad25201d0eea65972234cade87a95d8cd99fc26e5bd466942423cbd09efcebe4.json
 create mode 100644 backend/.sqlx/query-d9ef1def7044e58722c5c69c31e9b9f6877de8bc7d4714915bbd572946d9270a.json
 create mode 100644 backend/.sqlx/query-efdcdf0f8d24a23682bb3792ebaffeb7a8dc5632043b6bf4a3dd680c9b99b5df.json
 create mode 100644 backend/migrations/20260420162905_add_azure_trigger.down.sql
 create mode 100644 backend/migrations/20260420162905_add_azure_trigger.up.sql
 create mode 100644 backend/windmill-api/src/triggers/azure/mod.rs
 create mode 100644 backend/windmill-trigger-azure/Cargo.toml
 create mode 100644 backend/windmill-trigger-azure/src/handler_oss.rs
 create mode 100644 backend/windmill-trigger-azure/src/lib.rs
 create mode 100644 backend/windmill-trigger-azure/src/listener_oss.rs
 create mode 100644 frontend/src/lib/components/triggers/azure/AzureCapture.svelte
 create mode 100644 frontend/src/lib/components/triggers/azure/AzureTriggerEditor.svelte
 create mode 100644 frontend/src/lib/components/triggers/azure/AzureTriggerEditorConfigSection.svelte
 create mode 100644 frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
 create mode 100644 frontend/src/lib/components/triggers/azure/AzureTriggerPanel.svelte
 create mode 100644 frontend/src/lib/components/triggers/azure/utils.ts
 create mode 100644 frontend/src/routes/(root)/(logged)/azure_triggers/+page.svelte
 create mode 100644 system_prompts/auto-generated/schemas/azure_trigger.schema.yaml

diff --git a/.claude/skills/adding-a-trigger/SKILL.md b/.claude/skills/adding-a-trigger/SKILL.md
new file mode 100644
index 0000000000..c38cc1516d
--- /dev/null
+++ b/.claude/skills/adding-a-trigger/SKILL.md
@@ -0,0 +1,265 @@
+---
+name: adding-a-trigger
+description: Checklist for adding a new TriggerCrud-based trigger type to Windmill (Azure, GCP, Kafka, etc.). Use when wiring a new trigger kind across backend, frontend, CLI, and capture infrastructure.
+---
+
+# Skill: Adding a New Trigger Type
+
+Use this skill when adding a trigger kind that implements `TriggerCrud` (Kafka, GCP, Azure, MQTT, SQS, NATS, Postgres, Email…). For native triggers (Nextcloud, Google Drive — things wired through `windmill-native-triggers`), use the `native-trigger` skill instead.
+
+The goal of this doc is to enumerate every file that needs to change. Missing any one of them leads to silent regressions: sync drops the trigger, capture button does nothing, workspace forks lose it, sidebar counters undercount. Follow the checklist top-to-bottom — each section is independent enough to be validated on its own.
+
+Throughout this doc, substitute `{kind}` for the new trigger kind (`azure`, `kafka`, …), `{Kind}` for PascalCase (`Azure`, `Kafka`), `{KIND}` for SCREAMING (`AZURE`, `KAFKA`).
+
+## Reference implementations
+
+- **GCP** — closest analogue to Azure. Has push + pull, OIDC auth, ARM-like resource paths, capture handler. Grep for `gcp_trigger` / `GcpTrigger`.
+- **Kafka** — simpler (pull-only, streaming). Good for trivial integrations.
+- **Azure** — most recently added (2026). Shared-secret push auth, Event Grid namespaces + basic topics, ARM resource discovery, Namespace-pull data-plane. Grep for `azure_trigger` / `AzureTrigger`.
+
+## 1. Database migration
+
+Create a migration: `cargo sqlx migrate add -r add_{kind}_trigger` from `backend/`. Never write timestamps manually.
+
+The `up.sql` usually defines:
+- An optional enum type (e.g. `AZURE_MODE`) if the trigger has sub-kinds
+- The `{kind}_trigger` table with at minimum these columns (mirrored from kafka/gcp):
+  - primary: `(workspace_id, path)`
+  - `script_path`, `is_flow`, `enabled`, `mode`, `permissioned_as`, `edited_by`, `email`
+  - `edited_at`, `error`, `server_id`, `last_server_ping`
+  - `error_handler_path`, `error_handler_args jsonb`, `retry jsonb`
+  - trigger-specific fields
+- Indexes on foreign keys + any frequently-filtered columns
+- Foreign key to `workspace`
+
+Down migration drops the table and any enum types.
+
+## 2. Backend crate (`windmill-trigger-{kind}`)
+
+Create a new crate under `backend/windmill-trigger-{kind}/` with:
+
+- `Cargo.toml`: features `enterprise`, `private` if EE, standard deps
+- `src/lib.rs`: `pub use mod_ee::*;` behind `#[cfg(all(feature = "enterprise", feature = "private"))]`
+- `src/mod_ee.rs`: core types + helpers
+- `src/handler_ee.rs`: `TriggerCrud` impl + route handlers
+- `src/listener_ee.rs`: (only if streaming/pull-based) `Listener` trait impl
+
+Required in `mod_ee.rs`:
+- `{Kind}Config` struct (persisted shape, `FromRow`)
+- `{Kind}ConfigRequest` struct (what API receives — usually similar to Config but with validation fields)
+- `{Kind}Trigger` unit struct (implements the traits)
+- `impl TriggerJobArgs for {Kind}Trigger` — sets `TRIGGER_KIND`, `Payload`, `v1_payload_fn`
+
+Required in `handler_ee.rs`:
+- `#[async_trait] impl TriggerCrud for {Kind}Trigger` with:
+  - `type Trigger = Trigger<{Kind}Config>`
+  - `type TriggerConfigRequest = {Kind}ConfigRequest`
+  - `const ROUTE_PREFIX: &'static str = "/{kind}_triggers";`
+  - `const TABLE_NAME`, `ADDITIONAL_SELECT_FIELDS`
+  - `get_deployed_object`, `validate_config`, `create_trigger`, `update_trigger`, `delete_trigger`, `test_connection`
+  - `additional_routes` (optional — mount extra endpoints for things like ARM resource listing, topic discovery)
+
+Register the crate in `backend/Cargo.toml` as a workspace member and as a dep of `windmill-api` behind the feature flag.
+
+## 3. Wire into `windmill-api` (feature-gated everywhere)
+
+**`backend/windmill-api/src/triggers/handler.rs`** — mount the trigger crate:
+```rust
+#[cfg(all(feature = "enterprise", feature = "{kind}_trigger", feature = "private"))]
+{
+    use crate::triggers::{kind}::{Kind}Trigger;
+    router = router.nest({Kind}Trigger::ROUTE_PREFIX, complete_trigger_routes({Kind}Trigger));
+}
+```
+
+**`backend/windmill-api/src/triggers/{kind}/mod.rs`** — re-export the crate:
+```rust
+pub use windmill_trigger_{kind}::*;
+```
+
+**`backend/windmill-api/src/lib.rs`** — if the trigger receives inbound pushes, add a webhook route:
+```rust
+.nest("/{kind}/w/{workspace_id}", {
+    #[cfg(all(feature = "enterprise", feature = "{kind}_trigger", feature = "private"))]
+    { triggers::{kind}::handler_oss::{kind}_push_route_handler() }
+    #[cfg(not(...))]
+    { Router::new() }
+})
+```
+
+## 4. `TriggerKind` enum (`backend/windmill-types/src/triggers.rs`)
+
+Already has slots for most triggers but verify your variant exists:
+- Add `{Kind}` to the `TriggerKind` enum
+- Add match arm in `to_key()`
+- Add match arm in `from_str`
+- Add match arm in `JobTriggerKind` (if jobs need kind tagging)
+
+## 5. OpenAPI (`backend/windmill-api/openapi.yaml`)
+
+This file is huge and the single most-forgotten place. Add:
+
+- `/w/{workspace}/{kind}_triggers/create` + `/update/{path}` + `/delete/{path}` + `/get/{path}` + `/list` + `/exists/{path}` + `/setmode/{path}` + `/test` paths (mirror gcp section)
+- Any `additional_routes` your handler exposes (resource discovery, etc.)
+- Schemas: `{Kind}Trigger`, `{Kind}TriggerData`, `{Kind}Mode` (if enum), `{Kind}DeliveryConfig`, helper request/response types
+- Add `{kind}` to `CaptureTriggerKind` enum
+- Add `{kind}_used: boolean` to the `UsedTriggers` response schema
+
+Regenerate frontend client: `npm run generate-backend-client` from `frontend/`.
+
+## 6. `UsedTriggers` + workspace export
+
+**`backend/windmill-api-workspaces/src/workspaces.rs`** — add `{kind}_used: bool` to the `UsedTriggers` struct and add an `EXISTS(SELECT 1 FROM {kind}_trigger …)` to the `get_used_triggers` query.
+
+**`backend/windmill-api/src/workspaces_export.rs`** — add export block mirroring gcp's (export lists all triggers, serializes them to YAML/JSON).
+
+## 6.5 Hardcoded trigger-kind arrays (silent-failure hotspots)
+
+Several files keep **hardcoded arrays** of trigger kind strings. Miss one and ACL checks / user offboarding / trash drop your kind:
+
+- **`backend/windmill-api-groups/src/granular_acls.rs`** — `KINDS: [&str; N]`. **Increment N** (the compile error is cryptic otherwise). Controls which kinds accept granular ACL operations.
+- **`backend/windmill-api-users/src/users.rs`** (`extra_perms_tables`) — which tables get `extra_perms` entries cleaned when a user is deleted.
+- **`backend/windmill-api/src/offboarding.rs`** — three separate arrays (enumeration, fork-copy, and delete paths). **All three** need the new kind.
+- **`backend/windmill-api/src/trash.rs`** — `valid_tables` for the trash / restore API.
+- **`backend/windmill-git-sync/src/lib.rs`** — add a test assertion for `DeployedObject::{Kind}Trigger.get_kind() == "{kind}_trigger"` (the `get_kind` match arm itself lives in the enum impl — already required by the Rust compiler).
+- **`backend/windmill-api-auth/src/scopes.rs`** — add the `{Kind}Triggers` variant to `ScopeDomain` enum + `as_str` match + `from_str` match. Required for the OAuth/token system to recognise `{kind}_triggers:read|write` scopes.
+- **`backend/windmill-api/src/token.rs`** (`build_trigger_scope_domains` → `TRIGGER_DOMAINS`) — add `("{kind}_triggers", "{Kind display name}")` so the CreateToken UI's scope selector surfaces the `read` / `write` checkboxes.
+
+**OpenAPI enums** to extend (do NOT forget — generated client will allow it but server rejects as 400):
+- `CaptureTriggerKind` enum
+- Three `kind` enums under `/w/{workspace}/acls/{get,add,remove}/{kind}/{path}` (yes, same list repeated three times)
+
+After editing any of these, run a full `cargo check` with your feature flag + `gcp_trigger` + other core flags — the `KINDS: [&str; N]` length mismatch only surfaces when the crate compiles.
+
+## 7. Capture infrastructure (`backend/windmill-api/src/capture.rs`)
+
+If the trigger supports push delivery, it also needs a capture endpoint so users can test it:
+
+- `{Kind}TriggerConfig` struct (gated by feature flags)
+- `TriggerConfig::{Kind}` variant
+- `set_{kind}_trigger_config` function (creates the subscription/equivalent pointing at the capture URL — use your `manage_{kind}_subscription` helper with `trigger_mode=false`)
+- Both real + no-op versions behind feature gates
+- `TriggerKind::{Kind} => set_{kind}_trigger_config(...)` arm in `set_config`
+- `{kind}_payload` async handler — validates auth (if any), processes payload, calls `insert_capture_payload`
+- Route: `.route("/{kind}/{runnable_kind}/{*path}", post({kind}_payload))` inside `workspaced_unauthed_service` — and expand the surrounding `#[cfg(any(...))]` to include your feature flag
+
+## 8. CLI (`cli/`) — easy to miss, breaks sync silently
+
+Check all of these:
+
+**`cli/src/types.ts`:**
+- Add `"{kind}"` to `TRIGGER_TYPES` array
+- Add `"{kind}_trigger"` to `getTypeStrFromPath` return union
+- Add match case in `getTypeStrFromPath`'s `typeEnding ===` chain
+- Add `pushTrigger("{kind}", ...)` branch in `pushObj`
+
+**`cli/src/commands/trigger/trigger.ts`:**
+- Import `{Kind}Trigger` type
+- Add `{kind}: {Kind}Trigger` to the `Trigger` type map
+- Add `{kind}: wmill.get{Kind}Trigger`, `update{Kind}Trigger`, `create{Kind}Trigger` to each function map
+- Add `{kind}: { ... }` template to `triggerTemplates`
+- Add `list{Kind}Triggers` call + spread in the `list` aggregation
+- Update `--kind` option descriptions to mention the new kind
+
+**`cli/src/commands/sync/sync.ts`:**
+- Add `path.endsWith(".{kind}_trigger" + ext)` in the file-type filter
+- Add `typ == "{kind}_trigger"` in `getTypeOrder`
+- Add `"{kind}_trigger"` to the delete-suffix regex (~line 3092)
+- Add a `case "{kind}_trigger"` in the delete switch
+
+**`cli/src/guidance/skills.ts`** — **DO NOT EDIT DIRECTLY**. It's auto-generated by `system_prompts/generate.py`. Instead:
+- Edit `system_prompts/utils.py` → append `('{Kind}Trigger', '{kind}_trigger')` to the `SCHEMA_MAPPINGS['triggers']` list (this is the master list — the one in `generate.py` is duplicated and `utils.py` wins)
+- Then run `python3 system_prompts/generate.py` — it regenerates `cli/src/guidance/skills.ts` with the schema extracted from `backend/windmill-api/openapi.yaml`
+- Commit the regenerated file
+
+## 9. Frontend — editor + drawer
+
+Under `frontend/src/lib/components/triggers/{kind}/`:
+
+- `{Kind}TriggerPanel.svelte` — the tile shown in the triggers listing
+- `{Kind}TriggerEditor.svelte` — outer drawer wrapper
+- `{Kind}TriggerEditorInner.svelte` — state + business logic; must expose:
+  - `openEdit(path, isFlow, defaultValues?)` method
+  - `isEditor` prop, `onConfigChange` + `onCaptureConfigChange` callbacks
+  - `get{Kind}Config()` + `get{Kind}CaptureConfig()` helpers
+  - `captureConfig = $derived.by(untrack(() => isEditor) ? get{Kind}CaptureConfig : () => ({}))`
+  - `$effect(() => { const args = [captureConfig, isValid] as const; untrack(() => onCaptureConfigChange?.(...args)) })`
+- `{Kind}TriggerEditorConfigSection.svelte` — form fields; use design-system components (`TextInput`, `Select`, `Toggle`, `ToggleButtonGroup`), never raw `<input>`
+- `{Kind}Capture.svelte` — capture panel; wraps `CaptureSection` with `captureType="{kind}"`
+- `utils.ts` — `requestBody` builders and any trigger-type-specific helpers
+
+## 10. Frontend — global integration
+
+Easy to miss:
+
+- **`frontend/src/lib/components/triggers.ts`** — add `'{kind}'` to the `TriggerKind` union
+- **`frontend/src/lib/components/triggers/CaptureWrapper.svelte`**:
+  - Import `{Kind}Capture`
+  - Add to `isStreamingCapture()` array (streaming = pull-style; push-style is typically `false`)
+  - Add `{:else if captureType === '{kind}'}` branch with the `<{Kind}Capture>` render
+- **`frontend/src/lib/components/sidebar/SidebarContent.svelte`** — import the icon, add the nav entry
+- **`frontend/src/lib/components/sidebar/OperatorMenu.svelte`** — add the operator-mode entry
+- **`frontend/src/routes/(root)/(logged)/+layout.svelte`** — destructure `{kind}_used` from `/get_used_triggers` response, push `'{kind}'` into `usedKinds`
+- **`frontend/src/lib/components/search/GlobalSearchModal.svelte`** — import icon, add "Go to {Kind} ..." entry
+- **`frontend/src/lib/components/offboarding-utils.ts`** — add mappings `{kind}_trigger: '{kind}_triggers'` and `{kind}_trigger: '{kind} trigger'`
+- **`frontend/src/lib/components/icons/{Kind}Icon.svelte`** — single-path SVG, `fill={color ?? 'currentColor'}`, `size` prop default 16 (match existing icons — don't hardcode colors, don't use `width`/`height` props)
+- **`frontend/src/routes/(root)/(logged)/{kind}_triggers/+page.svelte`** — listing page (mirror `gcp_triggers/+page.svelte` for push+pull, `kafka_triggers` for pure streaming)
+- **`frontend/src/lib/components/CompareWorkspaces.svelte`** — workspace fork / compare tool. Needs: service import, editor import, `{kind}Editor` `$state`, `case '{kind}'` in `openTriggerDetails()`, entry in `triggerServices` object (list/delete/normalize), and `<{Kind}TriggerEditor bind:this={{kind}Editor} />` in the template
+
+## 10.5 AI system prompts (`system_prompts/`)
+
+- **`system_prompts/utils.py`** — append `('{Kind}Trigger', '{kind}_trigger')` to `SCHEMA_MAPPINGS['triggers']` (master list used by code generation + CLI skills)
+- **`system_prompts/generate.py`** — also has a duplicated `schema_types` list (~line 903) for the AI `triggers` skill content. Add `('{Kind}Trigger', '{kind}_trigger')` there too
+- **`system_prompts/generate.py`** `schema_names` (~line 1192) — add `'{Kind}Trigger'` (add `'New{Kind}Trigger'` only if the OpenAPI declares one; GCP and Azure don't)
+- Run `python3 system_prompts/generate.py` — this rewrites `cli/src/guidance/skills.ts` and all `auto-generated/` docs. Commit the regenerated files
+
+## 11. Validation
+
+Run all of these before declaring done:
+
+```bash
+# Backend
+cd backend
+cargo check --features enterprise,{kind}_trigger,private   # minimal
+cargo check --features enterprise,azure_trigger,private,gcp_trigger,http_trigger,mqtt_trigger,postgres_trigger,sqs_trigger,kafka,nats,smtp,websocket  # full
+
+# SQLx offline data (never run `cargo sqlx prepare` directly — use the wrapper)
+./update_sqlx.sh
+
+# Frontend
+cd frontend
+npm run generate-backend-client
+npm run check:fast
+```
+
+Smoke test in the UI: create a trigger, save, check it appears in sidebar + search, delete, re-create via CLI `wmill sync`.
+
+## 12. Common pitfalls
+
+- **Forgetting feature gates in `workspaced_unauthed_service()`** — the surrounding `#[cfg(any(...))]` expression must include your feature flag, not just the inner `#[cfg]` on the route
+- **`.route(path, ...).route(path, ...)` with same path and different methods** — older axum replaced; use `.route(path, post(h1).options(h2))` to chain methods on the same `MethodRouter`
+- **`on:event` directives** — legacy Svelte 4, no-op in runes mode. Use callback props (`onSelected`, `onConfigChange`)
+- **`$bindable(default_value)` on optional props** — banned by project CLAUDE.md. Use `$bindable()` + `$derived(prop ?? default)` instead
+- **CORS layer intercepting OPTIONS** — tower-http CorsLayer short-circuits OPTIONS before reaching your handler. For server-to-server webhook endpoints, drop the CORS layer entirely (CORS is browser-only)
+- **DeliveryAttributeMappings / custom headers for auth** — prefer HMAC or sha256-hashed shared secrets over opaque JWTs when the provider doesn't support signed tokens natively. Store only the hash; regenerate secret on every save
+- **ARM / API resource-listing cascades** — if the trigger's resource type is deep (Azure: subscription → RG → namespace → topic), offer dropdowns in the UI populated from the provider's APIs using the user's credential resource
+- **Clearing stale selections on dependency change** — when a dropdown's underlying data reloads (e.g., user changes SP or edition), clear selections that no longer match the new list
+- **Workspace-scoped tag compatibility** — if the trigger has tags, verify forked workspaces handle them (see commit `0773b5bc85` for a historical fix)
+
+## 13. EE file split
+
+If the trigger is enterprise-only, the code lives in `windmill-ee-private__worktrees/.../windmill-trigger-{kind}/src/*_ee.rs` and is symlinked into the OSS tree. The `windmill-ee-private__worktrees/` directory holds the real files; changes propagate via symlinks. See `docs/enterprise.md` for the workflow.
+
+## 14. Final checklist before PR
+
+- [ ] Migration up/down tested (revert + re-apply)
+- [ ] `./update_sqlx.sh` committed the updated `.sqlx/` offline data
+- [ ] `cargo check` passes with your feature flag + with all trigger features
+- [ ] `npm run check:fast` passes
+- [ ] Trigger visible in sidebar with correct icon weight (not oversized/colored — use `currentColor`)
+- [ ] Create, edit, delete flow all work in the UI
+- [ ] Capture button works (if push-capable)
+- [ ] Trigger appears in `/get_used_triggers` → sidebar pulse
+- [ ] `wmill sync pull` + `wmill sync push` both round-trip the trigger
+- [ ] `wmill trigger list` includes it
+- [ ] OpenAPI schemas are complete (no `null` in generated types)
diff --git a/backend/.sqlx/query-089d7bc7acdbb97cf477159e111bc7e9ee85289ff5c52af43166928337c257e7.json b/backend/.sqlx/query-089d7bc7acdbb97cf477159e111bc7e9ee85289ff5c52af43166928337c257e7.json
index 8aa1f9b22c..a7b98fa7c5 100644
--- a/backend/.sqlx/query-089d7bc7acdbb97cf477159e111bc7e9ee85289ff5c52af43166928337c257e7.json
+++ b/backend/.sqlx/query-089d7bc7acdbb97cf477159e111bc7e9ee85289ff5c52af43166928337c257e7.json
@@ -33,6 +33,7 @@
                 "nextcloud",
                 "google",
                 "ci_test",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-0f7e01b613a94b29784aae6d7b17b23d6dcf2e5364852a5e85b3c41c417bace2.json b/backend/.sqlx/query-0f7e01b613a94b29784aae6d7b17b23d6dcf2e5364852a5e85b3c41c417bace2.json
index 733612861e..9e50633c2c 100644
--- a/backend/.sqlx/query-0f7e01b613a94b29784aae6d7b17b23d6dcf2e5364852a5e85b3c41c417bace2.json
+++ b/backend/.sqlx/query-0f7e01b613a94b29784aae6d7b17b23d6dcf2e5364852a5e85b3c41c417bace2.json
@@ -26,6 +26,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-16d438374b03a9c515f4c2d638366f38ffe2f3a0958adea53e67757c6ac463ec.json b/backend/.sqlx/query-16d438374b03a9c515f4c2d638366f38ffe2f3a0958adea53e67757c6ac463ec.json
index ab6ee24af9..7147f89f94 100644
--- a/backend/.sqlx/query-16d438374b03a9c515f4c2d638366f38ffe2f3a0958adea53e67757c6ac463ec.json
+++ b/backend/.sqlx/query-16d438374b03a9c515f4c2d638366f38ffe2f3a0958adea53e67757c6ac463ec.json
@@ -26,6 +26,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-19b59c478744d029c6006b01f04243ad2e0aef485a780daea5d76b0be2bb2ea2.json b/backend/.sqlx/query-19b59c478744d029c6006b01f04243ad2e0aef485a780daea5d76b0be2bb2ea2.json
index 7ec162bbf8..78a00d969a 100644
--- a/backend/.sqlx/query-19b59c478744d029c6006b01f04243ad2e0aef485a780daea5d76b0be2bb2ea2.json
+++ b/backend/.sqlx/query-19b59c478744d029c6006b01f04243ad2e0aef485a780daea5d76b0be2bb2ea2.json
@@ -43,6 +43,7 @@
                 "nextcloud",
                 "google",
                 "ci_test",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-212553c83e4dcdc6d045eb2fe2dadbb2860ce52d37a56b2861de1215260ecff8.json b/backend/.sqlx/query-212553c83e4dcdc6d045eb2fe2dadbb2860ce52d37a56b2861de1215260ecff8.json
index 4d6593ef81..1ec4736b5b 100644
--- a/backend/.sqlx/query-212553c83e4dcdc6d045eb2fe2dadbb2860ce52d37a56b2861de1215260ecff8.json
+++ b/backend/.sqlx/query-212553c83e4dcdc6d045eb2fe2dadbb2860ce52d37a56b2861de1215260ecff8.json
@@ -37,6 +37,7 @@
                 "nextcloud",
                 "google",
                 "ci_test",
+                "azure",
                 "github"
               ]
             }
@@ -73,6 +74,7 @@
                 "nextcloud",
                 "google",
                 "ci_test",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-22e0e8a1aa48f8b21763452bd36fbe7db4887c4ac5295052c796bd78a7edc50b.json b/backend/.sqlx/query-22e0e8a1aa48f8b21763452bd36fbe7db4887c4ac5295052c796bd78a7edc50b.json
index 77ad70147d..07aa54a199 100644
--- a/backend/.sqlx/query-22e0e8a1aa48f8b21763452bd36fbe7db4887c4ac5295052c796bd78a7edc50b.json
+++ b/backend/.sqlx/query-22e0e8a1aa48f8b21763452bd36fbe7db4887c4ac5295052c796bd78a7edc50b.json
@@ -26,6 +26,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-23419adcd74c326d716527293eff518b42f4cdb33e034441015494bd26c172d2.json b/backend/.sqlx/query-23419adcd74c326d716527293eff518b42f4cdb33e034441015494bd26c172d2.json
index 827758156a..4197084736 100644
--- a/backend/.sqlx/query-23419adcd74c326d716527293eff518b42f4cdb33e034441015494bd26c172d2.json
+++ b/backend/.sqlx/query-23419adcd74c326d716527293eff518b42f4cdb33e034441015494bd26c172d2.json
@@ -42,6 +42,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-42b4b73e9d60348e2d90fcade9dcad6d8995242dc20a4e14c1a8fae4fc6a9fd2.json b/backend/.sqlx/query-42b4b73e9d60348e2d90fcade9dcad6d8995242dc20a4e14c1a8fae4fc6a9fd2.json
index ce6afa3841..3551cb88d0 100644
--- a/backend/.sqlx/query-42b4b73e9d60348e2d90fcade9dcad6d8995242dc20a4e14c1a8fae4fc6a9fd2.json
+++ b/backend/.sqlx/query-42b4b73e9d60348e2d90fcade9dcad6d8995242dc20a4e14c1a8fae4fc6a9fd2.json
@@ -26,6 +26,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-45024b932383199974616bba1fc2f7175cc6f2e02d9c565bb5159cae3e0b6835.json b/backend/.sqlx/query-45024b932383199974616bba1fc2f7175cc6f2e02d9c565bb5159cae3e0b6835.json
index e6cac8ffd7..405ec085ab 100644
--- a/backend/.sqlx/query-45024b932383199974616bba1fc2f7175cc6f2e02d9c565bb5159cae3e0b6835.json
+++ b/backend/.sqlx/query-45024b932383199974616bba1fc2f7175cc6f2e02d9c565bb5159cae3e0b6835.json
@@ -32,6 +32,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-4d272cf4a77aab7007a5b35589e08532a1020cabaf5e22325a1e05f0491d785c.json b/backend/.sqlx/query-4d272cf4a77aab7007a5b35589e08532a1020cabaf5e22325a1e05f0491d785c.json
index aaf1798f18..4515451455 100644
--- a/backend/.sqlx/query-4d272cf4a77aab7007a5b35589e08532a1020cabaf5e22325a1e05f0491d785c.json
+++ b/backend/.sqlx/query-4d272cf4a77aab7007a5b35589e08532a1020cabaf5e22325a1e05f0491d785c.json
@@ -39,6 +39,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-4f547c0fd54f3bc57212ce87810e35adf640d44d607e62a1fb296e38ac3fdd36.json b/backend/.sqlx/query-4f547c0fd54f3bc57212ce87810e35adf640d44d607e62a1fb296e38ac3fdd36.json
index 4bbc889b93..b3e047a10d 100644
--- a/backend/.sqlx/query-4f547c0fd54f3bc57212ce87810e35adf640d44d607e62a1fb296e38ac3fdd36.json
+++ b/backend/.sqlx/query-4f547c0fd54f3bc57212ce87810e35adf640d44d607e62a1fb296e38ac3fdd36.json
@@ -34,6 +34,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
@@ -74,6 +75,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-66a0e51cf149ba532463e29dd361a803e1bced2f8e1a12f8933b7598ee85a147.json b/backend/.sqlx/query-66a0e51cf149ba532463e29dd361a803e1bced2f8e1a12f8933b7598ee85a147.json
index db16d66df1..c92861b3ce 100644
--- a/backend/.sqlx/query-66a0e51cf149ba532463e29dd361a803e1bced2f8e1a12f8933b7598ee85a147.json
+++ b/backend/.sqlx/query-66a0e51cf149ba532463e29dd361a803e1bced2f8e1a12f8933b7598ee85a147.json
@@ -37,6 +37,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-67e25a7c19ea0ffaf7ea5303fcd04af5a7eb488c76f783e690af0c2153b1d6a8.json b/backend/.sqlx/query-67e25a7c19ea0ffaf7ea5303fcd04af5a7eb488c76f783e690af0c2153b1d6a8.json
index 6445018040..2e749b3792 100644
--- a/backend/.sqlx/query-67e25a7c19ea0ffaf7ea5303fcd04af5a7eb488c76f783e690af0c2153b1d6a8.json
+++ b/backend/.sqlx/query-67e25a7c19ea0ffaf7ea5303fcd04af5a7eb488c76f783e690af0c2153b1d6a8.json
@@ -159,6 +159,7 @@
                 "nextcloud",
                 "google",
                 "ci_test",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-7065f23d04e26831664048f2cfc4f412c57af931f80621aee5012e9cb3535626.json b/backend/.sqlx/query-7065f23d04e26831664048f2cfc4f412c57af931f80621aee5012e9cb3535626.json
index ff9a359af6..151a986746 100644
--- a/backend/.sqlx/query-7065f23d04e26831664048f2cfc4f412c57af931f80621aee5012e9cb3535626.json
+++ b/backend/.sqlx/query-7065f23d04e26831664048f2cfc4f412c57af931f80621aee5012e9cb3535626.json
@@ -31,6 +31,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-73fdd01bad58b8be1a52f89faef8d92a983470adcd3cc850734960c905e61e83.json b/backend/.sqlx/query-73fdd01bad58b8be1a52f89faef8d92a983470adcd3cc850734960c905e61e83.json
index a6cf7e0aeb..217584cb1f 100644
--- a/backend/.sqlx/query-73fdd01bad58b8be1a52f89faef8d92a983470adcd3cc850734960c905e61e83.json
+++ b/backend/.sqlx/query-73fdd01bad58b8be1a52f89faef8d92a983470adcd3cc850734960c905e61e83.json
@@ -26,6 +26,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-756f82b72af07fd690f37b2e16ed2d390604f4fc4cb330842a88d5764cbcf0c6.json b/backend/.sqlx/query-756f82b72af07fd690f37b2e16ed2d390604f4fc4cb330842a88d5764cbcf0c6.json
index 7d0847e4fc..0809ee271f 100644
--- a/backend/.sqlx/query-756f82b72af07fd690f37b2e16ed2d390604f4fc4cb330842a88d5764cbcf0c6.json
+++ b/backend/.sqlx/query-756f82b72af07fd690f37b2e16ed2d390604f4fc4cb330842a88d5764cbcf0c6.json
@@ -126,6 +126,7 @@
                 "nextcloud",
                 "google",
                 "ci_test",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-757ef6215d3d385cb3a69e26ee4ca846dd5e7fe7ceb1aa8b3fcd26a2bd30eb2c.json b/backend/.sqlx/query-757ef6215d3d385cb3a69e26ee4ca846dd5e7fe7ceb1aa8b3fcd26a2bd30eb2c.json
index 1710117097..baa5adc2fc 100644
--- a/backend/.sqlx/query-757ef6215d3d385cb3a69e26ee4ca846dd5e7fe7ceb1aa8b3fcd26a2bd30eb2c.json
+++ b/backend/.sqlx/query-757ef6215d3d385cb3a69e26ee4ca846dd5e7fe7ceb1aa8b3fcd26a2bd30eb2c.json
@@ -43,6 +43,7 @@
                 "nextcloud",
                 "google",
                 "ci_test",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-7fbf72d9059fcd77e4c1112fa4fa22e4276c1da653475628889ce17dc904fbaa.json b/backend/.sqlx/query-7fbf72d9059fcd77e4c1112fa4fa22e4276c1da653475628889ce17dc904fbaa.json
index 6b533d7d13..b5965729b4 100644
--- a/backend/.sqlx/query-7fbf72d9059fcd77e4c1112fa4fa22e4276c1da653475628889ce17dc904fbaa.json
+++ b/backend/.sqlx/query-7fbf72d9059fcd77e4c1112fa4fa22e4276c1da653475628889ce17dc904fbaa.json
@@ -29,6 +29,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-836bac47d89113d90bd03a471446eb9016207975af1e37042d81df8cb6ae2c53.json b/backend/.sqlx/query-836bac47d89113d90bd03a471446eb9016207975af1e37042d81df8cb6ae2c53.json
index 9f6bdd062b..716e4f7322 100644
--- a/backend/.sqlx/query-836bac47d89113d90bd03a471446eb9016207975af1e37042d81df8cb6ae2c53.json
+++ b/backend/.sqlx/query-836bac47d89113d90bd03a471446eb9016207975af1e37042d81df8cb6ae2c53.json
@@ -26,6 +26,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-952f244a06950ccfc70651cb48cdfb7766f7d62d34e68e65b975aaed9e104a5a.json b/backend/.sqlx/query-83d79dd52a708da7c0d55a171744214dc62651c8ae4ffa2be8b5aa68d8f8e791.json
similarity index 72%
rename from backend/.sqlx/query-952f244a06950ccfc70651cb48cdfb7766f7d62d34e68e65b975aaed9e104a5a.json
rename to backend/.sqlx/query-83d79dd52a708da7c0d55a171744214dc62651c8ae4ffa2be8b5aa68d8f8e791.json
index 0bffda8458..c0e0795349 100644
--- a/backend/.sqlx/query-952f244a06950ccfc70651cb48cdfb7766f7d62d34e68e65b975aaed9e104a5a.json
+++ b/backend/.sqlx/query-83d79dd52a708da7c0d55a171744214dc62651c8ae4ffa2be8b5aa68d8f8e791.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            EXISTS(SELECT 1 FROM websocket_trigger WHERE workspace_id = $1) AS \"websocket_used!\",\n            EXISTS(SELECT 1 FROM http_trigger WHERE workspace_id = $1) AS \"http_routes_used!\",\n            EXISTS(SELECT 1 FROM kafka_trigger WHERE workspace_id = $1) as \"kafka_used!\",\n            EXISTS(SELECT 1 FROM nats_trigger WHERE workspace_id = $1) as \"nats_used!\",\n            EXISTS(SELECT 1 FROM postgres_trigger WHERE workspace_id = $1) AS \"postgres_used!\",\n            EXISTS(SELECT 1 FROM mqtt_trigger WHERE workspace_id = $1) AS \"mqtt_used!\",\n            EXISTS(SELECT 1 FROM sqs_trigger WHERE workspace_id = $1) AS \"sqs_used!\",\n            EXISTS(SELECT 1 FROM gcp_trigger WHERE workspace_id = $1) AS \"gcp_used!\",\n            EXISTS(SELECT 1 FROM email_trigger WHERE workspace_id = $1) AS \"email_used!\",\n            EXISTS(SELECT 1 FROM native_trigger WHERE workspace_id = $1 AND service_name = 'nextcloud'::native_trigger_service) AS \"nextcloud_used!\",\n            EXISTS(SELECT 1 FROM native_trigger WHERE workspace_id = $1 AND service_name = 'google'::native_trigger_service) AS \"google_used!\",\n            EXISTS(SELECT 1 FROM native_trigger WHERE workspace_id = $1 AND service_name = 'github'::native_trigger_service) AS \"github_used!\"\n        ",
+  "query": "\n        SELECT\n            EXISTS(SELECT 1 FROM websocket_trigger WHERE workspace_id = $1) AS \"websocket_used!\",\n            EXISTS(SELECT 1 FROM http_trigger WHERE workspace_id = $1) AS \"http_routes_used!\",\n            EXISTS(SELECT 1 FROM kafka_trigger WHERE workspace_id = $1) as \"kafka_used!\",\n            EXISTS(SELECT 1 FROM nats_trigger WHERE workspace_id = $1) as \"nats_used!\",\n            EXISTS(SELECT 1 FROM postgres_trigger WHERE workspace_id = $1) AS \"postgres_used!\",\n            EXISTS(SELECT 1 FROM mqtt_trigger WHERE workspace_id = $1) AS \"mqtt_used!\",\n            EXISTS(SELECT 1 FROM sqs_trigger WHERE workspace_id = $1) AS \"sqs_used!\",\n            EXISTS(SELECT 1 FROM gcp_trigger WHERE workspace_id = $1) AS \"gcp_used!\",\n            EXISTS(SELECT 1 FROM azure_trigger WHERE workspace_id = $1) AS \"azure_used!\",\n            EXISTS(SELECT 1 FROM email_trigger WHERE workspace_id = $1) AS \"email_used!\",\n            EXISTS(SELECT 1 FROM native_trigger WHERE workspace_id = $1 AND service_name = 'nextcloud'::native_trigger_service) AS \"nextcloud_used!\",\n            EXISTS(SELECT 1 FROM native_trigger WHERE workspace_id = $1 AND service_name = 'google'::native_trigger_service) AS \"google_used!\",\n            EXISTS(SELECT 1 FROM native_trigger WHERE workspace_id = $1 AND service_name = 'github'::native_trigger_service) AS \"github_used!\"\n        ",
   "describe": {
     "columns": [
       {
@@ -45,21 +45,26 @@
       },
       {
         "ordinal": 8,
-        "name": "email_used!",
+        "name": "azure_used!",
         "type_info": "Bool"
       },
       {
         "ordinal": 9,
-        "name": "nextcloud_used!",
+        "name": "email_used!",
         "type_info": "Bool"
       },
       {
         "ordinal": 10,
-        "name": "google_used!",
+        "name": "nextcloud_used!",
         "type_info": "Bool"
       },
       {
         "ordinal": 11,
+        "name": "google_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 12,
         "name": "github_used!",
         "type_info": "Bool"
       }
@@ -81,8 +86,9 @@
       null,
       null,
       null,
+      null,
       null
     ]
   },
-  "hash": "952f244a06950ccfc70651cb48cdfb7766f7d62d34e68e65b975aaed9e104a5a"
+  "hash": "83d79dd52a708da7c0d55a171744214dc62651c8ae4ffa2be8b5aa68d8f8e791"
 }
diff --git a/backend/.sqlx/query-87564a196a1662f524407d853db506bf08c28efe82b68b3d44bafbd3d0e91c29.json b/backend/.sqlx/query-87564a196a1662f524407d853db506bf08c28efe82b68b3d44bafbd3d0e91c29.json
index 906adfd7ed..1a62365a30 100644
--- a/backend/.sqlx/query-87564a196a1662f524407d853db506bf08c28efe82b68b3d44bafbd3d0e91c29.json
+++ b/backend/.sqlx/query-87564a196a1662f524407d853db506bf08c28efe82b68b3d44bafbd3d0e91c29.json
@@ -37,6 +37,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-940b6d78bab940a37a42492f030d2393e297043e4e58555d872b5c4dd89c196a.json b/backend/.sqlx/query-940b6d78bab940a37a42492f030d2393e297043e4e58555d872b5c4dd89c196a.json
index 19669cf4ac..64d71b643a 100644
--- a/backend/.sqlx/query-940b6d78bab940a37a42492f030d2393e297043e4e58555d872b5c4dd89c196a.json
+++ b/backend/.sqlx/query-940b6d78bab940a37a42492f030d2393e297043e4e58555d872b5c4dd89c196a.json
@@ -26,6 +26,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-9c50e3a136a8ee3ec56e083f26d3a960b89e02ec40b292f3b5198baf2a1d3dbf.json b/backend/.sqlx/query-9c50e3a136a8ee3ec56e083f26d3a960b89e02ec40b292f3b5198baf2a1d3dbf.json
index 1c28f6dd59..826ede0972 100644
--- a/backend/.sqlx/query-9c50e3a136a8ee3ec56e083f26d3a960b89e02ec40b292f3b5198baf2a1d3dbf.json
+++ b/backend/.sqlx/query-9c50e3a136a8ee3ec56e083f26d3a960b89e02ec40b292f3b5198baf2a1d3dbf.json
@@ -34,6 +34,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-9ecb404e46a4eac55f977f05a3afbafe5dc3cdecc17a3d5a7476b160c1b6e7e1.json b/backend/.sqlx/query-9ecb404e46a4eac55f977f05a3afbafe5dc3cdecc17a3d5a7476b160c1b6e7e1.json
index ffef694e07..cf5a10ec6f 100644
--- a/backend/.sqlx/query-9ecb404e46a4eac55f977f05a3afbafe5dc3cdecc17a3d5a7476b160c1b6e7e1.json
+++ b/backend/.sqlx/query-9ecb404e46a4eac55f977f05a3afbafe5dc3cdecc17a3d5a7476b160c1b6e7e1.json
@@ -33,6 +33,7 @@
                 "nextcloud",
                 "google",
                 "ci_test",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-a4b6371d33206010b2f3ffd2b09e33244fe8ab9a803248fc23f334034d24aad4.json b/backend/.sqlx/query-a4b6371d33206010b2f3ffd2b09e33244fe8ab9a803248fc23f334034d24aad4.json
index f3cb2d40b6..ca16b4c4c1 100644
--- a/backend/.sqlx/query-a4b6371d33206010b2f3ffd2b09e33244fe8ab9a803248fc23f334034d24aad4.json
+++ b/backend/.sqlx/query-a4b6371d33206010b2f3ffd2b09e33244fe8ab9a803248fc23f334034d24aad4.json
@@ -189,6 +189,7 @@
                 "nextcloud",
                 "google",
                 "ci_test",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-ad25201d0eea65972234cade87a95d8cd99fc26e5bd466942423cbd09efcebe4.json b/backend/.sqlx/query-ad25201d0eea65972234cade87a95d8cd99fc26e5bd466942423cbd09efcebe4.json
new file mode 100644
index 0000000000..7b989b68f5
--- /dev/null
+++ b/backend/.sqlx/query-ad25201d0eea65972234cade87a95d8cd99fc26e5bd466942423cbd09efcebe4.json
@@ -0,0 +1,53 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            INSERT INTO azure_trigger (\n                azure_resource_path, azure_mode, scope_resource_id, topic_name,\n                subscription_name, event_type_filters,\n                push_auth_config, workspace_id, path, script_path, is_flow,\n                permissioned_as, mode, edited_by, email,\n                error_handler_path, error_handler_args, retry\n            ) VALUES (\n                $1, $2, $3, $4, $5, $6, $7,\n                $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18\n            )\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        {
+          "Custom": {
+            "name": "azure_trigger_mode",
+            "kind": {
+              "Enum": [
+                "basic_push",
+                "namespace_push",
+                "namespace_pull"
+              ]
+            }
+          }
+        },
+        "Text",
+        "Varchar",
+        "Varchar",
+        "Jsonb",
+        "Jsonb",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Bool",
+        "Varchar",
+        {
+          "Custom": {
+            "name": "trigger_mode",
+            "kind": {
+              "Enum": [
+                "enabled",
+                "disabled",
+                "suspended"
+              ]
+            }
+          }
+        },
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Jsonb",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ad25201d0eea65972234cade87a95d8cd99fc26e5bd466942423cbd09efcebe4"
+}
diff --git a/backend/.sqlx/query-b3771b690c5966272b1f42c9965bb6a8f961c119516e4c33dc928cd3b4f4edbc.json b/backend/.sqlx/query-b3771b690c5966272b1f42c9965bb6a8f961c119516e4c33dc928cd3b4f4edbc.json
index 5f0b320ec4..eef3715672 100644
--- a/backend/.sqlx/query-b3771b690c5966272b1f42c9965bb6a8f961c119516e4c33dc928cd3b4f4edbc.json
+++ b/backend/.sqlx/query-b3771b690c5966272b1f42c9965bb6a8f961c119516e4c33dc928cd3b4f4edbc.json
@@ -164,6 +164,7 @@
                 "nextcloud",
                 "google",
                 "ci_test",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-b3f0595cacba194e08b9a3e244d9e637e9e156cd85b69126c87dfff89a47711d.json b/backend/.sqlx/query-b3f0595cacba194e08b9a3e244d9e637e9e156cd85b69126c87dfff89a47711d.json
index 28bbedf55e..4d8f4b2a6b 100644
--- a/backend/.sqlx/query-b3f0595cacba194e08b9a3e244d9e637e9e156cd85b69126c87dfff89a47711d.json
+++ b/backend/.sqlx/query-b3f0595cacba194e08b9a3e244d9e637e9e156cd85b69126c87dfff89a47711d.json
@@ -26,6 +26,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-be6d2c92a62b7b284651c45af809746147aa9b8d0a81642a7b7cb4738a0cad66.json b/backend/.sqlx/query-be6d2c92a62b7b284651c45af809746147aa9b8d0a81642a7b7cb4738a0cad66.json
index 982ae5ef85..1cbbb14c8d 100644
--- a/backend/.sqlx/query-be6d2c92a62b7b284651c45af809746147aa9b8d0a81642a7b7cb4738a0cad66.json
+++ b/backend/.sqlx/query-be6d2c92a62b7b284651c45af809746147aa9b8d0a81642a7b7cb4738a0cad66.json
@@ -109,6 +109,7 @@
                 "nextcloud",
                 "google",
                 "ci_test",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-c3b1152b554812d65eb27f95b1fd434f860922fbc021185beffb9827647feb8e.json b/backend/.sqlx/query-c3b1152b554812d65eb27f95b1fd434f860922fbc021185beffb9827647feb8e.json
index 6708d6f04d..288f0d18e1 100644
--- a/backend/.sqlx/query-c3b1152b554812d65eb27f95b1fd434f860922fbc021185beffb9827647feb8e.json
+++ b/backend/.sqlx/query-c3b1152b554812d65eb27f95b1fd434f860922fbc021185beffb9827647feb8e.json
@@ -33,6 +33,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-ccef7a1bde5cac6c362c5fedb6c13f1f882b695f896f94e5cf91d205633355a1.json b/backend/.sqlx/query-ccef7a1bde5cac6c362c5fedb6c13f1f882b695f896f94e5cf91d205633355a1.json
index dc50df78d8..586566c997 100644
--- a/backend/.sqlx/query-ccef7a1bde5cac6c362c5fedb6c13f1f882b695f896f94e5cf91d205633355a1.json
+++ b/backend/.sqlx/query-ccef7a1bde5cac6c362c5fedb6c13f1f882b695f896f94e5cf91d205633355a1.json
@@ -26,6 +26,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-d41ea93fd58381b89e151c965eae1ea2fe96a1b94f5a92953fb1c1642d15c016.json b/backend/.sqlx/query-d41ea93fd58381b89e151c965eae1ea2fe96a1b94f5a92953fb1c1642d15c016.json
index b797bea7cb..4e27121aed 100644
--- a/backend/.sqlx/query-d41ea93fd58381b89e151c965eae1ea2fe96a1b94f5a92953fb1c1642d15c016.json
+++ b/backend/.sqlx/query-d41ea93fd58381b89e151c965eae1ea2fe96a1b94f5a92953fb1c1642d15c016.json
@@ -109,6 +109,7 @@
                 "nextcloud",
                 "google",
                 "ci_test",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-d4211392e174a0e8f89c7fcebdf120e5b0f629f9f04e08a2982df33ff23ac7a9.json b/backend/.sqlx/query-d4211392e174a0e8f89c7fcebdf120e5b0f629f9f04e08a2982df33ff23ac7a9.json
index 6a9e278e37..d0201ebb22 100644
--- a/backend/.sqlx/query-d4211392e174a0e8f89c7fcebdf120e5b0f629f9f04e08a2982df33ff23ac7a9.json
+++ b/backend/.sqlx/query-d4211392e174a0e8f89c7fcebdf120e5b0f629f9f04e08a2982df33ff23ac7a9.json
@@ -249,6 +249,7 @@
                 "nextcloud",
                 "google",
                 "ci_test",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-d495c94b580fd34d5ae90615ef21a8a9cc35f362197c0766a5787436af141106.json b/backend/.sqlx/query-d495c94b580fd34d5ae90615ef21a8a9cc35f362197c0766a5787436af141106.json
index d7d50a2fe3..4624e72641 100644
--- a/backend/.sqlx/query-d495c94b580fd34d5ae90615ef21a8a9cc35f362197c0766a5787436af141106.json
+++ b/backend/.sqlx/query-d495c94b580fd34d5ae90615ef21a8a9cc35f362197c0766a5787436af141106.json
@@ -27,6 +27,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-d9ef1def7044e58722c5c69c31e9b9f6877de8bc7d4714915bbd572946d9270a.json b/backend/.sqlx/query-d9ef1def7044e58722c5c69c31e9b9f6877de8bc7d4714915bbd572946d9270a.json
new file mode 100644
index 0000000000..3eb7e86989
--- /dev/null
+++ b/backend/.sqlx/query-d9ef1def7044e58722c5c69c31e9b9f6877de8bc7d4714915bbd572946d9270a.json
@@ -0,0 +1,53 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            UPDATE azure_trigger SET\n                azure_resource_path = $1,\n                azure_mode = $2,\n                scope_resource_id = $3,\n                topic_name = $4,\n                subscription_name = $5,\n                event_type_filters = $6,\n                push_auth_config = $7,\n                is_flow = $8,\n                edited_by = $9,\n                permissioned_as = $10,\n                script_path = $11,\n                path = $12,\n                mode = $13,\n                edited_at = now(),\n                error = NULL,\n                server_id = NULL,\n                error_handler_path = $14,\n                error_handler_args = $15,\n                retry = $16\n            WHERE workspace_id = $17 AND path = $18\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        {
+          "Custom": {
+            "name": "azure_trigger_mode",
+            "kind": {
+              "Enum": [
+                "basic_push",
+                "namespace_push",
+                "namespace_pull"
+              ]
+            }
+          }
+        },
+        "Text",
+        "Varchar",
+        "Varchar",
+        "Jsonb",
+        "Jsonb",
+        "Bool",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        {
+          "Custom": {
+            "name": "trigger_mode",
+            "kind": {
+              "Enum": [
+                "enabled",
+                "disabled",
+                "suspended"
+              ]
+            }
+          }
+        },
+        "Varchar",
+        "Jsonb",
+        "Jsonb",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "d9ef1def7044e58722c5c69c31e9b9f6877de8bc7d4714915bbd572946d9270a"
+}
diff --git a/backend/.sqlx/query-e4d71278fb80126a7a9da73f1889352d4d1e3cb3a8a08f1c9c03055a1cab1235.json b/backend/.sqlx/query-e4d71278fb80126a7a9da73f1889352d4d1e3cb3a8a08f1c9c03055a1cab1235.json
index 895e631348..3b9218e474 100644
--- a/backend/.sqlx/query-e4d71278fb80126a7a9da73f1889352d4d1e3cb3a8a08f1c9c03055a1cab1235.json
+++ b/backend/.sqlx/query-e4d71278fb80126a7a9da73f1889352d4d1e3cb3a8a08f1c9c03055a1cab1235.json
@@ -189,6 +189,7 @@
                 "nextcloud",
                 "google",
                 "ci_test",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-e80177f3ffd4c1f52cdb4757483f03f72ef81db302d727e18e63a307ac902022.json b/backend/.sqlx/query-e80177f3ffd4c1f52cdb4757483f03f72ef81db302d727e18e63a307ac902022.json
index 99e56e18cd..17bbbe1f60 100644
--- a/backend/.sqlx/query-e80177f3ffd4c1f52cdb4757483f03f72ef81db302d727e18e63a307ac902022.json
+++ b/backend/.sqlx/query-e80177f3ffd4c1f52cdb4757483f03f72ef81db302d727e18e63a307ac902022.json
@@ -33,6 +33,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-eac595e19e5c8e70f1514ef29dec35c7342ac9a814c73f6290e1d6ebd3a55423.json b/backend/.sqlx/query-eac595e19e5c8e70f1514ef29dec35c7342ac9a814c73f6290e1d6ebd3a55423.json
index 6e77b92ef2..df5eb38920 100644
--- a/backend/.sqlx/query-eac595e19e5c8e70f1514ef29dec35c7342ac9a814c73f6290e1d6ebd3a55423.json
+++ b/backend/.sqlx/query-eac595e19e5c8e70f1514ef29dec35c7342ac9a814c73f6290e1d6ebd3a55423.json
@@ -26,6 +26,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-ed8facbf29ebb670d05fe8aa34b50d6a6935420fbedc83aa3ad1e9be7465c8dd.json b/backend/.sqlx/query-ed8facbf29ebb670d05fe8aa34b50d6a6935420fbedc83aa3ad1e9be7465c8dd.json
index ffde077e91..f276d002c2 100644
--- a/backend/.sqlx/query-ed8facbf29ebb670d05fe8aa34b50d6a6935420fbedc83aa3ad1e9be7465c8dd.json
+++ b/backend/.sqlx/query-ed8facbf29ebb670d05fe8aa34b50d6a6935420fbedc83aa3ad1e9be7465c8dd.json
@@ -26,6 +26,7 @@
                 "default_email",
                 "nextcloud",
                 "google",
+                "azure",
                 "github"
               ]
             }
diff --git a/backend/.sqlx/query-efdcdf0f8d24a23682bb3792ebaffeb7a8dc5632043b6bf4a3dd680c9b99b5df.json b/backend/.sqlx/query-efdcdf0f8d24a23682bb3792ebaffeb7a8dc5632043b6bf4a3dd680c9b99b5df.json
new file mode 100644
index 0000000000..e1641f5bea
--- /dev/null
+++ b/backend/.sqlx/query-efdcdf0f8d24a23682bb3792ebaffeb7a8dc5632043b6bf4a3dd680c9b99b5df.json
@@ -0,0 +1,100 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT\n            azure_resource_path,\n            script_path,\n            is_flow,\n            mode as \"mode: _\",\n            workspace_id,\n            path,\n            edited_by,\n            permissioned_as,\n            push_auth_config AS \"push_auth_config: _\",\n            retry as \"retry: _\",\n            error_handler_path,\n            error_handler_args as \"error_handler_args: _\"\n        FROM\n            azure_trigger\n        WHERE\n            workspace_id = $1 AND\n            path = $2 AND\n            azure_mode IN ('basic_push'::AZURE_TRIGGER_MODE, 'namespace_push'::AZURE_TRIGGER_MODE)\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "azure_resource_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "script_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "is_flow",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "mode: _",
+        "type_info": {
+          "Custom": {
+            "name": "trigger_mode",
+            "kind": {
+              "Enum": [
+                "enabled",
+                "disabled",
+                "suspended"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 4,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 5,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 6,
+        "name": "edited_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "permissioned_as",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 8,
+        "name": "push_auth_config: _",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 9,
+        "name": "retry: _",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 10,
+        "name": "error_handler_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 11,
+        "name": "error_handler_args: _",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      true,
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "efdcdf0f8d24a23682bb3792ebaffeb7a8dc5632043b6bf4a3dd680c9b99b5df"
+}
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 1bf072ee99..24cf5ea272 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -16084,6 +16084,7 @@ dependencies = [
  "windmill-runtime-nativets",
  "windmill-test-utils",
  "windmill-trigger",
+ "windmill-trigger-azure",
  "windmill-trigger-gcp",
  "windmill-trigger-kafka",
  "windmill-trigger-mqtt",
@@ -16263,6 +16264,7 @@ dependencies = [
  "windmill-queue",
  "windmill-store",
  "windmill-trigger",
+ "windmill-trigger-azure",
  "windmill-trigger-email",
  "windmill-trigger-gcp",
  "windmill-trigger-http",
@@ -17533,6 +17535,39 @@ dependencies = [
  "windmill-queue",
 ]
 
+[[package]]
+name = "windmill-trigger-azure"
+version = "1.689.0"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "axum 0.8.4",
+ "base64 0.22.1",
+ "bytes",
+ "chrono",
+ "constant_time_eq 0.3.1",
+ "hex",
+ "http 1.4.0",
+ "itertools 0.14.0",
+ "lazy_static",
+ "quick_cache",
+ "rand 0.9.0",
+ "reqwest 0.13.1",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "sqlx",
+ "thiserror 2.0.18",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "windmill-api-auth",
+ "windmill-common",
+ "windmill-git-sync",
+ "windmill-store",
+ "windmill-trigger",
+]
+
 [[package]]
 name = "windmill-trigger-email"
 version = "1.689.0"
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 8115b10955..5affc12bd3 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -27,6 +27,7 @@ members = [
     "./windmill-trigger-nats",
     "./windmill-trigger-sqs",
     "./windmill-trigger-gcp",
+    "./windmill-trigger-azure",
     "./windmill-trigger-http",
     "./windmill-native-triggers",
     "./windmill-alerting",
@@ -142,6 +143,7 @@ mqtt_trigger = ["windmill-api/mqtt_trigger"]
 native_trigger = ["windmill-api/native_trigger"]
 sqs_trigger = ["windmill-api/sqs_trigger", "windmill-common/aws_auth", "windmill-api/openidconnect"]
 gcp_trigger = ["windmill-api/gcp_trigger"]
+azure_trigger = ["windmill-api/azure_trigger"]
 smtp = ["windmill-api/smtp", "windmill-common/smtp", "windmill-queue/smtp"]
 license = ["windmill-api/license", "windmill-api-settings/license"]
 oauth2 = ["windmill-api/oauth2"]
@@ -183,7 +185,7 @@ oss_core = [
 ce_core = ["oss_core", "private", "operator"]
 ee_core = [
     "enterprise", "stripe", "prometheus", "cloud",
-    "kafka", "sqs_trigger", "nats", "gcp_trigger",
+    "kafka", "sqs_trigger", "nats", "gcp_trigger", "azure_trigger",
     "jemalloc", "otel", "operator"
 ]
 ee_server = ["enterprise_saml", "tantivy", "agent_worker_server", "local_reports"]
@@ -197,7 +199,7 @@ ee_rhel = ["ce_core", "ee_core", "kafka-gssapi", "all_languages"]
 ee_windows = ["ce_core", "ee_core", "all_languages_windows"]
 all_sqlx_features = ["all_languages", "enterprise", "enterprise_saml", "embedding", "parquet", "prometheus", "flow_testing",
  "openidconnect", "cloud", "jemalloc", "tantivy", "sqlx", "kafka", "kafka-gssapi", "nats", "otel", "dind", "websocket", "http_trigger",
-  "postgres_trigger", "mcp", "mqtt_trigger", "sqs_trigger", "gcp_trigger", "smtp", "stripe",
+  "postgres_trigger", "mcp", "mqtt_trigger", "sqs_trigger", "gcp_trigger", "azure_trigger", "smtp", "stripe",
    "license", "oauth2", "zip", "static_frontend", "scoped_cache", "agent_worker_server", "bedrock", "native_trigger", "quickjs",
    "windmill-git-sync/all_sqlx_features"]
 
@@ -277,6 +279,7 @@ windmill-trigger-kafka.workspace = true
 windmill-trigger-nats.workspace = true
 windmill-trigger-sqs.workspace = true
 windmill-trigger-gcp.workspace = true
+windmill-trigger-azure.workspace = true
 windmill-api-auth.workspace = true
 axum.workspace = true
 serde.workspace = true
@@ -327,6 +330,7 @@ windmill-trigger-email = { path = "./windmill-trigger-email" }
 windmill-trigger-nats = { path = "./windmill-trigger-nats" }
 windmill-trigger-sqs = { path = "./windmill-trigger-sqs" }
 windmill-trigger-gcp = { path = "./windmill-trigger-gcp" }
+windmill-trigger-azure = { path = "./windmill-trigger-azure" }
 windmill-trigger-http = { path = "./windmill-trigger-http" }
 windmill-native-triggers = { path = "./windmill-native-triggers" }
 windmill-alerting = { path = "./windmill-alerting" }
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 998c232e11..cdc7d2a659 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-2c2b8dc99689f54b8cd916fb9472fd5698b09478
+9659382d47286e7f7f66d01b6f5dd8d4ed34848b
diff --git a/backend/migrations/20260420162905_add_azure_trigger.down.sql b/backend/migrations/20260420162905_add_azure_trigger.down.sql
new file mode 100644
index 0000000000..c83cbb3adb
--- /dev/null
+++ b/backend/migrations/20260420162905_add_azure_trigger.down.sql
@@ -0,0 +1,5 @@
+-- Add down migration script here
+DROP TABLE IF EXISTS azure_trigger;
+DROP TYPE IF EXISTS AZURE_TRIGGER_MODE;
+-- Note: TRIGGER_KIND and JOB_TRIGGER_KIND enums cannot have values removed
+-- so we leave 'azure' in place as a dead value (matches other trigger migrations)
diff --git a/backend/migrations/20260420162905_add_azure_trigger.up.sql b/backend/migrations/20260420162905_add_azure_trigger.up.sql
new file mode 100644
index 0000000000..bf57bd4702
--- /dev/null
+++ b/backend/migrations/20260420162905_add_azure_trigger.up.sql
@@ -0,0 +1,95 @@
+-- Add up migration script here
+
+ALTER TYPE TRIGGER_KIND ADD VALUE IF NOT EXISTS 'azure';
+ALTER TYPE JOB_TRIGGER_KIND ADD VALUE IF NOT EXISTS 'azure';
+
+CREATE TYPE AZURE_TRIGGER_MODE AS ENUM ('basic_push', 'namespace_push', 'namespace_pull');
+
+CREATE TABLE azure_trigger (
+    azure_resource_path   VARCHAR(255) NOT NULL,
+    azure_mode            AZURE_TRIGGER_MODE NOT NULL,
+    scope_resource_id     TEXT NOT NULL,
+    topic_name            VARCHAR(255),
+    subscription_name     VARCHAR(255) NOT NULL,
+    event_type_filters    JSONB,
+    push_auth_config      JSONB,
+    path                  VARCHAR(255) NOT NULL,
+    script_path           VARCHAR(255) NOT NULL,
+    is_flow               BOOLEAN NOT NULL,
+    workspace_id          VARCHAR(50) NOT NULL,
+    edited_by             VARCHAR(50) NOT NULL,
+    email                 VARCHAR(255) NOT NULL,
+    edited_at             TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    extra_perms           JSONB NOT NULL DEFAULT '{}',
+    server_id             VARCHAR(50),
+    last_server_ping      TIMESTAMPTZ,
+    error                 TEXT,
+    mode                  TRIGGER_MODE NOT NULL DEFAULT 'enabled',
+    permissioned_as       VARCHAR(255) NOT NULL,
+    error_handler_path    VARCHAR(255),
+    error_handler_args    JSONB,
+    retry                 JSONB,
+    labels                TEXT[],
+    PRIMARY KEY (path, workspace_id),
+    CONSTRAINT azure_topic_name_matches_mode CHECK (
+        (azure_mode = 'basic_push' AND topic_name IS NULL) OR
+        (azure_mode IN ('namespace_push', 'namespace_pull') AND topic_name IS NOT NULL)
+    ),
+    CONSTRAINT azure_push_auth_config_matches_mode CHECK (
+        (azure_mode IN ('basic_push', 'namespace_push') AND push_auth_config IS NOT NULL) OR
+        (azure_mode = 'namespace_pull' AND push_auth_config IS NULL)
+    )
+);
+
+CREATE UNIQUE INDEX unique_subscription_per_azure_scope
+ON azure_trigger (subscription_name, scope_resource_id, workspace_id);
+
+CREATE INDEX idx_azure_trigger_labels ON azure_trigger USING GIN (labels) WHERE labels IS NOT NULL;
+
+GRANT ALL ON azure_trigger TO windmill_user;
+GRANT ALL ON azure_trigger TO windmill_admin;
+
+ALTER TABLE azure_trigger ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY admin_policy ON azure_trigger FOR ALL TO windmill_admin USING (true);
+
+CREATE POLICY see_folder_extra_perms_user_select ON azure_trigger FOR SELECT TO windmill_user
+USING (SPLIT_PART(azure_trigger.path, '/', 1) = 'f' AND SPLIT_PART(azure_trigger.path, '/', 2) = any(regexp_split_to_array(current_setting('session.folders_read'), ',')::text[]));
+CREATE POLICY see_folder_extra_perms_user_insert ON azure_trigger FOR INSERT TO windmill_user
+WITH CHECK (SPLIT_PART(azure_trigger.path, '/', 1) = 'f' AND SPLIT_PART(azure_trigger.path, '/', 2) = any(regexp_split_to_array(current_setting('session.folders_write'), ',')::text[]));
+CREATE POLICY see_folder_extra_perms_user_update ON azure_trigger FOR UPDATE TO windmill_user
+USING (SPLIT_PART(azure_trigger.path, '/', 1) = 'f' AND SPLIT_PART(azure_trigger.path, '/', 2) = any(regexp_split_to_array(current_setting('session.folders_write'), ',')::text[]));
+CREATE POLICY see_folder_extra_perms_user_delete ON azure_trigger FOR DELETE TO windmill_user
+USING (SPLIT_PART(azure_trigger.path, '/', 1) = 'f' AND SPLIT_PART(azure_trigger.path, '/', 2) = any(regexp_split_to_array(current_setting('session.folders_write'), ',')::text[]));
+
+CREATE POLICY see_own ON azure_trigger FOR ALL TO windmill_user
+USING (SPLIT_PART(azure_trigger.path, '/', 1) = 'u' AND SPLIT_PART(azure_trigger.path, '/', 2) = current_setting('session.user'));
+CREATE POLICY see_member ON azure_trigger FOR ALL TO windmill_user
+USING (SPLIT_PART(azure_trigger.path, '/', 1) = 'g' AND SPLIT_PART(azure_trigger.path, '/', 2) = any(regexp_split_to_array(current_setting('session.groups'), ',')::text[]));
+
+CREATE POLICY see_extra_perms_user_select ON azure_trigger FOR SELECT TO windmill_user
+USING (extra_perms ? CONCAT('u/', current_setting('session.user')));
+CREATE POLICY see_extra_perms_user_insert ON azure_trigger FOR INSERT TO windmill_user
+WITH CHECK ((extra_perms ->> CONCAT('u/', current_setting('session.user')))::boolean);
+CREATE POLICY see_extra_perms_user_update ON azure_trigger FOR UPDATE TO windmill_user
+USING ((extra_perms ->> CONCAT('u/', current_setting('session.user')))::boolean);
+CREATE POLICY see_extra_perms_user_delete ON azure_trigger FOR DELETE TO windmill_user
+USING ((extra_perms ->> CONCAT('u/', current_setting('session.user')))::boolean);
+
+CREATE POLICY see_extra_perms_groups_select ON azure_trigger FOR SELECT TO windmill_user
+USING (extra_perms ?| regexp_split_to_array(current_setting('session.pgroups'), ',')::text[]);
+CREATE POLICY see_extra_perms_groups_insert ON azure_trigger FOR INSERT TO windmill_user
+WITH CHECK (exists(
+    SELECT key, value FROM jsonb_each_text(extra_perms)
+    WHERE SPLIT_PART(key, '/', 1) = 'g' AND key = ANY(regexp_split_to_array(current_setting('session.pgroups'), ',')::text[])
+    AND value::boolean));
+CREATE POLICY see_extra_perms_groups_update ON azure_trigger FOR UPDATE TO windmill_user
+USING (exists(
+    SELECT key, value FROM jsonb_each_text(extra_perms)
+    WHERE SPLIT_PART(key, '/', 1) = 'g' AND key = ANY(regexp_split_to_array(current_setting('session.pgroups'), ',')::text[])
+    AND value::boolean));
+CREATE POLICY see_extra_perms_groups_delete ON azure_trigger FOR DELETE TO windmill_user
+USING (exists(
+    SELECT key, value FROM jsonb_each_text(extra_perms)
+    WHERE SPLIT_PART(key, '/', 1) = 'g' AND key = ANY(regexp_split_to_array(current_setting('session.pgroups'), ',')::text[])
+    AND value::boolean));
diff --git a/backend/windmill-api-auth/src/scopes.rs b/backend/windmill-api-auth/src/scopes.rs
index b8f73fb95a..42bca309c7 100644
--- a/backend/windmill-api-auth/src/scopes.rs
+++ b/backend/windmill-api-auth/src/scopes.rs
@@ -259,6 +259,7 @@ pub enum ScopeDomain {
     MqttTriggers,
     SqsTriggers,
     GcpTriggers,
+    AzureTriggers,
     PostgresTriggers,
     EmailTriggers,
 
@@ -317,6 +318,7 @@ impl ScopeDomain {
             Self::MqttTriggers => "mqtt_triggers",
             Self::SqsTriggers => "sqs_triggers",
             Self::GcpTriggers => "gcp_triggers",
+            Self::AzureTriggers => "azure_triggers",
             Self::PostgresTriggers => "postgres_triggers",
             Self::EmailTriggers => "email_triggers",
             Self::NativeTriggers => "native_triggers",
@@ -366,6 +368,7 @@ impl ScopeDomain {
             "mqtt_triggers" => Some(Self::MqttTriggers),
             "sqs_triggers" => Some(Self::SqsTriggers),
             "gcp_triggers" => Some(Self::GcpTriggers),
+            "azure_triggers" => Some(Self::AzureTriggers),
             "postgres_triggers" => Some(Self::PostgresTriggers),
             "email_triggers" => Some(Self::EmailTriggers),
             "audit" => Some(Self::Audit),
diff --git a/backend/windmill-api-groups/src/granular_acls.rs b/backend/windmill-api-groups/src/granular_acls.rs
index d7ea8418f9..eac532dc78 100644
--- a/backend/windmill-api-groups/src/granular_acls.rs
+++ b/backend/windmill-api-groups/src/granular_acls.rs
@@ -24,7 +24,7 @@ use windmill_common::{
     utils::{not_found_if_none, StripPath},
 };
 
-const KINDS: [&str; 19] = [
+const KINDS: [&str; 20] = [
     "script",
     "group_",
     "resource",
@@ -41,6 +41,7 @@ const KINDS: [&str; 19] = [
     "postgres_trigger",
     "mqtt_trigger",
     "gcp_trigger",
+    "azure_trigger",
     "sqs_trigger",
     "email_trigger",
     "volume",
diff --git a/backend/windmill-api-users/src/users.rs b/backend/windmill-api-users/src/users.rs
index 9cef7e6996..2ee32bd96c 100644
--- a/backend/windmill-api-users/src/users.rs
+++ b/backend/windmill-api-users/src/users.rs
@@ -1690,6 +1690,7 @@ pub async fn delete_workspace_user_internal(
         "nats_trigger",
         "sqs_trigger",
         "gcp_trigger",
+        "azure_trigger",
         "email_trigger",
     ];
     for table in &extra_perms_tables {
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index cf2d850b2c..22a6ed3881 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -3138,6 +3138,7 @@ struct UsedTriggers {
     pub mqtt_used: bool,
     pub sqs_used: bool,
     pub gcp_used: bool,
+    pub azure_used: bool,
     pub email_used: bool,
     pub nextcloud_used: bool,
     pub google_used: bool,
@@ -3162,6 +3163,7 @@ async fn get_used_triggers(
             EXISTS(SELECT 1 FROM mqtt_trigger WHERE workspace_id = $1) AS "mqtt_used!",
             EXISTS(SELECT 1 FROM sqs_trigger WHERE workspace_id = $1) AS "sqs_used!",
             EXISTS(SELECT 1 FROM gcp_trigger WHERE workspace_id = $1) AS "gcp_used!",
+            EXISTS(SELECT 1 FROM azure_trigger WHERE workspace_id = $1) AS "azure_used!",
             EXISTS(SELECT 1 FROM email_trigger WHERE workspace_id = $1) AS "email_used!",
             EXISTS(SELECT 1 FROM native_trigger WHERE workspace_id = $1 AND service_name = 'nextcloud'::native_trigger_service) AS "nextcloud_used!",
             EXISTS(SELECT 1 FROM native_trigger WHERE workspace_id = $1 AND service_name = 'google'::native_trigger_service) AS "google_used!",
diff --git a/backend/windmill-api/Cargo.toml b/backend/windmill-api/Cargo.toml
index 7f73830c56..2af5e17406 100644
--- a/backend/windmill-api/Cargo.toml
+++ b/backend/windmill-api/Cargo.toml
@@ -10,8 +10,8 @@ path = "src/lib.rs"
 
 [features]
 default = []
-private = ["windmill-audit/private", "windmill-common/private", "windmill-api-auth/private", "windmill-store/private", "windmill-api-users/private", "windmill-api-workspaces/private", "windmill-api-groups/private", "windmill-api-configs/private", "windmill-api-settings/private", "windmill-api-agent-workers?/private", "windmill-trigger-kafka?/private", "windmill-trigger-postgres?/private", "windmill-trigger-mqtt?/private", "windmill-trigger-websocket?/private", "windmill-trigger-nats?/private", "windmill-trigger-sqs?/private", "windmill-trigger-gcp?/private", "windmill-trigger-email?/private", "windmill-git-sync/private", "windmill-autoscaling?/private"]
-enterprise = ["windmill-queue/enterprise", "windmill-audit/enterprise", "windmill-git-sync/enterprise", "windmill-common/enterprise", "windmill-worker?/enterprise", "windmill-api-auth/enterprise", "windmill-store/enterprise", "windmill-api-jobs/enterprise", "windmill-api-scripts/enterprise", "windmill-api-flows/enterprise", "windmill-api-users/enterprise", "windmill-api-workspaces/enterprise", "windmill-api-groups/enterprise", "windmill-api-configs/enterprise", "windmill-api-settings/enterprise", "windmill-api-schedule/enterprise", "windmill-api-agent-workers?/enterprise", "windmill-trigger/enterprise", "windmill-trigger-kafka?/enterprise", "windmill-trigger-postgres?/enterprise", "windmill-trigger-mqtt?/enterprise", "windmill-trigger-websocket?/enterprise", "windmill-trigger-email?/enterprise", "windmill-trigger-nats?/enterprise", "windmill-trigger-sqs?/enterprise", "windmill-trigger-gcp?/enterprise", "windmill-trigger-http?/enterprise", "windmill-native-triggers?/enterprise", "dep:windmill-autoscaling", "windmill-autoscaling/enterprise"]
+private = ["windmill-audit/private", "windmill-common/private", "windmill-api-auth/private", "windmill-store/private", "windmill-api-users/private", "windmill-api-workspaces/private", "windmill-api-groups/private", "windmill-api-configs/private", "windmill-api-settings/private", "windmill-api-agent-workers?/private", "windmill-trigger-kafka?/private", "windmill-trigger-postgres?/private", "windmill-trigger-mqtt?/private", "windmill-trigger-websocket?/private", "windmill-trigger-nats?/private", "windmill-trigger-sqs?/private", "windmill-trigger-gcp?/private", "windmill-trigger-azure?/private", "windmill-trigger-email?/private", "windmill-git-sync/private", "windmill-autoscaling?/private"]
+enterprise = ["windmill-queue/enterprise", "windmill-audit/enterprise", "windmill-git-sync/enterprise", "windmill-common/enterprise", "windmill-worker?/enterprise", "windmill-api-auth/enterprise", "windmill-store/enterprise", "windmill-api-jobs/enterprise", "windmill-api-scripts/enterprise", "windmill-api-flows/enterprise", "windmill-api-users/enterprise", "windmill-api-workspaces/enterprise", "windmill-api-groups/enterprise", "windmill-api-configs/enterprise", "windmill-api-settings/enterprise", "windmill-api-schedule/enterprise", "windmill-api-agent-workers?/enterprise", "windmill-trigger/enterprise", "windmill-trigger-kafka?/enterprise", "windmill-trigger-postgres?/enterprise", "windmill-trigger-mqtt?/enterprise", "windmill-trigger-websocket?/enterprise", "windmill-trigger-email?/enterprise", "windmill-trigger-nats?/enterprise", "windmill-trigger-sqs?/enterprise", "windmill-trigger-gcp?/enterprise", "windmill-trigger-azure?/enterprise", "windmill-trigger-http?/enterprise", "windmill-native-triggers?/enterprise", "dep:windmill-autoscaling", "windmill-autoscaling/enterprise"]
 stripe = []
 run_inline = ["dep:windmill-worker", "windmill-api-configs/run_inline"]
 agent_worker_server = ["dep:windmill-worker", "dep:windmill-api-agent-workers"]
@@ -37,6 +37,7 @@ mqtt_trigger = ["dep:windmill-trigger-mqtt", "windmill-store/mqtt_trigger"]
 native_trigger = ["dep:windmill-native-triggers", "windmill-native-triggers/native_trigger", "dep:strum", "oauth2"]
 sqs_trigger = ["dep:windmill-trigger-sqs", "windmill-store/sqs_trigger"]
 gcp_trigger = ["dep:windmill-trigger-gcp", "windmill-store/gcp_trigger"]
+azure_trigger = ["dep:windmill-trigger-azure", "windmill-store/azure_trigger"]
 cloud = ["windmill-common/cloud", "windmill-api-auth/cloud", "windmill-store/cloud", "windmill-api-workspaces/cloud"]
 mcp = ["dep:windmill-mcp", "windmill-mcp/server", "windmill-mcp/auth", "windmill-api-auth/mcp", "windmill-store/mcp"]
 bedrock = ["windmill-ai/bedrock", "dep:aws-sdk-bedrock", "dep:aws-sdk-bedrockruntime", "dep:aws-config", "dep:aws-credential-types", "dep:aws-smithy-types"]
@@ -145,6 +146,7 @@ windmill-trigger-email = { workspace = true, optional = true }
 windmill-trigger-nats = { workspace = true, optional = true }
 windmill-trigger-sqs = { workspace = true, optional = true }
 windmill-trigger-gcp = { workspace = true, optional = true }
+windmill-trigger-azure = { workspace = true, optional = true }
 windmill-trigger-http = { workspace = true, optional = true }
 windmill-native-triggers = { workspace = true, optional = true }
 windmill-alerting.workspace = true
diff --git a/backend/windmill-api/openapi-deref.json b/backend/windmill-api/openapi-deref.json
index 7c37aa953a..25febc37c6 100644
--- a/backend/windmill-api/openapi-deref.json
+++ b/backend/windmill-api/openapi-deref.json
@@ -1,7 +1,7 @@
 {
   "openapi": "3.0.3",
   "info": {
-    "version": "1.685.0",
+    "version": "1.689.0",
     "title": "Windmill API",
     "contact": {
       "name": "Windmill Team",
@@ -446,6 +446,28 @@
         }
       }
     },
+    "/auth/is_password_login_disabled": {
+      "get": {
+        "security": [],
+        "summary": "check if password login is disabled instance-wide",
+        "operationId": "isPasswordLoginDisabled",
+        "tags": [
+          "user"
+        ],
+        "responses": {
+          "200": {
+            "description": "returns true if password login is disabled",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "boolean"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/auth/request_password_reset": {
       "post": {
         "security": [],
@@ -3693,6 +3715,10 @@
                     },
                     "client_id": {
                       "type": "string"
+                    },
+                    "app_owner": {
+                      "type": "string",
+                      "nullable": true
                     }
                   },
                   "required": [
@@ -7050,6 +7076,9 @@
                     "gcp_used": {
                       "type": "boolean"
                     },
+                    "azure_used": {
+                      "type": "boolean"
+                    },
                     "sqs_used": {
                       "type": "boolean"
                     },
@@ -7061,6 +7090,9 @@
                     },
                     "google_used": {
                       "type": "boolean"
+                    },
+                    "github_used": {
+                      "type": "boolean"
                     }
                   },
                   "required": [
@@ -7071,10 +7103,12 @@
                     "postgres_used",
                     "mqtt_used",
                     "gcp_used",
+                    "azure_used",
                     "sqs_used",
                     "email_used",
                     "nextcloud_used",
-                    "google_used"
+                    "google_used",
+                    "github_used"
                   ]
                 }
               }
@@ -14707,7 +14741,7 @@
         "summary": "list flow conversations",
         "operationId": "listFlowConversations",
         "tags": [
-          "flow_conversation"
+          "flow_conversations"
         ],
         "parameters": [
           {
@@ -14750,7 +14784,7 @@
         "summary": "delete flow conversation",
         "operationId": "deleteFlowConversation",
         "tags": [
-          "flow_conversation"
+          "flow_conversations"
         ],
         "parameters": [
           {
@@ -14786,7 +14820,7 @@
         "summary": "list conversation messages",
         "operationId": "listConversationMessages",
         "tags": [
-          "flow_conversation"
+          "flow_conversations"
         ],
         "parameters": [
           {
@@ -16971,6 +17005,109 @@
         }
       }
     },
+    "/w/{workspace}/jobs/run/dependencies_async": {
+      "post": {
+        "summary": "queue a one-off dependencies job and return the job uuid",
+        "operationId": "runRawScriptDependenciesAsync",
+        "tags": [
+          "job"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          }
+        ],
+        "requestBody": {
+          "description": "raw script content",
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "raw_scripts": {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/components/schemas/RawScriptForDependencies"
+                    }
+                  },
+                  "entrypoint": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "entrypoint",
+                  "raw_scripts"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "dependency job created",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string",
+                  "format": "uuid"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/w/{workspace}/jobs/run/flow_dependencies_async": {
+      "post": {
+        "summary": "queue a one-off flow dependencies job and return the job uuid",
+        "operationId": "runFlowDependenciesAsync",
+        "tags": [
+          "job"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          }
+        ],
+        "requestBody": {
+          "description": "flow value and path",
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "path": {
+                    "type": "string"
+                  },
+                  "flow_value": {
+                    "$ref": "#/components/schemas/FlowValue"
+                  }
+                },
+                "required": [
+                  "path",
+                  "flow_value"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "flow dependencies job created",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string",
+                  "format": "uuid"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/w/{workspace}/jobs/run/preview_flow": {
       "post": {
         "summary": "run flow preview",
@@ -17644,6 +17781,13 @@
             "schema": {
               "type": "boolean"
             }
+          },
+          {
+            "name": "all_workspaces",
+            "in": "query",
+            "schema": {
+              "type": "boolean"
+            }
           }
         ],
         "requestBody": {
@@ -23289,6 +23433,40 @@
         }
       }
     },
+    "/w/{workspace}/native_triggers/github/repos": {
+      "get": {
+        "summary": "list GitHub repositories accessible to the user",
+        "operationId": "listGithubRepos",
+        "tags": [
+          "native_trigger"
+        ],
+        "parameters": [
+          {
+            "name": "workspace",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "list of GitHub repositories",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/GithubRepoEntry"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/native_triggers/{service_name}/w/{workspace_id}/webhook/{internal_id}": {
       "post": {
         "summary": "receive webhook from external native trigger service",
@@ -24118,6 +24296,495 @@
         }
       }
     },
+    "/w/{workspace}/azure_triggers/create": {
+      "post": {
+        "summary": "create an Azure Event Grid trigger",
+        "operationId": "createAzureTrigger",
+        "tags": [
+          "azure_trigger"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AzureTriggerData"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "azure trigger created",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/w/{workspace}/azure_triggers/update/{path}": {
+      "post": {
+        "summary": "update an Azure Event Grid trigger",
+        "operationId": "updateAzureTrigger",
+        "tags": [
+          "azure_trigger"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          },
+          {
+            "$ref": "#/components/parameters/Path"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AzureTriggerData"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "azure trigger updated",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/w/{workspace}/azure_triggers/delete/{path}": {
+      "delete": {
+        "summary": "delete an Azure Event Grid trigger",
+        "operationId": "deleteAzureTrigger",
+        "tags": [
+          "azure_trigger"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          },
+          {
+            "$ref": "#/components/parameters/Path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "azure trigger deleted",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/w/{workspace}/azure_triggers/get/{path}": {
+      "get": {
+        "summary": "get an Azure Event Grid trigger",
+        "operationId": "getAzureTrigger",
+        "tags": [
+          "azure_trigger"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          },
+          {
+            "$ref": "#/components/parameters/Path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "azure trigger",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AzureTrigger"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/w/{workspace}/azure_triggers/list": {
+      "get": {
+        "summary": "list azure triggers",
+        "operationId": "listAzureTriggers",
+        "tags": [
+          "azure_trigger"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          },
+          {
+            "$ref": "#/components/parameters/Page"
+          },
+          {
+            "$ref": "#/components/parameters/PerPage"
+          },
+          {
+            "name": "path",
+            "description": "filter by exact path",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "is_flow",
+            "in": "query",
+            "schema": {
+              "type": "boolean"
+            }
+          },
+          {
+            "name": "path_start",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "azure trigger list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/AzureTrigger"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/w/{workspace}/azure_triggers/exists/{path}": {
+      "get": {
+        "summary": "check whether an azure trigger exists",
+        "operationId": "existsAzureTrigger",
+        "tags": [
+          "azure_trigger"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          },
+          {
+            "$ref": "#/components/parameters/Path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "true/false",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "boolean"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/w/{workspace}/azure_triggers/setmode/{path}": {
+      "post": {
+        "summary": "set azure trigger mode",
+        "operationId": "setAzureTriggerMode",
+        "tags": [
+          "azure_trigger"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          },
+          {
+            "$ref": "#/components/parameters/Path"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "mode": {
+                    "$ref": "#/components/schemas/TriggerMode"
+                  }
+                },
+                "required": [
+                  "mode"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "trigger mode updated",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/w/{workspace}/azure_triggers/test": {
+      "post": {
+        "summary": "test Azure service principal connection",
+        "operationId": "testAzureConnection",
+        "tags": [
+          "azure_trigger"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/TestAzureConnection"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "connection successful",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/w/{workspace}/azure_triggers/namespaces/topics/list/{path}": {
+      "post": {
+        "summary": "list topics under an Event Grid Namespace",
+        "operationId": "listAzureNamespaceTopics",
+        "tags": [
+          "azure_trigger"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          },
+          {
+            "$ref": "#/components/parameters/Path"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AzureListTopics"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "topic list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/w/{workspace}/azure_triggers/namespaces/subscriptions/list/{path}": {
+      "post": {
+        "summary": "list subscriptions under a Namespace topic",
+        "operationId": "listAzureNamespaceSubscriptions",
+        "tags": [
+          "azure_trigger"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          },
+          {
+            "$ref": "#/components/parameters/Path"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AzureListSubscriptions"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "subscription list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/w/{workspace}/azure_triggers/subscriptions/delete/{path}": {
+      "delete": {
+        "summary": "delete an Event Grid subscription on Azure",
+        "operationId": "deleteAzureSubscription",
+        "tags": [
+          "azure_trigger"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          },
+          {
+            "$ref": "#/components/parameters/Path"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AzureDeleteSubscription"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "subscription deleted",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/w/{workspace}/azure_triggers/namespaces/list/{path}": {
+      "post": {
+        "summary": "list Event Grid Namespaces the service principal can access",
+        "operationId": "listAzureNamespaces",
+        "tags": [
+          "azure_trigger"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          },
+          {
+            "$ref": "#/components/parameters/Path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "namespace list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/AzureArmResource"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/w/{workspace}/azure_triggers/basic/topics/list/{path}": {
+      "post": {
+        "summary": "list Basic Event Grid topics + system topics the service principal can access",
+        "operationId": "listAzureBasicTopics",
+        "tags": [
+          "azure_trigger"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/WorkspaceId"
+          },
+          {
+            "$ref": "#/components/parameters/Path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "topic list",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/AzureArmResource"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/w/{workspace}/postgres_triggers/postgres/version/{path}": {
       "get": {
         "summary": "get postgres version",
@@ -27140,6 +27807,7 @@
                 "postgres_trigger",
                 "mqtt_trigger",
                 "gcp_trigger",
+                "azure_trigger",
                 "sqs_trigger",
                 "email_trigger",
                 "volume"
@@ -27201,6 +27869,7 @@
                 "postgres_trigger",
                 "mqtt_trigger",
                 "gcp_trigger",
+                "azure_trigger",
                 "sqs_trigger",
                 "email_trigger",
                 "volume"
@@ -27281,6 +27950,7 @@
                 "postgres_trigger",
                 "mqtt_trigger",
                 "gcp_trigger",
+                "azure_trigger",
                 "sqs_trigger",
                 "email_trigger",
                 "volume"
@@ -36900,7 +37570,9 @@
           "mqtt",
           "sqs",
           "gcp",
-          "google"
+          "azure",
+          "google",
+          "github"
         ]
       },
       "TriggerMode": {
@@ -37541,6 +38213,9 @@
           "gcp_count": {
             "type": "number"
           },
+          "azure_count": {
+            "type": "number"
+          },
           "sqs_count": {
             "type": "number"
           },
@@ -37549,6 +38224,9 @@
           },
           "google_count": {
             "type": "number"
+          },
+          "github_count": {
+            "type": "number"
           }
         }
       },
@@ -38436,6 +39114,233 @@
           "subscription_id"
         ]
       },
+      "AzureMode": {
+        "type": "string",
+        "enum": [
+          "basic_push",
+          "namespace_push",
+          "namespace_pull"
+        ],
+        "description": "Azure Event Grid trigger mode."
+      },
+      "AzureArmResource": {
+        "type": "object",
+        "description": "An ARM resource the service principal can see.",
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "location": {
+            "type": "string"
+          },
+          "type": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "name",
+          "type"
+        ]
+      },
+      "AzureDeleteSubscription": {
+        "type": "object",
+        "properties": {
+          "azure_mode": {
+            "$ref": "#/components/schemas/AzureMode"
+          },
+          "scope_resource_id": {
+            "type": "string"
+          },
+          "topic_name": {
+            "type": "string",
+            "nullable": true
+          },
+          "subscription_name": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "azure_mode",
+          "scope_resource_id",
+          "subscription_name"
+        ]
+      },
+      "AzureTrigger": {
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/TriggerExtraProperty"
+          }
+        ],
+        "type": "object",
+        "description": "An Azure Event Grid trigger that executes a script or flow when events arrive.",
+        "properties": {
+          "azure_resource_path": {
+            "type": "string"
+          },
+          "azure_mode": {
+            "$ref": "#/components/schemas/AzureMode"
+          },
+          "scope_resource_id": {
+            "type": "string",
+            "description": "ARM resource ID of the topic (basic) or namespace (namespace modes)."
+          },
+          "topic_name": {
+            "type": "string",
+            "nullable": true,
+            "description": "Topic name within the namespace (namespace modes only)."
+          },
+          "subscription_name": {
+            "type": "string"
+          },
+          "event_type_filters": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "nullable": true
+          },
+          "server_id": {
+            "type": "string"
+          },
+          "last_server_ping": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "error": {
+            "type": "string"
+          },
+          "error_handler_path": {
+            "type": "string"
+          },
+          "error_handler_args": {
+            "$ref": "#/components/schemas/ScriptArgs"
+          },
+          "retry": {
+            "$ref": "#/components/schemas/Retry"
+          }
+        },
+        "required": [
+          "azure_resource_path",
+          "azure_mode",
+          "scope_resource_id",
+          "subscription_name"
+        ]
+      },
+      "AzureTriggerData": {
+        "type": "object",
+        "description": "Data for creating or updating an Azure Event Grid trigger.",
+        "properties": {
+          "azure_resource_path": {
+            "type": "string"
+          },
+          "azure_mode": {
+            "$ref": "#/components/schemas/AzureMode"
+          },
+          "scope_resource_id": {
+            "type": "string"
+          },
+          "topic_name": {
+            "type": "string",
+            "nullable": true
+          },
+          "subscription_name": {
+            "type": "string"
+          },
+          "base_endpoint": {
+            "type": "string",
+            "description": "Base URL for push delivery endpoints (push modes only)."
+          },
+          "event_type_filters": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "path": {
+            "type": "string"
+          },
+          "script_path": {
+            "type": "string"
+          },
+          "is_flow": {
+            "type": "boolean"
+          },
+          "mode": {
+            "$ref": "#/components/schemas/TriggerMode"
+          },
+          "error_handler_path": {
+            "type": "string"
+          },
+          "error_handler_args": {
+            "$ref": "#/components/schemas/ScriptArgs"
+          },
+          "retry": {
+            "$ref": "#/components/schemas/Retry"
+          },
+          "permissioned_as": {
+            "type": "string"
+          },
+          "preserve_permissioned_as": {
+            "type": "boolean"
+          },
+          "labels": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        },
+        "required": [
+          "path",
+          "script_path",
+          "is_flow",
+          "azure_resource_path",
+          "azure_mode",
+          "scope_resource_id",
+          "subscription_name"
+        ]
+      },
+      "TestAzureConnection": {
+        "type": "object",
+        "properties": {
+          "azure_resource_path": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "azure_resource_path"
+        ]
+      },
+      "AzureListTopics": {
+        "type": "object",
+        "properties": {
+          "scope_resource_id": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "scope_resource_id"
+        ]
+      },
+      "AzureListSubscriptions": {
+        "type": "object",
+        "properties": {
+          "scope_resource_id": {
+            "type": "string"
+          },
+          "topic_name": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "scope_resource_id",
+          "topic_name"
+        ]
+      },
       "AwsAuthResourceType": {
         "type": "string",
         "enum": [
@@ -41604,6 +42509,7 @@
           "sqs",
           "mqtt",
           "gcp",
+          "azure",
           "email"
         ]
       },
@@ -42327,7 +43233,8 @@
         "type": "string",
         "enum": [
           "nextcloud",
-          "google"
+          "google",
+          "github"
         ]
       },
       "NativeTrigger": {
@@ -42689,6 +43596,29 @@
           "name"
         ]
       },
+      "GithubRepoEntry": {
+        "type": "object",
+        "properties": {
+          "full_name": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "owner": {
+            "type": "string"
+          },
+          "private": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "full_name",
+          "name",
+          "owner",
+          "private"
+        ]
+      },
       "schemas-StaticTransform": {
         "type": "object",
         "description": "Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'",
diff --git a/backend/windmill-api/openapi-deref.yaml b/backend/windmill-api/openapi-deref.yaml
index 4783545b60..8f24919fe5 100644
--- a/backend/windmill-api/openapi-deref.yaml
+++ b/backend/windmill-api/openapi-deref.yaml
@@ -1,6 +1,6 @@
 openapi: 3.0.3
 info:
-  version: 1.685.0
+  version: 1.689.0
   title: Windmill API
   contact:
     name: Windmill Team
@@ -146,18 +146,18 @@ paths:
                   checks:
                     type: object
                     description: Detailed health checks
-                    required: &ref_336
+                    required: &ref_346
                       - database
                       - readiness
-                    properties: &ref_337
+                    properties: &ref_347
                       database:
                         type: object
                         description: Database health status
-                        required: &ref_338
+                        required: &ref_348
                           - healthy
                           - latency_ms
                           - pool
-                        properties: &ref_339
+                        properties: &ref_349
                           healthy:
                             type: boolean
                             description: Whether the database is reachable
@@ -168,11 +168,11 @@ paths:
                           pool:
                             type: object
                             description: Database connection pool statistics
-                            required: &ref_340
+                            required: &ref_350
                               - size
                               - idle
                               - max_connections
-                            properties: &ref_341
+                            properties: &ref_351
                               size:
                                 type: integer
                                 description: Current number of connections in the pool
@@ -186,13 +186,13 @@ paths:
                         description: Workers health status
                         nullable: true
                         type: object
-                        required: &ref_342
+                        required: &ref_352
                           - healthy
                           - active_count
                           - worker_groups
                           - min_version
                           - versions
-                        properties: &ref_343
+                        properties: &ref_353
                           healthy:
                             type: boolean
                             description: Whether any workers are active
@@ -219,10 +219,10 @@ paths:
                         description: Job queue status
                         nullable: true
                         type: object
-                        required: &ref_344
+                        required: &ref_354
                           - pending_jobs
                           - running_jobs
-                        properties: &ref_345
+                        properties: &ref_355
                           pending_jobs:
                             type: integer
                             format: int64
@@ -234,9 +234,9 @@ paths:
                       readiness:
                         type: object
                         description: Server readiness status
-                        required: &ref_346
+                        required: &ref_356
                           - healthy
-                        properties: &ref_347
+                        properties: &ref_357
                           healthy:
                             type: boolean
                             description: Whether the server is ready to accept requests
@@ -488,24 +488,24 @@ paths:
         - name: before
           description: filter on started before (inclusive) timestamp
           in: query
-          schema: &ref_288
+          schema: &ref_298
             type: string
             format: date-time
         - name: after
           description: filter on created after (exclusive) timestamp
           in: query
-          schema: &ref_289
+          schema: &ref_299
             type: string
             format: date-time
         - name: username
           description: filter on exact username of user
           in: query
-          schema: &ref_297
+          schema: &ref_307
             type: string
         - name: operation
           description: filter on exact or prefix name of operation
           in: query
-          schema: &ref_298
+          schema: &ref_308
             type: string
         - name: operations
           in: query
@@ -520,12 +520,12 @@ paths:
         - name: resource
           description: filter on exact or prefix name of resource
           in: query
-          schema: &ref_299
+          schema: &ref_309
             type: string
         - name: action_kind
           description: filter on type of operation
           in: query
-          schema: &ref_300
+          schema: &ref_310
             type: string
             enum:
               - Create
@@ -562,12 +562,12 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_386
+              properties: &ref_396
                 email:
                   type: string
                 password:
                   type: string
-              required: &ref_387
+              required: &ref_397
                 - email
                 - password
       responses:
@@ -618,6 +618,20 @@ paths:
             application/json:
               schema:
                 type: boolean
+  /auth/is_password_login_disabled:
+    get:
+      security: []
+      summary: check if password login is disabled instance-wide
+      operationId: isPasswordLoginDisabled
+      tags:
+        - user
+      responses:
+        '200':
+          description: returns true if password login is disabled
+          content:
+            application/json:
+              schema:
+                type: boolean
   /auth/request_password_reset:
     post:
       security: []
@@ -743,7 +757,7 @@ paths:
                     nullable: true
                     allOf:
                       - type: object
-                        properties: &ref_383
+                        properties: &ref_393
                           source:
                             type: string
                             enum:
@@ -761,7 +775,7 @@ paths:
                             description: >-
                               The instance group name (when source is
                               'instance_group')
-                        required: &ref_384
+                        required: &ref_394
                           - source
                   is_service_account:
                     type: boolean
@@ -799,7 +813,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_388
+              properties: &ref_398
                 is_admin:
                   type: boolean
                 operator:
@@ -1173,7 +1187,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_402
+                  properties: &ref_412
                     jwt_hash:
                       type: integer
                       format: int64
@@ -1196,7 +1210,7 @@ paths:
                     last_used_at:
                       type: string
                       format: date-time
-                  required: &ref_403
+                  required: &ref_413
                     - jwt_hash
                     - email
                     - username
@@ -1328,7 +1342,7 @@ paths:
                     type: array
                     items:
                       type: object
-                      properties: &ref_389
+                      properties: &ref_399
                         label:
                           type: string
                         scopes:
@@ -1337,7 +1351,7 @@ paths:
                             type: string
                         expiration:
                           type: string
-                      required: &ref_390
+                      required: &ref_400
                         - label
                         - scopes
                     description: Tokens owned by this user (will be deleted)
@@ -1381,7 +1395,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_391
+              properties: &ref_401
                 reassign_to:
                   type: string
                   description: 'Target for reassignment: ''u/{username}'' or ''f/{folder}'''
@@ -1395,7 +1409,7 @@ paths:
                   type: boolean
                   default: true
                   description: Whether to also remove the user from the workspace
-              required: &ref_392
+              required: &ref_402
                 - reassign_to
       responses:
         '200':
@@ -1414,7 +1428,7 @@ paths:
                       on success.
                   summary:
                     type: object
-                    properties: &ref_393
+                    properties: &ref_403
                       scripts_reassigned:
                         type: integer
                       flows_reassigned:
@@ -1431,7 +1445,7 @@ paths:
                         type: integer
                       drafts_deleted:
                         type: integer
-                    required: &ref_394
+                    required: &ref_404
                       - scripts_reassigned
                       - flows_reassigned
                       - apps_reassigned
@@ -1461,12 +1475,12 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: &ref_395
+                properties: &ref_405
                   workspaces:
                     type: array
                     items:
                       type: object
-                      properties: &ref_397
+                      properties: &ref_407
                         workspace_id:
                           type: string
                         username:
@@ -1475,11 +1489,11 @@ paths:
                           type: object
                           properties: *ref_12
                           required: *ref_13
-                      required: &ref_398
+                      required: &ref_408
                         - workspace_id
                         - username
                         - preview
-                required: &ref_396
+                required: &ref_406
                   - workspaces
   /users/offboard/{email}:
     post:
@@ -1501,12 +1515,12 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_399
+              properties: &ref_409
                 reassignments:
                   type: object
                   additionalProperties:
                     type: object
-                    properties: &ref_400
+                    properties: &ref_410
                       reassign_to:
                         type: string
                         description: 'Target: ''u/{username}'' or ''f/{folder}'''
@@ -1515,7 +1529,7 @@ paths:
                         description: >-
                           Required when reassign_to is a folder. Username to use
                           as permissioned_as.
-                    required: &ref_401
+                    required: &ref_411
                       - reassign_to
                   description: Map of workspace_id to reassignment config
                 delete_user:
@@ -1575,7 +1589,7 @@ paths:
             application/json:
               schema:
                 type: array
-                items: &ref_542
+                items: &ref_558
                   type: object
                   properties:
                     workspace_id:
@@ -1673,7 +1687,7 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: &ref_483
+                properties: &ref_501
                   email:
                     type: string
                   workspaces:
@@ -1748,7 +1762,7 @@ paths:
                         - username
                         - color
                         - disabled
-                required: &ref_484
+                required: &ref_502
                   - email
                   - workspaces
   /w/{workspace}/workspaces/get_as_superadmin:
@@ -1810,7 +1824,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_485
+              properties: &ref_503
                 id:
                   type: string
                 name:
@@ -1819,7 +1833,7 @@ paths:
                   type: string
                 color:
                   type: string
-              required: &ref_486
+              required: &ref_504
                 - id
                 - name
       responses:
@@ -1995,7 +2009,7 @@ paths:
                   properties: &ref_24
                     logs:
                       type: object
-                      properties: &ref_451
+                      properties: &ref_469
                         super_admin:
                           type: string
                           enum: &ref_21
@@ -2689,11 +2703,11 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_525
+                  properties: &ref_541
                     name:
                       type: string
                     value: {}
-                  required: &ref_526
+                  required: &ref_542
                     - name
                     - value
   /settings/instance_config:
@@ -2791,9 +2805,9 @@ paths:
             application/json:
               schema:
                 type: object
-                required: &ref_359
+                required: &ref_369
                   - keys
-                properties: &ref_360
+                properties: &ref_370
                   keys:
                     type: array
                     items:
@@ -2895,11 +2909,11 @@ paths:
                     type: array
                     items:
                       type: object
-                      required: &ref_357
+                      required: &ref_367
                         - workspace_id
                         - path
                         - error
-                      properties: &ref_358
+                      properties: &ref_368
                         workspace_id:
                           type: string
                           description: Workspace ID where the secret is located
@@ -3546,6 +3560,9 @@ paths:
                     type: string
                   client_id:
                     type: string
+                  app_owner:
+                    type: string
+                    nullable: true
                 required:
                   - base_url
                   - app_slug
@@ -4064,13 +4081,13 @@ paths:
             application/json:
               schema:
                 type: object
-                required: &ref_534
+                required: &ref_550
                   - all_ahead_items_visible
                   - all_behind_items_visible
                   - skipped_comparison
                   - diffs
                   - summary
-                properties: &ref_535
+                properties: &ref_551
                   all_ahead_items_visible:
                     type: boolean
                     description: >-
@@ -4091,7 +4108,7 @@ paths:
                     description: List of differences found between workspaces
                     items:
                       type: object
-                      required: &ref_536
+                      required: &ref_552
                         - kind
                         - path
                         - ahead
@@ -4099,7 +4116,7 @@ paths:
                         - has_changes
                         - exists_in_source
                         - exists_in_fork
-                      properties: &ref_537
+                      properties: &ref_553
                         kind:
                           type: string
                           enum:
@@ -4132,7 +4149,7 @@ paths:
                   summary:
                     description: Summary statistics of the comparison
                     type: object
-                    required: &ref_538
+                    required: &ref_554
                       - total_diffs
                       - total_ahead
                       - total_behind
@@ -4144,7 +4161,7 @@ paths:
                       - resource_types_changed
                       - folders_changed
                       - conflicts
-                    properties: &ref_539
+                    properties: &ref_555
                       total_diffs:
                         type: integer
                         description: Total number of items with differences
@@ -4318,7 +4335,7 @@ paths:
                   auto_invite:
                     type: object
                     description: Configuration for auto-inviting users to the workspace
-                    properties: &ref_348
+                    properties: &ref_358
                       enabled:
                         type: boolean
                         default: false
@@ -4359,14 +4376,14 @@ paths:
                         type: object
                         additionalProperties:
                           type: object
-                          properties: &ref_367
+                          properties: &ref_377
                             resource_path:
                               type: string
                             models:
                               type: array
                               items:
                                 type: string
-                          required: &ref_368
+                          required: &ref_378
                             - resource_path
                             - models
                       default_model:
@@ -4408,7 +4425,7 @@ paths:
                   error_handler:
                     type: object
                     description: Configuration for the workspace error handler
-                    properties: &ref_349
+                    properties: &ref_359
                       path:
                         type: string
                         description: Path to the error handler script or flow
@@ -4425,7 +4442,7 @@ paths:
                   success_handler:
                     type: object
                     description: Configuration for the workspace success handler
-                    properties: &ref_350
+                    properties: &ref_360
                       path:
                         type: string
                         description: Path to the success handler script or flow
@@ -4456,12 +4473,12 @@ paths:
                         type: array
                         items:
                           type: object
-                          properties: &ref_509
+                          properties: &ref_527
                             pattern:
                               type: string
                             allow:
                               type: string
-                          required: &ref_510
+                          required: &ref_528
                             - pattern
                             - allow
                       secondary_storage:
@@ -4832,7 +4849,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_488
+                  properties: &ref_506
                     importer_path:
                       type: string
                     importer_kind:
@@ -4846,7 +4863,7 @@ paths:
                       items:
                         type: string
                       nullable: true
-                  required: &ref_489
+                  required: &ref_507
                     - importer_path
                     - importer_kind
   /w/{workspace}/workspaces/get_imports/{importer_path}:
@@ -4904,13 +4921,13 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_490
+                  properties: &ref_508
                     imported_path:
                       type: string
                     count:
                       type: integer
                       format: int64
-                  required: &ref_491
+                  required: &ref_509
                     - imported_path
                     - count
   /w/{workspace}/workspaces/get_dependency_map:
@@ -4933,7 +4950,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_487
+                  properties: &ref_505
                     workspace_id:
                       type: string
                       nullable: true
@@ -5432,7 +5449,7 @@ paths:
                         type: array
                         items:
                           type: object
-                          properties: &ref_369
+                          properties: &ref_379
                             provider:
                               type: string
                               enum: *ref_47
@@ -5440,7 +5457,7 @@ paths:
                               type: array
                               items:
                                 type: string
-                          required: &ref_370
+                          required: &ref_380
                             - provider
                             - models
                       default_model:
@@ -5527,10 +5544,10 @@ paths:
                 Request body for editing the workspace error handler. Accepts
                 both new grouped format and legacy flat format for backward
                 compatibility.
-              oneOf: &ref_351
+              oneOf: &ref_361
                 - type: object
                   description: New grouped format for editing error handler
-                  properties: &ref_352
+                  properties: &ref_362
                     path:
                       type: string
                       description: Path to the error handler script or flow
@@ -5548,7 +5565,7 @@ paths:
                   description: >-
                     Legacy flat format for editing error handler (deprecated,
                     use new format)
-                  properties: &ref_353
+                  properties: &ref_363
                     error_handler:
                       type: string
                       description: Path to the error handler script or flow
@@ -5587,10 +5604,10 @@ paths:
                 Request body for editing the workspace success handler. Accepts
                 both new grouped format and legacy flat format for backward
                 compatibility.
-              oneOf: &ref_354
+              oneOf: &ref_364
                 - type: object
                   description: New grouped format for editing success handler
-                  properties: &ref_355
+                  properties: &ref_365
                     path:
                       type: string
                       description: Path to the success handler script or flow
@@ -5602,7 +5619,7 @@ paths:
                   description: >-
                     Legacy flat format for editing success handler (deprecated,
                     use new format)
-                  properties: &ref_356
+                  properties: &ref_366
                     success_handler:
                       type: string
                       description: Path to the success handler script or flow
@@ -5719,10 +5736,10 @@ paths:
                 type: array
                 items:
                   type: object
-                  required: &ref_505
+                  required: &ref_523
                     - datatable_name
                     - schemas
-                  properties: &ref_506
+                  properties: &ref_524
                     datatable_name:
                       type: string
                     schemas:
@@ -6424,6 +6441,8 @@ paths:
                     type: boolean
                   gcp_used:
                     type: boolean
+                  azure_used:
+                    type: boolean
                   sqs_used:
                     type: boolean
                   email_used:
@@ -6432,6 +6451,8 @@ paths:
                     type: boolean
                   google_used:
                     type: boolean
+                  github_used:
+                    type: boolean
                 required:
                   - http_routes_used
                   - websocket_used
@@ -6440,10 +6461,12 @@ paths:
                   - postgres_used
                   - mqtt_used
                   - gcp_used
+                  - azure_used
                   - sqs_used
                   - email_used
                   - nextcloud_used
                   - google_used
+                  - github_used
   /w/{workspace}/users/list:
     get:
       summary: list users
@@ -6486,7 +6509,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_385
+                  properties: &ref_395
                     email:
                       type: string
                     executions:
@@ -6549,7 +6572,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_500
+                  properties: &ref_518
                     name:
                       type: string
                     description:
@@ -6559,7 +6582,7 @@ paths:
                       type: array
                       items:
                         type: object
-                        properties: &ref_498
+                        properties: &ref_516
                           value:
                             type: string
                           label:
@@ -6569,11 +6592,11 @@ paths:
                             nullable: true
                           requires_resource_path:
                             type: boolean
-                        required: &ref_499
+                        required: &ref_517
                           - value
                           - label
                           - requires_resource_path
-                  required: &ref_501
+                  required: &ref_519
                     - name
                     - scopes
   /users/tokens/create:
@@ -6589,7 +6612,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_404
+              properties: &ref_414
                 label:
                   type: string
                 expiration:
@@ -6621,7 +6644,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_405
+              properties: &ref_415
                 label:
                   type: string
                 expiration:
@@ -6631,7 +6654,7 @@ paths:
                   type: string
                 workspace_id:
                   type: string
-              required: &ref_406
+              required: &ref_416
                 - impersonate_email
       responses:
         '201':
@@ -6762,7 +6785,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_409
+              properties: &ref_419
                 path:
                   type: string
                   description: The path to the variable
@@ -6789,7 +6812,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_410
+              required: &ref_420
                 - path
                 - value
                 - is_secret
@@ -6911,7 +6934,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_411
+              properties: &ref_421
                 path:
                   type: string
                   description: The path to the variable
@@ -7147,7 +7170,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_407
+                  properties: &ref_417
                     name:
                       type: string
                     value:
@@ -7156,7 +7179,7 @@ paths:
                       type: string
                     is_custom:
                       type: boolean
-                  required: &ref_408
+                  required: &ref_418
                     - name
                     - value
                     - description
@@ -7343,12 +7366,12 @@ paths:
                   description: >-
                     A workspace protection rule defining restrictions and bypass
                     permissions
-                  required: &ref_545
+                  required: &ref_561
                     - name
                     - rules
                     - bypass_groups
                     - bypass_users
-                  properties: &ref_546
+                  properties: &ref_562
                     name:
                       type: string
                       description: Unique name for the protection rule
@@ -7360,7 +7383,7 @@ paths:
                       description: Configuration of protection restrictions
                       items: &ref_64
                         type: string
-                        enum: &ref_547
+                        enum: &ref_563
                           - DisableDirectDeployment
                           - DisableWorkspaceForking
                           - RestrictDeployToDeployers
@@ -7520,11 +7543,11 @@ paths:
                 type: array
                 items:
                   type: object
-                  required: &ref_548
+                  required: &ref_564
                     - username
                     - email
                     - is_admin
-                  properties: &ref_549
+                  properties: &ref_565
                     username:
                       type: string
                     email:
@@ -7579,10 +7602,10 @@ paths:
                         type: array
                         items:
                           type: object
-                          required: &ref_550
+                          required: &ref_566
                             - username
                             - email
-                          properties: &ref_551
+                          properties: &ref_567
                             username:
                               type: string
                             email:
@@ -8411,7 +8434,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_416
+              properties: &ref_426
                 path:
                   type: string
                   description: The path to the resource
@@ -8426,7 +8449,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_417
+              required: &ref_427
                 - path
                 - value
                 - resource_type
@@ -8517,7 +8540,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_418
+              properties: &ref_428
                 path:
                   type: string
                   description: The path to the resource
@@ -8593,7 +8616,7 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: &ref_419
+                properties: &ref_429
                   workspace_id:
                     type: string
                   path:
@@ -8618,7 +8641,7 @@ paths:
                     type: array
                     items:
                       type: string
-                required: &ref_420
+                required: &ref_430
                   - path
                   - resource_type
                   - is_oauth
@@ -8801,7 +8824,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_421
+                  properties: &ref_431
                     workspace_id:
                       type: string
                     path:
@@ -8836,7 +8859,7 @@ paths:
                       type: array
                       items:
                         type: string
-                  required: &ref_422
+                  required: &ref_432
                     - path
                     - resource_type
                     - is_oauth
@@ -8917,7 +8940,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: &ref_262
+          schema: &ref_272
             type: string
       responses:
         '200':
@@ -9050,7 +9073,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_423
+              properties: &ref_433
                 schema: {}
                 description:
                   type: string
@@ -9439,7 +9462,7 @@ paths:
                         description: >-
                           The flow structure containing modules and optional
                           preprocessor/failure handlers
-                        properties: &ref_588
+                        properties: &ref_606
                           modules:
                             type: array
                             description: >-
@@ -9471,7 +9494,7 @@ paths:
                                         in the flow. Use 'bun' as default
                                         language if unspecified. The script
                                         receives arguments from input_transforms
-                                      properties: &ref_312
+                                      properties: &ref_322
                                         input_transforms:
                                           type: object
                                           description: >-
@@ -9649,7 +9672,7 @@ paths:
                                                   - r
                                                   - w
                                                   - rw
-                                      required: &ref_313
+                                      required: &ref_323
                                         - type
                                         - content
                                         - language
@@ -9659,7 +9682,7 @@ paths:
                                         Reference to an existing script by path.
                                         Use this when calling a previously saved
                                         script instead of writing inline code
-                                      properties: &ref_314
+                                      properties: &ref_324
                                         input_transforms:
                                           type: object
                                           description: >-
@@ -9699,7 +9722,7 @@ paths:
                                           description: >-
                                             If true, this script is a trigger that
                                             can start the flow
-                                      required: &ref_315
+                                      required: &ref_325
                                         - type
                                         - path
                                         - input_transforms
@@ -9708,7 +9731,7 @@ paths:
                                         Reference to an existing flow by path.
                                         Use this to call another flow as a
                                         subflow
-                                      properties: &ref_316
+                                      properties: &ref_326
                                         input_transforms:
                                           type: object
                                           description: >-
@@ -9733,7 +9756,7 @@ paths:
                                           type: string
                                           enum:
                                             - flow
-                                      required: &ref_317
+                                      required: &ref_327
                                         - type
                                         - path
                                         - input_transforms
@@ -9746,7 +9769,7 @@ paths:
                                         'flow_input.iter.index' for the index.
                                         Supports parallel execution for better
                                         performance on I/O-bound operations
-                                      properties: &ref_318
+                                      properties: &ref_328
                                         modules:
                                           type: array
                                           description: >-
@@ -9795,7 +9818,7 @@ paths:
                                           discriminator: *ref_81
                                         squash:
                                           type: boolean
-                                      required: &ref_319
+                                      required: &ref_329
                                         - modules
                                         - iterator
                                         - skip_failures
@@ -9807,7 +9830,7 @@ paths:
                                         condition after each iteration. Use
                                         stop_after_if on modules to control loop
                                         termination
-                                      properties: &ref_320
+                                      properties: &ref_330
                                         modules:
                                           type: array
                                           description: >-
@@ -9845,7 +9868,7 @@ paths:
                                           discriminator: *ref_81
                                         squash:
                                           type: boolean
-                                      required: &ref_321
+                                      required: &ref_331
                                         - modules
                                         - skip_failures
                                         - type
@@ -9857,7 +9880,7 @@ paths:
                                         one with a true expression runs. If no
                                         branches match, the default branch
                                         executes
-                                      properties: &ref_322
+                                      properties: &ref_332
                                         branches:
                                           type: array
                                           description: >-
@@ -9909,7 +9932,7 @@ paths:
                                           type: string
                                           enum:
                                             - branchone
-                                      required: &ref_323
+                                      required: &ref_333
                                         - branches
                                         - default
                                         - type
@@ -9920,7 +9943,7 @@ paths:
                                         BranchOne, all branches run regardless
                                         of conditions. Useful for executing
                                         independent tasks concurrently
-                                      properties: &ref_324
+                                      properties: &ref_334
                                         branches:
                                           type: array
                                           description: >-
@@ -9961,7 +9984,7 @@ paths:
                                             If true, all branches execute
                                             concurrently. If false, they execute
                                             sequentially
-                                      required: &ref_325
+                                      required: &ref_335
                                         - branches
                                         - type
                                     - type: object
@@ -9969,7 +9992,7 @@ paths:
                                         Pass-through module that returns its
                                         input unchanged. Useful for flow
                                         structure or as a placeholder
-                                      properties: &ref_326
+                                      properties: &ref_336
                                         type:
                                           type: string
                                           enum:
@@ -9979,7 +10002,7 @@ paths:
                                           description: >-
                                             If true, marks this as a flow identity
                                             (special handling)
-                                      required: &ref_327
+                                      required: &ref_337
                                         - type
                                     - type: object
                                       description: >-
@@ -9987,7 +10010,7 @@ paths:
                                         accomplish tasks. The agent receives
                                         inputs and can call any of its
                                         configured tools to complete the task
-                                      properties: &ref_328
+                                      properties: &ref_338
                                         input_transforms:
                                           type: object
                                           description: >-
@@ -9999,22 +10022,22 @@ paths:
                                                 Provider configuration - can be static
                                                 (ProviderConfig), JavaScript expression,
                                                 or AI-determined
-                                              oneOf: &ref_330
+                                              oneOf: &ref_340
                                                 - type: object
                                                   description: >-
                                                     Static provider configuration passed
                                                     directly to the AI agent
-                                                  properties: &ref_573
+                                                  properties: &ref_591
                                                     value:
                                                       type: object
                                                       description: >-
                                                         Complete AI provider configuration with
                                                         resource reference and model selection
-                                                      properties: &ref_571
+                                                      properties: &ref_589
                                                         kind:
                                                           type: string
                                                           description: Supported AI provider types
-                                                          enum: &ref_305
+                                                          enum: &ref_315
                                                             - openai
                                                             - azure_openai
                                                             - anthropic
@@ -10037,7 +10060,7 @@ paths:
                                                           description: >-
                                                             Model identifier (e.g., 'gpt-4',
                                                             'claude-3-opus-20240229', 'gemini-pro')
-                                                      required: &ref_572
+                                                      required: &ref_590
                                                         - kind
                                                         - resource
                                                         - model
@@ -10045,7 +10068,7 @@ paths:
                                                       type: string
                                                       enum:
                                                         - static
-                                                  required: &ref_574
+                                                  required: &ref_592
                                                     - type
                                                     - value
                                                 - type: object
@@ -10065,7 +10088,7 @@ paths:
                                                     satisfy the parameter.
                                                   properties: *ref_86
                                                   required: *ref_87
-                                              discriminator: &ref_331
+                                              discriminator: &ref_341
                                                 propertyName: type
                                                 mapping:
                                                   static: >-
@@ -10135,27 +10158,27 @@ paths:
                                                 Memory configuration - can be static
                                                 (MemoryConfig), JavaScript expression,
                                                 or AI-determined
-                                              oneOf: &ref_332
+                                              oneOf: &ref_342
                                                 - type: object
                                                   description: >-
                                                     Static memory configuration passed
                                                     directly to the AI agent
-                                                  properties: &ref_579
+                                                  properties: &ref_597
                                                     value:
                                                       description: Conversation memory configuration
-                                                      oneOf: &ref_577
+                                                      oneOf: &ref_595
                                                         - type: object
                                                           description: No conversation memory/context
-                                                          properties: &ref_306
+                                                          properties: &ref_316
                                                             kind:
                                                               type: string
                                                               enum:
                                                                 - 'off'
-                                                          required: &ref_307
+                                                          required: &ref_317
                                                             - kind
                                                         - type: object
                                                           description: Automatic context management
-                                                          properties: &ref_308
+                                                          properties: &ref_318
                                                             kind:
                                                               type: string
                                                               enum:
@@ -10170,11 +10193,11 @@ paths:
                                                               description: >-
                                                                 Identifier for persistent memory across
                                                                 agent invocations
-                                                          required: &ref_309
+                                                          required: &ref_319
                                                             - kind
                                                         - type: object
                                                           description: Explicit message history
-                                                          properties: &ref_310
+                                                          properties: &ref_320
                                                             kind:
                                                               type: string
                                                               enum:
@@ -10184,7 +10207,7 @@ paths:
                                                               items:
                                                                 type: object
                                                                 description: A single message in conversation history
-                                                                properties: &ref_575
+                                                                properties: &ref_593
                                                                   role:
                                                                     type: string
                                                                     enum:
@@ -10193,13 +10216,13 @@ paths:
                                                                       - system
                                                                   content:
                                                                     type: string
-                                                                required: &ref_576
+                                                                required: &ref_594
                                                                   - role
                                                                   - content
-                                                          required: &ref_311
+                                                          required: &ref_321
                                                             - kind
                                                             - messages
-                                                      discriminator: &ref_578
+                                                      discriminator: &ref_596
                                                         propertyName: kind
                                                         mapping:
                                                           'off': '#/components/schemas/MemoryOff'
@@ -10209,7 +10232,7 @@ paths:
                                                       type: string
                                                       enum:
                                                         - static
-                                                  required: &ref_580
+                                                  required: &ref_598
                                                     - type
                                                     - value
                                                 - type: object
@@ -10229,7 +10252,7 @@ paths:
                                                     satisfy the parameter.
                                                   properties: *ref_86
                                                   required: *ref_87
-                                              discriminator: &ref_333
+                                              discriminator: &ref_343
                                                 propertyName: type
                                                 mapping:
                                                   static: >-
@@ -10328,7 +10351,7 @@ paths:
                                               A tool available to an AI agent. Can be
                                               a flow module or an external MCP (Model
                                               Context Protocol) tool
-                                            properties: &ref_334
+                                            properties: &ref_344
                                               id:
                                                 type: string
                                                 description: >-
@@ -10346,12 +10369,12 @@ paths:
                                                   The implementation of a tool. Can be a
                                                   flow module (script/flow) or an MCP tool
                                                   reference
-                                                oneOf: &ref_586
+                                                oneOf: &ref_604
                                                   - description: >-
                                                       A tool implemented as a flow module
                                                       (script, flow, etc.). The AI can call
                                                       this like any other flow module
-                                                    allOf: &ref_581
+                                                    allOf: &ref_599
                                                       - type: object
                                                         properties:
                                                           tool_type:
@@ -10384,7 +10407,7 @@ paths:
                                                       Reference to an external MCP (Model
                                                       Context Protocol) tool. The AI can call
                                                       tools from MCP servers
-                                                    properties: &ref_582
+                                                    properties: &ref_600
                                                       tool_type:
                                                         type: string
                                                         enum:
@@ -10408,7 +10431,7 @@ paths:
                                                           MCP server
                                                         items:
                                                           type: string
-                                                    required: &ref_583
+                                                    required: &ref_601
                                                       - tool_type
                                                       - resource_path
                                                   - type: object
@@ -10416,20 +10439,20 @@ paths:
                                                       A tool implemented as a websearch tool.
                                                       The AI can call this like any other
                                                       websearch tool
-                                                    properties: &ref_584
+                                                    properties: &ref_602
                                                       tool_type:
                                                         type: string
                                                         enum:
                                                           - websearch
-                                                    required: &ref_585
+                                                    required: &ref_603
                                                       - tool_type
-                                                discriminator: &ref_587
+                                                discriminator: &ref_605
                                                   propertyName: tool_type
                                                   mapping:
                                                     flowmodule: '#/components/schemas/FlowModuleTool'
                                                     mcp: '#/components/schemas/McpToolValue'
                                                     websearch: '#/components/schemas/WebsearchToolValue'
-                                            required: &ref_335
+                                            required: &ref_345
                                               - id
                                               - value
                                         type:
@@ -10441,7 +10464,7 @@ paths:
                                           description: >-
                                             If true, the agent can execute multiple
                                             tool calls in parallel
-                                      required: &ref_329
+                                      required: &ref_339
                                         - tools
                                         - type
                                         - input_transforms
@@ -10605,7 +10628,7 @@ paths:
                                     Retry configuration for failed module
                                     executions
                                   type: object
-                                  properties: &ref_304
+                                  properties: &ref_314
                                     constant:
                                       type: object
                                       description: >-
@@ -10646,14 +10669,14 @@ paths:
                                       description: >-
                                         Conditional retry based on error or
                                         result
-                                      properties: &ref_192
+                                      properties: &ref_194
                                         expr:
                                           type: string
                                           description: >-
                                             JavaScript expression that returns true
                                             to retry. Has access to 'result' and
                                             'error' variables
-                                      required: &ref_193
+                                      required: &ref_195
                                         - expr
                                 debouncing:
                                   description: >-
@@ -10787,7 +10810,7 @@ paths:
                               description: >-
                                 A sticky note attached to a flow for
                                 documentation and annotation
-                              properties: &ref_143
+                              properties: &ref_145
                                 id:
                                   type: string
                                   description: Unique identifier for the note
@@ -10846,7 +10869,7 @@ paths:
                                   description: >-
                                     For group notes, the IDs of nodes contained
                                     within this group
-                              required: &ref_144
+                              required: &ref_146
                                 - id
                                 - text
                                 - color
@@ -10866,7 +10889,7 @@ paths:
                                 collapsibility in the editor. Members are
                                 computed dynamically from all nodes on paths
                                 between start_id and end_id.
-                              properties: &ref_145
+                              properties: &ref_147
                                 summary:
                                   type: string
                                   description: Display name for this group
@@ -10892,10 +10915,10 @@ paths:
                                 color:
                                   type: string
                                   description: Color for the group in the flow editor
-                              required: &ref_146
+                              required: &ref_148
                                 - start_id
                                 - end_id
-                        required: &ref_589
+                        required: &ref_607
                           - modules
                       schema:
                         type: object
@@ -11929,7 +11952,7 @@ paths:
                         type: string
                       kind:
                         type: string
-                        enum: &ref_290
+                        enum: &ref_300
                           - s3object
                           - resource
                           - ducklake
@@ -12093,7 +12116,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_374
+              properties: &ref_384
                 workspace_id:
                   type: string
                 language:
@@ -12105,7 +12128,7 @@ paths:
                   type: string
                 content:
                   type: string
-              required: &ref_375
+              required: &ref_385
                 - workspace_id
                 - language
                 - content
@@ -12462,12 +12485,16 @@ paths:
                     type: number
                   gcp_count:
                     type: number
+                  azure_count:
+                    type: number
                   sqs_count:
                     type: number
                   nextcloud_count:
                     type: number
                   google_count:
                     type: number
+                  github_count:
+                    type: number
   /w/{workspace}/scripts/list_tokens/{path}:
     get:
       summary: get tokens with script scope
@@ -12515,7 +12542,7 @@ paths:
           content:
             application/json:
               schema:
-                allOf: &ref_376
+                allOf: &ref_386
                   - type: object
                     properties: *ref_104
                     required: *ref_105
@@ -12738,7 +12765,7 @@ paths:
         - name: token
           in: path
           required: true
-          schema: &ref_294
+          schema: &ref_304
             type: string
         - name: path
           in: path
@@ -14316,7 +14343,7 @@ paths:
                           properties: *ref_120
                           required: *ref_121
                         - type: object
-                          properties: &ref_493
+                          properties: &ref_511
                             workspace_id:
                               type: string
                             path:
@@ -14330,7 +14357,7 @@ paths:
                               type: boolean
                             extra_perms:
                               type: object
-                              additionalProperties: &ref_492
+                              additionalProperties: &ref_510
                                 type: boolean
                             starred:
                               type: boolean
@@ -14355,7 +14382,7 @@ paths:
                               items:
                                 type: string
                               default: []
-                          required: &ref_494
+                          required: &ref_512
                             - path
                             - edited_by
                             - edited_at
@@ -14902,7 +14929,7 @@ paths:
       summary: list flow conversations
       operationId: listFlowConversations
       tags:
-        - flow_conversation
+        - flow_conversations
       parameters:
         - name: workspace
           in: path
@@ -14930,14 +14957,14 @@ paths:
                 type: array
                 items:
                   type: object
-                  required: &ref_361
+                  required: &ref_371
                     - id
                     - workspace_id
                     - flow_path
                     - created_at
                     - updated_at
                     - created_by
-                  properties: &ref_362
+                  properties: &ref_372
                     id:
                       type: string
                       format: uuid
@@ -14968,7 +14995,7 @@ paths:
       summary: delete flow conversation
       operationId: deleteFlowConversation
       tags:
-        - flow_conversation
+        - flow_conversations
       parameters:
         - name: workspace
           in: path
@@ -14993,7 +15020,7 @@ paths:
       summary: list conversation messages
       operationId: listConversationMessages
       tags:
-        - flow_conversation
+        - flow_conversations
       parameters:
         - name: workspace
           in: path
@@ -15030,13 +15057,13 @@ paths:
                 type: array
                 items:
                   type: object
-                  required: &ref_363
+                  required: &ref_373
                     - id
                     - conversation_id
                     - message_type
                     - content
                     - created_at
-                  properties: &ref_364
+                  properties: &ref_374
                     id:
                       type: string
                       format: uuid
@@ -15169,7 +15196,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_502
+                  properties: &ref_520
                     workspace_id:
                       type: string
                     path:
@@ -15192,7 +15219,7 @@ paths:
                       items:
                         type: string
                       default: []
-                  required: &ref_503
+                  required: &ref_521
                     - workspace_id
                     - path
                     - summary
@@ -15325,7 +15352,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_496
+                  properties: &ref_514
                     id:
                       type: integer
                     workspace_id:
@@ -15358,7 +15385,7 @@ paths:
                       items:
                         type: string
                       default: []
-                  required: &ref_497
+                  required: &ref_515
                     - id
                     - workspace_id
                     - path
@@ -15590,7 +15617,7 @@ paths:
           content:
             application/json:
               schema:
-                allOf: &ref_504
+                allOf: &ref_522
                   - type: object
                     properties: *ref_128
                     required: *ref_129
@@ -15700,7 +15727,7 @@ paths:
         - name: version
           in: path
           required: true
-          schema: &ref_295
+          schema: &ref_305
             type: integer
       requestBody:
         description: App deployment message
@@ -16496,7 +16523,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: &ref_169
+          schema: &ref_171
             type: string
             format: uuid
         - name: scheduled_for
@@ -16764,7 +16791,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_412
+              properties: &ref_422
                 content:
                   type: string
                   description: The code to run
@@ -16775,7 +16802,7 @@ paths:
                 language:
                   type: string
                   enum: *ref_94
-              required: &ref_413
+              required: &ref_423
                 - content
                 - args
                 - language
@@ -16910,12 +16937,12 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_414
+              properties: &ref_424
                 args:
                   type: object
                   description: The arguments to pass to the script or flow
                   additionalProperties: true
-              required: &ref_415
+              required: &ref_425
                 - args
       responses:
         '201':
@@ -16948,7 +16975,7 @@ paths:
                   type: array
                   items:
                     type: object
-                    properties: &ref_519
+                    properties: &ref_143
                       raw_code:
                         type: string
                       path:
@@ -16956,7 +16983,7 @@ paths:
                       language:
                         type: string
                         enum: *ref_94
-                    required: &ref_520
+                    required: &ref_144
                       - raw_code
                       - path
                       - language
@@ -16977,10 +17004,10 @@ paths:
                     type: string
                 required:
                   - lock
-  /w/{workspace}/jobs/run/preview_flow:
+  /w/{workspace}/jobs/run/dependencies_async:
     post:
-      summary: run flow preview
-      operationId: runFlowPreview
+      summary: queue a one-off dependencies job and return the job uuid
+      operationId: runRawScriptDependenciesAsync
       tags:
         - job
       parameters:
@@ -16988,48 +17015,60 @@ paths:
           in: path
           required: true
           schema: *ref_4
-        - name: include_header
-          description: >
-            List of headers's keys (separated with ',') whove value are added to
-            the args
-
-            Header's key lowercased and '-'' replaced to '_' such that
-            'Content-Type' becomes the 'content_type' arg key
-          in: query
-          schema: *ref_114
-        - name: invisible_to_owner
-          description: make the run invisible to the the script owner (default false)
-          in: query
-          schema:
-            type: boolean
-        - name: job_id
-          description: >-
-            The job id to assign to the created job. if missing, job is chosen
-            randomly using the ULID scheme. If a job id already exists in the
-            queue or as a completed job, the request to create one will fail
-            (Bad Request)
-          in: query
-          schema: *ref_113
-        - name: memory_id
-          description: memory ID for chat-enabled flows
-          in: query
-          schema:
-            type: string
-            format: uuid
       requestBody:
-        description: preview
+        description: raw script content
         required: true
         content:
           application/json:
             schema:
               type: object
-              properties: &ref_147
-                value:
+              properties:
+                raw_scripts:
+                  type: array
+                  items:
+                    type: object
+                    properties: *ref_143
+                    required: *ref_144
+                entrypoint:
+                  type: string
+              required:
+                - entrypoint
+                - raw_scripts
+      responses:
+        '201':
+          description: dependency job created
+          content:
+            text/plain:
+              schema:
+                type: string
+                format: uuid
+  /w/{workspace}/jobs/run/flow_dependencies_async:
+    post:
+      summary: queue a one-off flow dependencies job and return the job uuid
+      operationId: runFlowDependenciesAsync
+      tags:
+        - job
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema: *ref_4
+      requestBody:
+        description: flow value and path
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                path:
+                  type: string
+                flow_value:
                   type: object
                   description: >-
                     The flow structure containing modules and optional
                     preprocessor/failure handlers
-                  properties: &ref_151
+                  properties: &ref_149
                     modules:
                       type: array
                       description: >-
@@ -17131,8 +17170,8 @@ paths:
                         description: >-
                           A sticky note attached to a flow for documentation and
                           annotation
-                        properties: *ref_143
-                        required: *ref_144
+                        properties: *ref_145
+                        required: *ref_146
                     groups:
                       type: array
                       description: Semantic groups of modules for organizational purposes
@@ -17145,10 +17184,75 @@ paths:
                           naming and collapsibility in the editor. Members are
                           computed dynamically from all nodes on paths between
                           start_id and end_id.
-                        properties: *ref_145
-                        required: *ref_146
-                  required: &ref_152
+                        properties: *ref_147
+                        required: *ref_148
+                  required: &ref_150
                     - modules
+              required:
+                - path
+                - flow_value
+      responses:
+        '201':
+          description: flow dependencies job created
+          content:
+            text/plain:
+              schema:
+                type: string
+                format: uuid
+  /w/{workspace}/jobs/run/preview_flow:
+    post:
+      summary: run flow preview
+      operationId: runFlowPreview
+      tags:
+        - job
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema: *ref_4
+        - name: include_header
+          description: >
+            List of headers's keys (separated with ',') whove value are added to
+            the args
+
+            Header's key lowercased and '-'' replaced to '_' such that
+            'Content-Type' becomes the 'content_type' arg key
+          in: query
+          schema: *ref_114
+        - name: invisible_to_owner
+          description: make the run invisible to the the script owner (default false)
+          in: query
+          schema:
+            type: boolean
+        - name: job_id
+          description: >-
+            The job id to assign to the created job. if missing, job is chosen
+            randomly using the ULID scheme. If a job id already exists in the
+            queue or as a completed job, the request to create one will fail
+            (Bad Request)
+          in: query
+          schema: *ref_113
+        - name: memory_id
+          description: memory ID for chat-enabled flows
+          in: query
+          schema:
+            type: string
+            format: uuid
+      requestBody:
+        description: preview
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties: &ref_151
+                value:
+                  type: object
+                  description: >-
+                    The flow structure containing modules and optional
+                    preprocessor/failure handlers
+                  properties: *ref_149
+                  required: *ref_150
                 path:
                   type: string
                 args:
@@ -17159,7 +17263,7 @@ paths:
                   type: string
                 restarted_from:
                   type: object
-                  properties: &ref_495
+                  properties: &ref_513
                     flow_job_id:
                       type: string
                       format: uuid
@@ -17169,7 +17273,7 @@ paths:
                       type: integer
                     flow_version:
                       type: integer
-              required: &ref_148
+              required: &ref_152
                 - value
                 - content
                 - args
@@ -17205,8 +17309,8 @@ paths:
           application/json:
             schema:
               type: object
-              properties: *ref_147
-              required: *ref_148
+              properties: *ref_151
+              required: *ref_152
       responses:
         '200':
           description: job result
@@ -17231,7 +17335,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_507
+              properties: &ref_525
                 entrypoint_function:
                   type: string
                   description: Name of the function to execute for dynamic select
@@ -17252,7 +17356,7 @@ paths:
                           description: Path to the deployed script or flow
                         runnable_kind:
                           type: string
-                          enum: &ref_197
+                          enum: &ref_199
                             - script
                             - flow
                       required:
@@ -17274,7 +17378,7 @@ paths:
                       required:
                         - source
                         - code
-              required: &ref_508
+              required: &ref_526
                 - entrypoint_function
                 - runnable_ref
       responses:
@@ -17320,7 +17424,7 @@ paths:
             (e.g. 'worker-1,worker-2') and negation by prefixing all values with
             '!' (e.g. '!worker-1,!worker-2')
           in: query
-          schema: &ref_153
+          schema: &ref_155
             type: string
         - name: script_path_exact
           description: >-
@@ -17328,7 +17432,7 @@ paths:
             (e.g. 'f/script1,f/script2') and negation by prefixing all values
             with '!' (e.g. '!f/script1,!f/script2')
           in: query
-          schema: &ref_154
+          schema: &ref_156
             type: string
         - name: script_path_start
           description: >-
@@ -17336,12 +17440,12 @@ paths:
             'f/folder1,f/folder2') and negation by prefixing all values with '!'
             (e.g. '!f/folder1,!f/folder2')
           in: query
-          schema: &ref_155
+          schema: &ref_157
             type: string
         - name: schedule_path
           description: mask to filter by schedule path
           in: query
-          schema: &ref_156
+          schema: &ref_158
             type: string
         - name: trigger_path
           description: >-
@@ -17349,7 +17453,7 @@ paths:
             'f/trigger1,f/trigger2') and negation by prefixing all values with
             '!' (e.g. '!f/trigger1,!f/trigger2')
           in: query
-          schema: &ref_296
+          schema: &ref_306
             type: string
         - name: trigger_kind
           description: >-
@@ -17358,34 +17462,34 @@ paths:
             (e.g. '!schedule,!webhook')
           in: query
           x-go-name: JobTriggerKindParam
-          schema: &ref_185
+          schema: &ref_187
             type: string
         - name: script_hash
           description: mask to filter exact matching path
           in: query
-          schema: &ref_157
+          schema: &ref_159
             type: string
         - name: started_before
           description: filter on started before (inclusive) timestamp
           in: query
-          schema: &ref_158
+          schema: &ref_160
             type: string
             format: date-time
         - name: started_after
           description: filter on started after (exclusive) timestamp
           in: query
-          schema: &ref_159
+          schema: &ref_161
             type: string
             format: date-time
         - name: success
           description: filter on successful jobs
           in: query
-          schema: &ref_167
+          schema: &ref_169
             type: boolean
         - name: scheduled_for_before_now
           description: filter on jobs scheduled_for before now (hence waitinf for a worker)
           in: query
-          schema: &ref_161
+          schema: &ref_163
             type: boolean
         - name: job_kinds
           description: >-
@@ -17393,36 +17497,36 @@ paths:
             ('preview', 'script', 'dependencies', 'flow') and negation by
             prefixing all values with '!' (e.g. '!preview,!dependencies')
           in: query
-          schema: &ref_162
+          schema: &ref_164
             type: string
         - name: suspended
           description: filter on suspended jobs
           in: query
-          schema: &ref_163
+          schema: &ref_165
             type: boolean
         - name: running
           description: filter on running jobs
           in: query
-          schema: &ref_160
+          schema: &ref_162
             type: boolean
         - name: args
           description: >-
             filter on jobs containing those args as a json subset (@> in
             postgres)
           in: query
-          schema: &ref_164
+          schema: &ref_166
             type: string
         - name: result
           description: >-
             filter on jobs containing those result as a json subset (@> in
             postgres)
           in: query
-          schema: &ref_166
+          schema: &ref_168
             type: string
         - name: allow_wildcards
           description: allow wildcards (*) in the filter of label, tag, worker
           in: query
-          schema: &ref_168
+          schema: &ref_170
             type: boolean
         - name: tag
           description: >-
@@ -17430,7 +17534,7 @@ paths:
             'gpu,highmem') and negation by prefixing all values with '!' (e.g.
             '!gpu,!highmem')
           in: query
-          schema: &ref_165
+          schema: &ref_167
             type: string
         - name: page
           description: which page to return (start at 1, default 1)
@@ -17461,7 +17565,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_188
+                  properties: &ref_190
                     workspace_id:
                       type: string
                     id:
@@ -17536,14 +17640,14 @@ paths:
                         by extension its DT_TOKEN.
                     flow_status:
                       type: object
-                      properties: &ref_172
+                      properties: &ref_174
                         step:
                           type: integer
                         modules:
                           type: array
                           items:
                             type: object
-                            properties: &ref_149
+                            properties: &ref_153
                               type:
                                 type: string
                                 enum:
@@ -17697,20 +17801,20 @@ paths:
                                 type: array
                                 items:
                                   type: boolean
-                            required: &ref_150
+                            required: &ref_154
                               - type
                         user_states:
                           additionalProperties: true
                         preprocessor_module:
                           allOf:
                             - type: object
-                              properties: *ref_149
-                              required: *ref_150
+                              properties: *ref_153
+                              required: *ref_154
                         failure_module:
                           allOf:
                             - type: object
-                              properties: *ref_149
-                              required: *ref_150
+                              properties: *ref_153
+                              required: *ref_154
                             - type: object
                               properties:
                                 parent_module:
@@ -17725,13 +17829,13 @@ paths:
                               items:
                                 type: string
                                 format: uuid
-                      required: &ref_173
+                      required: &ref_175
                         - step
                         - modules
                         - failure_module
                     workflow_as_code_status:
                       type: object
-                      properties: &ref_174
+                      properties: &ref_176
                         scheduled_for:
                           type: string
                           format: date-time
@@ -17747,8 +17851,8 @@ paths:
                       description: >-
                         The flow structure containing modules and optional
                         preprocessor/failure handlers
-                      properties: *ref_151
-                      required: *ref_152
+                      properties: *ref_149
+                      required: *ref_150
                     is_flow_step:
                       type: boolean
                     language:
@@ -17774,7 +17878,7 @@ paths:
                       type: boolean
                     worker:
                       type: string
-                  required: &ref_189
+                  required: &ref_191
                     - id
                     - running
                     - canceled
@@ -17897,7 +18001,7 @@ paths:
             (e.g. 'deploy,release') and negation by prefixing all values with
             '!' (e.g. '!deploy,!release')
           in: query
-          schema: &ref_171
+          schema: &ref_173
             type: string
         - name: worker
           description: >-
@@ -17905,7 +18009,7 @@ paths:
             (e.g. 'worker-1,worker-2') and negation by prefixing all values with
             '!' (e.g. '!worker-1,!worker-2')
           in: query
-          schema: *ref_153
+          schema: *ref_155
         - name: parent_job
           description: >-
             The parent job that is at the origin and responsible for the
@@ -17918,104 +18022,104 @@ paths:
             (e.g. 'f/script1,f/script2') and negation by prefixing all values
             with '!' (e.g. '!f/script1,!f/script2')
           in: query
-          schema: *ref_154
+          schema: *ref_156
         - name: script_path_start
           description: >-
             filter by script path prefix. Supports comma-separated list (e.g.
             'f/folder1,f/folder2') and negation by prefixing all values with '!'
             (e.g. '!f/folder1,!f/folder2')
           in: query
-          schema: *ref_155
+          schema: *ref_157
         - name: schedule_path
           description: mask to filter by schedule path
           in: query
-          schema: *ref_156
+          schema: *ref_158
         - name: script_hash
           description: mask to filter exact matching path
           in: query
-          schema: *ref_157
+          schema: *ref_159
         - name: started_before
           description: filter on started before (inclusive) timestamp
           in: query
-          schema: *ref_158
+          schema: *ref_160
         - name: started_after
           description: filter on started after (exclusive) timestamp
           in: query
-          schema: *ref_159
+          schema: *ref_161
         - name: created_before
           description: filter on created before (inclusive) timestamp
           in: query
-          schema: &ref_179
+          schema: &ref_181
             type: string
             format: date-time
         - name: created_after
           description: filter on created after (exclusive) timestamp
           in: query
-          schema: &ref_180
+          schema: &ref_182
             type: string
             format: date-time
         - name: completed_before
           description: filter on started before (inclusive) timestamp
           in: query
-          schema: &ref_181
+          schema: &ref_183
             type: string
             format: date-time
         - name: completed_after
           description: filter on started after (exclusive) timestamp
           in: query
-          schema: &ref_182
+          schema: &ref_184
             type: string
             format: date-time
         - name: created_before_queue
           description: filter on jobs created before X for jobs in the queue only
           in: query
-          schema: &ref_183
+          schema: &ref_185
             type: string
             format: date-time
         - name: created_after_queue
           description: filter on jobs created after X for jobs in the queue only
           in: query
-          schema: &ref_184
+          schema: &ref_186
             type: string
             format: date-time
         - name: running
           description: filter on running jobs
           in: query
-          schema: *ref_160
+          schema: *ref_162
         - name: scheduled_for_before_now
           description: filter on jobs scheduled_for before now (hence waitinf for a worker)
           in: query
-          schema: *ref_161
+          schema: *ref_163
         - name: job_kinds
           description: >-
             filter by job kind. Supports comma-separated list of values
             ('preview', 'script', 'dependencies', 'flow') and negation by
             prefixing all values with '!' (e.g. '!preview,!dependencies')
           in: query
-          schema: *ref_162
+          schema: *ref_164
         - name: suspended
           description: filter on suspended jobs
           in: query
-          schema: *ref_163
+          schema: *ref_165
         - name: args
           description: >-
             filter on jobs containing those args as a json subset (@> in
             postgres)
           in: query
-          schema: *ref_164
+          schema: *ref_166
         - name: tag
           description: >-
             filter by tag/worker group. Supports comma-separated list (e.g.
             'gpu,highmem') and negation by prefixing all values with '!' (e.g.
             '!gpu,!highmem')
           in: query
-          schema: *ref_165
+          schema: *ref_167
         - name: result
           description: >-
             filter on jobs containing those result as a json subset (@> in
             postgres)
           in: query
-          schema: *ref_166
+          schema: *ref_168
         - name: page
           description: which page to return (start at 1, default 1)
           in: query
@@ -18099,76 +18203,76 @@ paths:
             (e.g. 'f/script1,f/script2') and negation by prefixing all values
             with '!' (e.g. '!f/script1,!f/script2')
           in: query
-          schema: *ref_154
+          schema: *ref_156
         - name: script_path_start
           description: >-
             filter by script path prefix. Supports comma-separated list (e.g.
             'f/folder1,f/folder2') and negation by prefixing all values with '!'
             (e.g. '!f/folder1,!f/folder2')
           in: query
-          schema: *ref_155
+          schema: *ref_157
         - name: schedule_path
           description: mask to filter by schedule path
           in: query
-          schema: *ref_156
+          schema: *ref_158
         - name: script_hash
           description: mask to filter exact matching path
           in: query
-          schema: *ref_157
+          schema: *ref_159
         - name: started_before
           description: filter on started before (inclusive) timestamp
           in: query
-          schema: *ref_158
+          schema: *ref_160
         - name: started_after
           description: filter on started after (exclusive) timestamp
           in: query
-          schema: *ref_159
+          schema: *ref_161
         - name: success
           description: filter on successful jobs
           in: query
-          schema: *ref_167
+          schema: *ref_169
         - name: scheduled_for_before_now
           description: filter on jobs scheduled_for before now (hence waitinf for a worker)
           in: query
-          schema: *ref_161
+          schema: *ref_163
         - name: job_kinds
           description: >-
             filter by job kind. Supports comma-separated list of values
             ('preview', 'script', 'dependencies', 'flow') and negation by
             prefixing all values with '!' (e.g. '!preview,!dependencies')
           in: query
-          schema: *ref_162
+          schema: *ref_164
         - name: suspended
           description: filter on suspended jobs
           in: query
-          schema: *ref_163
+          schema: *ref_165
         - name: running
           description: filter on running jobs
           in: query
-          schema: *ref_160
+          schema: *ref_162
         - name: args
           description: >-
             filter on jobs containing those args as a json subset (@> in
             postgres)
           in: query
-          schema: *ref_164
+          schema: *ref_166
         - name: result
           description: >-
             filter on jobs containing those result as a json subset (@> in
             postgres)
           in: query
-          schema: *ref_166
+          schema: *ref_168
         - name: allow_wildcards
           description: allow wildcards (*) in the filter of label, tag, worker
           in: query
-          schema: *ref_168
+          schema: *ref_170
         - name: tag
           description: >-
             filter by tag/worker group. Supports comma-separated list (e.g.
             'gpu,highmem') and negation by prefixing all values with '!' (e.g.
             '!gpu,!highmem')
           in: query
-          schema: *ref_165
+          schema: *ref_167
         - name: page
           description: which page to return (start at 1, default 1)
           in: query
@@ -18218,6 +18322,10 @@ paths:
           in: query
           schema:
             type: boolean
+        - name: all_workspaces
+          in: query
+          schema:
+            type: boolean
       requestBody:
         description: uuids of the jobs to cancel
         required: true
@@ -18250,7 +18358,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       responses:
         '200':
           description: list of OTEL Span objects (compatible with OpenTelemetry Span proto)
@@ -18278,7 +18386,7 @@ paths:
           schema:
             description: job trigger kind (schedule, http, websocket...)
             type: string
-            enum: &ref_170
+            enum: &ref_172
               - webhook
               - default_email
               - email
@@ -18291,7 +18399,9 @@ paths:
               - mqtt
               - sqs
               - gcp
+              - azure
               - google
+              - github
         - name: trigger_path
           description: The path of the trigger (can contain forward slashes)
           in: path
@@ -18342,7 +18452,7 @@ paths:
           schema:
             description: job trigger kind (schedule, http, websocket...)
             type: string
-            enum: *ref_170
+            enum: *ref_172
         - name: trigger_path
           description: The path of the trigger (can contain forward slashes)
           in: path
@@ -18403,14 +18513,14 @@ paths:
             (e.g. 'deploy,release') and negation by prefixing all values with
             '!' (e.g. '!deploy,!release')
           in: query
-          schema: *ref_171
+          schema: *ref_173
         - name: worker
           description: >-
             filter by worker this job ran on. Supports comma-separated list
             (e.g. 'worker-1,worker-2') and negation by prefixing all values with
             '!' (e.g. '!worker-1,!worker-2')
           in: query
-          schema: *ref_153
+          schema: *ref_155
         - name: parent_job
           description: >-
             The parent job that is at the origin and responsible for the
@@ -18423,64 +18533,64 @@ paths:
             (e.g. 'f/script1,f/script2') and negation by prefixing all values
             with '!' (e.g. '!f/script1,!f/script2')
           in: query
-          schema: *ref_154
+          schema: *ref_156
         - name: script_path_start
           description: >-
             filter by script path prefix. Supports comma-separated list (e.g.
             'f/folder1,f/folder2') and negation by prefixing all values with '!'
             (e.g. '!f/folder1,!f/folder2')
           in: query
-          schema: *ref_155
+          schema: *ref_157
         - name: schedule_path
           description: mask to filter by schedule path
           in: query
-          schema: *ref_156
+          schema: *ref_158
         - name: script_hash
           description: mask to filter exact matching path
           in: query
-          schema: *ref_157
+          schema: *ref_159
         - name: started_before
           description: filter on started before (inclusive) timestamp
           in: query
-          schema: *ref_158
+          schema: *ref_160
         - name: started_after
           description: filter on started after (exclusive) timestamp
           in: query
-          schema: *ref_159
+          schema: *ref_161
         - name: success
           description: filter on successful jobs
           in: query
-          schema: *ref_167
+          schema: *ref_169
         - name: job_kinds
           description: >-
             filter by job kind. Supports comma-separated list of values
             ('preview', 'script', 'dependencies', 'flow') and negation by
             prefixing all values with '!' (e.g. '!preview,!dependencies')
           in: query
-          schema: *ref_162
+          schema: *ref_164
         - name: args
           description: >-
             filter on jobs containing those args as a json subset (@> in
             postgres)
           in: query
-          schema: *ref_164
+          schema: *ref_166
         - name: result
           description: >-
             filter on jobs containing those result as a json subset (@> in
             postgres)
           in: query
-          schema: *ref_166
+          schema: *ref_168
         - name: allow_wildcards
           description: allow wildcards (*) in the filter of label, tag, worker
           in: query
-          schema: *ref_168
+          schema: *ref_170
         - name: tag
           description: >-
             filter by tag/worker group. Supports comma-separated list (e.g.
             'gpu,highmem') and negation by prefixing all values with '!' (e.g.
             '!gpu,!highmem')
           in: query
-          schema: *ref_165
+          schema: *ref_167
         - name: page
           description: which page to return (start at 1, default 1)
           in: query
@@ -18518,7 +18628,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_186
+                  properties: &ref_188
                     workspace_id:
                       type: string
                     id:
@@ -18595,18 +18705,18 @@ paths:
                         by extension its DT_TOKEN.
                     flow_status:
                       type: object
-                      properties: *ref_172
-                      required: *ref_173
+                      properties: *ref_174
+                      required: *ref_175
                     workflow_as_code_status:
                       type: object
-                      properties: *ref_174
+                      properties: *ref_176
                     raw_flow:
                       type: object
                       description: >-
                         The flow structure containing modules and optional
                         preprocessor/failure handlers
-                      properties: *ref_151
-                      required: *ref_152
+                      properties: *ref_149
+                      required: *ref_150
                     is_flow_step:
                       type: boolean
                     language:
@@ -18636,7 +18746,7 @@ paths:
                       type: boolean
                     worker:
                       type: string
-                  required: &ref_187
+                  required: &ref_189
                     - id
                     - created_by
                     - duration_ms
@@ -18680,7 +18790,7 @@ paths:
                 items:
                   type: object
                   description: Completed job with full data for export/import operations
-                  properties: &ref_175
+                  properties: &ref_177
                     id:
                       type: string
                       format: uuid
@@ -18818,7 +18928,7 @@ paths:
                     status:
                       type: string
                       description: Actual job status from database
-                  required: &ref_176
+                  required: &ref_178
                     - id
                     - created_by
                     - created_at
@@ -18846,8 +18956,8 @@ paths:
               items:
                 type: object
                 description: Completed job with full data for export/import operations
-                properties: *ref_175
-                required: *ref_176
+                properties: *ref_177
+                required: *ref_178
       responses:
         '200':
           description: Successfully imported completed jobs
@@ -18884,7 +18994,7 @@ paths:
                 items:
                   type: object
                   description: Queued job with full data for export/import operations
-                  properties: &ref_177
+                  properties: &ref_179
                     id:
                       type: string
                       format: uuid
@@ -19015,7 +19125,7 @@ paths:
                     suspend_until:
                       type: string
                       format: date-time
-                  required: &ref_178
+                  required: &ref_180
                     - id
                     - created_by
                     - created_at
@@ -19043,8 +19153,8 @@ paths:
               items:
                 type: object
                 description: Queued job with full data for export/import operations
-                properties: *ref_177
-                required: *ref_178
+                properties: *ref_179
+                required: *ref_180
       responses:
         '200':
           description: Successfully imported queued jobs
@@ -19106,14 +19216,14 @@ paths:
             (e.g. 'deploy,release') and negation by prefixing all values with
             '!' (e.g. '!deploy,!release')
           in: query
-          schema: *ref_171
+          schema: *ref_173
         - name: worker
           description: >-
             filter by worker this job ran on. Supports comma-separated list
             (e.g. 'worker-1,worker-2') and negation by prefixing all values with
             '!' (e.g. '!worker-1,!worker-2')
           in: query
-          schema: *ref_153
+          schema: *ref_155
         - name: parent_job
           description: >-
             The parent job that is at the origin and responsible for the
@@ -19126,96 +19236,96 @@ paths:
             (e.g. 'f/script1,f/script2') and negation by prefixing all values
             with '!' (e.g. '!f/script1,!f/script2')
           in: query
-          schema: *ref_154
+          schema: *ref_156
         - name: script_path_start
           description: >-
             filter by script path prefix. Supports comma-separated list (e.g.
             'f/folder1,f/folder2') and negation by prefixing all values with '!'
             (e.g. '!f/folder1,!f/folder2')
           in: query
-          schema: *ref_155
+          schema: *ref_157
         - name: schedule_path
           description: mask to filter by schedule path
           in: query
-          schema: *ref_156
+          schema: *ref_158
         - name: script_hash
           description: mask to filter exact matching path
           in: query
-          schema: *ref_157
+          schema: *ref_159
         - name: started_before
           description: filter on started before (inclusive) timestamp
           in: query
-          schema: *ref_158
+          schema: *ref_160
         - name: started_after
           description: filter on started after (exclusive) timestamp
           in: query
-          schema: *ref_159
+          schema: *ref_161
         - name: created_before
           description: filter on created before (inclusive) timestamp
           in: query
-          schema: *ref_179
+          schema: *ref_181
         - name: created_after
           description: filter on created after (exclusive) timestamp
           in: query
-          schema: *ref_180
+          schema: *ref_182
         - name: completed_before
           description: filter on started before (inclusive) timestamp
           in: query
-          schema: *ref_181
+          schema: *ref_183
         - name: completed_after
           description: filter on started after (exclusive) timestamp
           in: query
-          schema: *ref_182
+          schema: *ref_184
         - name: created_before_queue
           description: filter on jobs created before X for jobs in the queue only
           in: query
-          schema: *ref_183
+          schema: *ref_185
         - name: created_after_queue
           description: filter on jobs created after X for jobs in the queue only
           in: query
-          schema: *ref_184
+          schema: *ref_186
         - name: running
           description: filter on running jobs
           in: query
-          schema: *ref_160
+          schema: *ref_162
         - name: scheduled_for_before_now
           description: filter on jobs scheduled_for before now (hence waitinf for a worker)
           in: query
-          schema: *ref_161
+          schema: *ref_163
         - name: job_kinds
           description: >-
             filter by job kind. Supports comma-separated list of values
             ('preview', 'script', 'dependencies', 'flow') and negation by
             prefixing all values with '!' (e.g. '!preview,!dependencies')
           in: query
-          schema: *ref_162
+          schema: *ref_164
         - name: suspended
           description: filter on suspended jobs
           in: query
-          schema: *ref_163
+          schema: *ref_165
         - name: args
           description: >-
             filter on jobs containing those args as a json subset (@> in
             postgres)
           in: query
-          schema: *ref_164
+          schema: *ref_166
         - name: tag
           description: >-
             filter by tag/worker group. Supports comma-separated list (e.g.
             'gpu,highmem') and negation by prefixing all values with '!' (e.g.
             '!gpu,!highmem')
           in: query
-          schema: *ref_165
+          schema: *ref_167
         - name: result
           description: >-
             filter on jobs containing those result as a json subset (@> in
             postgres)
           in: query
-          schema: *ref_166
+          schema: *ref_168
         - name: allow_wildcards
           description: allow wildcards (*) in the filter of label, tag, worker
           in: query
-          schema: *ref_168
+          schema: *ref_170
         - name: per_page
           description: number of items to return for a given page (default 30, max 100)
           in: query
@@ -19227,7 +19337,7 @@ paths:
             (e.g. '!schedule,!webhook')
           in: query
           x-go-name: JobTriggerKindParam
-          schema: *ref_185
+          schema: *ref_187
         - name: is_skipped
           description: is the job skipped
           in: query
@@ -19275,28 +19385,28 @@ paths:
               schema:
                 type: array
                 items:
-                  oneOf: &ref_190
-                    - allOf:
-                        - type: object
-                          properties: *ref_186
-                          required: *ref_187
-                        - type: object
-                          properties:
-                            type:
-                              type: string
-                              enum:
-                                - CompletedJob
+                  oneOf: &ref_192
                     - allOf:
                         - type: object
                           properties: *ref_188
                           required: *ref_189
+                        - type: object
+                          properties:
+                            type:
+                              type: string
+                              enum:
+                                - CompletedJob
+                    - allOf:
+                        - type: object
+                          properties: *ref_190
+                          required: *ref_191
                         - type: object
                           properties:
                             type:
                               type: string
                               enum:
                                 - QueuedJob
-                  discriminator: &ref_191
+                  discriminator: &ref_193
                     propertyName: type
   /jobs/db_clock:
     get:
@@ -19364,7 +19474,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: no_logs
           in: query
           schema:
@@ -19379,8 +19489,8 @@ paths:
           content:
             application/json:
               schema:
-                oneOf: *ref_190
-                discriminator: *ref_191
+                oneOf: *ref_192
+                discriminator: *ref_193
   /w/{workspace}/jobs_u/get_root_job_id/{id}:
     get:
       summary: get root job id
@@ -19395,7 +19505,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       responses:
         '200':
           description: get root job id
@@ -19418,7 +19528,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: remove_ansi_warnings
           in: query
           schema:
@@ -19444,7 +19554,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       responses:
         '200':
           description: concatenated logs of all flow steps
@@ -19466,7 +19576,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       responses:
         '200':
           description: completed job logs tail
@@ -19488,7 +19598,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       responses:
         '200':
           description: job args
@@ -19539,7 +19649,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: running
           in: query
           schema:
@@ -19586,11 +19696,11 @@ paths:
                     type: string
                   flow_status:
                     type: object
-                    properties: *ref_172
-                    required: *ref_173
+                    properties: *ref_174
+                    required: *ref_175
                   workflow_as_code_status:
                     type: object
-                    properties: *ref_174
+                    properties: *ref_176
   /w/{workspace}/jobs_u/getupdate_sse/{id}:
     get:
       summary: get job updates via server-sent events
@@ -19605,7 +19715,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: running
           in: query
           schema:
@@ -19678,7 +19788,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       responses:
         '200':
           description: flow debug info details
@@ -19699,7 +19809,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       responses:
         '200':
           description: job details
@@ -19707,8 +19817,8 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: *ref_186
-                required: *ref_187
+                properties: *ref_188
+                required: *ref_189
   /w/{workspace}/jobs_u/completed/get_result/{id}:
     get:
       summary: get completed job result
@@ -19723,7 +19833,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: suspended_job
           in: query
           schema:
@@ -19760,10 +19870,10 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: get_started
           in: query
-          schema: &ref_302
+          schema: &ref_312
             type: boolean
       responses:
         '200':
@@ -19797,7 +19907,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       responses:
         '200':
           description: job timing details
@@ -19830,7 +19940,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       responses:
         '200':
           description: job details
@@ -19838,8 +19948,8 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: *ref_186
-                required: *ref_187
+                properties: *ref_188
+                required: *ref_189
   /w/{workspace}/jobs_u/queue/cancel/{id}:
     post:
       summary: cancel queued or running job
@@ -19854,7 +19964,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       requestBody:
         description: reason
         required: true
@@ -19918,7 +20028,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       requestBody:
         description: reason
         required: true
@@ -19980,7 +20090,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       responses:
         '200':
           description: scheduled for timestamp
@@ -20002,7 +20112,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: resume_id
           in: path
           required: true
@@ -20033,7 +20143,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: resume_id
           in: path
           required: true
@@ -20083,7 +20193,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: approver
           in: query
           schema:
@@ -20144,7 +20254,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: approver
           in: query
           schema:
@@ -20332,7 +20442,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: payload
           description: >
             The base64 encoded payload that has been encoded as a JSON. e.g how
@@ -20375,7 +20485,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: resume_id
           in: path
           required: true
@@ -20417,7 +20527,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: key
           in: path
           required: true
@@ -20449,7 +20559,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: key
           in: path
           required: true
@@ -20475,7 +20585,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       requestBody:
         required: true
         content:
@@ -20503,7 +20613,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: resume_id
           in: path
           required: true
@@ -20538,7 +20648,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: resume_id
           in: path
           required: true
@@ -20580,7 +20690,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
         - name: resume_id
           in: path
           required: true
@@ -20604,8 +20714,8 @@ paths:
                 type: object
                 properties:
                   job:
-                    oneOf: *ref_190
-                    discriminator: *ref_191
+                    oneOf: *ref_192
+                    discriminator: *ref_193
                   approvers:
                     type: array
                     items:
@@ -20680,7 +20790,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_425
+              properties: &ref_435
                 path:
                   type: string
                   description: The unique path identifier for this schedule
@@ -20771,7 +20881,7 @@ paths:
                   nullable: true
                   type: object
                   description: Retry configuration for failed module executions
-                  properties: &ref_194
+                  properties: &ref_196
                     constant:
                       type: object
                       description: Retry with constant delay between attempts
@@ -20806,8 +20916,8 @@ paths:
                     retry_if:
                       type: object
                       description: Conditional retry based on error or result
-                      properties: *ref_192
-                      required: *ref_193
+                      properties: *ref_194
+                      required: *ref_195
                 no_flow_overlap:
                   type: boolean
                   description: >-
@@ -20860,7 +20970,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_426
+              required: &ref_436
                 - path
                 - schedule
                 - timezone
@@ -20904,7 +21014,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_427
+              properties: &ref_437
                 schedule:
                   type: string
                   description: >-
@@ -20979,7 +21089,7 @@ paths:
                   nullable: true
                   type: object
                   description: Retry configuration for failed module executions
-                  properties: *ref_194
+                  properties: *ref_196
                 no_flow_overlap:
                   type: boolean
                   description: >-
@@ -21035,7 +21145,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_428
+              required: &ref_438
                 - schedule
                 - timezone
                 - args
@@ -21126,7 +21236,7 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: &ref_195
+                properties: &ref_197
                   path:
                     type: string
                     description: The unique path identifier for this schedule
@@ -21245,7 +21355,7 @@ paths:
                     nullable: true
                     type: object
                     description: Retry configuration for failed module executions
-                    properties: *ref_194
+                    properties: *ref_196
                   summary:
                     type: string
                     nullable: true
@@ -21288,7 +21398,7 @@ paths:
                     items:
                       type: string
                     default: []
-                required: &ref_196
+                required: &ref_198
                   - path
                   - edited_by
                   - edited_at
@@ -21347,7 +21457,7 @@ paths:
             filter on jobs containing those args as a json subset (@> in
             postgres)
           in: query
-          schema: *ref_164
+          schema: *ref_166
         - name: path
           description: filter by path (script path)
           in: query
@@ -21400,8 +21510,8 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: *ref_195
-                  required: *ref_196
+                  properties: *ref_197
+                  required: *ref_198
   /w/{workspace}/schedules/list_with_jobs:
     get:
       summary: list schedules with last 20 jobs
@@ -21429,10 +21539,10 @@ paths:
               schema:
                 type: array
                 items:
-                  allOf: &ref_424
+                  allOf: &ref_434
                     - type: object
-                      properties: *ref_195
-                      required: *ref_196
+                      properties: *ref_197
+                      required: *ref_198
                     - type: object
                       properties:
                         jobs:
@@ -21510,10 +21620,10 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_198
+              properties: &ref_200
                 info:
                   type: object
-                  properties: &ref_434
+                  properties: &ref_444
                     title:
                       type: string
                     version:
@@ -21542,28 +21652,28 @@ paths:
                           type: string
                       required:
                         - name
-                  required: &ref_435
+                  required: &ref_445
                     - title
                     - version
                 url:
                   type: string
                 openapi_spec_format:
                   type: string
-                  enum: &ref_429
+                  enum: &ref_439
                     - yaml
                     - json
                 http_route_filters:
                   type: array
                   items:
                     type: object
-                    properties: &ref_430
+                    properties: &ref_440
                       folder_regex:
                         type: string
                       path_regex:
                         type: string
                       route_path_regex:
                         type: string
-                    required: &ref_431
+                    required: &ref_441
                       - folder_regex
                       - path_regex
                       - route_path_regex
@@ -21571,7 +21681,7 @@ paths:
                   type: array
                   items:
                     type: object
-                    properties: &ref_432
+                    properties: &ref_442
                       user_or_folder_regex:
                         type: string
                         enum:
@@ -21584,8 +21694,8 @@ paths:
                         type: string
                       runnable_kind:
                         type: string
-                        enum: *ref_197
-                    required: &ref_433
+                        enum: *ref_199
+                    required: &ref_443
                       - user_or_folder_regex
                       - user_or_folder_regex_value
                       - path
@@ -21614,7 +21724,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: *ref_198
+              properties: *ref_200
       responses:
         '200':
           description: Downloaded OpenAPI spec
@@ -21643,7 +21753,7 @@ paths:
               type: array
               items:
                 type: object
-                properties: &ref_199
+                properties: &ref_201
                   path:
                     type: string
                     description: The unique path identifier for this trigger
@@ -21694,7 +21804,7 @@ paths:
                       HTTP method (get, post, put, delete, patch) that triggers
                       this endpoint
                     type: string
-                    enum: &ref_201
+                    enum: &ref_203
                       - get
                       - post
                       - put
@@ -21716,7 +21826,7 @@ paths:
                       'async' returns job ID immediately, 'sync_sse' streams
                       results via Server-Sent Events
                     type: string
-                    enum: &ref_202
+                    enum: &ref_204
                       - sync
                       - async
                       - sync_sse
@@ -21726,7 +21836,7 @@ paths:
                       'windmill' (Windmill token), 'api_key', 'basic_http',
                       'custom_script', 'signature'
                     type: string
-                    enum: &ref_203
+                    enum: &ref_205
                       - none
                       - windmill
                       - api_key
@@ -21744,7 +21854,7 @@ paths:
                   mode:
                     description: job trigger mode
                     type: string
-                    enum: &ref_204
+                    enum: &ref_206
                       - enabled
                       - disabled
                       - suspended
@@ -21765,7 +21875,7 @@ paths:
                   retry:
                     description: Retry configuration for failed module executions
                     type: object
-                    properties: *ref_194
+                    properties: *ref_196
                   permissioned_as:
                     type: string
                     description: >-
@@ -21781,7 +21891,7 @@ paths:
                     type: array
                     items:
                       type: string
-                required: &ref_200
+                required: &ref_202
                   - path
                   - script_path
                   - route_path
@@ -21814,8 +21924,8 @@ paths:
           application/json:
             schema:
               type: object
-              properties: *ref_199
-              required: *ref_200
+              properties: *ref_201
+              required: *ref_202
       responses:
         '201':
           description: http trigger created
@@ -21845,7 +21955,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_436
+              properties: &ref_446
                 path:
                   type: string
                   description: The unique path identifier for this trigger
@@ -21902,7 +22012,7 @@ paths:
                     HTTP method (get, post, put, delete, patch) that triggers
                     this endpoint
                   type: string
-                  enum: *ref_201
+                  enum: *ref_203
                 is_async:
                   type: boolean
                   description: Deprecated, use request_type instead
@@ -21912,14 +22022,14 @@ paths:
                     'async' returns job ID immediately, 'sync_sse' streams
                     results via Server-Sent Events
                   type: string
-                  enum: *ref_202
+                  enum: *ref_204
                 authentication_method:
                   description: >-
                     How requests are authenticated - 'none' (public), 'windmill'
                     (Windmill token), 'api_key', 'basic_http', 'custom_script',
                     'signature'
                   type: string
-                  enum: *ref_203
+                  enum: *ref_205
                 is_static_website:
                   type: boolean
                   description: >-
@@ -21943,7 +22053,7 @@ paths:
                 retry:
                   description: Retry configuration for failed module executions
                   type: object
-                  properties: *ref_194
+                  properties: *ref_196
                 permissioned_as:
                   type: string
                   description: >-
@@ -21959,7 +22069,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_437
+              required: &ref_447
                 - path
                 - script_path
                 - is_flow
@@ -22017,9 +22127,9 @@ paths:
           content:
             application/json:
               schema:
-                allOf: &ref_205
+                allOf: &ref_207
                   - type: object
-                    properties: &ref_211
+                    properties: &ref_213
                       path:
                         type: string
                         description: The unique path identifier for this trigger
@@ -22054,13 +22164,13 @@ paths:
                       mode:
                         description: job trigger mode
                         type: string
-                        enum: *ref_204
+                        enum: *ref_206
                       labels:
                         type: array
                         items:
                           type: string
                         default: []
-                    required: &ref_212
+                    required: &ref_214
                       - path
                       - script_path
                       - permissioned_as
@@ -22071,7 +22181,7 @@ paths:
                       - is_flow
                       - mode
                 type: object
-                properties: &ref_206
+                properties: &ref_208
                   route_path:
                     type: string
                     description: >-
@@ -22100,7 +22210,7 @@ paths:
                       HTTP method (get, post, put, delete, patch) that triggers
                       this endpoint
                     type: string
-                    enum: *ref_201
+                    enum: *ref_203
                   authentication_resource_path:
                     type: string
                     nullable: true
@@ -22122,14 +22232,14 @@ paths:
                       'async' returns job ID immediately, 'sync_sse' streams
                       results via Server-Sent Events
                     type: string
-                    enum: *ref_202
+                    enum: *ref_204
                   authentication_method:
                     description: >-
                       How requests are authenticated - 'none' (public),
                       'windmill' (Windmill token), 'api_key', 'basic_http',
                       'custom_script', 'signature'
                     type: string
-                    enum: *ref_203
+                    enum: *ref_205
                   is_static_website:
                     type: boolean
                     description: >-
@@ -22158,8 +22268,8 @@ paths:
                   retry:
                     description: Retry configuration for failed module executions
                     type: object
-                    properties: *ref_194
-                required: &ref_207
+                    properties: *ref_196
+                required: &ref_209
                   - route_path
                   - request_type
                   - authentication_method
@@ -22214,10 +22324,10 @@ paths:
               schema:
                 type: array
                 items:
-                  allOf: *ref_205
+                  allOf: *ref_207
                   type: object
-                  properties: *ref_206
-                  required: *ref_207
+                  properties: *ref_208
+                  required: *ref_209
   /w/{workspace}/http_triggers/exists/{path}:
     get:
       summary: does http trigger exists
@@ -22263,7 +22373,7 @@ paths:
                   type: string
                 http_method:
                   type: string
-                  enum: *ref_201
+                  enum: *ref_203
                 trigger_path:
                   type: string
                 workspaced_route:
@@ -22303,7 +22413,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
               required:
                 - mode
       responses:
@@ -22331,7 +22441,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_438
+              properties: &ref_448
                 path:
                   type: string
                   description: The unique path identifier for this trigger
@@ -22353,7 +22463,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
                 filters:
                   type: array
                   description: >-
@@ -22384,7 +22494,7 @@ paths:
                     Messages to send immediately after connecting (can be raw
                     strings or computed by runnables)
                   items:
-                    anyOf: &ref_208
+                    anyOf: &ref_210
                       - type: object
                         properties:
                           raw_message:
@@ -22427,7 +22537,7 @@ paths:
                   nullable: true
                   description: Optional periodic heartbeat message configuration
                   type: object
-                  properties: &ref_209
+                  properties: &ref_211
                     interval_secs:
                       type: integer
                       minimum: 1
@@ -22444,7 +22554,7 @@ paths:
                         Optional. Top-level JSON field to extract from incoming
                         messages. The extracted value replaces {{state}} in the
                         heartbeat message.
-                  required: &ref_210
+                  required: &ref_212
                     - interval_secs
                     - message
                 error_handler_path:
@@ -22457,7 +22567,7 @@ paths:
                 retry:
                   description: Retry configuration for failed module executions
                   type: object
-                  properties: *ref_194
+                  properties: *ref_196
                 permissioned_as:
                   type: string
                   description: >-
@@ -22473,7 +22583,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_439
+              required: &ref_449
                 - path
                 - script_path
                 - url
@@ -22510,7 +22620,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_440
+              properties: &ref_450
                 url:
                   type: string
                   description: >-
@@ -22559,7 +22669,7 @@ paths:
                     Messages to send immediately after connecting (can be raw
                     strings or computed by runnables)
                   items:
-                    anyOf: *ref_208
+                    anyOf: *ref_210
                 url_runnable_args:
                   description: The arguments to pass to the script or flow
                   nullable: true
@@ -22577,8 +22687,8 @@ paths:
                   nullable: true
                   description: Optional periodic heartbeat message configuration
                   type: object
-                  properties: *ref_209
-                  required: *ref_210
+                  properties: *ref_211
+                  required: *ref_212
                 error_handler_path:
                   type: string
                   description: Path to a script or flow to run when the triggered job fails
@@ -22589,7 +22699,7 @@ paths:
                 retry:
                   description: Retry configuration for failed module executions
                   type: object
-                  properties: *ref_194
+                  properties: *ref_196
                 permissioned_as:
                   type: string
                   description: >-
@@ -22605,7 +22715,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_441
+              required: &ref_451
                 - path
                 - script_path
                 - url
@@ -22663,12 +22773,12 @@ paths:
           content:
             application/json:
               schema:
-                allOf: &ref_213
+                allOf: &ref_215
                   - type: object
-                    properties: *ref_211
-                    required: *ref_212
+                    properties: *ref_213
+                    required: *ref_214
                 type: object
-                properties: &ref_214
+                properties: &ref_216
                   url:
                     type: string
                     description: >-
@@ -22716,7 +22826,7 @@ paths:
                       Messages to send immediately after connecting (can be raw
                       strings or computed by runnables)
                     items:
-                      anyOf: *ref_208
+                      anyOf: *ref_210
                   url_runnable_args:
                     description: The arguments to pass to the script or flow
                     nullable: true
@@ -22734,8 +22844,8 @@ paths:
                     nullable: true
                     description: Optional periodic heartbeat message configuration
                     type: object
-                    properties: *ref_209
-                    required: *ref_210
+                    properties: *ref_211
+                    required: *ref_212
                   error_handler_path:
                     type: string
                     description: >-
@@ -22748,8 +22858,8 @@ paths:
                   retry:
                     description: Retry configuration for failed module executions
                     type: object
-                    properties: *ref_194
-                required: &ref_215
+                    properties: *ref_196
+                required: &ref_217
                   - url
                   - filters
                   - can_return_message
@@ -22800,10 +22910,10 @@ paths:
               schema:
                 type: array
                 items:
-                  allOf: *ref_213
+                  allOf: *ref_215
                   type: object
-                  properties: *ref_214
-                  required: *ref_215
+                  properties: *ref_216
+                  required: *ref_217
   /w/{workspace}/websocket_triggers/exists/{path}:
     get:
       summary: does websocket trigger exists
@@ -22852,7 +22962,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
               required:
                 - mode
       responses:
@@ -22917,7 +23027,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_465
+              properties: &ref_483
                 path:
                   type: string
                   description: The unique path identifier for this trigger
@@ -22983,7 +23093,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
                 error_handler_path:
                   type: string
                   description: Path to a script or flow to run when the triggered job fails
@@ -22994,7 +23104,7 @@ paths:
                 retry:
                   description: Retry configuration for failed module executions
                   type: object
-                  properties: *ref_194
+                  properties: *ref_196
                 permissioned_as:
                   type: string
                   description: >-
@@ -23010,7 +23120,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_466
+              required: &ref_484
                 - path
                 - script_path
                 - is_flow
@@ -23047,7 +23157,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_467
+              properties: &ref_485
                 kafka_resource_path:
                   type: string
                   description: >-
@@ -23120,7 +23230,7 @@ paths:
                 retry:
                   description: Retry configuration for failed module executions
                   type: object
-                  properties: *ref_194
+                  properties: *ref_196
                 permissioned_as:
                   type: string
                   description: >-
@@ -23136,7 +23246,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_468
+              required: &ref_486
                 - path
                 - script_path
                 - kafka_resource_path
@@ -23194,12 +23304,12 @@ paths:
           content:
             application/json:
               schema:
-                allOf: &ref_216
+                allOf: &ref_218
                   - type: object
-                    properties: *ref_211
-                    required: *ref_212
+                    properties: *ref_213
+                    required: *ref_214
                 type: object
-                properties: &ref_217
+                properties: &ref_219
                   kafka_resource_path:
                     type: string
                     description: >-
@@ -23274,8 +23384,8 @@ paths:
                   retry:
                     description: Retry configuration for failed module executions
                     type: object
-                    properties: *ref_194
-                required: &ref_218
+                    properties: *ref_196
+                required: &ref_220
                   - kafka_resource_path
                   - group_id
                   - topics
@@ -23326,10 +23436,10 @@ paths:
               schema:
                 type: array
                 items:
-                  allOf: *ref_216
+                  allOf: *ref_218
                   type: object
-                  properties: *ref_217
-                  required: *ref_218
+                  properties: *ref_219
+                  required: *ref_220
   /w/{workspace}/kafka_triggers/exists/{path}:
     get:
       summary: does kafka trigger exists
@@ -23378,7 +23488,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
               required:
                 - mode
       responses:
@@ -23492,7 +23602,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_469
+              properties: &ref_487
                 path:
                   type: string
                   description: The unique path identifier for this trigger
@@ -23532,7 +23642,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
                 error_handler_path:
                   type: string
                   description: Path to a script or flow to run when the triggered job fails
@@ -23543,7 +23653,7 @@ paths:
                 retry:
                   description: Retry configuration for failed module executions
                   type: object
-                  properties: *ref_194
+                  properties: *ref_196
                 permissioned_as:
                   type: string
                   description: >-
@@ -23559,7 +23669,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_470
+              required: &ref_488
                 - path
                 - script_path
                 - is_flow
@@ -23595,7 +23705,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_471
+              properties: &ref_489
                 nats_resource_path:
                   type: string
                   description: >-
@@ -23642,7 +23752,7 @@ paths:
                 retry:
                   description: Retry configuration for failed module executions
                   type: object
-                  properties: *ref_194
+                  properties: *ref_196
                 permissioned_as:
                   type: string
                   description: >-
@@ -23658,7 +23768,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_472
+              required: &ref_490
                 - path
                 - script_path
                 - nats_resource_path
@@ -23715,12 +23825,12 @@ paths:
           content:
             application/json:
               schema:
-                allOf: &ref_219
+                allOf: &ref_221
                   - type: object
-                    properties: *ref_211
-                    required: *ref_212
+                    properties: *ref_213
+                    required: *ref_214
                 type: object
-                properties: &ref_220
+                properties: &ref_222
                   nats_resource_path:
                     type: string
                     description: >-
@@ -23770,8 +23880,8 @@ paths:
                   retry:
                     description: Retry configuration for failed module executions
                     type: object
-                    properties: *ref_194
-                required: &ref_221
+                    properties: *ref_196
+                required: &ref_223
                   - nats_resource_path
                   - use_jetstream
                   - subjects
@@ -23821,10 +23931,10 @@ paths:
               schema:
                 type: array
                 items:
-                  allOf: *ref_219
+                  allOf: *ref_221
                   type: object
-                  properties: *ref_220
-                  required: *ref_221
+                  properties: *ref_222
+                  required: *ref_223
   /w/{workspace}/nats_triggers/exists/{path}:
     get:
       summary: does nats trigger exists
@@ -23873,7 +23983,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
               required:
                 - mode
       responses:
@@ -23931,7 +24041,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_452
+              properties: &ref_470
                 queue_url:
                   type: string
                   description: The full URL of the AWS SQS queue to poll for messages
@@ -23940,7 +24050,7 @@ paths:
                     Authentication type - 'credentials' for access key/secret,
                     'oidc' for OpenID Connect
                   type: string
-                  enum: &ref_222
+                  enum: &ref_224
                     - oidc
                     - credentials
                 aws_resource_path:
@@ -23972,7 +24082,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
                 error_handler_path:
                   type: string
                   description: Path to a script or flow to run when the triggered job fails
@@ -23983,7 +24093,7 @@ paths:
                 retry:
                   description: Retry configuration for failed module executions
                   type: object
-                  properties: *ref_194
+                  properties: *ref_196
                 permissioned_as:
                   type: string
                   description: >-
@@ -23999,7 +24109,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_453
+              required: &ref_471
                 - queue_url
                 - aws_resource_path
                 - path
@@ -24035,7 +24145,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_454
+              properties: &ref_472
                 queue_url:
                   type: string
                   description: The full URL of the AWS SQS queue to poll for messages
@@ -24044,7 +24154,7 @@ paths:
                     Authentication type - 'credentials' for access key/secret,
                     'oidc' for OpenID Connect
                   type: string
-                  enum: *ref_222
+                  enum: *ref_224
                 aws_resource_path:
                   type: string
                   description: >-
@@ -24074,7 +24184,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
                 error_handler_path:
                   type: string
                   description: Path to a script or flow to run when the triggered job fails
@@ -24085,7 +24195,7 @@ paths:
                 retry:
                   description: Retry configuration for failed module executions
                   type: object
-                  properties: *ref_194
+                  properties: *ref_196
                 permissioned_as:
                   type: string
                   description: >-
@@ -24101,7 +24211,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_455
+              required: &ref_473
                 - queue_url
                 - aws_resource_path
                 - path
@@ -24159,12 +24269,12 @@ paths:
           content:
             application/json:
               schema:
-                allOf: &ref_223
+                allOf: &ref_225
                   - type: object
-                    properties: *ref_211
-                    required: *ref_212
+                    properties: *ref_213
+                    required: *ref_214
                 type: object
-                properties: &ref_224
+                properties: &ref_226
                   queue_url:
                     type: string
                     description: The full URL of the AWS SQS queue to poll for messages
@@ -24173,7 +24283,7 @@ paths:
                       Authentication type - 'credentials' for access key/secret,
                       'oidc' for OpenID Connect
                     type: string
-                    enum: *ref_222
+                    enum: *ref_224
                   aws_resource_path:
                     type: string
                     description: >-
@@ -24211,8 +24321,8 @@ paths:
                   retry:
                     description: Retry configuration for failed module executions
                     type: object
-                    properties: *ref_194
-                required: &ref_225
+                    properties: *ref_196
+                required: &ref_227
                   - queue_url
                   - aws_resource_path
                   - aws_auth_resource_type
@@ -24262,10 +24372,10 @@ paths:
               schema:
                 type: array
                 items:
-                  allOf: *ref_223
+                  allOf: *ref_225
                   type: object
-                  properties: *ref_224
-                  required: *ref_225
+                  properties: *ref_226
+                  required: *ref_227
   /w/{workspace}/sqs_triggers/exists/{path}:
     get:
       summary: does sqs trigger exists
@@ -24314,7 +24424,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
               required:
                 - mode
       responses:
@@ -24374,16 +24484,17 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_556
+                  properties: &ref_572
                     service_name:
                       type: string
-                      enum: &ref_226
+                      enum: &ref_228
                         - nextcloud
                         - google
+                        - github
                     oauth_data:
                       nullable: true
                       type: object
-                      properties: &ref_227
+                      properties: &ref_229
                         client_id:
                           type: string
                           description: The OAuth client ID for the workspace
@@ -24398,7 +24509,7 @@ paths:
                           type: string
                           format: uri
                           description: The OAuth redirect URI
-                      required: &ref_228
+                      required: &ref_230
                         - client_id
                         - client_secret
                         - base_url
@@ -24407,7 +24518,7 @@ paths:
                       type: string
                       nullable: true
                       description: Path to the resource storing the OAuth token
-                  required: &ref_557
+                  required: &ref_573
                     - service_name
   /w/{workspace}/native_triggers/integrations/{service_name}/exists:
     get:
@@ -24425,7 +24536,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_226
+            enum: *ref_228
       responses:
         '200':
           description: integration exists
@@ -24449,7 +24560,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_226
+            enum: *ref_228
       requestBody:
         description: new native trigger service
         required: true
@@ -24457,8 +24568,8 @@ paths:
           application/json:
             schema:
               type: object
-              properties: *ref_227
-              required: *ref_228
+              properties: *ref_229
+              required: *ref_230
       responses:
         '201':
           description: native trigger service created
@@ -24482,7 +24593,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_226
+            enum: *ref_228
       requestBody:
         description: redirect_uri
         required: true
@@ -24490,10 +24601,10 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_229
+              properties: &ref_231
                 redirect_uri:
                   type: string
-              required: &ref_230
+              required: &ref_232
                 - redirect_uri
       responses:
         '200':
@@ -24518,7 +24629,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_226
+            enum: *ref_228
       responses:
         '200':
           description: whether instance sharing is available
@@ -24542,7 +24653,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_226
+            enum: *ref_228
       requestBody:
         description: redirect_uri
         required: true
@@ -24550,8 +24661,8 @@ paths:
           application/json:
             schema:
               type: object
-              properties: *ref_229
-              required: *ref_230
+              properties: *ref_231
+              required: *ref_232
       responses:
         '200':
           description: authorization URL using instance credentials
@@ -24575,7 +24686,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_226
+            enum: *ref_228
       responses:
         '200':
           description: native trigger service deleted
@@ -24599,7 +24710,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_226
+            enum: *ref_228
       requestBody:
         description: OAuth callback data
         required: true
@@ -24648,7 +24759,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_226
+            enum: *ref_228
       requestBody:
         description: new native trigger configuration
         required: true
@@ -24657,7 +24768,7 @@ paths:
             schema:
               type: object
               description: Data for creating or updating a native trigger
-              properties: &ref_231
+              properties: &ref_233
                 script_path:
                   type: string
                   description: The path to the script or flow that will be triggered
@@ -24674,7 +24785,7 @@ paths:
                   type: string
                   nullable: true
                   description: Short summary to be displayed when listed
-              required: &ref_232
+              required: &ref_234
                 - script_path
                 - is_flow
                 - service_config
@@ -24686,13 +24797,13 @@ paths:
               schema:
                 type: object
                 description: Response returned when a native trigger is created
-                properties: &ref_559
+                properties: &ref_575
                   external_id:
                     type: string
                     description: >-
                       The external ID of the created trigger from the external
                       service
-                required: &ref_560
+                required: &ref_576
                   - external_id
   /w/{workspace}/native_triggers/{service_name}/update/{external_id}:
     post:
@@ -24715,7 +24826,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_226
+            enum: *ref_228
         - name: external_id
           in: path
           required: true
@@ -24730,8 +24841,8 @@ paths:
             schema:
               type: object
               description: Data for creating or updating a native trigger
-              properties: *ref_231
-              required: *ref_232
+              properties: *ref_233
+              required: *ref_234
       responses:
         '200':
           description: native trigger updated
@@ -24760,7 +24871,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_226
+            enum: *ref_228
         - name: external_id
           in: path
           required: true
@@ -24777,7 +24888,7 @@ paths:
                 description: >-
                   Full trigger response containing both Windmill data and
                   external service data
-                properties: &ref_554
+                properties: &ref_570
                   external_id:
                     type: string
                     description: The unique identifier from the external service
@@ -24786,7 +24897,7 @@ paths:
                     description: The workspace this trigger belongs to
                   service_name:
                     type: string
-                    enum: *ref_226
+                    enum: *ref_228
                   script_path:
                     type: string
                     description: The path to the script or flow that will be triggered
@@ -24813,7 +24924,7 @@ paths:
                     type: object
                     description: Configuration data from the external service
                     additionalProperties: true
-                required: &ref_555
+                required: &ref_571
                   - external_id
                   - workspace_id
                   - service_name
@@ -24842,7 +24953,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_226
+            enum: *ref_228
         - name: external_id
           in: path
           required: true
@@ -24873,7 +24984,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_226
+            enum: *ref_228
         - name: page
           description: which page to return (start at 1, default 1)
           in: query
@@ -24908,7 +25019,7 @@ paths:
                 items:
                   type: object
                   description: A native trigger stored in Windmill
-                  properties: &ref_552
+                  properties: &ref_568
                     external_id:
                       type: string
                       description: The unique identifier from the external service
@@ -24917,7 +25028,7 @@ paths:
                       description: The workspace this trigger belongs to
                     service_name:
                       type: string
-                      enum: *ref_226
+                      enum: *ref_228
                     script_path:
                       type: string
                       description: The path to the script or flow that will be triggered
@@ -24940,7 +25051,7 @@ paths:
                       type: string
                       nullable: true
                       description: Short summary to be displayed when listed
-                  required: &ref_553
+                  required: &ref_569
                     - external_id
                     - workspace_id
                     - service_name
@@ -24964,7 +25075,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_226
+            enum: *ref_228
         - name: external_id
           in: path
           required: true
@@ -24994,7 +25105,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_226
+            enum: *ref_228
       responses:
         '200':
           description: sync completed successfully
@@ -25019,7 +25130,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_561
+                  properties: &ref_577
                     id:
                       type: string
                     name:
@@ -25030,7 +25141,7 @@ paths:
                       type: string
                     path:
                       type: string
-                  required: &ref_562
+                  required: &ref_578
                     - id
                     - name
                     - path
@@ -25055,7 +25166,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_563
+                  properties: &ref_579
                     id:
                       type: string
                     summary:
@@ -25063,7 +25174,7 @@ paths:
                     primary:
                       type: boolean
                       default: false
-                  required: &ref_564
+                  required: &ref_580
                     - id
                     - summary
   /w/{workspace}/native_triggers/google/drive/files:
@@ -25106,12 +25217,12 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: &ref_567
+                properties: &ref_583
                   files:
                     type: array
                     items:
                       type: object
-                      properties: &ref_565
+                      properties: &ref_581
                         id:
                           type: string
                         name:
@@ -25121,13 +25232,13 @@ paths:
                         is_folder:
                           type: boolean
                           default: false
-                      required: &ref_566
+                      required: &ref_582
                         - id
                         - name
                         - mime_type
                   next_page_token:
                     type: string
-                required: &ref_568
+                required: &ref_584
                   - files
   /w/{workspace}/native_triggers/google/drive/shared_drives:
     get:
@@ -25150,14 +25261,49 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_569
+                  properties: &ref_585
                     id:
                       type: string
                     name:
                       type: string
-                  required: &ref_570
+                  required: &ref_586
                     - id
                     - name
+  /w/{workspace}/native_triggers/github/repos:
+    get:
+      summary: list GitHub repositories accessible to the user
+      operationId: listGithubRepos
+      tags:
+        - native_trigger
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: list of GitHub repositories
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+                  properties: &ref_587
+                    full_name:
+                      type: string
+                    name:
+                      type: string
+                    owner:
+                      type: string
+                    private:
+                      type: boolean
+                  required: &ref_588
+                    - full_name
+                    - name
+                    - owner
+                    - private
   /native_triggers/{service_name}/w/{workspace_id}/webhook/{internal_id}:
     post:
       summary: receive webhook from external native trigger service
@@ -25170,7 +25316,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_226
+            enum: *ref_228
         - name: workspace_id
           in: path
           required: true
@@ -25219,7 +25365,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_443
+              properties: &ref_453
                 mqtt_resource_path:
                   type: string
                   description: >-
@@ -25229,16 +25375,16 @@ paths:
                   type: array
                   items:
                     type: object
-                    properties: &ref_233
+                    properties: &ref_235
                       qos:
                         type: string
-                        enum: &ref_442
+                        enum: &ref_452
                           - qos0
                           - qos1
                           - qos2
                       topic:
                         type: string
-                    required: &ref_234
+                    required: &ref_236
                       - qos
                       - topic
                   description: >-
@@ -25252,7 +25398,7 @@ paths:
                   nullable: true
                   description: MQTT v3 specific configuration (clean_session)
                   type: object
-                  properties: &ref_235
+                  properties: &ref_237
                     clean_session:
                       type: boolean
                 v5_config:
@@ -25261,7 +25407,7 @@ paths:
                     MQTT v5 specific configuration (clean_start,
                     topic_alias_maximum, session_expiry_interval)
                   type: object
-                  properties: &ref_236
+                  properties: &ref_238
                     clean_start:
                       type: boolean
                     topic_alias_maximum:
@@ -25272,7 +25418,7 @@ paths:
                   nullable: true
                   description: MQTT protocol version ('v3' or 'v5')
                   type: string
-                  enum: &ref_237
+                  enum: &ref_239
                     - v3
                     - v5
                 path:
@@ -25291,7 +25437,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
                 error_handler_path:
                   type: string
                   description: Path to a script or flow to run when the triggered job fails
@@ -25302,7 +25448,7 @@ paths:
                 retry:
                   description: Retry configuration for failed module executions
                   type: object
-                  properties: *ref_194
+                  properties: *ref_196
                 permissioned_as:
                   type: string
                   description: >-
@@ -25318,7 +25464,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_444
+              required: &ref_454
                 - path
                 - script_path
                 - is_flow
@@ -25353,7 +25499,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_445
+              properties: &ref_455
                 mqtt_resource_path:
                   type: string
                   description: >-
@@ -25363,8 +25509,8 @@ paths:
                   type: array
                   items:
                     type: object
-                    properties: *ref_233
-                    required: *ref_234
+                    properties: *ref_235
+                    required: *ref_236
                   description: >-
                     Array of MQTT topics to subscribe to, each with topic name
                     and QoS level
@@ -25376,19 +25522,19 @@ paths:
                   nullable: true
                   description: MQTT v3 specific configuration (clean_session)
                   type: object
-                  properties: *ref_235
+                  properties: *ref_237
                 v5_config:
                   nullable: true
                   description: >-
                     MQTT v5 specific configuration (clean_start,
                     topic_alias_maximum, session_expiry_interval)
                   type: object
-                  properties: *ref_236
+                  properties: *ref_238
                 client_version:
                   nullable: true
                   description: MQTT protocol version ('v3' or 'v5')
                   type: string
-                  enum: *ref_237
+                  enum: *ref_239
                 path:
                   type: string
                   description: The unique path identifier for this trigger
@@ -25405,7 +25551,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
                 error_handler_path:
                   type: string
                   description: Path to a script or flow to run when the triggered job fails
@@ -25416,7 +25562,7 @@ paths:
                 retry:
                   description: Retry configuration for failed module executions
                   type: object
-                  properties: *ref_194
+                  properties: *ref_196
                 permissioned_as:
                   type: string
                   description: >-
@@ -25432,7 +25578,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_446
+              required: &ref_456
                 - path
                 - script_path
                 - is_flow
@@ -25489,12 +25635,12 @@ paths:
           content:
             application/json:
               schema:
-                allOf: &ref_238
+                allOf: &ref_240
                   - type: object
-                    properties: *ref_211
-                    required: *ref_212
+                    properties: *ref_213
+                    required: *ref_214
                 type: object
-                properties: &ref_239
+                properties: &ref_241
                   mqtt_resource_path:
                     type: string
                     description: >-
@@ -25504,8 +25650,8 @@ paths:
                     type: array
                     items:
                       type: object
-                      properties: *ref_233
-                      required: *ref_234
+                      properties: *ref_235
+                      required: *ref_236
                     description: >-
                       Array of MQTT topics to subscribe to, each with topic name
                       and QoS level
@@ -25513,14 +25659,14 @@ paths:
                     nullable: true
                     description: MQTT v3 specific configuration (clean_session)
                     type: object
-                    properties: *ref_235
+                    properties: *ref_237
                   v5_config:
                     nullable: true
                     description: >-
                       MQTT v5 specific configuration (clean_start,
                       topic_alias_maximum, session_expiry_interval)
                     type: object
-                    properties: *ref_236
+                    properties: *ref_238
                   client_id:
                     type: string
                     nullable: true
@@ -25529,7 +25675,7 @@ paths:
                     nullable: true
                     description: MQTT protocol version ('v3' or 'v5')
                     type: string
-                    enum: *ref_237
+                    enum: *ref_239
                   server_id:
                     type: string
                     description: >-
@@ -25554,8 +25700,8 @@ paths:
                   retry:
                     description: Retry configuration for failed module executions
                     type: object
-                    properties: *ref_194
-                required: &ref_240
+                    properties: *ref_196
+                required: &ref_242
                   - subscribe_topics
                   - mqtt_resource_path
   /w/{workspace}/mqtt_triggers/list:
@@ -25604,10 +25750,10 @@ paths:
               schema:
                 type: array
                 items:
-                  allOf: *ref_238
+                  allOf: *ref_240
                   type: object
-                  properties: *ref_239
-                  required: *ref_240
+                  properties: *ref_241
+                  required: *ref_242
   /w/{workspace}/mqtt_triggers/exists/{path}:
     get:
       summary: does mqtt trigger exists
@@ -25656,7 +25802,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
               required:
                 - mode
       responses:
@@ -25715,7 +25861,7 @@ paths:
             schema:
               type: object
               description: Data for creating or updating a Google Cloud Pub/Sub trigger.
-              properties: &ref_241
+              properties: &ref_243
                 gcp_resource_path:
                   type: string
                   description: >-
@@ -25723,7 +25869,7 @@ paths:
                     credentials for authentication.
                 subscription_mode:
                   type: string
-                  enum: &ref_246
+                  enum: &ref_248
                     - existing
                     - create_update
                   description: >-
@@ -25741,7 +25887,7 @@ paths:
                   description: Base URL for push delivery endpoint.
                 delivery_type:
                   type: string
-                  enum: &ref_243
+                  enum: &ref_245
                     - push
                     - pull
                   description: >-
@@ -25752,7 +25898,7 @@ paths:
                   nullable: true
                   type: object
                   description: Configuration for push delivery mode.
-                  properties: &ref_244
+                  properties: &ref_246
                     audience:
                       type: string
                       description: >-
@@ -25763,7 +25909,7 @@ paths:
                       description: >-
                         If true, push messages will include OIDC authentication
                         tokens.
-                  required: &ref_245
+                  required: &ref_247
                     - authenticate
                     - base_endpoint
                 path:
@@ -25782,7 +25928,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
                 auto_acknowledge_msg:
                   type: boolean
                   description: >-
@@ -25809,7 +25955,7 @@ paths:
                 retry:
                   description: Retry configuration for failed module executions
                   type: object
-                  properties: *ref_194
+                  properties: *ref_196
                 permissioned_as:
                   type: string
                   description: >-
@@ -25825,7 +25971,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_242
+              required: &ref_244
                 - path
                 - script_path
                 - is_flow
@@ -25862,8 +26008,8 @@ paths:
             schema:
               type: object
               description: Data for creating or updating a Google Cloud Pub/Sub trigger.
-              properties: *ref_241
-              required: *ref_242
+              properties: *ref_243
+              required: *ref_244
       responses:
         '200':
           description: gcp trigger updated
@@ -25914,15 +26060,15 @@ paths:
           content:
             application/json:
               schema:
-                allOf: &ref_247
+                allOf: &ref_249
                   - type: object
-                    properties: *ref_211
-                    required: *ref_212
+                    properties: *ref_213
+                    required: *ref_214
                 type: object
                 description: >-
                   A Google Cloud Pub/Sub trigger that executes a script or flow
                   when messages are received.
-                properties: &ref_248
+                properties: &ref_250
                   gcp_resource_path:
                     type: string
                     description: >-
@@ -25941,7 +26087,7 @@ paths:
                       use).
                   delivery_type:
                     type: string
-                    enum: *ref_243
+                    enum: *ref_245
                     description: >-
                       Delivery mode for messages. 'push' for HTTP push delivery
                       where messages are sent to a webhook endpoint, 'pull' for
@@ -25950,11 +26096,11 @@ paths:
                     nullable: true
                     type: object
                     description: Configuration for push delivery mode.
-                    properties: *ref_244
-                    required: *ref_245
+                    properties: *ref_246
+                    required: *ref_247
                   subscription_mode:
                     type: string
-                    enum: *ref_246
+                    enum: *ref_248
                     description: >-
                       The mode of subscription. 'existing' means using an
                       existing GCP subscription, while 'create_update' involves
@@ -25978,8 +26124,8 @@ paths:
                   retry:
                     description: Retry configuration for failed module executions
                     type: object
-                    properties: *ref_194
-                required: &ref_249
+                    properties: *ref_196
+                required: &ref_251
                   - gcp_resource_path
                   - topic_id
                   - subscription_id
@@ -26031,13 +26177,13 @@ paths:
               schema:
                 type: array
                 items:
-                  allOf: *ref_247
+                  allOf: *ref_249
                   type: object
                   description: >-
                     A Google Cloud Pub/Sub trigger that executes a script or
                     flow when messages are received.
-                  properties: *ref_248
-                  required: *ref_249
+                  properties: *ref_250
+                  required: *ref_251
   /w/{workspace}/gcp_triggers/exists/{path}:
     get:
       summary: does gcp trigger exists
@@ -26086,7 +26232,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
               required:
                 - mode
       responses:
@@ -26148,10 +26294,10 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_449
+              properties: &ref_459
                 subscription_id:
                   type: string
-              required: &ref_450
+              required: &ref_460
                 - subscription_id
       responses:
         '200':
@@ -26206,10 +26352,10 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_447
+              properties: &ref_457
                 topic_id:
                   type: string
-              required: &ref_448
+              required: &ref_458
                 - topic_id
       responses:
         '200':
@@ -26220,6 +26366,535 @@ paths:
                 type: array
                 items:
                   type: string
+  /w/{workspace}/azure_triggers/create:
+    post:
+      summary: create an Azure Event Grid trigger
+      operationId: createAzureTrigger
+      tags:
+        - azure_trigger
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema: *ref_4
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              description: Data for creating or updating an Azure Event Grid trigger.
+              properties: &ref_252
+                azure_resource_path:
+                  type: string
+                azure_mode:
+                  type: string
+                  enum: &ref_254
+                    - basic_push
+                    - namespace_push
+                    - namespace_pull
+                  description: Azure Event Grid trigger mode.
+                scope_resource_id:
+                  type: string
+                topic_name:
+                  type: string
+                  nullable: true
+                subscription_name:
+                  type: string
+                base_endpoint:
+                  type: string
+                  description: Base URL for push delivery endpoints (push modes only).
+                event_type_filters:
+                  type: array
+                  items:
+                    type: string
+                path:
+                  type: string
+                script_path:
+                  type: string
+                is_flow:
+                  type: boolean
+                mode:
+                  description: job trigger mode
+                  type: string
+                  enum: *ref_206
+                error_handler_path:
+                  type: string
+                error_handler_args:
+                  type: object
+                  description: The arguments to pass to the script or flow
+                  additionalProperties: true
+                retry:
+                  type: object
+                  description: Retry configuration for failed module executions
+                  properties: *ref_196
+                permissioned_as:
+                  type: string
+                preserve_permissioned_as:
+                  type: boolean
+                labels:
+                  type: array
+                  items:
+                    type: string
+              required: &ref_253
+                - path
+                - script_path
+                - is_flow
+                - azure_resource_path
+                - azure_mode
+                - scope_resource_id
+                - subscription_name
+      responses:
+        '201':
+          description: azure trigger created
+          content:
+            text/plain:
+              schema:
+                type: string
+  /w/{workspace}/azure_triggers/update/{path}:
+    post:
+      summary: update an Azure Event Grid trigger
+      operationId: updateAzureTrigger
+      tags:
+        - azure_trigger
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema: *ref_4
+        - name: path
+          in: path
+          required: true
+          schema: *ref_60
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              description: Data for creating or updating an Azure Event Grid trigger.
+              properties: *ref_252
+              required: *ref_253
+      responses:
+        '200':
+          description: azure trigger updated
+          content:
+            text/plain:
+              schema:
+                type: string
+  /w/{workspace}/azure_triggers/delete/{path}:
+    delete:
+      summary: delete an Azure Event Grid trigger
+      operationId: deleteAzureTrigger
+      tags:
+        - azure_trigger
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema: *ref_4
+        - name: path
+          in: path
+          required: true
+          schema: *ref_60
+      responses:
+        '200':
+          description: azure trigger deleted
+          content:
+            text/plain:
+              schema:
+                type: string
+  /w/{workspace}/azure_triggers/get/{path}:
+    get:
+      summary: get an Azure Event Grid trigger
+      operationId: getAzureTrigger
+      tags:
+        - azure_trigger
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema: *ref_4
+        - name: path
+          in: path
+          required: true
+          schema: *ref_60
+      responses:
+        '200':
+          description: azure trigger
+          content:
+            application/json:
+              schema:
+                allOf: &ref_255
+                  - type: object
+                    properties: *ref_213
+                    required: *ref_214
+                type: object
+                description: >-
+                  An Azure Event Grid trigger that executes a script or flow
+                  when events arrive.
+                properties: &ref_256
+                  azure_resource_path:
+                    type: string
+                  azure_mode:
+                    type: string
+                    enum: *ref_254
+                    description: Azure Event Grid trigger mode.
+                  scope_resource_id:
+                    type: string
+                    description: >-
+                      ARM resource ID of the topic (basic) or namespace
+                      (namespace modes).
+                  topic_name:
+                    type: string
+                    nullable: true
+                    description: Topic name within the namespace (namespace modes only).
+                  subscription_name:
+                    type: string
+                  event_type_filters:
+                    type: array
+                    items:
+                      type: string
+                    nullable: true
+                  server_id:
+                    type: string
+                  last_server_ping:
+                    type: string
+                    format: date-time
+                  error:
+                    type: string
+                  error_handler_path:
+                    type: string
+                  error_handler_args:
+                    type: object
+                    description: The arguments to pass to the script or flow
+                    additionalProperties: true
+                  retry:
+                    type: object
+                    description: Retry configuration for failed module executions
+                    properties: *ref_196
+                required: &ref_257
+                  - azure_resource_path
+                  - azure_mode
+                  - scope_resource_id
+                  - subscription_name
+  /w/{workspace}/azure_triggers/list:
+    get:
+      summary: list azure triggers
+      operationId: listAzureTriggers
+      tags:
+        - azure_trigger
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema: *ref_4
+        - name: page
+          description: which page to return (start at 1, default 1)
+          in: query
+          schema: *ref_17
+        - name: per_page
+          description: number of items to return for a given page (default 30, max 100)
+          in: query
+          schema: *ref_18
+        - name: path
+          description: filter by exact path
+          in: query
+          schema:
+            type: string
+        - name: is_flow
+          in: query
+          schema:
+            type: boolean
+        - name: path_start
+          in: query
+          schema:
+            type: string
+      responses:
+        '200':
+          description: azure trigger list
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  allOf: *ref_255
+                  type: object
+                  description: >-
+                    An Azure Event Grid trigger that executes a script or flow
+                    when events arrive.
+                  properties: *ref_256
+                  required: *ref_257
+  /w/{workspace}/azure_triggers/exists/{path}:
+    get:
+      summary: check whether an azure trigger exists
+      operationId: existsAzureTrigger
+      tags:
+        - azure_trigger
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema: *ref_4
+        - name: path
+          in: path
+          required: true
+          schema: *ref_60
+      responses:
+        '200':
+          description: true/false
+          content:
+            application/json:
+              schema:
+                type: boolean
+  /w/{workspace}/azure_triggers/setmode/{path}:
+    post:
+      summary: set azure trigger mode
+      operationId: setAzureTriggerMode
+      tags:
+        - azure_trigger
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema: *ref_4
+        - name: path
+          in: path
+          required: true
+          schema: *ref_60
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                mode:
+                  description: job trigger mode
+                  type: string
+                  enum: *ref_206
+              required:
+                - mode
+      responses:
+        '200':
+          description: trigger mode updated
+          content:
+            text/plain:
+              schema:
+                type: string
+  /w/{workspace}/azure_triggers/test:
+    post:
+      summary: test Azure service principal connection
+      operationId: testAzureConnection
+      tags:
+        - azure_trigger
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema: *ref_4
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties: &ref_463
+                azure_resource_path:
+                  type: string
+              required: &ref_464
+                - azure_resource_path
+      responses:
+        '200':
+          description: connection successful
+          content:
+            text/plain:
+              schema:
+                type: string
+  /w/{workspace}/azure_triggers/namespaces/topics/list/{path}:
+    post:
+      summary: list topics under an Event Grid Namespace
+      operationId: listAzureNamespaceTopics
+      tags:
+        - azure_trigger
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema: *ref_4
+        - name: path
+          in: path
+          required: true
+          schema: *ref_60
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties: &ref_465
+                scope_resource_id:
+                  type: string
+              required: &ref_466
+                - scope_resource_id
+      responses:
+        '200':
+          description: topic list
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+  /w/{workspace}/azure_triggers/namespaces/subscriptions/list/{path}:
+    post:
+      summary: list subscriptions under a Namespace topic
+      operationId: listAzureNamespaceSubscriptions
+      tags:
+        - azure_trigger
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema: *ref_4
+        - name: path
+          in: path
+          required: true
+          schema: *ref_60
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties: &ref_467
+                scope_resource_id:
+                  type: string
+                topic_name:
+                  type: string
+              required: &ref_468
+                - scope_resource_id
+                - topic_name
+      responses:
+        '200':
+          description: subscription list
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+  /w/{workspace}/azure_triggers/subscriptions/delete/{path}:
+    delete:
+      summary: delete an Event Grid subscription on Azure
+      operationId: deleteAzureSubscription
+      tags:
+        - azure_trigger
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema: *ref_4
+        - name: path
+          in: path
+          required: true
+          schema: *ref_60
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties: &ref_461
+                azure_mode:
+                  type: string
+                  enum: *ref_254
+                  description: Azure Event Grid trigger mode.
+                scope_resource_id:
+                  type: string
+                topic_name:
+                  type: string
+                  nullable: true
+                subscription_name:
+                  type: string
+              required: &ref_462
+                - azure_mode
+                - scope_resource_id
+                - subscription_name
+      responses:
+        '200':
+          description: subscription deleted
+          content:
+            text/plain:
+              schema:
+                type: string
+  /w/{workspace}/azure_triggers/namespaces/list/{path}:
+    post:
+      summary: list Event Grid Namespaces the service principal can access
+      operationId: listAzureNamespaces
+      tags:
+        - azure_trigger
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema: *ref_4
+        - name: path
+          in: path
+          required: true
+          schema: *ref_60
+      responses:
+        '200':
+          description: namespace list
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+                  description: An ARM resource the service principal can see.
+                  properties: &ref_258
+                    id:
+                      type: string
+                    name:
+                      type: string
+                    location:
+                      type: string
+                    type:
+                      type: string
+                  required: &ref_259
+                    - id
+                    - name
+                    - type
+  /w/{workspace}/azure_triggers/basic/topics/list/{path}:
+    post:
+      summary: >-
+        list Basic Event Grid topics + system topics the service principal can
+        access
+      operationId: listAzureBasicTopics
+      tags:
+        - azure_trigger
+      parameters:
+        - name: workspace
+          in: path
+          required: true
+          schema: *ref_4
+        - name: path
+          in: path
+          required: true
+          schema: *ref_60
+      responses:
+        '200':
+          description: topic list
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+                  description: An ARM resource the service principal can see.
+                  properties: *ref_258
+                  required: *ref_259
   /w/{workspace}/postgres_triggers/postgres/version/{path}:
     get:
       summary: get postgres version
@@ -26282,19 +26957,19 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_459
+              properties: &ref_477
                 postgres_resource_path:
                   type: string
                 relations:
                   type: array
                   items:
                     type: object
-                    properties: &ref_251
+                    properties: &ref_261
                       schema_name:
                         type: string
                       table_to_track:
                         type: array
-                        items: &ref_457
+                        items: &ref_475
                           type: object
                           properties:
                             table_name:
@@ -26307,14 +26982,14 @@ paths:
                               type: string
                           required:
                             - table_name
-                    required: &ref_252
+                    required: &ref_262
                       - schema_name
                       - table_to_track
                 language:
                   type: string
-                  enum: &ref_458
+                  enum: &ref_476
                     - Typescript
-              required: &ref_460
+              required: &ref_478
                 - postgres_resource_path
                 - relations
                 - language
@@ -26339,7 +27014,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: &ref_293
+          schema: &ref_303
             type: string
       responses:
         '200':
@@ -26372,7 +27047,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_456
+                  properties: &ref_474
                     slot_name:
                       type: string
                     active:
@@ -26399,7 +27074,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_250
+              properties: &ref_260
                 name:
                   type: string
       responses:
@@ -26431,7 +27106,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: *ref_250
+              properties: *ref_260
       responses:
         '200':
           description: postgres replication slot deleted
@@ -26482,7 +27157,7 @@ paths:
           in: path
           required: true
           description: The name of the publication
-          schema: &ref_253
+          schema: &ref_263
             type: string
       responses:
         '200':
@@ -26491,18 +27166,18 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: &ref_254
+                properties: &ref_264
                   table_to_track:
                     type: array
                     items:
                       type: object
-                      properties: *ref_251
-                      required: *ref_252
+                      properties: *ref_261
+                      required: *ref_262
                   transaction_to_track:
                     type: array
                     items:
                       type: string
-                required: &ref_255
+                required: &ref_265
                   - transaction_to_track
   /w/{workspace}/postgres_triggers/publication/create/{publication}/{path}:
     post:
@@ -26523,7 +27198,7 @@ paths:
           in: path
           required: true
           description: The name of the publication
-          schema: *ref_253
+          schema: *ref_263
       requestBody:
         description: new publication for postgres
         required: true
@@ -26531,8 +27206,8 @@ paths:
           application/json:
             schema:
               type: object
-              properties: *ref_254
-              required: *ref_255
+              properties: *ref_264
+              required: *ref_265
       responses:
         '201':
           description: publication created
@@ -26559,7 +27234,7 @@ paths:
           in: path
           required: true
           description: The name of the publication
-          schema: *ref_253
+          schema: *ref_263
       requestBody:
         description: update publication for postgres
         required: true
@@ -26567,8 +27242,8 @@ paths:
           application/json:
             schema:
               type: object
-              properties: *ref_254
-              required: *ref_255
+              properties: *ref_264
+              required: *ref_265
       responses:
         '201':
           description: publication updated
@@ -26595,7 +27270,7 @@ paths:
           in: path
           required: true
           description: The name of the publication
-          schema: *ref_253
+          schema: *ref_263
       responses:
         '200':
           description: postgres publication deleted
@@ -26621,7 +27296,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_461
+              properties: &ref_479
                 replication_slot_name:
                   type: string
                   description: Name of the PostgreSQL logical replication slot to use
@@ -26646,7 +27321,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
                 postgres_resource_path:
                   type: string
                   description: >-
@@ -26657,8 +27332,8 @@ paths:
                     Configuration for creating/managing the publication (tables,
                     operations)
                   type: object
-                  properties: *ref_254
-                  required: *ref_255
+                  properties: *ref_264
+                  required: *ref_265
                 error_handler_path:
                   type: string
                   description: Path to a script or flow to run when the triggered job fails
@@ -26669,7 +27344,7 @@ paths:
                 retry:
                   description: Retry configuration for failed module executions
                   type: object
-                  properties: *ref_194
+                  properties: *ref_196
                 permissioned_as:
                   type: string
                   description: >-
@@ -26685,7 +27360,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_462
+              required: &ref_480
                 - path
                 - script_path
                 - is_flow
@@ -26720,7 +27395,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_463
+              properties: &ref_481
                 replication_slot_name:
                   type: string
                   description: Name of the PostgreSQL logical replication slot to use
@@ -26745,7 +27420,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
                 postgres_resource_path:
                   type: string
                   description: >-
@@ -26756,8 +27431,8 @@ paths:
                     Configuration for creating/managing the publication (tables,
                     operations)
                   type: object
-                  properties: *ref_254
-                  required: *ref_255
+                  properties: *ref_264
+                  required: *ref_265
                 error_handler_path:
                   type: string
                   description: Path to a script or flow to run when the triggered job fails
@@ -26768,7 +27443,7 @@ paths:
                 retry:
                   description: Retry configuration for failed module executions
                   type: object
-                  properties: *ref_194
+                  properties: *ref_196
                 permissioned_as:
                   type: string
                   description: >-
@@ -26784,7 +27459,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_464
+              required: &ref_482
                 - path
                 - script_path
                 - is_flow
@@ -26842,12 +27517,12 @@ paths:
           content:
             application/json:
               schema:
-                allOf: &ref_256
+                allOf: &ref_266
                   - type: object
-                    properties: *ref_211
-                    required: *ref_212
+                    properties: *ref_213
+                    required: *ref_214
                 type: object
-                properties: &ref_257
+                properties: &ref_267
                   postgres_resource_path:
                     type: string
                     description: >-
@@ -26885,8 +27560,8 @@ paths:
                   retry:
                     description: Retry configuration for failed module executions
                     type: object
-                    properties: *ref_194
-                required: &ref_258
+                    properties: *ref_196
+                required: &ref_268
                   - postgres_resource_path
                   - replication_slot_name
                   - publication_name
@@ -26936,10 +27611,10 @@ paths:
               schema:
                 type: array
                 items:
-                  allOf: *ref_256
+                  allOf: *ref_266
                   type: object
-                  properties: *ref_257
-                  required: *ref_258
+                  properties: *ref_267
+                  required: *ref_268
   /w/{workspace}/postgres_triggers/exists/{path}:
     get:
       summary: does postgres trigger exists
@@ -26988,7 +27663,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
               required:
                 - mode
       responses:
@@ -27046,7 +27721,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_473
+              properties: &ref_491
                 path:
                   type: string
                 script_path:
@@ -27066,11 +27741,11 @@ paths:
                 retry:
                   type: object
                   description: Retry configuration for failed module executions
-                  properties: *ref_194
+                  properties: *ref_196
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
                 permissioned_as:
                   type: string
                   description: >-
@@ -27086,7 +27761,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_474
+              required: &ref_492
                 - path
                 - script_path
                 - local_part
@@ -27120,7 +27795,7 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_475
+              properties: &ref_493
                 path:
                   type: string
                 script_path:
@@ -27140,7 +27815,7 @@ paths:
                 retry:
                   type: object
                   description: Retry configuration for failed module executions
-                  properties: *ref_194
+                  properties: *ref_196
                 permissioned_as:
                   type: string
                   description: >-
@@ -27156,7 +27831,7 @@ paths:
                   type: array
                   items:
                     type: string
-              required: &ref_476
+              required: &ref_494
                 - path
                 - script_path
                 - is_flow
@@ -27210,12 +27885,12 @@ paths:
           content:
             application/json:
               schema:
-                allOf: &ref_259
+                allOf: &ref_269
                   - type: object
-                    properties: *ref_211
-                    required: *ref_212
+                    properties: *ref_213
+                    required: *ref_214
                 type: object
-                properties: &ref_260
+                properties: &ref_270
                   local_part:
                     type: string
                   workspaced_local_part:
@@ -27229,8 +27904,8 @@ paths:
                   retry:
                     type: object
                     description: Retry configuration for failed module executions
-                    properties: *ref_194
-                required: &ref_261
+                    properties: *ref_196
+                required: &ref_271
                   - local_part
   /w/{workspace}/email_triggers/list:
     get:
@@ -27278,10 +27953,10 @@ paths:
               schema:
                 type: array
                 items:
-                  allOf: *ref_259
+                  allOf: *ref_269
                   type: object
-                  properties: *ref_260
-                  required: *ref_261
+                  properties: *ref_270
+                  required: *ref_271
   /w/{workspace}/email_triggers/exists/{path}:
     get:
       summary: does email trigger exists
@@ -27363,7 +28038,7 @@ paths:
                 mode:
                   description: job trigger mode
                   type: string
-                  enum: *ref_204
+                  enum: *ref_206
               required:
                 - mode
       responses:
@@ -27388,9 +28063,9 @@ paths:
                 type: array
                 items:
                   type: object
-                  required: &ref_477
+                  required: &ref_495
                     - name
-                  properties: &ref_478
+                  properties: &ref_496
                     name:
                       type: string
                     summary:
@@ -27420,9 +28095,9 @@ paths:
                 type: array
                 items:
                   type: object
-                  required: &ref_263
+                  required: &ref_273
                     - name
-                  properties: &ref_264
+                  properties: &ref_274
                     name:
                       type: string
                     summary:
@@ -27441,14 +28116,14 @@ paths:
                       type: array
                       items:
                         type: object
-                        properties: &ref_479
+                        properties: &ref_497
                           workspace_id:
                             type: string
                           workspace_name:
                             type: string
                           role:
                             type: string
-                        required: &ref_480
+                        required: &ref_498
                           - name
   /groups/get/{name}:
     get:
@@ -27460,7 +28135,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       responses:
         '200':
           description: instance group
@@ -27468,8 +28143,8 @@ paths:
             application/json:
               schema:
                 type: object
-                required: *ref_263
-                properties: *ref_264
+                required: *ref_273
+                properties: *ref_274
   /groups/create:
     post:
       summary: create instance group
@@ -27507,7 +28182,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       requestBody:
         description: update instance group
         required: true
@@ -27543,7 +28218,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       responses:
         '200':
           description: instance group deleted
@@ -27561,7 +28236,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       requestBody:
         description: user to add to instance group
         required: true
@@ -27591,7 +28266,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       requestBody:
         description: user to remove from instance group
         required: true
@@ -27626,7 +28301,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_265
+                  properties: &ref_275
                     name:
                       type: string
                     summary:
@@ -27647,7 +28322,7 @@ paths:
                       enum:
                         - superadmin
                         - devops
-                  required: &ref_266
+                  required: &ref_276
                     - name
   /groups/overwrite:
     post:
@@ -27664,8 +28339,8 @@ paths:
               type: array
               items:
                 type: object
-                properties: *ref_265
-                required: *ref_266
+                properties: *ref_275
+                required: *ref_276
       responses:
         '200':
           description: success message
@@ -27701,7 +28376,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_267
+                  properties: &ref_277
                     name:
                       type: string
                     summary:
@@ -27714,7 +28389,7 @@ paths:
                       type: object
                       additionalProperties:
                         type: boolean
-                  required: &ref_268
+                  required: &ref_278
                     - name
   /w/{workspace}/groups/listnames:
     get:
@@ -27787,7 +28462,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       requestBody:
         description: updated group
         required: true
@@ -27819,7 +28494,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       responses:
         '200':
           description: group deleted
@@ -27841,7 +28516,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       responses:
         '200':
           description: group
@@ -27849,8 +28524,8 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: *ref_267
-                required: *ref_268
+                properties: *ref_277
+                required: *ref_278
   /w/{workspace}/groups/adduser/{name}:
     post:
       summary: add user to group
@@ -27865,7 +28540,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       requestBody:
         description: added user to group
         required: true
@@ -27897,7 +28572,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       requestBody:
         description: added user to group
         required: true
@@ -27929,7 +28604,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
         - name: page
           description: which page to return (start at 1, default 1)
           in: query
@@ -27988,7 +28663,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_270
+                  properties: &ref_280
                     name:
                       type: string
                     owners:
@@ -28014,7 +28689,7 @@ paths:
                         (relative to the folder root) wins, and its
                         `permissioned_as` is used as the default.
                       type: array
-                      items: &ref_269
+                      items: &ref_279
                         type: object
                         required:
                           - path_glob
@@ -28035,7 +28710,7 @@ paths:
                               permissioned as. Must be `u/<username>`,
                               `g/<groupname>`, or an email that exists in this
                               workspace.
-                  required: &ref_271
+                  required: &ref_281
                     - name
                     - owners
                     - extra_perms
@@ -28102,7 +28777,7 @@ paths:
                     to the folder root) wins, and its `permissioned_as` is used
                     as the default.
                   type: array
-                  items: *ref_269
+                  items: *ref_279
               required:
                 - name
       responses:
@@ -28126,7 +28801,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       requestBody:
         description: update folder
         required: true
@@ -28152,7 +28827,7 @@ paths:
                     to the folder root) wins, and its `permissioned_as` is used
                     as the default.
                   type: array
-                  items: *ref_269
+                  items: *ref_279
       responses:
         '200':
           description: folder updated
@@ -28174,7 +28849,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       responses:
         '200':
           description: folder deleted
@@ -28196,7 +28871,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       responses:
         '200':
           description: folder
@@ -28204,8 +28879,8 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: *ref_270
-                required: *ref_271
+                properties: *ref_280
+                required: *ref_281
   /w/{workspace}/folders/exists/{name}:
     get:
       summary: exists folder
@@ -28220,7 +28895,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       responses:
         '200':
           description: folder exists
@@ -28242,7 +28917,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       responses:
         '200':
           description: folder
@@ -28284,7 +28959,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       requestBody:
         description: owner user to folder
         required: true
@@ -28318,7 +28993,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       requestBody:
         description: added owner to folder
         required: true
@@ -28354,7 +29029,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
         - name: page
           description: which page to return (start at 1, default 1)
           in: query
@@ -28418,7 +29093,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_481
+                  properties: &ref_499
                     worker:
                       type: string
                     worker_instance:
@@ -28464,7 +29139,7 @@ paths:
                       type: string
                     native_mode:
                       type: boolean
-                  required: &ref_482
+                  required: &ref_500
                     - worker
                     - worker_instance
                     - ping_at
@@ -28598,7 +29273,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       responses:
         '200':
           description: a config
@@ -28607,12 +29282,12 @@ paths:
               schema:
                 type: object
                 nullable: true
-                properties: &ref_373
+                properties: &ref_383
                   alerts:
                     type: array
                     items:
                       type: object
-                      properties: &ref_371
+                      properties: &ref_381
                         name:
                           type: string
                         tags_to_monitor:
@@ -28625,7 +29300,7 @@ paths:
                           type: integer
                         alert_time_threshold_seconds:
                           type: integer
-                      required: &ref_372
+                      required: &ref_382
                         - name
                         - tags_to_monitor
                         - jobs_num_threshold
@@ -28641,7 +29316,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       requestBody:
         description: worker group
         required: true
@@ -28664,7 +29339,7 @@ paths:
         - name: name
           in: path
           required: true
-          schema: *ref_262
+          schema: *ref_272
       responses:
         '200':
           description: Delete config
@@ -28687,12 +29362,12 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_527
+                  properties: &ref_543
                     name:
                       type: string
                     config:
                       type: object
-                  required: &ref_528
+                  required: &ref_544
                     - name
   /configs/list_autoscaling_events/{worker_group}:
     get:
@@ -28723,7 +29398,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_531
+                  properties: &ref_547
                     id:
                       type: integer
                       format: int64
@@ -29000,6 +29675,7 @@ paths:
               - postgres_trigger
               - mqtt_trigger
               - gcp_trigger
+              - azure_trigger
               - sqs_trigger
               - email_trigger
               - volume
@@ -29049,6 +29725,7 @@ paths:
               - postgres_trigger
               - mqtt_trigger
               - gcp_trigger
+              - azure_trigger
               - sqs_trigger
               - email_trigger
               - volume
@@ -29110,6 +29787,7 @@ paths:
               - postgres_trigger
               - mqtt_trigger
               - gcp_trigger
+              - azure_trigger
               - sqs_trigger
               - email_trigger
               - volume
@@ -29153,7 +29831,7 @@ paths:
               properties:
                 trigger_kind:
                   type: string
-                  enum: &ref_272
+                  enum: &ref_282
                     - webhook
                     - http
                     - websocket
@@ -29164,6 +29842,7 @@ paths:
                     - sqs
                     - mqtt
                     - gcp
+                    - azure
                     - email
                 path:
                   type: string
@@ -29198,7 +29877,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: *ref_272
+            enum: *ref_282
         - name: runnable_kind
           in: path
           required: true
@@ -29238,17 +29917,17 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_532
+                  properties: &ref_548
                     trigger_config: {}
                     trigger_kind:
                       type: string
-                      enum: *ref_272
+                      enum: *ref_282
                     error:
                       type: string
                     last_server_ping:
                       type: string
                       format: date-time
-                  required: &ref_533
+                  required: &ref_549
                     - trigger_kind
   /w/{workspace}/capture/list/{runnable_kind}/{path}:
     get:
@@ -29273,7 +29952,7 @@ paths:
           in: query
           schema:
             type: string
-            enum: *ref_272
+            enum: *ref_282
         - name: page
           description: which page to return (start at 1, default 1)
           in: query
@@ -29291,10 +29970,10 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_273
+                  properties: &ref_283
                     trigger_kind:
                       type: string
-                      enum: *ref_272
+                      enum: *ref_282
                     main_args: {}
                     preprocessor_args: {}
                     id:
@@ -29302,7 +29981,7 @@ paths:
                     created_at:
                       type: string
                       format: date-time
-                  required: &ref_274
+                  required: &ref_284
                     - trigger_kind
                     - main_args
                     - preprocessor_args
@@ -29367,8 +30046,8 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: *ref_273
-                required: *ref_274
+                properties: *ref_283
+                required: *ref_284
     delete:
       summary: delete a capture
       operationId: deleteCapture
@@ -29460,13 +30139,13 @@ paths:
           schema: *ref_4
         - name: runnable_id
           in: query
-          schema: &ref_275
+          schema: &ref_285
             type: string
         - name: runnable_type
           in: query
-          schema: &ref_276
+          schema: &ref_286
             type: string
-            enum: &ref_381
+            enum: &ref_391
               - ScriptHash
               - ScriptPath
               - FlowPath
@@ -29483,7 +30162,7 @@ paths:
             filter on jobs containing those args as a json subset (@> in
             postgres)
           in: query
-          schema: *ref_164
+          schema: *ref_166
         - name: include_preview
           in: query
           schema:
@@ -29497,7 +30176,7 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_277
+                  properties: &ref_287
                     id:
                       type: string
                     name:
@@ -29511,7 +30190,7 @@ paths:
                       type: boolean
                     success:
                       type: boolean
-                  required: &ref_278
+                  required: &ref_288
                     - id
                     - name
                     - args
@@ -29561,10 +30240,10 @@ paths:
           schema: *ref_4
         - name: runnable_id
           in: query
-          schema: *ref_275
+          schema: *ref_285
         - name: runnable_type
           in: query
-          schema: *ref_276
+          schema: *ref_286
         - name: page
           description: which page to return (start at 1, default 1)
           in: query
@@ -29582,8 +30261,8 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: *ref_277
-                  required: *ref_278
+                  properties: *ref_287
+                  required: *ref_288
   /w/{workspace}/inputs/create:
     post:
       summary: Create an Input for future use in a script or flow
@@ -29597,10 +30276,10 @@ paths:
           schema: *ref_4
         - name: runnable_id
           in: query
-          schema: *ref_275
+          schema: *ref_285
         - name: runnable_type
           in: query
-          schema: *ref_276
+          schema: *ref_286
       requestBody:
         description: Input
         required: true
@@ -29608,12 +30287,12 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_377
+              properties: &ref_387
                 name:
                   type: string
                 args:
                   type: object
-              required: &ref_378
+              required: &ref_388
                 - name
                 - args
                 - created_by
@@ -29643,14 +30322,14 @@ paths:
           application/json:
             schema:
               type: object
-              properties: &ref_379
+              properties: &ref_389
                 id:
                   type: string
                 name:
                   type: string
                 is_public:
                   type: boolean
-              required: &ref_380
+              required: &ref_390
                 - id
                 - name
                 - is_public
@@ -29676,7 +30355,7 @@ paths:
         - name: input
           in: path
           required: true
-          schema: &ref_301
+          schema: &ref_311
             type: string
       responses:
         '200':
@@ -29709,7 +30388,7 @@ paths:
               properties:
                 s3_resource:
                   type: object
-                  properties: &ref_279
+                  properties: &ref_289
                     bucket:
                       type: string
                     region:
@@ -29724,7 +30403,7 @@ paths:
                       type: string
                     pathStyle:
                       type: boolean
-                  required: &ref_280
+                  required: &ref_290
                     - bucket
                     - region
                     - endPoint
@@ -29802,8 +30481,8 @@ paths:
               properties:
                 s3_resource:
                   type: object
-                  properties: *ref_279
-                  required: *ref_280
+                  properties: *ref_289
+                  required: *ref_290
       responses:
         '200':
           description: Connection settings
@@ -29824,10 +30503,10 @@ paths:
                     type: boolean
                   client_kwargs:
                     type: object
-                    properties: &ref_281
+                    properties: &ref_291
                       region_name:
                         type: string
-                    required: &ref_282
+                    required: &ref_292
                       - region_name
                 required:
                   - endpoint_url
@@ -29882,8 +30561,8 @@ paths:
                         type: boolean
                       client_kwargs:
                         type: object
-                        properties: *ref_281
-                        required: *ref_282
+                        properties: *ref_291
+                        required: *ref_292
                     required:
                       - endpoint_url
                       - use_ssl
@@ -29941,8 +30620,8 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: *ref_279
-                required: *ref_280
+                properties: *ref_289
+                required: *ref_290
   /w/{workspace}/job_helpers/test_connection:
     get:
       summary: Test connection to the workspace object storage
@@ -30006,10 +30685,10 @@ paths:
                     type: array
                     items:
                       type: object
-                      properties: &ref_283
+                      properties: &ref_293
                         s3:
                           type: string
-                      required: &ref_284
+                      required: &ref_294
                         - s3
                   restricted_access:
                     type: boolean
@@ -30042,7 +30721,7 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: &ref_287
+                properties: &ref_297
                   mime_type:
                     type: string
                   size_in_bytes:
@@ -30106,7 +30785,7 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: &ref_285
+                properties: &ref_295
                   msg:
                     type: string
                   content:
@@ -30118,7 +30797,7 @@ paths:
                       - Csv
                       - Parquet
                       - Unknown
-                required: &ref_286
+                required: &ref_296
                   - content_type
   /w/{workspace}/job_helpers/list_git_repo_files:
     get:
@@ -30166,8 +30845,8 @@ paths:
                     type: array
                     items:
                       type: object
-                      properties: *ref_283
-                      required: *ref_284
+                      properties: *ref_293
+                      required: *ref_294
                   restricted_access:
                     type: boolean
                 required:
@@ -30226,8 +30905,8 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: *ref_285
-                required: *ref_286
+                properties: *ref_295
+                required: *ref_296
   /w/{workspace}/job_helpers/load_git_repo_file_metadata:
     get:
       summary: >-
@@ -30258,7 +30937,7 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: *ref_287
+                properties: *ref_297
   /w/{workspace}/job_helpers/check_s3_folder_exists:
     get:
       summary: Check if S3 path exists and is a folder
@@ -30700,7 +31379,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       requestBody:
         description: parameters for statistics retrieval
         required: true
@@ -30729,46 +31408,46 @@ paths:
                     type: array
                     items:
                       type: object
-                      properties: &ref_511
+                      properties: &ref_529
                         id:
                           type: string
                         name:
                           type: string
-                      required: &ref_512
+                      required: &ref_530
                         - id
                   scalar_metrics:
                     type: array
                     items:
                       type: object
-                      properties: &ref_513
+                      properties: &ref_531
                         metric_id:
                           type: string
                         value:
                           type: number
-                      required: &ref_514
+                      required: &ref_532
                         - id
                         - value
                   timeseries_metrics:
                     type: array
                     items:
                       type: object
-                      properties: &ref_515
+                      properties: &ref_533
                         metric_id:
                           type: string
                         values:
                           type: array
                           items:
                             type: object
-                            properties: &ref_517
+                            properties: &ref_535
                               timestamp:
                                 type: string
                                 format: date-time
                               value:
                                 type: number
-                            required: &ref_518
+                            required: &ref_536
                               - timestamp
                               - value
-                      required: &ref_516
+                      required: &ref_534
                         - id
                         - values
   /w/{workspace}/job_metrics/set_progress/{id}:
@@ -30785,7 +31464,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       requestBody:
         description: parameters for statistics retrieval
         required: true
@@ -30819,7 +31498,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       responses:
         '200':
           description: job progress between 0 and 99
@@ -30837,11 +31516,11 @@ paths:
         - name: before
           description: filter on started before (inclusive) timestamp
           in: query
-          schema: *ref_288
+          schema: *ref_298
         - name: after
           description: filter on created after (exclusive) timestamp
           in: query
-          schema: *ref_289
+          schema: *ref_299
         - name: with_error
           in: query
           required: false
@@ -30913,12 +31592,12 @@ paths:
                 type: array
                 items:
                   type: object
-                  properties: &ref_521
+                  properties: &ref_537
                     concurrency_key:
                       type: string
                     total_running:
                       type: number
-                  required: &ref_522
+                  required: &ref_538
                     - concurrency_key
                     - total_running
   /concurrency_groups/prune/{concurrency_id}:
@@ -30931,7 +31610,7 @@ paths:
         - name: concurrency_id
           in: path
           required: true
-          schema: &ref_303
+          schema: &ref_313
             type: string
       responses:
         '200':
@@ -30951,7 +31630,7 @@ paths:
         - name: id
           in: path
           required: true
-          schema: *ref_169
+          schema: *ref_171
       responses:
         '200':
           description: concurrency key for given job
@@ -30994,7 +31673,7 @@ paths:
             (e.g. 'deploy,release') and negation by prefixing all values with
             '!' (e.g. '!deploy,!release')
           in: query
-          schema: *ref_171
+          schema: *ref_173
         - name: parent_job
           description: >-
             The parent job that is at the origin and responsible for the
@@ -31007,84 +31686,84 @@ paths:
             (e.g. 'f/script1,f/script2') and negation by prefixing all values
             with '!' (e.g. '!f/script1,!f/script2')
           in: query
-          schema: *ref_154
+          schema: *ref_156
         - name: script_path_start
           description: >-
             filter by script path prefix. Supports comma-separated list (e.g.
             'f/folder1,f/folder2') and negation by prefixing all values with '!'
             (e.g. '!f/folder1,!f/folder2')
           in: query
-          schema: *ref_155
+          schema: *ref_157
         - name: schedule_path
           description: mask to filter by schedule path
           in: query
-          schema: *ref_156
+          schema: *ref_158
         - name: script_hash
           description: mask to filter exact matching path
           in: query
-          schema: *ref_157
+          schema: *ref_159
         - name: started_before
           description: filter on started before (inclusive) timestamp
           in: query
-          schema: *ref_158
+          schema: *ref_160
         - name: started_after
           description: filter on started after (exclusive) timestamp
           in: query
-          schema: *ref_159
+          schema: *ref_161
         - name: running
           description: filter on running jobs
           in: query
-          schema: *ref_160
+          schema: *ref_162
         - name: scheduled_for_before_now
           description: filter on jobs scheduled_for before now (hence waitinf for a worker)
           in: query
-          schema: *ref_161
+          schema: *ref_163
         - name: completed_before
           description: filter on started before (inclusive) timestamp
           in: query
-          schema: *ref_181
+          schema: *ref_183
         - name: completed_after
           description: filter on started after (exclusive) timestamp
           in: query
-          schema: *ref_182
+          schema: *ref_184
         - name: created_before_queue
           description: filter on jobs created before X for jobs in the queue only
           in: query
-          schema: *ref_183
+          schema: *ref_185
         - name: created_after_queue
           description: filter on jobs created after X for jobs in the queue only
           in: query
-          schema: *ref_184
+          schema: *ref_186
         - name: job_kinds
           description: >-
             filter by job kind. Supports comma-separated list of values
             ('preview', 'script', 'dependencies', 'flow') and negation by
             prefixing all values with '!' (e.g. '!preview,!dependencies')
           in: query
-          schema: *ref_162
+          schema: *ref_164
         - name: args
           description: >-
             filter on jobs containing those args as a json subset (@> in
             postgres)
           in: query
-          schema: *ref_164
+          schema: *ref_166
         - name: tag
           description: >-
             filter by tag/worker group. Supports comma-separated list (e.g.
             'gpu,highmem') and negation by prefixing all values with '!' (e.g.
             '!gpu,!highmem')
           in: query
-          schema: *ref_165
+          schema: *ref_167
         - name: result
           description: >-
             filter on jobs containing those result as a json subset (@> in
             postgres)
           in: query
-          schema: *ref_166
+          schema: *ref_168
         - name: allow_wildcards
           description: allow wildcards (*) in the filter of label, tag, worker
           in: query
-          schema: *ref_168
+          schema: *ref_170
         - name: page
           description: which page to return (start at 1, default 1)
           in: query
@@ -31100,7 +31779,7 @@ paths:
             (e.g. '!schedule,!webhook')
           in: query
           x-go-name: JobTriggerKindParam
-          schema: *ref_185
+          schema: *ref_187
         - name: is_skipped
           description: is the job skipped
           in: query
@@ -31140,17 +31819,17 @@ paths:
             application/json:
               schema:
                 type: object
-                properties: &ref_523
+                properties: &ref_539
                   jobs:
                     type: array
                     items:
-                      oneOf: *ref_190
-                      discriminator: *ref_191
+                      oneOf: *ref_192
+                      discriminator: *ref_193
                   obscured_jobs:
                     type: array
                     items:
                       type: object
-                      properties: &ref_382
+                      properties: &ref_392
                         typ:
                           type: string
                         started_at:
@@ -31163,7 +31842,7 @@ paths:
                       Obscured jobs omitted for security because of too specific
                       filtering
                     type: boolean
-                required: &ref_524
+                required: &ref_540
                   - jobs
                   - obscured_jobs
   /srch/w/{workspace}/index/search/job:
@@ -31207,7 +31886,7 @@ paths:
                     type: array
                     items:
                       type: object
-                      properties: &ref_529
+                      properties: &ref_545
                         dancer:
                           type: string
                   hit_count:
@@ -31286,7 +31965,7 @@ paths:
                     type: array
                     items:
                       type: object
-                      properties: &ref_530
+                      properties: &ref_546
                         dancer:
                           type: string
   /srch/index/search/count_service_logs:
@@ -31549,7 +32228,7 @@ paths:
                           type: string
                         kind:
                           type: string
-                          enum: *ref_290
+                          enum: *ref_300
                         usages:
                           type: array
                           items:
@@ -31562,13 +32241,13 @@ paths:
                                 type: string
                               kind:
                                 type: string
-                                enum: &ref_292
+                                enum: &ref_302
                                   - script
                                   - flow
                                   - job
                               access_type:
                                 type: string
-                                enum: &ref_291
+                                enum: &ref_301
                                   - r
                                   - w
                                   - rw
@@ -31578,7 +32257,7 @@ paths:
                                 description: The columns used (for tables)
                                 additionalProperties:
                                   type: string
-                                  enum: *ref_291
+                                  enum: *ref_301
                                   nullable: true
                               created_at:
                                 type: string
@@ -31651,7 +32330,7 @@ paths:
                         type: string
                       kind:
                         type: string
-                        enum: *ref_292
+                        enum: *ref_302
       responses:
         '200':
           description: all assets used by the given usage paths, in the same order
@@ -31671,10 +32350,10 @@ paths:
                         type: string
                       kind:
                         type: string
-                        enum: *ref_290
+                        enum: *ref_300
                       access_type:
                         type: string
-                        enum: *ref_291
+                        enum: *ref_301
                         nullable: true
   /w/{workspace}/assets/list_favorites:
     get:
@@ -31722,13 +32401,13 @@ paths:
                 type: array
                 items:
                   type: object
-                  required: &ref_543
+                  required: &ref_559
                     - name
                     - size_bytes
                     - file_count
                     - created_at
                     - created_by
-                  properties: &ref_544
+                  properties: &ref_560
                     name:
                       type: string
                     size_bytes:
@@ -31843,13 +32522,13 @@ paths:
                 type: array
                 items:
                   type: object
-                  required: &ref_365
+                  required: &ref_375
                     - name
                     - description
                     - instructions
                     - path
                     - method
-                  properties: &ref_366
+                  properties: &ref_376
                     name:
                       type: string
                       description: The tool name/operation ID
@@ -31986,7 +32665,7 @@ components:
       name: id
       in: path
       required: true
-      schema: *ref_293
+      schema: *ref_303
     Key:
       name: key
       in: path
@@ -32002,7 +32681,7 @@ components:
       in: path
       required: true
       description: The name of the publication
-      schema: *ref_253
+      schema: *ref_263
     VersionId:
       name: version
       in: path
@@ -32013,7 +32692,7 @@ components:
       name: token
       in: path
       required: true
-      schema: *ref_294
+      schema: *ref_304
     AccountId:
       name: id
       in: path
@@ -32038,7 +32717,7 @@ components:
       name: id
       in: path
       required: true
-      schema: *ref_169
+      schema: *ref_171
     Path:
       name: path
       in: path
@@ -32058,12 +32737,12 @@ components:
       name: version
       in: path
       required: true
-      schema: *ref_295
+      schema: *ref_305
     Name:
       name: name
       in: path
       required: true
-      schema: *ref_262
+      schema: *ref_272
     Page:
       name: page
       description: which page to return (start at 1, default 1)
@@ -32082,7 +32761,7 @@ components:
         '!schedule,!webhook')
       in: query
       x-go-name: JobTriggerKindParam
-      schema: *ref_185
+      schema: *ref_187
     OrderDesc:
       name: order_desc
       description: order by desc order (default true)
@@ -32103,7 +32782,7 @@ components:
         'deploy,release') and negation by prefixing all values with '!' (e.g.
         '!deploy,!release')
       in: query
-      schema: *ref_171
+      schema: *ref_173
     Worker:
       name: worker
       description: >-
@@ -32111,7 +32790,7 @@ components:
         'worker-1,worker-2') and negation by prefixing all values with '!' (e.g.
         '!worker-1,!worker-2')
       in: query
-      schema: *ref_153
+      schema: *ref_155
     ParentJob:
       name: parent_job
       description: >-
@@ -32177,12 +32856,12 @@ components:
         'f/folder1,f/folder2') and negation by prefixing all values with '!'
         (e.g. '!f/folder1,!f/folder2')
       in: query
-      schema: *ref_155
+      schema: *ref_157
     SchedulePath:
       name: schedule_path
       description: mask to filter by schedule path
       in: query
-      schema: *ref_156
+      schema: *ref_158
     TriggerPath:
       name: trigger_path
       description: >-
@@ -32190,7 +32869,7 @@ components:
         'f/trigger1,f/trigger2') and negation by prefixing all values with '!'
         (e.g. '!f/trigger1,!f/trigger2')
       in: query
-      schema: *ref_296
+      schema: *ref_306
     ScriptExactPath:
       name: script_path_exact
       description: >-
@@ -32198,87 +32877,87 @@ components:
         (e.g. 'f/script1,f/script2') and negation by prefixing all values with
         '!' (e.g. '!f/script1,!f/script2')
       in: query
-      schema: *ref_154
+      schema: *ref_156
     ScriptExactHash:
       name: script_hash
       description: mask to filter exact matching path
       in: query
-      schema: *ref_157
+      schema: *ref_159
     CreatedBefore:
       name: created_before
       description: filter on created before (inclusive) timestamp
       in: query
-      schema: *ref_179
+      schema: *ref_181
     CreatedAfter:
       name: created_after
       description: filter on created after (exclusive) timestamp
       in: query
-      schema: *ref_180
+      schema: *ref_182
     StartedBefore:
       name: started_before
       description: filter on started before (inclusive) timestamp
       in: query
-      schema: *ref_158
+      schema: *ref_160
     StartedAfter:
       name: started_after
       description: filter on started after (exclusive) timestamp
       in: query
-      schema: *ref_159
+      schema: *ref_161
     Before:
       name: before
       description: filter on started before (inclusive) timestamp
       in: query
-      schema: *ref_288
+      schema: *ref_298
     CompletedBefore:
       name: completed_before
       description: filter on started before (inclusive) timestamp
       in: query
-      schema: *ref_181
+      schema: *ref_183
     CompletedAfter:
       name: completed_after
       description: filter on started after (exclusive) timestamp
       in: query
-      schema: *ref_182
+      schema: *ref_184
     CreatedAfterQueue:
       name: created_after_queue
       description: filter on jobs created after X for jobs in the queue only
       in: query
-      schema: *ref_184
+      schema: *ref_186
     CreatedBeforeQueue:
       name: created_before_queue
       description: filter on jobs created before X for jobs in the queue only
       in: query
-      schema: *ref_183
+      schema: *ref_185
     Success:
       name: success
       description: filter on successful jobs
       in: query
-      schema: *ref_167
+      schema: *ref_169
     ScheduledForBeforeNow:
       name: scheduled_for_before_now
       description: filter on jobs scheduled_for before now (hence waitinf for a worker)
       in: query
-      schema: *ref_161
+      schema: *ref_163
     Suspended:
       name: suspended
       description: filter on suspended jobs
       in: query
-      schema: *ref_163
+      schema: *ref_165
     Running:
       name: running
       description: filter on running jobs
       in: query
-      schema: *ref_160
+      schema: *ref_162
     AllowWildcards:
       name: allow_wildcards
       description: allow wildcards (*) in the filter of label, tag, worker
       in: query
-      schema: *ref_168
+      schema: *ref_170
     ArgsFilter:
       name: args
       description: filter on jobs containing those args as a json subset (@> in postgres)
       in: query
-      schema: *ref_164
+      schema: *ref_166
     Tag:
       name: tag
       description: >-
@@ -32286,37 +32965,37 @@ components:
         'gpu,highmem') and negation by prefixing all values with '!' (e.g.
         '!gpu,!highmem')
       in: query
-      schema: *ref_165
+      schema: *ref_167
     ResultFilter:
       name: result
       description: filter on jobs containing those result as a json subset (@> in postgres)
       in: query
-      schema: *ref_166
+      schema: *ref_168
     After:
       name: after
       description: filter on created after (exclusive) timestamp
       in: query
-      schema: *ref_289
+      schema: *ref_299
     Username:
       name: username
       description: filter on exact username of user
       in: query
-      schema: *ref_297
+      schema: *ref_307
     Operation:
       name: operation
       description: filter on exact or prefix name of operation
       in: query
-      schema: *ref_298
+      schema: *ref_308
     ResourceName:
       name: resource
       description: filter on exact or prefix name of resource
       in: query
-      schema: *ref_299
+      schema: *ref_309
     ActionKind:
       name: action_kind
       description: filter on type of operation
       in: query
-      schema: *ref_300
+      schema: *ref_310
     JobKinds:
       name: job_kinds
       description: >-
@@ -32324,29 +33003,29 @@ components:
         'script', 'dependencies', 'flow') and negation by prefixing all values
         with '!' (e.g. '!preview,!dependencies')
       in: query
-      schema: *ref_162
+      schema: *ref_164
     RunnableId:
       name: runnable_id
       in: query
-      schema: *ref_275
+      schema: *ref_285
     RunnableTypeQuery:
       name: runnable_type
       in: query
-      schema: *ref_276
+      schema: *ref_286
     InputId:
       name: input
       in: path
       required: true
-      schema: *ref_301
+      schema: *ref_311
     GetStarted:
       name: get_started
       in: query
-      schema: *ref_302
+      schema: *ref_312
     ConcurrencyId:
       name: concurrency_id
       in: path
       required: true
-      schema: *ref_303
+      schema: *ref_313
     RunnableKind:
       name: runnable_kind
       in: path
@@ -32365,12 +33044,12 @@ components:
       description: >-
         The flow structure containing modules and optional preprocessor/failure
         handlers
-      properties: *ref_151
-      required: *ref_152
+      properties: *ref_149
+      required: *ref_150
     Retry:
       type: object
       description: Retry configuration for failed module executions
-      properties: *ref_194
+      properties: *ref_196
     StopAfterIf:
       type: object
       description: Early termination condition for a module
@@ -32513,7 +33192,7 @@ components:
         retry:
           description: Retry configuration for failed module executions
           type: object
-          properties: *ref_304
+          properties: *ref_314
         debouncing:
           description: Debounce configuration for this step (EE only)
           type: object
@@ -32604,7 +33283,7 @@ components:
         kind:
           type: string
           description: Supported AI provider types
-          enum: *ref_305
+          enum: *ref_315
         resource:
           type: string
           description: >-
@@ -32624,16 +33303,16 @@ components:
       oneOf:
         - type: object
           description: No conversation memory/context
-          properties: *ref_306
-          required: *ref_307
+          properties: *ref_316
+          required: *ref_317
         - type: object
           description: Automatic context management
-          properties: *ref_308
-          required: *ref_309
+          properties: *ref_318
+          required: *ref_319
         - type: object
           description: Explicit message history
-          properties: *ref_310
-          required: *ref_311
+          properties: *ref_320
+          required: *ref_321
       discriminator:
         propertyName: kind
         mapping:
@@ -32650,62 +33329,62 @@ components:
             Inline script with code defined directly in the flow. Use 'bun' as
             default language if unspecified. The script receives arguments from
             input_transforms
-          properties: *ref_312
-          required: *ref_313
+          properties: *ref_322
+          required: *ref_323
         - type: object
           description: >-
             Reference to an existing script by path. Use this when calling a
             previously saved script instead of writing inline code
-          properties: *ref_314
-          required: *ref_315
+          properties: *ref_324
+          required: *ref_325
         - type: object
           description: >-
             Reference to an existing flow by path. Use this to call another flow
             as a subflow
-          properties: *ref_316
-          required: *ref_317
+          properties: *ref_326
+          required: *ref_327
         - type: object
           description: >-
             Executes nested modules in a loop over an iterator. Inside the loop,
             use 'flow_input.iter.value' to access the current iteration value,
             and 'flow_input.iter.index' for the index. Supports parallel
             execution for better performance on I/O-bound operations
-          properties: *ref_318
-          required: *ref_319
+          properties: *ref_328
+          required: *ref_329
         - type: object
           description: >-
             Executes nested modules repeatedly while a condition is true. The
             loop checks the condition after each iteration. Use stop_after_if on
             modules to control loop termination
-          properties: *ref_320
-          required: *ref_321
+          properties: *ref_330
+          required: *ref_331
         - type: object
           description: >-
             Conditional branching where only the first matching branch executes.
             Branches are evaluated in order, and the first one with a true
             expression runs. If no branches match, the default branch executes
-          properties: *ref_322
-          required: *ref_323
+          properties: *ref_332
+          required: *ref_333
         - type: object
           description: >-
             Parallel branching where all branches execute simultaneously. Unlike
             BranchOne, all branches run regardless of conditions. Useful for
             executing independent tasks concurrently
-          properties: *ref_324
-          required: *ref_325
+          properties: *ref_334
+          required: *ref_335
         - type: object
           description: >-
             Pass-through module that returns its input unchanged. Useful for
             flow structure or as a placeholder
-          properties: *ref_326
-          required: *ref_327
+          properties: *ref_336
+          required: *ref_337
         - type: object
           description: >-
             AI agent step that can use tools to accomplish tasks. The agent
             receives inputs and can call any of its configured tools to complete
             the task
-          properties: *ref_328
-          required: *ref_329
+          properties: *ref_338
+          required: *ref_339
       discriminator:
         propertyName: type
         mapping:
@@ -33111,8 +33790,8 @@ components:
               description: >-
                 Provider configuration - can be static (ProviderConfig),
                 JavaScript expression, or AI-determined
-              oneOf: *ref_330
-              discriminator: *ref_331
+              oneOf: *ref_340
+              discriminator: *ref_341
             output_type:
               allOf:
                 - description: >-
@@ -33165,8 +33844,8 @@ components:
               description: >-
                 Memory configuration - can be static (MemoryConfig), JavaScript
                 expression, or AI-determined
-              oneOf: *ref_332
-              discriminator: *ref_333
+              oneOf: *ref_342
+              discriminator: *ref_343
             output_schema:
               allOf:
                 - description: >-
@@ -33242,8 +33921,8 @@ components:
             description: >-
               A tool available to an AI agent. Can be a flow module or an
               external MCP (Model Context Protocol) tool
-            properties: *ref_334
-            required: *ref_335
+            properties: *ref_344
+            required: *ref_345
         type:
           type: string
           enum:
@@ -33272,8 +33951,8 @@ components:
         - type
     FlowStatus:
       type: object
-      properties: *ref_172
-      required: *ref_173
+      properties: *ref_174
+      required: *ref_175
     FlowStatusModule:
       type: object
       properties:
@@ -33510,75 +34189,75 @@ components:
     HealthChecks:
       type: object
       description: Detailed health checks
-      required: *ref_336
-      properties: *ref_337
+      required: *ref_346
+      properties: *ref_347
     DatabaseHealth:
       type: object
       description: Database health status
-      required: *ref_338
-      properties: *ref_339
+      required: *ref_348
+      properties: *ref_349
     PoolStats:
       type: object
       description: Database connection pool statistics
-      required: *ref_340
-      properties: *ref_341
+      required: *ref_350
+      properties: *ref_351
     WorkersHealth:
       type: object
       description: Workers health status
-      required: *ref_342
-      properties: *ref_343
+      required: *ref_352
+      properties: *ref_353
     QueueHealth:
       type: object
       description: Job queue status
-      required: *ref_344
-      properties: *ref_345
+      required: *ref_354
+      properties: *ref_355
     ReadinessHealth:
       type: object
       description: Server readiness status
-      required: *ref_346
-      properties: *ref_347
+      required: *ref_356
+      properties: *ref_357
     AutoInviteConfig:
       type: object
       description: Configuration for auto-inviting users to the workspace
-      properties: *ref_348
+      properties: *ref_358
     ErrorHandlerConfig:
       type: object
       description: Configuration for the workspace error handler
-      properties: *ref_349
+      properties: *ref_359
     SuccessHandlerConfig:
       type: object
       description: Configuration for the workspace success handler
-      properties: *ref_350
+      properties: *ref_360
     EditErrorHandler:
       description: >-
         Request body for editing the workspace error handler. Accepts both new
         grouped format and legacy flat format for backward compatibility.
-      oneOf: *ref_351
+      oneOf: *ref_361
     EditErrorHandlerNew:
       type: object
       description: New grouped format for editing error handler
-      properties: *ref_352
+      properties: *ref_362
     EditErrorHandlerLegacy:
       type: object
       description: >-
         Legacy flat format for editing error handler (deprecated, use new
         format)
-      properties: *ref_353
+      properties: *ref_363
     EditSuccessHandler:
       description: >-
         Request body for editing the workspace success handler. Accepts both new
         grouped format and legacy flat format for backward compatibility.
-      oneOf: *ref_354
+      oneOf: *ref_364
     EditSuccessHandlerNew:
       type: object
       description: New grouped format for editing success handler
-      properties: *ref_355
+      properties: *ref_365
     EditSuccessHandlerLegacy:
       type: object
       description: >-
         Legacy flat format for editing success handler (deprecated, use new
         format)
-      properties: *ref_356
+      properties: *ref_366
     VaultSettings:
       type: object
       required: *ref_27
@@ -33593,28 +34272,28 @@ components:
       properties: *ref_34
     SecretMigrationFailure:
       type: object
-      required: *ref_357
-      properties: *ref_358
+      required: *ref_367
+      properties: *ref_368
     SecretMigrationReport:
       type: object
       required: *ref_29
       properties: *ref_30
     JwksResponse:
       type: object
-      required: *ref_359
-      properties: *ref_360
+      required: *ref_369
+      properties: *ref_370
     FlowConversation:
       type: object
-      required: *ref_361
-      properties: *ref_362
+      required: *ref_371
+      properties: *ref_372
     FlowConversationMessage:
       type: object
-      required: *ref_363
-      properties: *ref_364
+      required: *ref_373
+      properties: *ref_374
     EndpointTool:
       type: object
-      required: *ref_365
-      properties: *ref_366
+      required: *ref_375
+      properties: *ref_376
     AIProvider:
       type: string
       enum: *ref_47
@@ -33627,35 +34306,35 @@ components:
       required: *ref_44
     AIProviderConfig:
       type: object
-      properties: *ref_367
-      required: *ref_368
+      properties: *ref_377
+      required: *ref_378
     AIConfig:
       type: object
       properties: *ref_46
     InstanceAIProviderSummary:
       type: object
-      properties: *ref_369
-      required: *ref_370
+      properties: *ref_379
+      required: *ref_380
     InstanceAISummary:
       type: object
       properties: *ref_48
       required: *ref_49
     Alert:
       type: object
-      properties: *ref_371
-      required: *ref_372
+      properties: *ref_381
+      required: *ref_382
     Configs:
       type: object
       nullable: true
-      properties: *ref_373
+      properties: *ref_383
     WorkspaceDependencies:
       type: object
       properties: *ref_97
       required: *ref_98
     NewWorkspaceDependencies:
       type: object
-      properties: *ref_374
-      required: *ref_375
+      properties: *ref_384
+      required: *ref_385
     Script:
       type: object
       properties: *ref_99
@@ -33665,7 +34344,7 @@ components:
       properties: *ref_104
       required: *ref_105
     NewScriptWithDraft:
-      allOf: *ref_376
+      allOf: *ref_386
     ScriptHistory:
       type: object
       properties: *ref_106
@@ -33676,65 +34355,65 @@ components:
       additionalProperties: true
     Input:
       type: object
-      properties: *ref_277
-      required: *ref_278
+      properties: *ref_287
+      required: *ref_288
     CreateInput:
       type: object
-      properties: *ref_377
-      required: *ref_378
+      properties: *ref_387
+      required: *ref_388
     UpdateInput:
       type: object
-      properties: *ref_379
-      required: *ref_380
+      properties: *ref_389
+      required: *ref_390
     RunnableType:
       type: string
-      enum: *ref_381
+      enum: *ref_391
     QueuedJob:
+      type: object
+      properties: *ref_190
+      required: *ref_191
+    CompletedJob:
       type: object
       properties: *ref_188
       required: *ref_189
-    CompletedJob:
-      type: object
-      properties: *ref_186
-      required: *ref_187
     ExportableCompletedJob:
       type: object
       description: Completed job with full data for export/import operations
-      properties: *ref_175
-      required: *ref_176
+      properties: *ref_177
+      required: *ref_178
     ExportableQueuedJob:
       type: object
       description: Queued job with full data for export/import operations
-      properties: *ref_177
-      required: *ref_178
+      properties: *ref_179
+      required: *ref_180
     ObscuredJob:
       type: object
-      properties: *ref_382
+      properties: *ref_392
     Job:
-      oneOf: *ref_190
-      discriminator: *ref_191
+      oneOf: *ref_192
+      discriminator: *ref_193
     User:
       type: object
       properties: *ref_35
       required: *ref_36
     UserSource:
       type: object
-      properties: *ref_383
-      required: *ref_384
+      properties: *ref_393
+      required: *ref_394
     UserUsage:
       type: object
-      properties: *ref_385
+      properties: *ref_395
     Login:
       type: object
-      properties: *ref_386
-      required: *ref_387
+      properties: *ref_396
+      required: *ref_397
     PasswordResetResponse:
       type: object
       properties: *ref_7
       required: *ref_8
     EditWorkspaceUser:
       type: object
-      properties: *ref_388
+      properties: *ref_398
     OffboardAffectedPaths:
       type: object
       properties: *ref_11
@@ -33744,64 +34423,64 @@ components:
       required: *ref_13
     OffboardTokenInfo:
       type: object
-      properties: *ref_389
-      required: *ref_390
+      properties: *ref_399
+      required: *ref_400
     OffboardRequest:
       type: object
-      properties: *ref_391
-      required: *ref_392
+      properties: *ref_401
+      required: *ref_402
     OffboardResponse:
       type: object
       properties: *ref_14
     OffboardSummary:
       type: object
-      properties: *ref_393
-      required: *ref_394
+      properties: *ref_403
+      required: *ref_404
     GlobalOffboardPreview:
       type: object
-      properties: *ref_395
-      required: *ref_396
+      properties: *ref_405
+      required: *ref_406
     WorkspaceOffboardPreview:
       type: object
-      properties: *ref_397
-      required: *ref_398
+      properties: *ref_407
+      required: *ref_408
     GlobalOffboardRequest:
       type: object
-      properties: *ref_399
+      properties: *ref_409
     WorkspaceReassignment:
       type: object
-      properties: *ref_400
-      required: *ref_401
+      properties: *ref_410
+      required: *ref_411
     TruncatedToken:
       type: object
       properties: *ref_102
       required: *ref_103
     ExternalJwtToken:
       type: object
-      properties: *ref_402
-      required: *ref_403
+      properties: *ref_412
+      required: *ref_413
     NewToken:
       type: object
-      properties: *ref_404
+      properties: *ref_414
     NewTokenImpersonate:
       type: object
-      properties: *ref_405
-      required: *ref_406
+      properties: *ref_415
+      required: *ref_416
     ListableVariable:
       type: object
       properties: *ref_61
       required: *ref_62
     ContextualVariable:
       type: object
-      properties: *ref_407
-      required: *ref_408
+      properties: *ref_417
+      required: *ref_418
     CreateVariable:
       type: object
-      properties: *ref_409
-      required: *ref_410
+      properties: *ref_419
+      required: *ref_420
     EditVariable:
       type: object
-      properties: *ref_411
+      properties: *ref_421
     AuditLog:
       type: object
       properties: *ref_5
@@ -33950,51 +34629,51 @@ components:
       required: *ref_142
     PreviewInline:
       type: object
-      properties: *ref_412
-      required: *ref_413
+      properties: *ref_422
+      required: *ref_423
     InlineScriptArgs:
       type: object
       properties: *ref_140
     WorkflowTask:
       type: object
-      properties: *ref_414
-      required: *ref_415
+      properties: *ref_424
+      required: *ref_425
     WorkflowStatusRecord:
       type: object
       additionalProperties:
         type: object
-        properties: *ref_174
+        properties: *ref_176
     WorkflowStatus:
       type: object
-      properties: *ref_174
+      properties: *ref_176
     CreateResource:
       type: object
-      properties: *ref_416
-      required: *ref_417
+      properties: *ref_426
+      required: *ref_427
     EditResource:
       type: object
-      properties: *ref_418
+      properties: *ref_428
     Resource:
       type: object
-      properties: *ref_419
-      required: *ref_420
+      properties: *ref_429
+      required: *ref_430
     ListableResource:
       type: object
-      properties: *ref_421
-      required: *ref_422
+      properties: *ref_431
+      required: *ref_432
     ResourceType:
       type: object
       properties: *ref_77
       required: *ref_78
     EditResourceType:
       type: object
-      properties: *ref_423
+      properties: *ref_433
     Schedule:
       type: object
-      properties: *ref_195
-      required: *ref_196
+      properties: *ref_197
+      required: *ref_198
     ScheduleWJobs:
-      allOf: *ref_424
+      allOf: *ref_434
     ErrorHandler:
       type: string
       enum:
@@ -34004,121 +34683,121 @@ components:
         - email
     NewSchedule:
       type: object
-      properties: *ref_425
-      required: *ref_426
+      properties: *ref_435
+      required: *ref_436
     EditSchedule:
       type: object
-      properties: *ref_427
-      required: *ref_428
+      properties: *ref_437
+      required: *ref_438
     JobTriggerKind:
       description: job trigger kind (schedule, http, websocket...)
       type: string
-      enum: *ref_170
+      enum: *ref_172
     TriggerMode:
       description: job trigger mode
       type: string
-      enum: *ref_204
+      enum: *ref_206
     TriggerExtraProperty:
       type: object
-      properties: *ref_211
-      required: *ref_212
+      properties: *ref_213
+      required: *ref_214
     AuthenticationMethod:
       type: string
-      enum: *ref_203
+      enum: *ref_205
     RunnableKind:
       type: string
-      enum: *ref_197
+      enum: *ref_199
     OpenapiSpecFormat:
       type: string
-      enum: *ref_429
+      enum: *ref_439
     OpenapiHttpRouteFilters:
       type: object
-      properties: *ref_430
-      required: *ref_431
+      properties: *ref_440
+      required: *ref_441
     WebhookFilters:
       type: object
-      properties: *ref_432
-      required: *ref_433
+      properties: *ref_442
+      required: *ref_443
     OpenapiV3Info:
       type: object
-      properties: *ref_434
-      required: *ref_435
+      properties: *ref_444
+      required: *ref_445
     GenerateOpenapiSpec:
       type: object
-      properties: *ref_198
+      properties: *ref_200
     HttpMethod:
       type: string
-      enum: *ref_201
+      enum: *ref_203
     HttpRequestType:
       type: string
-      enum: *ref_202
+      enum: *ref_204
     HttpTrigger:
-      allOf: *ref_205
+      allOf: *ref_207
       type: object
-      properties: *ref_206
-      required: *ref_207
+      properties: *ref_208
+      required: *ref_209
     NewHttpTrigger:
       type: object
-      properties: *ref_199
-      required: *ref_200
+      properties: *ref_201
+      required: *ref_202
     EditHttpTrigger:
       type: object
-      properties: *ref_436
-      required: *ref_437
+      properties: *ref_446
+      required: *ref_447
     TriggersCount:
       type: object
       properties: *ref_125
     WebsocketHeartbeat:
       type: object
-      properties: *ref_209
-      required: *ref_210
+      properties: *ref_211
+      required: *ref_212
     WebsocketTrigger:
-      allOf: *ref_213
+      allOf: *ref_215
       type: object
-      properties: *ref_214
-      required: *ref_215
+      properties: *ref_216
+      required: *ref_217
     NewWebsocketTrigger:
       type: object
-      properties: *ref_438
-      required: *ref_439
+      properties: *ref_448
+      required: *ref_449
     EditWebsocketTrigger:
       type: object
-      properties: *ref_440
-      required: *ref_441
+      properties: *ref_450
+      required: *ref_451
     WebsocketTriggerInitialMessage:
-      anyOf: *ref_208
+      anyOf: *ref_210
     MqttQoS:
       type: string
-      enum: *ref_442
+      enum: *ref_452
     MqttV3Config:
       type: object
-      properties: *ref_235
+      properties: *ref_237
     MqttV5Config:
       type: object
-      properties: *ref_236
+      properties: *ref_238
     MqttSubscribeTopic:
       type: object
-      properties: *ref_233
-      required: *ref_234
+      properties: *ref_235
+      required: *ref_236
     MqttClientVersion:
       type: string
-      enum: *ref_237
+      enum: *ref_239
     MqttTrigger:
-      allOf: *ref_238
+      allOf: *ref_240
       type: object
-      properties: *ref_239
-      required: *ref_240
+      properties: *ref_241
+      required: *ref_242
     NewMqttTrigger:
       type: object
-      properties: *ref_443
-      required: *ref_444
+      properties: *ref_453
+      required: *ref_454
     EditMqttTrigger:
       type: object
-      properties: *ref_445
-      required: *ref_446
+      properties: *ref_455
+      required: *ref_456
     DeliveryType:
       type: string
-      enum: *ref_243
+      enum: *ref_245
       description: >-
         Delivery mode for messages. 'push' for HTTP push delivery where messages
         are sent to a webhook endpoint, 'pull' for polling where the trigger
@@ -34126,19 +34805,19 @@ components:
     PushConfig:
       type: object
       description: Configuration for push delivery mode.
-      properties: *ref_244
-      required: *ref_245
+      properties: *ref_246
+      required: *ref_247
     GcpTrigger:
-      allOf: *ref_247
+      allOf: *ref_249
       type: object
       description: >-
         A Google Cloud Pub/Sub trigger that executes a script or flow when
         messages are received.
-      properties: *ref_248
-      required: *ref_249
+      properties: *ref_250
+      required: *ref_251
     SubscriptionMode:
       type: string
-      enum: *ref_246
+      enum: *ref_248
       description: >-
         The mode of subscription. 'existing' means using an existing GCP
         subscription, while 'create_update' involves creating or updating a new
@@ -34146,30 +34825,68 @@ components:
     GcpTriggerData:
       type: object
       description: Data for creating or updating a Google Cloud Pub/Sub trigger.
-      properties: *ref_241
-      required: *ref_242
+      properties: *ref_243
+      required: *ref_244
     GetAllTopicSubscription:
       type: object
-      properties: *ref_447
-      required: *ref_448
+      properties: *ref_457
+      required: *ref_458
     DeleteGcpSubscription:
       type: object
-      properties: *ref_449
-      required: *ref_450
+      properties: *ref_459
+      required: *ref_460
+    AzureMode:
+      type: string
+      enum: *ref_254
+      description: Azure Event Grid trigger mode.
+    AzureArmResource:
+      type: object
+      description: An ARM resource the service principal can see.
+      properties: *ref_258
+      required: *ref_259
+    AzureDeleteSubscription:
+      type: object
+      properties: *ref_461
+      required: *ref_462
+    AzureTrigger:
+      allOf: *ref_255
+      type: object
+      description: >-
+        An Azure Event Grid trigger that executes a script or flow when events
+        arrive.
+      properties: *ref_256
+      required: *ref_257
+    AzureTriggerData:
+      type: object
+      description: Data for creating or updating an Azure Event Grid trigger.
+      properties: *ref_252
+      required: *ref_253
+    TestAzureConnection:
+      type: object
+      properties: *ref_463
+      required: *ref_464
+    AzureListTopics:
+      type: object
+      properties: *ref_465
+      required: *ref_466
+    AzureListSubscriptions:
+      type: object
+      properties: *ref_467
+      required: *ref_468
     AwsAuthResourceType:
       type: string
-      enum: *ref_222
+      enum: *ref_224
     SqsTrigger:
-      allOf: *ref_223
+      allOf: *ref_225
       type: object
-      properties: *ref_224
-      required: *ref_225
+      properties: *ref_226
+      required: *ref_227
     LoggedWizardStatus:
       type: string
       enum: *ref_21
     CustomInstanceDbLogs:
       type: object
-      properties: *ref_451
+      properties: *ref_469
     CustomInstanceDbTag:
       type: string
       enum: *ref_22
@@ -34179,108 +34896,108 @@ components:
       properties: *ref_24
     NewSqsTrigger:
       type: object
-      properties: *ref_452
-      required: *ref_453
+      properties: *ref_470
+      required: *ref_471
     EditSqsTrigger:
       type: object
-      properties: *ref_454
-      required: *ref_455
+      properties: *ref_472
+      required: *ref_473
     Slot:
       type: object
-      properties: *ref_250
+      properties: *ref_260
     SlotList:
       type: object
-      properties: *ref_456
+      properties: *ref_474
     PublicationData:
       type: object
-      properties: *ref_254
-      required: *ref_255
+      properties: *ref_264
+      required: *ref_265
     TableToTrack:
       type: array
-      items: *ref_457
+      items: *ref_475
     Relations:
       type: object
-      properties: *ref_251
-      required: *ref_252
+      properties: *ref_261
+      required: *ref_262
     Language:
       type: string
-      enum: *ref_458
+      enum: *ref_476
     TemplateScript:
       type: object
-      properties: *ref_459
-      required: *ref_460
+      properties: *ref_477
+      required: *ref_478
     PostgresTrigger:
-      allOf: *ref_256
-      type: object
-      properties: *ref_257
-      required: *ref_258
-    NewPostgresTrigger:
-      type: object
-      properties: *ref_461
-      required: *ref_462
-    EditPostgresTrigger:
-      type: object
-      properties: *ref_463
-      required: *ref_464
-    KafkaTrigger:
-      allOf: *ref_216
-      type: object
-      properties: *ref_217
-      required: *ref_218
-    NewKafkaTrigger:
-      type: object
-      properties: *ref_465
-      required: *ref_466
-    EditKafkaTrigger:
-      type: object
-      properties: *ref_467
-      required: *ref_468
-    NatsTrigger:
-      allOf: *ref_219
-      type: object
-      properties: *ref_220
-      required: *ref_221
-    NewNatsTrigger:
-      type: object
-      properties: *ref_469
-      required: *ref_470
-    EditNatsTrigger:
-      type: object
-      properties: *ref_471
-      required: *ref_472
-    EmailTrigger:
-      allOf: *ref_259
-      type: object
-      properties: *ref_260
-      required: *ref_261
-    NewEmailTrigger:
-      type: object
-      properties: *ref_473
-      required: *ref_474
-    EditEmailTrigger:
-      type: object
-      properties: *ref_475
-      required: *ref_476
-    Group:
+      allOf: *ref_266
       type: object
       properties: *ref_267
       required: *ref_268
-    InstanceGroup:
-      type: object
-      required: *ref_477
-      properties: *ref_478
-    InstanceGroupWithWorkspaces:
-      type: object
-      required: *ref_263
-      properties: *ref_264
-    WorkspaceInfo:
+    NewPostgresTrigger:
       type: object
       properties: *ref_479
       required: *ref_480
-    Folder:
+    EditPostgresTrigger:
+      type: object
+      properties: *ref_481
+      required: *ref_482
+    KafkaTrigger:
+      allOf: *ref_218
+      type: object
+      properties: *ref_219
+      required: *ref_220
+    NewKafkaTrigger:
+      type: object
+      properties: *ref_483
+      required: *ref_484
+    EditKafkaTrigger:
+      type: object
+      properties: *ref_485
+      required: *ref_486
+    NatsTrigger:
+      allOf: *ref_221
+      type: object
+      properties: *ref_222
+      required: *ref_223
+    NewNatsTrigger:
+      type: object
+      properties: *ref_487
+      required: *ref_488
+    EditNatsTrigger:
+      type: object
+      properties: *ref_489
+      required: *ref_490
+    EmailTrigger:
+      allOf: *ref_269
       type: object
       properties: *ref_270
       required: *ref_271
+    NewEmailTrigger:
+      type: object
+      properties: *ref_491
+      required: *ref_492
+    EditEmailTrigger:
+      type: object
+      properties: *ref_493
+      required: *ref_494
+    Group:
+      type: object
+      properties: *ref_277
+      required: *ref_278
+    InstanceGroup:
+      type: object
+      required: *ref_495
+      properties: *ref_496
+    InstanceGroupWithWorkspaces:
+      type: object
+      required: *ref_273
+      properties: *ref_274
+    WorkspaceInfo:
+      type: object
+      properties: *ref_497
+      required: *ref_498
+    Folder:
+      type: object
+      properties: *ref_280
+      required: *ref_281
     FolderDefaultPermissionedAs:
       description: >
         Ordered list of rules applied at create-time when admins or
@@ -34288,19 +35005,19 @@ components:
         `path_glob` matches the item path (relative to the folder root) wins,
         and its `permissioned_as` is used as the default.
       type: array
-      items: *ref_269
+      items: *ref_279
     WorkerPing:
       type: object
-      properties: *ref_481
-      required: *ref_482
+      properties: *ref_499
+      required: *ref_500
     UserWorkspaceList:
       type: object
-      properties: *ref_483
-      required: *ref_484
+      properties: *ref_501
+      required: *ref_502
     CreateWorkspace:
       type: object
-      properties: *ref_485
-      required: *ref_486
+      properties: *ref_503
+      required: *ref_504
     CreateWorkspaceFork:
       type: object
       properties: *ref_19
@@ -34311,15 +35028,15 @@ components:
       required: *ref_16
     DependencyMap:
       type: object
-      properties: *ref_487
+      properties: *ref_505
     DependencyDependent:
       type: object
-      properties: *ref_488
-      required: *ref_489
+      properties: *ref_506
+      required: *ref_507
     DependentsAmount:
       type: object
-      properties: *ref_490
-      required: *ref_491
+      properties: *ref_508
+      required: *ref_509
     WorkspaceInvite:
       type: object
       properties: *ref_41
@@ -34332,45 +35049,45 @@ components:
       allOf: *ref_124
     ExtraPerms:
       type: object
-      additionalProperties: *ref_492
+      additionalProperties: *ref_510
     FlowMetadata:
       type: object
-      properties: *ref_493
-      required: *ref_494
+      properties: *ref_511
+      required: *ref_512
     OpenFlowWPath:
       allOf: *ref_126
     FlowPreview:
       type: object
-      properties: *ref_147
-      required: *ref_148
+      properties: *ref_151
+      required: *ref_152
     RestartedFrom:
       type: object
-      properties: *ref_495
+      properties: *ref_513
     Policy:
       type: object
       properties: *ref_127
     ListableApp:
       type: object
-      properties: *ref_496
-      required: *ref_497
+      properties: *ref_514
+      required: *ref_515
     ScopeDefinition:
       type: object
-      properties: *ref_498
-      required: *ref_499
+      properties: *ref_516
+      required: *ref_517
     ScopeDomain:
       type: object
-      properties: *ref_500
-      required: *ref_501
+      properties: *ref_518
+      required: *ref_519
     ListableRawApp:
       type: object
-      properties: *ref_502
-      required: *ref_503
+      properties: *ref_520
+      required: *ref_521
     AppWithLastVersion:
       type: object
       properties: *ref_128
       required: *ref_129
     AppWithLastVersionWDraft:
-      allOf: *ref_504
+      allOf: *ref_522
     AppHistory:
       type: object
       properties: *ref_130
@@ -34405,8 +35122,8 @@ components:
       enum: *ref_93
     PolarsClientKwargs:
       type: object
-      properties: *ref_281
-      required: *ref_282
+      properties: *ref_291
+      required: *ref_292
     LargeFileStorage:
       type: object
       properties: *ref_50
@@ -34420,27 +35137,27 @@ components:
       properties: *ref_54
     DataTableSchema:
       type: object
-      required: *ref_505
-      properties: *ref_506
+      required: *ref_523
+      properties: *ref_524
     DynamicInputData:
       type: object
-      properties: *ref_507
-      required: *ref_508
+      properties: *ref_525
+      required: *ref_526
     WindmillLargeFile:
       type: object
-      properties: *ref_283
-      required: *ref_284
+      properties: *ref_293
+      required: *ref_294
     WindmillFileMetadata:
       type: object
-      properties: *ref_287
+      properties: *ref_297
     WindmillFilePreview:
       type: object
-      properties: *ref_285
-      required: *ref_286
+      properties: *ref_295
+      required: *ref_296
     S3Resource:
       type: object
-      properties: *ref_279
-      required: *ref_280
+      properties: *ref_289
+      required: *ref_290
     WorkspaceGitSyncSettings:
       type: object
       properties: *ref_55
@@ -34452,48 +35169,48 @@ components:
       properties: *ref_59
     S3PermissionRule:
       type: object
-      properties: *ref_509
-      required: *ref_510
+      properties: *ref_527
+      required: *ref_528
     GitRepositorySettings:
       type: object
       properties: *ref_56
       required: *ref_57
     MetricMetadata:
       type: object
-      properties: *ref_511
-      required: *ref_512
+      properties: *ref_529
+      required: *ref_530
     ScalarMetric:
       type: object
-      properties: *ref_513
-      required: *ref_514
+      properties: *ref_531
+      required: *ref_532
     TimeseriesMetric:
       type: object
-      properties: *ref_515
-      required: *ref_516
+      properties: *ref_533
+      required: *ref_534
     MetricDataPoint:
       type: object
-      properties: *ref_517
-      required: *ref_518
+      properties: *ref_535
+      required: *ref_536
     RawScriptForDependencies:
       type: object
-      properties: *ref_519
-      required: *ref_520
+      properties: *ref_143
+      required: *ref_144
     ConcurrencyGroup:
       type: object
-      properties: *ref_521
-      required: *ref_522
+      properties: *ref_537
+      required: *ref_538
     ExtendedJobs:
       type: object
-      properties: *ref_523
-      required: *ref_524
+      properties: *ref_539
+      required: *ref_540
     ExportedUser:
       type: object
       properties: *ref_9
       required: *ref_10
     GlobalSetting:
       type: object
-      properties: *ref_525
-      required: *ref_526
+      properties: *ref_541
+      required: *ref_542
     InstanceConfig:
       type: object
       description: >-
@@ -34502,35 +35219,35 @@ components:
       properties: *ref_26
     Config:
       type: object
-      properties: *ref_527
-      required: *ref_528
+      properties: *ref_543
+      required: *ref_544
     ExportedInstanceGroup:
       type: object
-      properties: *ref_265
-      required: *ref_266
+      properties: *ref_275
+      required: *ref_276
     JobSearchHit:
       type: object
-      properties: *ref_529
+      properties: *ref_545
     LogSearchHit:
       type: object
-      properties: *ref_530
+      properties: *ref_546
     AutoscalingEvent:
       type: object
-      properties: *ref_531
+      properties: *ref_547
     CriticalAlert:
       type: object
       properties: *ref_63
     CaptureTriggerKind:
       type: string
-      enum: *ref_272
+      enum: *ref_282
     Capture:
       type: object
-      properties: *ref_273
-      required: *ref_274
+      properties: *ref_283
+      required: *ref_284
     CaptureConfig:
       type: object
-      properties: *ref_532
-      required: *ref_533
+      properties: *ref_548
+      required: *ref_549
     OperatorSettings:
       nullable: true
       type: object
@@ -34538,16 +35255,16 @@ components:
       properties: *ref_38
     WorkspaceComparison:
       type: object
-      required: *ref_534
-      properties: *ref_535
+      required: *ref_550
+      properties: *ref_551
     WorkspaceItemDiff:
       type: object
-      required: *ref_536
-      properties: *ref_537
+      required: *ref_552
+      properties: *ref_553
     CompareSummary:
       type: object
-      required: *ref_538
-      properties: *ref_539
+      required: *ref_554
+      properties: *ref_555
     TeamInfo:
       type: object
       required:
@@ -34568,12 +35285,12 @@ components:
           description: List of channels within the team
           items:
             type: object
-            required: &ref_540
+            required: &ref_556
               - channel_id
               - channel_name
               - tenant_id
               - service_url
-            properties: &ref_541
+            properties: &ref_557
               channel_id:
                 type: string
                 description: The unique identifier of the channel
@@ -34593,11 +35310,11 @@ components:
                   https://smba.trafficmanager.net/amer/12345678-1234-1234-1234-123456789012/
     ChannelInfo:
       type: object
-      required: *ref_540
-      properties: *ref_541
+      required: *ref_556
+      properties: *ref_557
     GithubInstallations:
       type: array
-      items: *ref_542
+      items: *ref_558
     WorkspaceGithubInstallation:
       type: object
       properties:
@@ -34638,14 +35355,14 @@ components:
           minLength: 1
     AssetUsageKind:
       type: string
-      enum: *ref_292
+      enum: *ref_302
     AssetUsageAccessType:
       type: string
-      enum: *ref_291
+      enum: *ref_301
       nullable: true
     AssetKind:
       type: string
-      enum: *ref_290
+      enum: *ref_300
     Asset:
       type: object
       properties:
@@ -34653,26 +35370,26 @@ components:
           type: string
         kind:
           type: string
-          enum: *ref_290
+          enum: *ref_300
       required:
         - path
         - kind
     Volume:
       type: object
-      required: *ref_543
-      properties: *ref_544
+      required: *ref_559
+      properties: *ref_560
     ProtectionRuleset:
       type: object
       description: A workspace protection rule defining restrictions and bypass permissions
-      required: *ref_545
-      properties: *ref_546
+      required: *ref_561
+      properties: *ref_562
     ProtectionRules:
       type: array
       description: Configuration of protection restrictions
       items: *ref_64
     ProtectionRuleKind:
       type: string
-      enum: *ref_547
+      enum: *ref_563
     RuleBypasserGroups:
       type: array
       description: Groups that can bypass this ruleset
@@ -34683,12 +35400,12 @@ components:
       items: *ref_66
     DeploymentRequestEligibleDeployer:
       type: object
-      required: *ref_548
-      properties: *ref_549
+      required: *ref_564
+      properties: *ref_565
     DeploymentRequestAssignee:
       type: object
-      required: *ref_550
-      properties: *ref_551
+      required: *ref_566
+      properties: *ref_567
     DeploymentRequestComment:
       type: object
       required: *ref_69
@@ -34703,27 +35420,27 @@ components:
       required: *ref_72
     NativeServiceName:
       type: string
-      enum: *ref_226
+      enum: *ref_228
     NativeTrigger:
       type: object
       description: A native trigger stored in Windmill
-      properties: *ref_552
-      required: *ref_553
+      properties: *ref_568
+      required: *ref_569
     NativeTriggerWithExternal:
       type: object
       description: >-
         Full trigger response containing both Windmill data and external service
         data
-      properties: *ref_554
-      required: *ref_555
+      properties: *ref_570
+      required: *ref_571
     WorkspaceIntegrations:
       type: object
-      properties: *ref_556
-      required: *ref_557
+      properties: *ref_572
+      required: *ref_573
     WorkspaceOAuthConfig:
       type: object
-      properties: *ref_227
-      required: *ref_228
+      properties: *ref_229
+      required: *ref_230
     WebhookEvent:
       type: object
       properties:
@@ -34734,7 +35451,7 @@ components:
         request_type:
           type: string
           description: The type of webhook request (define possible values here)
-          enum: &ref_558
+          enum: &ref_574
             - async
             - sync
       required:
@@ -34743,21 +35460,21 @@ components:
     WebhookRequestType:
       type: string
       description: The type of webhook request (define possible values here)
-      enum: *ref_558
+      enum: *ref_574
     RedirectUri:
       type: object
-      properties: *ref_229
-      required: *ref_230
+      properties: *ref_231
+      required: *ref_232
     NativeTriggerData:
       type: object
       description: Data for creating or updating a native trigger
-      properties: *ref_231
-      required: *ref_232
+      properties: *ref_233
+      required: *ref_234
     CreateTriggerResponse:
       type: object
       description: Response returned when a native trigger is created
-      properties: *ref_559
-      required: *ref_560
+      properties: *ref_575
+      required: *ref_576
     SyncResult:
       type: object
       properties:
@@ -34781,24 +35498,28 @@ components:
         - total_windmill
     NextCloudEventType:
       type: object
-      properties: *ref_561
-      required: *ref_562
+      properties: *ref_577
+      required: *ref_578
     GoogleCalendarEntry:
       type: object
-      properties: *ref_563
-      required: *ref_564
+      properties: *ref_579
+      required: *ref_580
     GoogleDriveFile:
       type: object
-      properties: *ref_565
-      required: *ref_566
+      properties: *ref_581
+      required: *ref_582
     GoogleDriveFilesResponse:
       type: object
-      properties: *ref_567
-      required: *ref_568
+      properties: *ref_583
+      required: *ref_584
     SharedDriveEntry:
       type: object
-      properties: *ref_569
-      required: *ref_570
+      properties: *ref_585
+      required: *ref_586
+    GithubRepoEntry:
+      type: object
+      properties: *ref_587
+      required: *ref_588
     schemas-StaticTransform:
       type: object
       description: >-
@@ -34834,22 +35555,22 @@ components:
         Inline script with code defined directly in the flow. Use 'bun' as
         default language if unspecified. The script receives arguments from
         input_transforms
-      properties: *ref_312
-      required: *ref_313
+      properties: *ref_322
+      required: *ref_323
     schemas-PathScript:
       type: object
       description: >-
         Reference to an existing script by path. Use this when calling a
         previously saved script instead of writing inline code
-      properties: *ref_314
-      required: *ref_315
+      properties: *ref_324
+      required: *ref_325
     schemas-PathFlow:
       type: object
       description: >-
         Reference to an existing flow by path. Use this to call another flow as
         a subflow
-      properties: *ref_316
-      required: *ref_317
+      properties: *ref_326
+      required: *ref_327
     schemas-FlowModule:
       type: object
       description: A single step in a flow. Can be a script, subflow, loop, or branch
@@ -34862,96 +35583,96 @@ components:
         'flow_input.iter.value' to access the current iteration value, and
         'flow_input.iter.index' for the index. Supports parallel execution for
         better performance on I/O-bound operations
-      properties: *ref_318
-      required: *ref_319
+      properties: *ref_328
+      required: *ref_329
     schemas-WhileloopFlow:
       type: object
       description: >-
         Executes nested modules repeatedly while a condition is true. The loop
         checks the condition after each iteration. Use stop_after_if on modules
         to control loop termination
-      properties: *ref_320
-      required: *ref_321
+      properties: *ref_330
+      required: *ref_331
     schemas-BranchOne:
       type: object
       description: >-
         Conditional branching where only the first matching branch executes.
         Branches are evaluated in order, and the first one with a true
         expression runs. If no branches match, the default branch executes
-      properties: *ref_322
-      required: *ref_323
+      properties: *ref_332
+      required: *ref_333
     schemas-BranchAll:
       type: object
       description: >-
         Parallel branching where all branches execute simultaneously. Unlike
         BranchOne, all branches run regardless of conditions. Useful for
         executing independent tasks concurrently
-      properties: *ref_324
-      required: *ref_325
+      properties: *ref_334
+      required: *ref_335
     schemas-Identity:
       type: object
       description: >-
         Pass-through module that returns its input unchanged. Useful for flow
         structure or as a placeholder
-      properties: *ref_326
-      required: *ref_327
+      properties: *ref_336
+      required: *ref_337
     AIProviderKind:
       type: string
       description: Supported AI provider types
-      enum: *ref_305
+      enum: *ref_315
     schemas-ProviderConfig:
       type: object
       description: >-
         Complete AI provider configuration with resource reference and model
         selection
-      properties: *ref_571
-      required: *ref_572
+      properties: *ref_589
+      required: *ref_590
     StaticProviderTransform:
       type: object
       description: Static provider configuration passed directly to the AI agent
-      properties: *ref_573
-      required: *ref_574
+      properties: *ref_591
+      required: *ref_592
     ProviderTransform:
       description: >-
         Provider configuration - can be static (ProviderConfig), JavaScript
         expression, or AI-determined
-      oneOf: *ref_330
-      discriminator: *ref_331
+      oneOf: *ref_340
+      discriminator: *ref_341
     MemoryOff:
       type: object
       description: No conversation memory/context
-      properties: *ref_306
-      required: *ref_307
+      properties: *ref_316
+      required: *ref_317
     MemoryAuto:
       type: object
       description: Automatic context management
-      properties: *ref_308
-      required: *ref_309
+      properties: *ref_318
+      required: *ref_319
     MemoryMessage:
       type: object
       description: A single message in conversation history
-      properties: *ref_575
-      required: *ref_576
+      properties: *ref_593
+      required: *ref_594
     MemoryManual:
       type: object
       description: Explicit message history
-      properties: *ref_310
-      required: *ref_311
+      properties: *ref_320
+      required: *ref_321
     schemas-MemoryConfig:
       description: Conversation memory configuration
-      oneOf: *ref_577
-      discriminator: *ref_578
+      oneOf: *ref_595
+      discriminator: *ref_596
     StaticMemoryTransform:
       type: object
       description: Static memory configuration passed directly to the AI agent
-      properties: *ref_579
-      required: *ref_580
+      properties: *ref_597
+      required: *ref_598
     MemoryTransform:
       description: >-
         Memory configuration - can be static (MemoryConfig), JavaScript
         expression, or AI-determined
-      oneOf: *ref_332
-      discriminator: *ref_333
+      oneOf: *ref_342
+      discriminator: *ref_343
     schemas-FlowModuleValue:
       description: >-
         The actual implementation of a flow step. Can be a script (inline or
@@ -34962,41 +35683,41 @@ components:
       description: >-
         A tool implemented as a flow module (script, flow, etc.). The AI can
         call this like any other flow module
-      allOf: *ref_581
+      allOf: *ref_599
     McpToolValue:
       type: object
       description: >-
         Reference to an external MCP (Model Context Protocol) tool. The AI can
         call tools from MCP servers
-      properties: *ref_582
-      required: *ref_583
+      properties: *ref_600
+      required: *ref_601
     WebsearchToolValue:
       type: object
       description: >-
         A tool implemented as a websearch tool. The AI can call this like any
         other websearch tool
-      properties: *ref_584
-      required: *ref_585
+      properties: *ref_602
+      required: *ref_603
     ToolValue:
       description: >-
         The implementation of a tool. Can be a flow module (script/flow) or an
         MCP tool reference
-      oneOf: *ref_586
-      discriminator: *ref_587
+      oneOf: *ref_604
+      discriminator: *ref_605
     AgentTool:
       type: object
       description: >-
         A tool available to an AI agent. Can be a flow module or an external MCP
         (Model Context Protocol) tool
-      properties: *ref_334
-      required: *ref_335
+      properties: *ref_344
+      required: *ref_345
     schemas-AiAgent:
       type: object
       description: >-
         AI agent step that can use tools to accomplish tasks. The agent receives
         inputs and can call any of its configured tools to complete the task
-      properties: *ref_328
-      required: *ref_329
+      properties: *ref_338
+      required: *ref_339
     schemas-StopAfterIf:
       type: object
       description: Early termination condition for a module
@@ -35005,17 +35726,17 @@ components:
     RetryIf:
       type: object
       description: Conditional retry based on error or result
-      properties: *ref_192
-      required: *ref_193
+      properties: *ref_194
+      required: *ref_195
     schemas-Retry:
       type: object
       description: Retry configuration for failed module executions
-      properties: *ref_304
+      properties: *ref_314
     schemas-FlowNote:
       type: object
       description: A sticky note attached to a flow for documentation and annotation
-      properties: *ref_143
-      required: *ref_144
+      properties: *ref_145
+      required: *ref_146
     FlowGroup:
       type: object
       description: >-
@@ -35024,16 +35745,16 @@ components:
         flow. Groups provide naming and collapsibility in the editor. Members
         are computed dynamically from all nodes on paths between start_id and
         end_id.
-      properties: *ref_145
-      required: *ref_146
+      properties: *ref_147
+      required: *ref_148
     schemas-FlowValue:
       type: object
       description: >-
         The flow structure containing modules and optional preprocessor/failure
         handlers
-      properties: *ref_588
-      required: *ref_589
+      properties: *ref_606
+      required: *ref_607
     schemas-FlowStatusModule:
       type: object
-      properties: *ref_149
-      required: *ref_150
+      properties: *ref_153
+      required: *ref_154
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 8d04a06771..726d02129b 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -4575,6 +4575,8 @@ paths:
                     type: boolean
                   gcp_used:
                     type: boolean
+                  azure_used:
+                    type: boolean
                   sqs_used:
                     type: boolean
                   email_used:
@@ -4593,6 +4595,7 @@ paths:
                   - postgres_used
                   - mqtt_used
                   - gcp_used
+                  - azure_used
                   - sqs_used
                   - email_used
                   - nextcloud_used
@@ -15219,6 +15222,296 @@ paths:
                 items:
                   type: string
 
+  /w/{workspace}/azure_triggers/create:
+    post:
+      summary: create an Azure Event Grid trigger
+      operationId: createAzureTrigger
+      tags:
+        - azure_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AzureTriggerData"
+      responses:
+        "201":
+          description: azure trigger created
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/azure_triggers/update/{path}:
+    post:
+      summary: update an Azure Event Grid trigger
+      operationId: updateAzureTrigger
+      tags:
+        - azure_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AzureTriggerData"
+      responses:
+        "200":
+          description: azure trigger updated
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/azure_triggers/delete/{path}:
+    delete:
+      summary: delete an Azure Event Grid trigger
+      operationId: deleteAzureTrigger
+      tags:
+        - azure_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      responses:
+        "200":
+          description: azure trigger deleted
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/azure_triggers/get/{path}:
+    get:
+      summary: get an Azure Event Grid trigger
+      operationId: getAzureTrigger
+      tags:
+        - azure_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      responses:
+        "200":
+          description: azure trigger
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AzureTrigger"
+
+  /w/{workspace}/azure_triggers/list:
+    get:
+      summary: list azure triggers
+      operationId: listAzureTriggers
+      tags:
+        - azure_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PerPage"
+        - name: path
+          description: filter by exact path
+          in: query
+          schema:
+            type: string
+        - name: is_flow
+          in: query
+          schema:
+            type: boolean
+        - name: path_start
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          description: azure trigger list
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/AzureTrigger"
+
+  /w/{workspace}/azure_triggers/exists/{path}:
+    get:
+      summary: check whether an azure trigger exists
+      operationId: existsAzureTrigger
+      tags:
+        - azure_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      responses:
+        "200":
+          description: true/false
+          content:
+            application/json:
+              schema:
+                type: boolean
+
+  /w/{workspace}/azure_triggers/setmode/{path}:
+    post:
+      summary: set azure trigger mode
+      operationId: setAzureTriggerMode
+      tags:
+        - azure_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                mode:
+                  $ref: "#/components/schemas/TriggerMode"
+              required:
+                - mode
+      responses:
+        "200":
+          description: trigger mode updated
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/azure_triggers/test:
+    post:
+      summary: test Azure service principal connection
+      operationId: testAzureConnection
+      tags:
+        - azure_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/TestAzureConnection"
+      responses:
+        "200":
+          description: connection successful
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/azure_triggers/namespaces/topics/list/{path}:
+    post:
+      summary: list topics under an Event Grid Namespace
+      operationId: listAzureNamespaceTopics
+      tags:
+        - azure_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AzureListTopics"
+      responses:
+        "200":
+          description: topic list
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+
+  /w/{workspace}/azure_triggers/namespaces/subscriptions/list/{path}:
+    post:
+      summary: list subscriptions under a Namespace topic
+      operationId: listAzureNamespaceSubscriptions
+      tags:
+        - azure_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AzureListSubscriptions"
+      responses:
+        "200":
+          description: subscription list
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+
+  /w/{workspace}/azure_triggers/subscriptions/delete/{path}:
+    delete:
+      summary: delete an Event Grid subscription on Azure
+      operationId: deleteAzureSubscription
+      tags:
+        - azure_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AzureDeleteSubscription"
+      responses:
+        "200":
+          description: subscription deleted
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/azure_triggers/namespaces/list/{path}:
+    post:
+      summary: list Event Grid Namespaces the service principal can access
+      operationId: listAzureNamespaces
+      tags:
+        - azure_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      responses:
+        "200":
+          description: namespace list
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/AzureArmResource"
+
+  /w/{workspace}/azure_triggers/basic/topics/list/{path}:
+    post:
+      summary: list Basic Event Grid topics + system topics the service principal can access
+      operationId: listAzureBasicTopics
+      tags:
+        - azure_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      responses:
+        "200":
+          description: topic list
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/AzureArmResource"
+
   /w/{workspace}/postgres_triggers/postgres/version/{path}:
     get:
       summary: get postgres version
@@ -17099,6 +17392,7 @@ paths:
                 postgres_trigger,
                 mqtt_trigger,
                 gcp_trigger,
+                azure_trigger,
                 sqs_trigger,
                 email_trigger,
                 volume,
@@ -17145,6 +17439,7 @@ paths:
                 postgres_trigger,
                 mqtt_trigger,
                 gcp_trigger,
+                azure_trigger,
                 sqs_trigger,
                 email_trigger,
                 volume,
@@ -17202,6 +17497,7 @@ paths:
                 postgres_trigger,
                 mqtt_trigger,
                 gcp_trigger,
+                azure_trigger,
                 sqs_trigger,
                 email_trigger,
                 volume,
@@ -22899,6 +23195,7 @@ components:
         - mqtt
         - sqs
         - gcp
+        - azure
         - google
         - github
 
@@ -23386,6 +23683,8 @@ components:
           type: number
         gcp_count:
           type: number
+        azure_count:
+          type: number
         sqs_count:
           type: number
         nextcloud_count:
@@ -24060,6 +24359,171 @@ components:
       required:
         - subscription_id
 
+    AzureMode:
+      type: string
+      enum:
+        - basic_push
+        - namespace_push
+        - namespace_pull
+      description: "Azure Event Grid trigger mode."
+
+    AzureArmResource:
+      type: object
+      description: "An ARM resource the service principal can see."
+      properties:
+        id:
+          type: string
+        name:
+          type: string
+        location:
+          type: string
+        type:
+          type: string
+      required:
+        - id
+        - name
+        - type
+
+    AzureDeleteSubscription:
+      type: object
+      properties:
+        azure_mode:
+          $ref: "#/components/schemas/AzureMode"
+        scope_resource_id:
+          type: string
+        topic_name:
+          type: string
+          nullable: true
+        subscription_name:
+          type: string
+      required:
+        - azure_mode
+        - scope_resource_id
+        - subscription_name
+
+    AzureTrigger:
+      allOf:
+        - $ref: "#/components/schemas/TriggerExtraProperty"
+      type: object
+      description: "An Azure Event Grid trigger that executes a script or flow when events arrive."
+      properties:
+        azure_resource_path:
+          type: string
+        azure_mode:
+          $ref: "#/components/schemas/AzureMode"
+        scope_resource_id:
+          type: string
+          description: "ARM resource ID of the topic (basic) or namespace (namespace modes)."
+        topic_name:
+          type: string
+          nullable: true
+          description: "Topic name within the namespace (namespace modes only)."
+        subscription_name:
+          type: string
+        event_type_filters:
+          type: array
+          items:
+            type: string
+          nullable: true
+        server_id:
+          type: string
+        last_server_ping:
+          type: string
+          format: date-time
+        error:
+          type: string
+        error_handler_path:
+          type: string
+        error_handler_args:
+          $ref: "#/components/schemas/ScriptArgs"
+        retry:
+          $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
+      required:
+        - azure_resource_path
+        - azure_mode
+        - scope_resource_id
+        - subscription_name
+
+    AzureTriggerData:
+      type: object
+      description: "Data for creating or updating an Azure Event Grid trigger."
+      properties:
+        azure_resource_path:
+          type: string
+        azure_mode:
+          $ref: "#/components/schemas/AzureMode"
+        scope_resource_id:
+          type: string
+        topic_name:
+          type: string
+          nullable: true
+        subscription_name:
+          type: string
+        base_endpoint:
+          type: string
+          description: "Base URL for push delivery endpoints (push modes only)."
+        event_type_filters:
+          type: array
+          items:
+            type: string
+        path:
+          type: string
+        script_path:
+          type: string
+        is_flow:
+          type: boolean
+        mode:
+          $ref: "#/components/schemas/TriggerMode"
+        error_handler_path:
+          type: string
+        error_handler_args:
+          $ref: "#/components/schemas/ScriptArgs"
+        retry:
+          $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
+        permissioned_as:
+          type: string
+        preserve_permissioned_as:
+          type: boolean
+        labels:
+          type: array
+          items:
+            type: string
+      required:
+        - path
+        - script_path
+        - is_flow
+        - azure_resource_path
+        - azure_mode
+        - scope_resource_id
+        - subscription_name
+
+    TestAzureConnection:
+      type: object
+      properties:
+        azure_resource_path:
+          type: string
+      required:
+        - azure_resource_path
+
+    AzureListTopics:
+      type: object
+      properties:
+        scope_resource_id:
+          type: string
+      required:
+        - scope_resource_id
+
+    AzureListSubscriptions:
+      type: object
+      properties:
+        scope_resource_id:
+          type: string
+        topic_name:
+          type: string
+      required:
+        - scope_resource_id
+        - topic_name
+
     AwsAuthResourceType:
       type: string
       enum:
@@ -26361,6 +26825,7 @@ components:
           sqs,
           mqtt,
           gcp,
+          azure,
           email,
         ]
 
diff --git a/backend/windmill-api/src/capture.rs b/backend/windmill-api/src/capture.rs
index c8ddea37d2..bf98ae460d 100644
--- a/backend/windmill-api/src/capture.rs
+++ b/backend/windmill-api/src/capture.rs
@@ -114,7 +114,8 @@ pub fn workspaced_unauthed_service() -> Router {
 
     #[cfg(any(
         feature = "http_trigger",
-        all(feature = "enterprise", feature = "gcp_trigger")
+        all(feature = "enterprise", feature = "gcp_trigger"),
+        all(feature = "enterprise", feature = "azure_trigger")
     ))]
     {
         #[cfg(feature = "http_trigger")]
@@ -125,12 +126,16 @@ pub fn workspaced_unauthed_service() -> Router {
         #[cfg(all(feature = "enterprise", feature = "gcp_trigger", feature = "private"))]
         let router = router.route("/gcp/{runnable_kind}/{*path}", post(gcp_payload));
 
+        #[cfg(all(feature = "enterprise", feature = "azure_trigger", feature = "private"))]
+        let router = router.route("/azure/{runnable_kind}/{*path}", post(azure_payload));
+
         router
     }
 
     #[cfg(not(any(
         feature = "http_trigger",
-        all(feature = "enterprise", feature = "gcp_trigger")
+        all(feature = "enterprise", feature = "gcp_trigger"),
+        all(feature = "enterprise", feature = "azure_trigger")
     )))]
     {
         router
@@ -170,6 +175,26 @@ pub struct SqsTriggerConfig {
     pub aws_auth_resource_type: AwsAuthResourceType,
 }
 
+#[cfg(all(feature = "enterprise", feature = "azure_trigger", feature = "private"))]
+#[derive(Debug, Serialize, Deserialize)]
+pub struct AzureTriggerConfig {
+    pub azure_resource_path: String,
+    pub azure_mode: crate::triggers::azure::AzureMode,
+    pub scope_resource_id: String,
+    #[serde(default, deserialize_with = "empty_as_none")]
+    pub topic_name: Option<String>,
+    pub subscription_name: String,
+    #[serde(default, deserialize_with = "empty_as_none")]
+    pub base_endpoint: Option<String>,
+    #[serde(default)]
+    pub event_type_filters: Option<Vec<String>>,
+    /// Server-managed. Populated by `set_azure_trigger_config` after
+    /// `manage_azure_subscription` regenerates the secret; skipped on
+    /// (de)serialization so clients never see or send it.
+    #[serde(skip, default)]
+    pub push_auth_config: Option<crate::triggers::azure::PushAuthConfig>,
+}
+
 #[cfg(all(feature = "enterprise", feature = "gcp_trigger", feature = "private"))]
 #[derive(Debug, Serialize, Deserialize)]
 pub struct GcpTriggerConfig {
@@ -248,6 +273,8 @@ enum TriggerConfig {
     Mqtt(MqttTriggerConfig),
     #[cfg(all(feature = "enterprise", feature = "gcp_trigger", feature = "private"))]
     Gcp(GcpTriggerConfig),
+    #[cfg(all(feature = "enterprise", feature = "azure_trigger", feature = "private"))]
+    Azure(AzureTriggerConfig),
     #[cfg(all(feature = "enterprise", feature = "smtp", feature = "private"))]
     Email(EmailTriggerConfig),
 }
@@ -419,6 +446,78 @@ async fn set_gcp_trigger_config(
     Ok(capture_config)
 }
 
+#[cfg(all(feature = "enterprise", feature = "azure_trigger", feature = "private"))]
+async fn set_azure_trigger_config(
+    w_id: &str,
+    authed: ApiAuthed,
+    db: &DB,
+    mut capture_config: NewCaptureConfig,
+) -> Result<NewCaptureConfig> {
+    use crate::triggers::azure::{manage_azure_subscription, AzureConfigRequest};
+
+    let Some(TriggerConfig::Azure(azure_config)) = capture_config.trigger_config else {
+        return Err(Error::BadRequest(
+            "Invalid Azure Event Grid config".to_string(),
+        ));
+    };
+
+    // Suffix subscription name so capture never clobbers the deployed trigger's
+    // subscription. Azure allows [A-Za-z0-9-]{3,50}; reserve 11 chars for
+    // "-wm-capture" (mirrors Kafka's `_wm_capture` convention — hyphen since
+    // Azure names disallow underscores).
+    let mut sub_name = azure_config.subscription_name;
+    if sub_name.len() > 39 {
+        sub_name.truncate(39);
+    }
+    sub_name.push_str("-wm-capture");
+
+    let mut req = AzureConfigRequest {
+        azure_resource_path: azure_config.azure_resource_path,
+        azure_mode: azure_config.azure_mode,
+        scope_resource_id: azure_config.scope_resource_id,
+        topic_name: azure_config.topic_name,
+        subscription_name: sub_name,
+        base_endpoint: azure_config.base_endpoint,
+        event_type_filters: azure_config.event_type_filters,
+        push_auth_config: azure_config.push_auth_config,
+    };
+
+    manage_azure_subscription(
+        authed,
+        db,
+        w_id,
+        &mut req,
+        &capture_config.path,
+        capture_config.is_flow,
+        false,
+    )
+    .await?;
+
+    capture_config.trigger_config = Some(TriggerConfig::Azure(AzureTriggerConfig {
+        azure_resource_path: req.azure_resource_path,
+        azure_mode: req.azure_mode,
+        scope_resource_id: req.scope_resource_id,
+        topic_name: req.topic_name,
+        subscription_name: req.subscription_name,
+        base_endpoint: req.base_endpoint,
+        event_type_filters: req.event_type_filters,
+        push_auth_config: req.push_auth_config,
+    }));
+
+    Ok(capture_config)
+}
+
+#[inline]
+#[cfg(not(all(feature = "enterprise", feature = "azure_trigger", feature = "private")))]
+async fn set_azure_trigger_config(
+    _w_id: &str,
+    _authed: ApiAuthed,
+    _db: &DB,
+    capture_config: NewCaptureConfig,
+) -> Result<NewCaptureConfig> {
+    Ok(capture_config)
+}
+
 async fn set_config(
     authed: ApiAuthed,
     Extension(user_db): Extension<UserDB>,
@@ -431,6 +530,7 @@ async fn set_config(
             set_postgres_trigger_config(&w_id, authed.clone(), &db, user_db.clone(), nc).await?
         }
         TriggerKind::Gcp => set_gcp_trigger_config(&w_id, authed.clone(), &db, nc).await?,
+        TriggerKind::Azure => set_azure_trigger_config(&w_id, authed.clone(), &db, nc).await?,
         _ => nc,
     };
 
@@ -960,6 +1060,70 @@ async fn gcp_payload(
     Ok(StatusCode::NO_CONTENT)
 }
 
+#[cfg(all(feature = "enterprise", feature = "azure_trigger", feature = "private"))]
+async fn azure_payload(
+    Extension(db): Extension<DB>,
+    Path((w_id, runnable_kind, path)): Path<(String, RunnableKind, String)>,
+    headers: HeaderMap,
+    request: Request,
+) -> Result<StatusCode> {
+    use crate::triggers::azure::{
+        cloud_event_to_args, process_azure_push_request, validate_push_secret, AzureTrigger,
+        PushOutcome,
+    };
+    use crate::triggers::trigger_helpers::TriggerJobArgs;
+
+    let is_flow = matches!(runnable_kind, RunnableKind::Flow);
+    let (azure_trigger_config, owner, _email): (AzureTriggerConfig, _, _) =
+        get_capture_trigger_config_and_owner(&db, &w_id, &path, is_flow, &TriggerKind::Azure)
+            .await?;
+
+    // Basic handshake posts don't carry the secret header; let them through.
+    let is_classic_handshake = headers
+        .get("aeg-event-type")
+        .and_then(|h| h.to_str().ok())
+        .map(|v| v.eq_ignore_ascii_case("SubscriptionValidation"))
+        .unwrap_or(false);
+
+    if !is_classic_handshake {
+        let dc = azure_trigger_config
+            .push_auth_config
+            .as_ref()
+            .ok_or_else(|| {
+                Error::NotAuthorized("azure capture missing push_auth_config".to_string())
+            })?;
+        validate_push_secret(&headers, dc)?;
+    }
+
+    let outcome = process_azure_push_request(headers, request).await?;
+    let (cloud_events, headers_map) = match outcome {
+        PushOutcome::Handshake(_) => {
+            // Capture path doesn't need to echo validation response — return 200.
+            return Ok(StatusCode::OK);
+        }
+        PushOutcome::Events { cloud_events, headers } => (cloud_events, headers),
+    };
+
+    for event in cloud_events {
+        let (payload, trigger_info) = cloud_event_to_args(&event, &headers_map);
+        let (main_args, preprocessor_args) =
+            AzureTrigger::build_capture_payloads(&payload, trigger_info);
+        let _ = insert_capture_payload(
+            &db,
+            &w_id,
+            &path,
+            is_flow,
+            &TriggerKind::Azure,
+            main_args,
+            preprocessor_args,
+            &owner,
+        )
+        .await?;
+    }
+
+    Ok(StatusCode::NO_CONTENT)
+}
+
 #[cfg(feature = "http_trigger")]
 async fn http_payload(
     Extension(db): Extension<DB>,
diff --git a/backend/windmill-api/src/lib.rs b/backend/windmill-api/src/lib.rs
index 042aa98a14..6cebf7aa15 100644
--- a/backend/windmill-api/src/lib.rs
+++ b/backend/windmill-api/src/lib.rs
@@ -900,6 +900,24 @@ pub async fn run_server(
                         Router::new()
                     }
                 })
+                .nest("/azure/w/{workspace_id}", {
+                    #[cfg(all(
+                        feature = "enterprise",
+                        feature = "azure_trigger",
+                        feature = "private"
+                    ))]
+                    {
+                        triggers::azure::handler_oss::azure_push_route_handler()
+                    }
+                    #[cfg(not(all(
+                        feature = "enterprise",
+                        feature = "azure_trigger",
+                        feature = "private"
+                    )))]
+                    {
+                        Router::new()
+                    }
+                })
                 .route("/version", get(git_v))
                 .nest("/health/status", health::status_service())
                 .route("/min_keep_alive_version", get(min_keep_alive_version))
diff --git a/backend/windmill-api/src/offboarding.rs b/backend/windmill-api/src/offboarding.rs
index aeee13c5f5..a5d15165a2 100644
--- a/backend/windmill-api/src/offboarding.rs
+++ b/backend/windmill-api/src/offboarding.rs
@@ -189,6 +189,7 @@ async fn get_offboard_preview(
         "nats_trigger",
         "sqs_trigger",
         "gcp_trigger",
+        "azure_trigger",
         "email_trigger",
     ];
     let mut triggers = HashMap::new();
@@ -748,6 +749,7 @@ async fn check_path_conflicts(
         "nats_trigger",
         "sqs_trigger",
         "gcp_trigger",
+        "azure_trigger",
         "email_trigger",
     ];
 
@@ -1020,6 +1022,7 @@ async fn offboard_user_from_workspace<'c>(
         "nats_trigger",
         "sqs_trigger",
         "gcp_trigger",
+        "azure_trigger",
         "email_trigger",
     ];
 
diff --git a/backend/windmill-api/src/token.rs b/backend/windmill-api/src/token.rs
index 61baf5e3c4..ac4da6497e 100644
--- a/backend/windmill-api/src/token.rs
+++ b/backend/windmill-api/src/token.rs
@@ -26,6 +26,7 @@ fn build_trigger_scope_domains() -> Vec<ScopeDomain> {
         ("mqtt_triggers", "MQTT"),
         ("sqs_triggers", "AWS SQS"),
         ("gcp_triggers", "GCP Pub/Sub"),
+        ("azure_triggers", "Azure Event Grid"),
         ("postgres_triggers", "PostgreSQL"),
         ("email_triggers", "Email"),
     ];
diff --git a/backend/windmill-api/src/trash.rs b/backend/windmill-api/src/trash.rs
index a4bc105238..83e607a7dc 100644
--- a/backend/windmill-api/src/trash.rs
+++ b/backend/windmill-api/src/trash.rs
@@ -469,6 +469,7 @@ async fn restore_trigger(tx: &mut sqlx::PgConnection, item: &TrashItemWithData)
         "mqtt_trigger",
         "sqs_trigger",
         "gcp_trigger",
+        "azure_trigger",
         "email_trigger",
     ];
 
diff --git a/backend/windmill-api/src/triggers/azure/mod.rs b/backend/windmill-api/src/triggers/azure/mod.rs
new file mode 100644
index 0000000000..9928a53a1a
--- /dev/null
+++ b/backend/windmill-api/src/triggers/azure/mod.rs
@@ -0,0 +1 @@
+pub use windmill_trigger_azure::*;
diff --git a/backend/windmill-api/src/triggers/handler.rs b/backend/windmill-api/src/triggers/handler.rs
index c199734794..35b025965d 100644
--- a/backend/windmill-api/src/triggers/handler.rs
+++ b/backend/windmill-api/src/triggers/handler.rs
@@ -81,6 +81,16 @@ pub fn generate_trigger_routers() -> Router {
         );
     }
 
+    #[cfg(all(feature = "enterprise", feature = "azure_trigger", feature = "private"))]
+    {
+        use crate::triggers::azure::AzureTrigger;
+
+        router = router.nest(
+            AzureTrigger::ROUTE_PREFIX,
+            complete_trigger_routes(AzureTrigger),
+        );
+    }
+
     #[cfg(feature = "postgres_trigger")]
     {
         use crate::triggers::postgres::PostgresTrigger;
@@ -135,6 +145,7 @@ pub struct TriggersCount {
     mqtt_count: i64,
     sqs_count: i64,
     gcp_count: i64,
+    azure_count: i64,
     nextcloud_count: i64,
     google_count: i64,
     github_count: i64,
@@ -252,6 +263,17 @@ pub async fn get_triggers_count_internal(
     #[cfg(not(all(feature = "gcp_trigger", feature = "enterprise", feature = "private")))]
     let gcp_count = 0;
 
+    #[cfg(all(feature = "azure_trigger", feature = "enterprise", feature = "private"))]
+    let azure_count = {
+        use crate::triggers::azure::AzureTrigger;
+        let count = AzureTrigger
+            .trigger_count(&mut tx, w_id, is_flow, path)
+            .await;
+        count
+    };
+    #[cfg(not(all(feature = "azure_trigger", feature = "enterprise", feature = "private")))]
+    let azure_count = 0;
+
     #[cfg(all(feature = "smtp", feature = "enterprise", feature = "private"))]
     let email_count = {
         use crate::triggers::email::EmailTrigger;
@@ -341,6 +363,7 @@ pub async fn get_triggers_count_internal(
         postgres_count,
         mqtt_count,
         gcp_count,
+        azure_count,
         sqs_count,
         nextcloud_count,
         google_count,
diff --git a/backend/windmill-api/src/triggers/listener.rs b/backend/windmill-api/src/triggers/listener.rs
index 3e67f36109..43cabf13e3 100644
--- a/backend/windmill-api/src/triggers/listener.rs
+++ b/backend/windmill-api/src/triggers/listener.rs
@@ -67,6 +67,14 @@ pub fn start_all_listeners(db: DB, killpill_rx: &tokio::sync::broadcast::Receive
         listen_to(GcpTrigger, db.clone(), gcp_killpill_rx);
     }
 
+    #[cfg(all(feature = "azure_trigger", feature = "enterprise", feature = "private"))]
+    {
+        let azure_killpill_rx = killpill_rx.resubscribe();
+        use crate::triggers::azure::AzureTrigger;
+
+        listen_to(AzureTrigger, db.clone(), azure_killpill_rx);
+    }
+
     #[cfg(all(feature = "sqs_trigger", feature = "enterprise", feature = "private"))]
     {
         let gcp_killpill_rx = killpill_rx.resubscribe();
diff --git a/backend/windmill-api/src/triggers/mod.rs b/backend/windmill-api/src/triggers/mod.rs
index 94c5039775..bc69c66b2b 100644
--- a/backend/windmill-api/src/triggers/mod.rs
+++ b/backend/windmill-api/src/triggers/mod.rs
@@ -1,4 +1,6 @@
 // Concrete trigger submodules (feature-gated)
+#[cfg(all(feature = "azure_trigger", feature = "enterprise", feature = "private"))]
+pub mod azure;
 #[cfg(all(feature = "smtp", feature = "private"))]
 pub mod email;
 #[cfg(all(feature = "gcp_trigger", feature = "enterprise", feature = "private"))]
diff --git a/backend/windmill-api/src/workspaces_export.rs b/backend/windmill-api/src/workspaces_export.rs
index 2e59081328..9673537804 100644
--- a/backend/windmill-api/src/workspaces_export.rs
+++ b/backend/windmill-api/src/workspaces_export.rs
@@ -23,6 +23,7 @@ use crate::{apps::AppWithLastVersion, db::DB, folders::Folder};
             feature = "kafka",
             feature = "sqs_trigger",
             feature = "gcp_trigger",
+            feature = "azure_trigger",
             feature = "nats",
             feature = "smtp",
         ),
@@ -768,6 +769,23 @@ pub(crate) async fn tarball_workspace(
             }
         }
 
+        #[cfg(all(feature = "enterprise", feature = "azure_trigger", feature = "private"))]
+        {
+            use crate::triggers::azure::AzureTrigger;
+            let handler = AzureTrigger;
+            let azure_triggers = handler.list_triggers(&mut *tx, &w_id, None).await?;
+
+            for trigger in azure_triggers {
+                let trigger_str = &to_string_without_metadata(&trigger, false, None).unwrap();
+                archive
+                    .write_to_archive(
+                        &trigger_str,
+                        &format!("{}.azure_trigger.json", trigger.base.path),
+                    )
+                    .await?;
+            }
+        }
+
         #[cfg(all(feature = "enterprise", feature = "nats", feature = "private"))]
         {
             use crate::triggers::nats::NatsTrigger;
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index 0db5e133ee..5dab417f95 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -157,7 +157,7 @@ pub enum ObjectType {
     WorkspaceDependencies,
 }
 
-pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28191/sync-script-to-git-repo-windmill";
+pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28213/sync-script-to-git-repo-windmill";
 
 /// Prefix used to identify fork workspaces. A workspace whose id starts with this string is a
 /// fork of another workspace.
diff --git a/backend/windmill-git-sync/src/lib.rs b/backend/windmill-git-sync/src/lib.rs
index dcbcd5bcb2..efbc562cf9 100644
--- a/backend/windmill-git-sync/src/lib.rs
+++ b/backend/windmill-git-sync/src/lib.rs
@@ -39,6 +39,7 @@ pub enum DeployedObject {
     MqttTrigger { path: String, parent_path: Option<String> },
     SqsTrigger { path: String, parent_path: Option<String> },
     GcpTrigger { path: String, parent_path: Option<String> },
+    AzureTrigger { path: String, parent_path: Option<String> },
     EmailTrigger { path: String, parent_path: Option<String> },
     Settings { setting_type: String },
     Key { key_type: String },
@@ -67,6 +68,7 @@ impl DeployedObject {
             DeployedObject::MqttTrigger { path, .. } => path.to_owned(),
             DeployedObject::SqsTrigger { path, .. } => path.to_owned(),
             DeployedObject::GcpTrigger { path, .. } => path.to_owned(),
+            DeployedObject::AzureTrigger { path, .. } => path.to_owned(),
             DeployedObject::EmailTrigger { path, .. } => path.to_owned(),
             DeployedObject::Settings { .. } => "settings.yaml".to_string(),
             DeployedObject::Key { .. } => "encryption_key.yaml".to_string(),
@@ -107,6 +109,7 @@ impl DeployedObject {
             DeployedObject::MqttTrigger { parent_path, .. } => parent_path.to_owned(),
             DeployedObject::SqsTrigger { parent_path, .. } => parent_path.to_owned(),
             DeployedObject::GcpTrigger { parent_path, .. } => parent_path.to_owned(),
+            DeployedObject::AzureTrigger { parent_path, .. } => parent_path.to_owned(),
             DeployedObject::EmailTrigger { parent_path, .. } => parent_path.to_owned(),
             DeployedObject::Settings { .. } => None,
             DeployedObject::Key { .. } => None,
@@ -135,6 +138,7 @@ impl DeployedObject {
             DeployedObject::MqttTrigger { .. } => "mqtt_trigger",
             DeployedObject::SqsTrigger { .. } => "sqs_trigger",
             DeployedObject::GcpTrigger { .. } => "gcp_trigger",
+            DeployedObject::AzureTrigger { .. } => "azure_trigger",
             DeployedObject::EmailTrigger { .. } => "email_trigger",
             DeployedObject::Settings { .. } => "settings",
             DeployedObject::Key { .. } => "key",
@@ -369,6 +373,10 @@ mod tests {
             DeployedObject::GcpTrigger { path: "t".to_string(), parent_path: None }.get_kind(),
             "gcp_trigger"
         );
+        assert_eq!(
+            DeployedObject::AzureTrigger { path: "t".to_string(), parent_path: None }.get_kind(),
+            "azure_trigger"
+        );
         assert_eq!(
             DeployedObject::EmailTrigger { path: "t".to_string(), parent_path: None }.get_kind(),
             "email_trigger"
diff --git a/backend/windmill-store/Cargo.toml b/backend/windmill-store/Cargo.toml
index 9fee538ef6..cb1e41ad05 100644
--- a/backend/windmill-store/Cargo.toml
+++ b/backend/windmill-store/Cargo.toml
@@ -21,6 +21,7 @@ postgres_trigger = []
 mqtt_trigger = []
 sqs_trigger = []
 gcp_trigger = []
+azure_trigger = []
 kafka = []
 nats = []
 openidconnect = ["windmill-common/openidconnect"]
diff --git a/backend/windmill-store/src/resources.rs b/backend/windmill-store/src/resources.rs
index 9f9ea7b22b..c8e5eb555d 100644
--- a/backend/windmill-store/src/resources.rs
+++ b/backend/windmill-store/src/resources.rs
@@ -1820,6 +1820,7 @@ async fn update_resource_type(
         any(
             feature = "sqs_trigger",
             feature = "gcp_trigger",
+            feature = "azure_trigger",
             feature = "kafka",
             feature = "nats"
         )
diff --git a/backend/windmill-trigger-azure/Cargo.toml b/backend/windmill-trigger-azure/Cargo.toml
new file mode 100644
index 0000000000..31fb9a9fc7
--- /dev/null
+++ b/backend/windmill-trigger-azure/Cargo.toml
@@ -0,0 +1,43 @@
+[package]
+name = "windmill-trigger-azure"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+
+[lib]
+name = "windmill_trigger_azure"
+path = "src/lib.rs"
+
+[features]
+default = []
+enterprise = ["windmill-common/enterprise", "windmill-store/enterprise", "windmill-trigger/enterprise"]
+private = ["windmill-common/private", "windmill-store/private"]
+
+[dependencies]
+windmill-common = { workspace = true, default-features = false }
+windmill-api-auth.workspace = true
+windmill-store = { workspace = true, features = ["azure_trigger"] }
+windmill-trigger.workspace = true
+windmill-git-sync.workspace = true
+axum.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+sqlx.workspace = true
+tokio.workspace = true
+tokio-util.workspace = true
+tracing.workspace = true
+async-trait.workspace = true
+itertools.workspace = true
+anyhow.workspace = true
+base64.workspace = true
+bytes.workspace = true
+http.workspace = true
+quick_cache.workspace = true
+lazy_static.workspace = true
+reqwest.workspace = true
+chrono.workspace = true
+thiserror.workspace = true
+sha2.workspace = true
+rand.workspace = true
+hex.workspace = true
+constant_time_eq.workspace = true
diff --git a/backend/windmill-trigger-azure/src/handler_oss.rs b/backend/windmill-trigger-azure/src/handler_oss.rs
new file mode 100644
index 0000000000..e56c76a2fd
--- /dev/null
+++ b/backend/windmill-trigger-azure/src/handler_oss.rs
@@ -0,0 +1,65 @@
+#[allow(unused)]
+#[cfg(feature = "private")]
+pub use super::handler_ee::*;
+
+#[cfg(not(feature = "private"))]
+use {
+    super::AzureTrigger,
+    async_trait::async_trait,
+    sqlx::PgConnection,
+    windmill_api_auth::ApiAuthed,
+    windmill_common::{
+        error::{Error, Result},
+        DB,
+    },
+    windmill_git_sync::DeployedObject,
+    windmill_trigger::{TriggerCrud, TriggerData},
+};
+
+#[cfg(not(feature = "private"))]
+#[async_trait]
+impl TriggerCrud for AzureTrigger {
+    type Trigger = ();
+    type TriggerConfig = ();
+    type TriggerConfigRequest = ();
+    type TestConnectionConfig = ();
+
+    const TABLE_NAME: &'static str = "";
+    const TRIGGER_TYPE: &'static str = "";
+    const SUPPORTS_SERVER_STATE: bool = false;
+    const SUPPORTS_TEST_CONNECTION: bool = false;
+    const ROUTE_PREFIX: &'static str = "/azure_triggers";
+    const DEPLOYMENT_NAME: &'static str = "";
+    const IS_ALLOWED_ON_CLOUD: bool = false;
+
+    fn get_deployed_object(path: String, parent_path: Option<String>) -> DeployedObject {
+        DeployedObject::AzureTrigger { path, parent_path }
+    }
+
+    async fn create_trigger(
+        &self,
+        _db: &DB,
+        _executor: &mut PgConnection,
+        _authed: &ApiAuthed,
+        _w_id: &str,
+        _trigger: TriggerData<Self::TriggerConfigRequest>,
+    ) -> Result<()> {
+        Err(Error::BadRequest(
+            "Azure triggers are not available in open source version".to_string(),
+        ))
+    }
+
+    async fn update_trigger(
+        &self,
+        _db: &DB,
+        _executor: &mut PgConnection,
+        _authed: &ApiAuthed,
+        _workspace_id: &str,
+        _path: &str,
+        _trigger: TriggerData<Self::TriggerConfigRequest>,
+    ) -> Result<()> {
+        Err(Error::BadRequest(
+            "Azure triggers are not available in open source version".to_string(),
+        ))
+    }
+}
diff --git a/backend/windmill-trigger-azure/src/lib.rs b/backend/windmill-trigger-azure/src/lib.rs
new file mode 100644
index 0000000000..a151f3e949
--- /dev/null
+++ b/backend/windmill-trigger-azure/src/lib.rs
@@ -0,0 +1,15 @@
+#[cfg(feature = "private")]
+mod handler_ee;
+pub mod handler_oss;
+
+#[cfg(feature = "private")]
+mod listener_ee;
+pub mod listener_oss;
+
+#[cfg(feature = "private")]
+mod mod_ee;
+#[cfg(feature = "private")]
+pub use mod_ee::*;
+
+#[derive(Clone, Copy)]
+pub struct AzureTrigger;
diff --git a/backend/windmill-trigger-azure/src/listener_oss.rs b/backend/windmill-trigger-azure/src/listener_oss.rs
new file mode 100644
index 0000000000..cc68b74f83
--- /dev/null
+++ b/backend/windmill-trigger-azure/src/listener_oss.rs
@@ -0,0 +1,52 @@
+#[allow(unused)]
+#[cfg(feature = "private")]
+pub use super::listener_ee::*;
+
+#[cfg(not(feature = "private"))]
+use {
+    super::AzureTrigger,
+    serde_json::{value::RawValue, Value},
+    std::{collections::HashMap, sync::Arc},
+    tokio::sync::RwLock,
+    windmill_common::{error::Result, jobs::JobTriggerKind, triggers::TriggerKind, DB},
+    windmill_trigger::{listener::ListeningTrigger, trigger_helpers::TriggerJobArgs, Listener},
+};
+
+#[cfg(not(feature = "private"))]
+impl TriggerJobArgs for AzureTrigger {
+    type Payload = Value;
+    const TRIGGER_KIND: TriggerKind = TriggerKind::Azure;
+    fn v1_payload_fn(_payload: &Self::Payload) -> HashMap<String, Box<RawValue>> {
+        HashMap::new()
+    }
+}
+
+#[cfg(not(feature = "private"))]
+#[async_trait::async_trait]
+impl Listener for AzureTrigger {
+    type Consumer = ();
+    type Extra = ();
+    type ExtraState = ();
+    const JOB_TRIGGER_KIND: JobTriggerKind = JobTriggerKind::Azure;
+
+    async fn get_consumer(
+        &self,
+        _db: &DB,
+        _listening_trigger: &ListeningTrigger<Self::TriggerConfig>,
+        _err_message: Arc<RwLock<Option<String>>>,
+        _killpill_rx: tokio::sync::broadcast::Receiver<()>,
+    ) -> Result<Option<Self::Consumer>> {
+        Ok(None)
+    }
+    async fn consume(
+        &self,
+        _db: &DB,
+        _consumer: Self::Consumer,
+        _listening_trigger: &ListeningTrigger<Self::TriggerConfig>,
+        _err_message: Arc<RwLock<Option<String>>>,
+        _killpill_rx: tokio::sync::broadcast::Receiver<()>,
+        _extra_state: Option<&Self::ExtraState>,
+    ) {
+        ()
+    }
+}
diff --git a/backend/windmill-types/src/jobs.rs b/backend/windmill-types/src/jobs.rs
index 5d374ca75d..d84e80c902 100644
--- a/backend/windmill-types/src/jobs.rs
+++ b/backend/windmill-types/src/jobs.rs
@@ -36,6 +36,7 @@ pub enum JobTriggerKind {
     Postgres,
     Schedule,
     Gcp,
+    Azure,
     Nextcloud,
     Google,
     Github,
@@ -58,6 +59,7 @@ impl std::fmt::Display for JobTriggerKind {
             JobTriggerKind::Postgres => "postgres",
             JobTriggerKind::Schedule => "schedule",
             JobTriggerKind::Gcp => "gcp",
+            JobTriggerKind::Azure => "azure",
             JobTriggerKind::Nextcloud => "nextcloud",
             JobTriggerKind::Google => "google",
             JobTriggerKind::Github => "github",
diff --git a/backend/windmill-types/src/triggers.rs b/backend/windmill-types/src/triggers.rs
index 71c7221086..8ad1d5e8a7 100644
--- a/backend/windmill-types/src/triggers.rs
+++ b/backend/windmill-types/src/triggers.rs
@@ -19,6 +19,7 @@ pub enum TriggerKind {
     Sqs,
     Postgres,
     Gcp,
+    Azure,
     Nextcloud,
     Google,
     Github,
@@ -38,6 +39,7 @@ impl TriggerKind {
             TriggerKind::Sqs => "sqs".to_string(),
             TriggerKind::Postgres => "postgres".to_string(),
             TriggerKind::Gcp => "gcp".to_string(),
+            TriggerKind::Azure => "azure".to_string(),
             TriggerKind::Nextcloud => "nextcloud".to_string(),
             TriggerKind::Google => "google".to_string(),
             TriggerKind::Github => "github".to_string(),
@@ -59,6 +61,7 @@ impl fmt::Display for TriggerKind {
             TriggerKind::Sqs => "sqs",
             TriggerKind::Postgres => "postgres",
             TriggerKind::Gcp => "gcp",
+            TriggerKind::Azure => "azure",
             TriggerKind::Nextcloud => "nextcloud",
             TriggerKind::Google => "google",
             TriggerKind::Github => "github",
diff --git a/cli/bun.lock b/cli/bun.lock
index ddcf459725..9d9bfe0e4f 100644
--- a/cli/bun.lock
+++ b/cli/bun.lock
@@ -1,5 +1,6 @@
 {
   "lockfileVersion": 1,
+  "configVersion": 0,
   "workspaces": {
     "": {
       "name": "wmill-dev",
diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index 26ee585b3c..33d123edb4 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -1495,6 +1495,7 @@ export async function elementsToMap(
         path.endsWith(".mqtt_trigger" + ext) ||
         path.endsWith(".sqs_trigger" + ext) ||
         path.endsWith(".gcp_trigger" + ext) ||
+        path.endsWith(".azure_trigger" + ext) ||
         path.endsWith(".email_trigger" + ext) ||
         path.endsWith("_native_trigger" + ext))
     ) {
@@ -1873,6 +1874,7 @@ function getOrderFromPath(p: string) {
     typ == "mqtt_trigger" ||
     typ == "sqs_trigger" ||
     typ == "gcp_trigger" ||
+    typ == "azure_trigger" ||
     typ == "email_trigger" ||
     typ == "native_trigger"
   ) {
@@ -3132,7 +3134,7 @@ export async function push(
           }
         }
         const rules = folderRulesCache.get(folderName)!;
-        const remotePath = change.path.replace(/\.(script|schedule|http_trigger|websocket_trigger|kafka_trigger|nats_trigger|postgres_trigger|mqtt_trigger|sqs_trigger|gcp_trigger|email_trigger)\.(yaml|json)$/, "").replace(/(\.flow|__flow)\/flow\.(yaml|json)$/, "").replace(/\.(app|raw_app)(\/app\.(yaml|json))?$/, "");
+        const remotePath = change.path.replace(/\.(script|schedule|http_trigger|websocket_trigger|kafka_trigger|nats_trigger|postgres_trigger|mqtt_trigger|sqs_trigger|gcp_trigger|azure_trigger|email_trigger)\.(yaml|json)$/, "").replace(/(\.flow|__flow)\/flow\.(yaml|json)$/, "").replace(/\.(app|raw_app)(\/app\.(yaml|json))?$/, "");
         const relative = remotePath.slice(`f/${folderName}/`.length);
         if (!relative) continue;
         for (const rule of rules) {
@@ -3765,6 +3767,12 @@ export async function push(
                     path: removeSuffix(target, ".gcp_trigger.json"),
                   });
                   break;
+                case "azure_trigger":
+                  await wmill.deleteAzureTrigger({
+                    workspace: workspaceId,
+                    path: removeSuffix(target, ".azure_trigger.json"),
+                  });
+                  break;
                 case "email_trigger":
                   await wmill.deleteEmailTrigger({
                     workspace: workspaceId,
diff --git a/cli/src/commands/trigger/trigger.ts b/cli/src/commands/trigger/trigger.ts
index df2657427c..aaa43880ac 100644
--- a/cli/src/commands/trigger/trigger.ts
+++ b/cli/src/commands/trigger/trigger.ts
@@ -5,6 +5,7 @@ import { stringify as yamlStringify } from "yaml";
 import * as wmill from "../../../gen/services.gen.ts";
 import {
   GcpTrigger,
+  AzureTrigger,
   HttpTrigger,
   KafkaTrigger,
   MqttTrigger,
@@ -48,6 +49,7 @@ type Trigger = {
   mqtt: MqttTrigger;
   sqs: SqsTrigger;
   gcp: GcpTrigger;
+  azure: AzureTrigger;
   email: EmailTrigger;
 };
 
@@ -83,6 +85,7 @@ async function getTrigger<K extends TriggerType>(
     mqtt: wmill.getMqttTrigger,
     sqs: wmill.getSqsTrigger,
     gcp: wmill.getGcpTrigger,
+    azure: wmill.getAzureTrigger,
     email: wmill.getEmailTrigger,
   };
   const triggerFunction = triggerFunctions[triggerType];
@@ -112,6 +115,7 @@ async function updateTrigger<K extends TriggerType>(
     mqtt: wmill.updateMqttTrigger,
     sqs: wmill.updateSqsTrigger,
     gcp: wmill.updateGcpTrigger,
+    azure: wmill.updateAzureTrigger,
     email: wmill.updateEmailTrigger,
   };
   const triggerFunction = triggerFunctions[triggerType];
@@ -139,6 +143,7 @@ async function createTrigger<K extends TriggerType>(
     mqtt: wmill.createMqttTrigger,
     sqs: wmill.createSqsTrigger,
     gcp: wmill.createGcpTrigger,
+    azure: wmill.createAzureTrigger,
     email: wmill.createEmailTrigger,
   };
   const triggerFunction = triggerFunctions[triggerType];
@@ -393,6 +398,15 @@ const triggerTemplates: Record<TriggerType, Record<string, any>> = {
     subscription_mode: "create_update",
     enabled: false,
   },
+  azure: {
+    script_path: "",
+    is_flow: false,
+    azure_resource_path: "",
+    azure_mode: "namespace_pull",
+    scope_resource_id: "",
+    subscription_name: "",
+    enabled: false,
+  },
   email: {
     script_path: "",
     is_flow: false,
@@ -523,6 +537,7 @@ async function list(opts: GlobalOptions & { json?: boolean }) {
     mqttTriggers,
     sqsTriggers,
     gcpTriggers,
+    azureTriggers,
     emailTriggers,
   ] = await Promise.all([
     listOrEmpty(() => wmill.listHttpTriggers({ workspace: ws })),
@@ -533,6 +548,7 @@ async function list(opts: GlobalOptions & { json?: boolean }) {
     listOrEmpty(() => wmill.listMqttTriggers({ workspace: ws })),
     listOrEmpty(() => wmill.listSqsTriggers({ workspace: ws })),
     listOrEmpty(() => wmill.listGcpTriggers({ workspace: ws })),
+    listOrEmpty(() => wmill.listAzureTriggers({ workspace: ws })),
     listOrEmpty(() => wmill.listEmailTriggers({ workspace: ws })),
   ]);
   const triggers = [
@@ -544,6 +560,7 @@ async function list(opts: GlobalOptions & { json?: boolean }) {
     ...mqttTriggers.map((x) => ({ path: x.path, kind: "mqtt" })),
     ...sqsTriggers.map((x) => ({ path: x.path, kind: "sqs" })),
     ...gcpTriggers.map((x) => ({ path: x.path, kind: "gcp" })),
+    ...azureTriggers.map((x) => ({ path: x.path, kind: "azure" })),
     ...emailTriggers.map((x) => ({ path: x.path, kind: "email" })),
   ];
 
@@ -622,11 +639,11 @@ const command = new Command()
   .command("get", "get a trigger's details")
   .arguments("<path:string>")
   .option("--json", "Output as JSON (for piping to jq)")
-  .option("--kind <kind:string>", "Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email). Recommended for faster lookup")
+  .option("--kind <kind:string>", "Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup")
   .action(get as any)
   .command("new", "create a new trigger locally")
   .arguments("<path:string>")
-  .option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email)")
+  .option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)")
   .action(newTrigger as any)
   .command(
     "push",
@@ -641,7 +658,7 @@ const command = new Command()
   .arguments("<path:string> <email:string>")
   .option(
     "--kind <kind:string>",
-    "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email)"
+    "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)"
   )
   .action((async (opts: any, triggerPath: string, email: string) => {
     const workspace = await resolveWorkspace(opts);
diff --git a/cli/src/guidance/skills.ts b/cli/src/guidance/skills.ts
index 6f2f7d100d..46115d6872 100644
--- a/cli/src/guidance/skills.ts
+++ b/cli/src/guidance/skills.ts
@@ -5760,12 +5760,12 @@ trigger related commands
   - \`--json\` - Output as JSON (for piping to jq)
 - \`trigger get <path:string>\` - get a trigger's details
   - \`--json\` - Output as JSON (for piping to jq)
-  - \`--kind <kind:string>\` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email). Recommended for faster lookup
+  - \`--kind <kind:string>\` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup
 - \`trigger new <path:string>\` - create a new trigger locally
-  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email)
+  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
 - \`trigger push <file_path:string> <remote_path:string>\` - push a local trigger spec. This overrides any remote versions.
 - \`trigger set-permissioned-as <path:string> <email:string>\` - Set the email (run-as user) for a trigger (requires admin or wm_deployers group)
-  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email)
+  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
 
 ### user
 
@@ -5873,6 +5873,91 @@ workspace related commands
 
 // YAML schema content for triggers and schedules
 export const SCHEMAS: Record<string, string> = {
+  "azure_trigger": `type: object
+properties:
+  script_path:
+    type: string
+    description: Path to the script or flow to execute when triggered
+  permissioned_as:
+    type: string
+    description: The user or group this trigger runs as (permissioned_as)
+  is_flow:
+    type: boolean
+    description: True if script_path points to a flow, false if it points to a script
+  labels:
+    type: array
+    items:
+      type: string
+  azure_resource_path:
+    type: string
+  azure_mode:
+    type: string
+    enum:
+    - basic_push
+    - namespace_push
+    - namespace_pull
+    description: Azure Event Grid trigger mode.
+  scope_resource_id:
+    type: string
+    description: ARM resource ID of the topic (basic) or namespace (namespace modes).
+  topic_name:
+    type: string
+    description: Topic name within the namespace (namespace modes only).
+  subscription_name:
+    type: string
+  event_type_filters:
+    type: array
+    items:
+      type: string
+  error_handler_path:
+    type: string
+  error_handler_args:
+    type: object
+    description: The arguments to pass to the script or flow
+  retry:
+    type: object
+    properties:
+      constant:
+        type: object
+        description: Retry with constant delay between attempts
+        properties:
+          attempts:
+            type: integer
+            description: Number of retry attempts
+          seconds:
+            type: integer
+            description: Seconds to wait between retries
+      exponential:
+        type: object
+        description: Retry with exponential backoff (delay doubles each time)
+        properties:
+          attempts:
+            type: integer
+            description: Number of retry attempts
+          multiplier:
+            type: integer
+            description: Multiplier for exponential backoff
+          seconds:
+            type: integer
+            minimum: 1
+            description: Initial delay in seconds
+          random_factor:
+            type: integer
+            minimum: 0
+            maximum: 100
+            description: Random jitter percentage (0-100) to avoid thundering herd
+      retry_if:
+        $ref: '#/components/schemas/RetryIf'
+    description: Retry configuration for failed module executions
+required:
+- script_path
+- permissioned_as
+- is_flow
+- azure_resource_path
+- azure_mode
+- scope_resource_id
+- subscription_name
+`,
   "gcp_trigger": `type: object
 properties:
   script_path:
@@ -6807,6 +6892,7 @@ export const SCHEMA_MAPPINGS: Record<string, SchemaMapping[]> = {
     { name: "MqttTrigger", schemaKey: "mqtt_trigger", filePattern: "*.mqtt_trigger.yaml" },
     { name: "SqsTrigger", schemaKey: "sqs_trigger", filePattern: "*.sqs_trigger.yaml" },
     { name: "GcpTrigger", schemaKey: "gcp_trigger", filePattern: "*.gcp_trigger.yaml" },
+    { name: "AzureTrigger", schemaKey: "azure_trigger", filePattern: "*.azure_trigger.yaml" },
   ],
   "schedules": [
     { name: "Schedule", schemaKey: "schedule", filePattern: "*.schedule.yaml" },
diff --git a/cli/src/types.ts b/cli/src/types.ts
index 495d27b9c1..a854b16419 100644
--- a/cli/src/types.ts
+++ b/cli/src/types.ts
@@ -61,6 +61,7 @@ export const TRIGGER_TYPES = [
   "mqtt",
   "sqs",
   "gcp",
+  "azure",
   "email",
 ] as const;
 
@@ -204,6 +205,8 @@ export async function pushObj(
     await pushTrigger("sqs", workspace, p, befObj, newObj, permissionedAsContext);
   } else if (typeEnding === "gcp_trigger") {
     await pushTrigger("gcp", workspace, p, befObj, newObj, permissionedAsContext);
+  } else if (typeEnding === "azure_trigger") {
+    await pushTrigger("azure", workspace, p, befObj, newObj, permissionedAsContext);
   } else if (typeEnding === "email_trigger") {
     await pushTrigger("email", workspace, p, befObj, newObj, permissionedAsContext);
   } else if (typeEnding === "native_trigger") {
@@ -263,6 +266,7 @@ export function getTypeStrFromPath(
   | "mqtt_trigger"
   | "sqs_trigger"
   | "gcp_trigger"
+  | "azure_trigger"
   | "email_trigger"
   | "native_trigger"
   | "user"
@@ -343,6 +347,7 @@ export function getTypeStrFromPath(
     typeEnding === "mqtt_trigger" ||
     typeEnding === "sqs_trigger" ||
     typeEnding === "gcp_trigger" ||
+    typeEnding === "azure_trigger" ||
     typeEnding === "email_trigger" ||
     typeEnding === "user" ||
     typeEnding === "group" ||
diff --git a/cli/test/list_get_new_commands.test.ts b/cli/test/list_get_new_commands.test.ts
index df3d109630..bd574b1998 100644
--- a/cli/test/list_get_new_commands.test.ts
+++ b/cli/test/list_get_new_commands.test.ts
@@ -668,4 +668,32 @@ describe("new command", () => {
       expect(content).toContain("topics");
     });
   });
+
+  test("trigger new --kind azure creates azure trigger yaml template", async () => {
+    await withTestBackend(async (backend, tempDir) => {
+      await setupWorkspaceProfile(backend);
+
+      await mkdir(join(tempDir, "f", "test"), { recursive: true });
+
+      const result = await backend.runCLICommand(
+        ["trigger", "new", "f/test/azure_trigger", "--kind", "azure"],
+        tempDir
+      );
+
+      expect(result.code).toEqual(0);
+
+      const filePath = join(
+        tempDir,
+        "f/test/azure_trigger.azure_trigger.yaml"
+      );
+      const fileStat = await stat(filePath);
+      expect(fileStat.isFile()).toBe(true);
+
+      const content = await readFile(filePath, "utf-8");
+      expect(content).toContain("azure_resource_path");
+      expect(content).toContain("azure_mode");
+      expect(content).toContain("scope_resource_id");
+      expect(content).toContain("subscription_name");
+    });
+  });
 });
diff --git a/frontend/src/lib/components/CompareWorkspaces.svelte b/frontend/src/lib/components/CompareWorkspaces.svelte
index 3ace24d1fb..d9e94264a9 100644
--- a/frontend/src/lib/components/CompareWorkspaces.svelte
+++ b/frontend/src/lib/components/CompareWorkspaces.svelte
@@ -25,6 +25,7 @@
 		EmailTriggerService,
 		FlowService,
 		FolderService,
+		AzureTriggerService,
 		GcpTriggerService,
 		HttpTriggerService,
 		KafkaTriggerService,
@@ -53,6 +54,7 @@
 	import MqttTriggerEditor from './triggers/mqtt/MqttTriggerEditor.svelte'
 	import SqsTriggerEditor from './triggers/sqs/SqsTriggerEditor.svelte'
 	import GcpTriggerEditor from './triggers/gcp/GcpTriggerEditor.svelte'
+	import AzureTriggerEditor from './triggers/azure/AzureTriggerEditor.svelte'
 	import EmailTriggerEditor from './triggers/email/EmailTriggerEditor.svelte'
 	import { userWorkspaces, workspaceStore } from '$lib/stores'
 
@@ -640,6 +642,7 @@
 	let mqttEditor: MqttTriggerEditor | undefined = $state()
 	let sqsEditor: SqsTriggerEditor | undefined = $state()
 	let gcpEditor: GcpTriggerEditor | undefined = $state()
+	let azureEditor: AzureTriggerEditor | undefined = $state()
 	let emailEditor: EmailTriggerEditor | undefined = $state()
 
 	function openTriggerDetails(trigger: ForkTrigger) {
@@ -672,6 +675,9 @@
 			case 'gcp':
 				gcpEditor?.openEdit(trigger.path, isFlow)
 				break
+			case 'azure':
+				azureEditor?.openEdit(trigger.path, isFlow)
+				break
 			case 'emails':
 				emailEditor?.openEdit(trigger.path, isFlow)
 				break
@@ -794,6 +800,19 @@
 				extraLabel: item.topic_id
 			})
 		},
+		azure: {
+			list: (ws: string) => AzureTriggerService.listAzureTriggers({ workspace: ws }),
+			delete: (ws: string, path: string) =>
+				AzureTriggerService.deleteAzureTrigger({ workspace: ws, path }),
+			normalize: (item: any): ForkTrigger => ({
+				path: item.path,
+				triggerKind: 'azure',
+				scriptPath: item.script_path,
+				isFlow: item.is_flow,
+				enabled: item.mode === 'enabled',
+				extraLabel: item.topic_name ?? item.scope_resource_id
+			})
+		},
 		emails: {
 			list: (ws: string) => EmailTriggerService.listEmailTriggers({ workspace: ws }),
 			delete: (ws: string, path: string) =>
@@ -1316,6 +1335,7 @@
 	<MqttTriggerEditor bind:this={mqttEditor} />
 	<SqsTriggerEditor bind:this={sqsEditor} />
 	<GcpTriggerEditor bind:this={gcpEditor} />
+	<AzureTriggerEditor bind:this={azureEditor} />
 	<EmailTriggerEditor bind:this={emailEditor} />
 
 	<ConfirmationModal
diff --git a/frontend/src/lib/components/Path.svelte b/frontend/src/lib/components/Path.svelte
index 3aaa47ac9c..6e1244b05f 100644
--- a/frontend/src/lib/components/Path.svelte
+++ b/frontend/src/lib/components/Path.svelte
@@ -22,6 +22,7 @@
 		MqttTriggerService,
 		SqsTriggerService,
 		GcpTriggerService,
+		AzureTriggerService,
 		EmailTriggerService
 	} from '$lib/gen'
 	import { superadmin, userStore, workspaceStore } from '$lib/stores'
@@ -55,6 +56,7 @@
 		| 'mqtt_trigger'
 		| 'sqs_trigger'
 		| 'gcp_trigger'
+		| 'azure_trigger'
 		| 'email_trigger'
 	let meta: Meta | undefined = $state(undefined)
 	interface Props {
@@ -300,6 +302,11 @@
 				workspace: $workspaceStore!,
 				path: path
 			})
+		} else if (kind === 'azure_trigger') {
+			return await AzureTriggerService.existsAzureTrigger({
+				workspace: $workspaceStore!,
+				path: path
+			})
 		} else if (kind === 'email_trigger') {
 			return await EmailTriggerService.existsEmailTrigger({
 				workspace: $workspaceStore!,
diff --git a/frontend/src/lib/components/ShareModal.svelte b/frontend/src/lib/components/ShareModal.svelte
index 357cd55946..0996e6ca7b 100644
--- a/frontend/src/lib/components/ShareModal.svelte
+++ b/frontend/src/lib/components/ShareModal.svelte
@@ -41,6 +41,7 @@
 		| 'sqs_trigger'
 		| 'postgres_trigger'
 		| 'gcp_trigger'
+		| 'azure_trigger'
 		| 'email_trigger'
 		| 'volume'
 	let kind: Kind
diff --git a/frontend/src/lib/components/graph/renderers/triggers/TriggersBadge.svelte b/frontend/src/lib/components/graph/renderers/triggers/TriggersBadge.svelte
index bcd85954dd..d7340e053a 100644
--- a/frontend/src/lib/components/graph/renderers/triggers/TriggersBadge.svelte
+++ b/frontend/src/lib/components/graph/renderers/triggers/TriggersBadge.svelte
@@ -6,6 +6,7 @@
 	import { type TriggerContext } from '$lib/components/triggers'
 	import { enterpriseLicense } from '$lib/stores'
 	import { MqttIcon, NatsIcon, KafkaIcon, AwsIcon, GoogleCloudIcon } from '$lib/components/icons'
+	import AzureIcon from '$lib/components/icons/AzureIcon.svelte'
 	import { type Trigger, type TriggerType } from '$lib/components/triggers/utils'
 	import { Menu, Menubar, MeltButton, MenuItem, Tooltip } from '$lib/components/meltComponents'
 	import { twMerge } from 'tailwind-merge'
@@ -70,6 +71,7 @@
 			mqtt: { icon: MqttIcon, countKey: 'mqtt_count', disabled: !$enterpriseLicense },
 			sqs: { icon: AwsIcon, countKey: 'sqs_count', disabled: !$enterpriseLicense },
 			gcp: { icon: GoogleCloudIcon, countKey: 'gcp_count', disabled: !$enterpriseLicense },
+			azure: { icon: AzureIcon, countKey: 'azure_count', disabled: !$enterpriseLicense },
 			poll: { icon: SchedulePollIcon },
 			cli: { icon: Terminal },
 			nextcloud: { icon: NextcloudIcon, countKey: 'nextcloud_count' },
@@ -103,6 +105,7 @@
 		'mqtt',
 		'sqs',
 		'gcp',
+		'azure',
 		'email',
 		'poll',
 		'cli',
diff --git a/frontend/src/lib/components/icons/AzureIcon.svelte b/frontend/src/lib/components/icons/AzureIcon.svelte
index 4940e9b43e..c6c3b6d60b 100644
--- a/frontend/src/lib/components/icons/AzureIcon.svelte
+++ b/frontend/src/lib/components/icons/AzureIcon.svelte
@@ -1,35 +1,22 @@
 <script lang="ts">
 	interface Props {
-		height?: string;
-		width?: string;
+		size?: number
+		color?: string | undefined
+		class?: string
 	}
 
-	let { height = '24px', width = '24px' }: Props = $props();
+	let { size = 16, color = undefined, class: clazz = '' }: Props = $props()
 </script>
 
-<svg id="azure" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 374.5 377.3" {width} {height}
-	><style>
-		.st0-azure {
-			fill: #00bef2;
-		}
-		.st1-azure {
-			fill: #fff;
-			stroke: #fff;
-			stroke-width: 1.2357;
-			stroke-linecap: round;
-			stroke-linejoin: round;
-		}
-	</style><g id="layer1" transform="translate(-39.022 -78.115)"
-		><g id="g1016" transform="translate(-63.947 -88.179)"
-			><path
-				id="path1008"
-				class="st0-azure"
-				d="M290 166.3c.4 0 .8.5 1.4 1.4.5.8 42.6 51.3 93.6 112.2 51 60.9 92.6 111 92.4 111.3-.1.3-40.7 33.6-90.2 73.9s-91.6 74.6-93.5 76.2c-3.3 2.7-3.5 2.8-4.7 1.6-.7-.7-42.9-35.2-93.8-76.7S102.8 390.5 103 390c.2-.5 42-50.4 93.1-111s92.9-110.7 93.1-111.5c.2-.8.5-1.2.8-1.2z"
-			/><path
-				id="path923"
-				class="st1-azure"
-				d="M283.1 483.6c-5.8-2.1-12.8-8.1-15.7-13.7-3.6-6.9-3.3-17.7.7-26.3 3.1-6.4 3.1-6.6 1.1-8.1-1.1-.8-14.4-8.2-29.4-16.3-15-8.1-28.1-15.2-29-15.7-1.2-.7-3.2 0-6.8 2.3-11.7 7.4-23.9 6.6-33.5-2.3-6.9-6.4-8.9-10.9-8.9-20.1 0-8.9 1.8-13.5 7.5-19.2 7.7-7.7 18-10.3 27.9-7 5.4 1.8 5.5 1.8 8.9-.8 4-3 36.1-32.3 51.6-47l10.7-10.2-3.2-6.7c-6.5-13.5-3.2-28.5 8.2-37.5 6.2-4.9 10.8-6.4 19.7-6.4 20.8 0 35.3 21.8 27.5 41.3-2.1 5.4-2.1 5.5-.1 8.8 1.7 2.9 30.6 37.8 45.9 55.6 2.7 3.1 5.7 5.6 6.7 5.6s4.4-1 7.6-2.2c14.9-5.9 30.6.7 36.8 15.5 4 9.5.5 22.3-8 30-6 5.4-10.4 7.1-18.4 7.1-5.6 0-7.7-.6-13.6-3.8-4.4-2.4-7.8-3.6-9.2-3.2-2.4.6-39.3 25.9-47.5 32.5-5 4.1-5.4 5.6-2.8 11.7 2.5 6 2.2 15.4-.6 21.3-3.1 6.5-10.8 13-17.5 15-6.8 1.9-10.9 1.9-16.6-.2zm1.7-110.2v-57l-3.2-4.4c-1.8-2.4-3.5-4.4-3.8-4.4-1.3 0-65.9 58.7-65.9 59.9 0 .3 1 3.3 2.2 6.5 1.2 3.3 2.1 8 2 10.7-.1 2.7-.1 5.7-.1 6.7.1 2.3 21.7 16.1 54.1 34.8 8.9 5.2 12 6.5 13.1 5.6 1.3-1.1 1.6-12.2 1.6-58.4zm27.4 50.4c42.8-26.9 50.8-32.3 51.3-34.3.3-1.2.7-5.9.8-10.6l.3-8.4-21.8-25.9c-23.4-27.7-32-37.1-34-37.1-.7 0-4.2 2-7.8 4.4l-6.6 4.4.3 56.9c.3 51 .7 59.6 2.6 59.6.2.1 7-4 14.9-9z"
-			/></g
-		></g
-	></svg
+<svg
+	xmlns="http://www.w3.org/2000/svg"
+	width={`${size}px`}
+	height={`${size}px`}
+	viewBox="0 0 24 24"
+	fill={color ?? 'currentColor'}
+	class={clazz}
 >
+	<path
+		d="M22.379 23.343a1.62 1.62 0 0 0 1.536-1.1l.029-.092q.053-.164.081-.336v-.016a1.68 1.68 0 0 0-.268-1.227L15.147 5.44a1.63 1.63 0 0 0-1.354-.724l-3.473.011L5.94 8.57a6 6 0 0 0-1.386 1.74L.262 17.717a1.63 1.63 0 0 0 1.422 2.429l-.055-.013zM13.398 7.25l5.322 9.183-10.683.024zm-3.363 12.754-8.316.021 8.318-14.4 1.795 3.1-6.516 11.274z"
+	/>
+</svg>
diff --git a/frontend/src/lib/components/offboarding-utils.ts b/frontend/src/lib/components/offboarding-utils.ts
index 45cb8cb4b2..791d65e8d6 100644
--- a/frontend/src/lib/components/offboarding-utils.ts
+++ b/frontend/src/lib/components/offboarding-utils.ts
@@ -31,6 +31,7 @@ const TRIGGER_TABLE_TO_ROUTE: Record<string, string> = {
 	nats_trigger: 'nats_triggers',
 	sqs_trigger: 'sqs_triggers',
 	gcp_trigger: 'gcp_triggers',
+	azure_trigger: 'azure_triggers',
 	email_trigger: 'email_triggers'
 }
 
@@ -43,6 +44,7 @@ const TRIGGER_TABLE_TO_LABEL: Record<string, string> = {
 	nats_trigger: 'nats trigger',
 	sqs_trigger: 'sqs trigger',
 	gcp_trigger: 'gcp trigger',
+	azure_trigger: 'azure trigger',
 	email_trigger: 'email trigger'
 }
 
diff --git a/frontend/src/lib/components/search/GlobalSearchModal.svelte b/frontend/src/lib/components/search/GlobalSearchModal.svelte
index 3fa32d6db9..21b79ea6b9 100644
--- a/frontend/src/lib/components/search/GlobalSearchModal.svelte
+++ b/frontend/src/lib/components/search/GlobalSearchModal.svelte
@@ -40,7 +40,7 @@
 	import { Alert } from '../common'
 	import Popover from '../Popover.svelte'
 	import Logs from 'lucide-svelte/icons/logs'
-	import { AwsIcon, GoogleCloudIcon, KafkaIcon, MqttIcon, NatsIcon } from '../icons'
+	import { AwsIcon, AzureIcon, GoogleCloudIcon, KafkaIcon, MqttIcon, NatsIcon } from '../icons'
 	import RunsSearch from './RunsSearch.svelte'
 	import AskAiButton from '../copilot/AskAiButton.svelte'
 
@@ -138,6 +138,13 @@
 			icon: GoogleCloudIcon,
 			disabled: $userStore?.operator
 		},
+		{
+			search_id: 'nav:azure_event_grid',
+			label: 'Go to Azure Event Grid' + (!$enterpriseLicense ? '' : ' (EE)'),
+			action: (newtab: boolean = false) => gotoPage('/azure_triggers', newtab),
+			icon: AzureIcon,
+			disabled: $userStore?.operator
+		},
 		{
 			search_id: 'nav:mqtt_triggers',
 			label: 'Go to MQTT triggers',
diff --git a/frontend/src/lib/components/sidebar/OperatorMenu.svelte b/frontend/src/lib/components/sidebar/OperatorMenu.svelte
index 2b916550ff..b3b30aa710 100644
--- a/frontend/src/lib/components/sidebar/OperatorMenu.svelte
+++ b/frontend/src/lib/components/sidebar/OperatorMenu.svelte
@@ -151,6 +151,12 @@
 					href: `${base}/gcp_triggers`,
 					kind: 'gcp'
 				},
+				{
+					label: 'Azure Event Grid triggers',
+					id: 'triggers',
+					href: `${base}/azure_triggers`,
+					kind: 'azure'
+				},
 				{ label: 'MQTT triggers', id: 'triggers', href: `${base}/mqtt_triggers`, kind: 'mqtt' },
 				{ label: 'Email triggers', id: 'triggers', href: `${base}/email_triggers`, kind: 'email' }
 			] as TriggerMenuLink[]
diff --git a/frontend/src/lib/components/sidebar/SidebarContent.svelte b/frontend/src/lib/components/sidebar/SidebarContent.svelte
index 91e71ff191..8ec3076b40 100644
--- a/frontend/src/lib/components/sidebar/SidebarContent.svelte
+++ b/frontend/src/lib/components/sidebar/SidebarContent.svelte
@@ -74,6 +74,7 @@
 	} from '$lib/components/meltComponents'
 	import MenuButton from './MenuButton.svelte'
 	import GoogleCloudIcon from '../icons/GoogleCloudIcon.svelte'
+	import AzureIcon from '../icons/AzureIcon.svelte'
 
 	async function leaveWorkspace() {
 		await WorkspaceService.leaveWorkspace({ workspace: $workspaceStore ?? '' })
@@ -365,6 +366,15 @@
 			aiId: 'sidebar-menu-link-gcp',
 			aiDescription: 'Button to navigate to GCP Pub/Sub triggers'
 		},
+		{
+			label: 'Azure Event Grid' + ($enterpriseLicense ? '' : ' (EE)'),
+			href: '/azure_triggers',
+			icon: AzureIcon,
+			disabled: $userStore?.operator || !$enterpriseLicense,
+			kind: 'azure',
+			aiId: 'sidebar-menu-link-azure',
+			aiDescription: 'Button to navigate to Azure Event Grid triggers'
+		},
 		{
 			label: 'MQTT',
 			href: '/mqtt_triggers',
diff --git a/frontend/src/lib/components/triggers.ts b/frontend/src/lib/components/triggers.ts
index 988df6149b..a870b9a622 100644
--- a/frontend/src/lib/components/triggers.ts
+++ b/frontend/src/lib/components/triggers.ts
@@ -56,6 +56,7 @@ export type TriggerKind =
 	| 'mqtt'
 	| 'sqs'
 	| 'gcp'
+	| 'azure'
 	| 'nextcloud'
 	| 'google'
 	| 'github'
diff --git a/frontend/src/lib/components/triggers/AddTriggersButton.svelte b/frontend/src/lib/components/triggers/AddTriggersButton.svelte
index ea381a6ccc..19daa64489 100644
--- a/frontend/src/lib/components/triggers/AddTriggersButton.svelte
+++ b/frontend/src/lib/components/triggers/AddTriggersButton.svelte
@@ -104,6 +104,12 @@
 				icon: triggerIconMap.gcp,
 				extra: cloudHosted ? extra : undefined
 			},
+			{
+				displayName: 'Azure Event Grid',
+				action: () => onAddDraftTrigger?.('azure'),
+				icon: triggerIconMap.azure,
+				extra: cloudHosted ? extra : undefined
+			},
 			{
 				displayName: 'Email',
 				action: () => onAddDraftTrigger?.('email'),
diff --git a/frontend/src/lib/components/triggers/CaptureWrapper.svelte b/frontend/src/lib/components/triggers/CaptureWrapper.svelte
index 0c763987a9..2c56681230 100644
--- a/frontend/src/lib/components/triggers/CaptureWrapper.svelte
+++ b/frontend/src/lib/components/triggers/CaptureWrapper.svelte
@@ -15,6 +15,7 @@
 	import MqttCapture from './mqtt/MqttCapture.svelte'
 	import SqsCapture from './sqs/SqsCapture.svelte'
 	import GcpCapture from './gcp/GcpCapture.svelte'
+	import AzureCapture from './azure/AzureCapture.svelte'
 	import EmailCapture from './email/EmailCapture.svelte'
 
 	interface Props {
@@ -74,7 +75,12 @@
 		if (captureType === 'gcp' && args.delivery_type === 'push') {
 			return false
 		}
-		return ['mqtt', 'sqs', 'websocket', 'postgres', 'kafka', 'nats', 'gcp'].includes(captureType)
+		if (captureType === 'azure' && args.azure_mode !== 'namespace_pull') {
+			return false
+		}
+		return ['mqtt', 'sqs', 'websocket', 'postgres', 'kafka', 'nats', 'gcp', 'azure'].includes(
+			captureType
+		)
 	}
 
 	async function getCaptureConfigs() {
@@ -324,6 +330,20 @@
 				on:captureToggle={handleCapture}
 				on:testWithArgs
 			/>
+		{:else if captureType === 'azure'}
+			<AzureCapture
+				{isValid}
+				{captureInfo}
+				{hasPreprocessor}
+				{isFlow}
+				{captureLoading}
+				subscriptionName={args.subscription_name}
+				on:applyArgs
+				on:updateSchema
+				on:addPreprocessor
+				on:captureToggle={handleCapture}
+				on:testWithArgs
+			/>
 		{:else if captureType === 'email'}
 			<EmailCapture
 				local_part={args.local_part}
diff --git a/frontend/src/lib/components/triggers/TriggersEditor.svelte b/frontend/src/lib/components/triggers/TriggersEditor.svelte
index c7187848ee..3f886be4ee 100644
--- a/frontend/src/lib/components/triggers/TriggersEditor.svelte
+++ b/frontend/src/lib/components/triggers/TriggersEditor.svelte
@@ -28,6 +28,7 @@
 		MqttTriggerService,
 		HttpTriggerService,
 		GcpTriggerService,
+		AzureTriggerService,
 		SqsTriggerService,
 		EmailTriggerService,
 		NativeTriggerService,
@@ -112,6 +113,7 @@
 			kafka: () => KafkaTriggerService.deleteKafkaTrigger,
 			nats: () => NatsTriggerService.deleteNatsTrigger,
 			gcp: () => GcpTriggerService.deleteGcpTrigger,
+			azure: () => AzureTriggerService.deleteAzureTrigger,
 			sqs: () => SqsTriggerService.deleteSqsTrigger,
 			mqtt: () => MqttTriggerService.deleteMqttTrigger,
 			http: () => HttpTriggerService.deleteHttpTrigger,
@@ -229,6 +231,14 @@
 				isFlow,
 				$userStore
 			)
+		} else if (triggerType === 'azure') {
+			await triggersState.fetchAzureTriggers(
+				triggersCount,
+				$workspaceStore,
+				currentPath,
+				isFlow,
+				$userStore
+			)
 		} else if (triggerType === 'sqs') {
 			await triggersState.fetchSqsTriggers(
 				triggersCount,
diff --git a/frontend/src/lib/components/triggers/TriggersWrapper.svelte b/frontend/src/lib/components/triggers/TriggersWrapper.svelte
index 490ff02b53..6b9399c6a2 100644
--- a/frontend/src/lib/components/triggers/TriggersWrapper.svelte
+++ b/frontend/src/lib/components/triggers/TriggersWrapper.svelte
@@ -10,6 +10,7 @@
 	import MqttTriggerPanel from './mqtt/MqttTriggersPanel.svelte'
 	import SqsTriggerPanel from './sqs/SqsTriggerPanel.svelte'
 	import GcpTriggerPanel from './gcp/GcpTriggerPanel.svelte'
+	import AzureTriggerPanel from './azure/AzureTriggerPanel.svelte'
 	import ScheduledPollPanel from './scheduled/ScheduledPollPanel.svelte'
 	import WebsocketTriggersPanel from './websocket/WebsocketTriggersPanel.svelte'
 	import { triggerIconMap, type Trigger } from './utils'
@@ -160,6 +161,15 @@
 		{customLabel}
 		{...props}
 	/>
+{:else if selectedTrigger.type === 'azure'}
+	<AzureTriggerPanel
+		{isFlow}
+		path={initialPath || fakeInitialPath}
+		{selectedTrigger}
+		defaultValues={selectedTrigger.draftConfig ?? selectedTrigger.captureConfig ?? undefined}
+		{customLabel}
+		{...props}
+	/>
 {:else if selectedTrigger.type === 'email'}
 	<EmailTriggerPanel
 		{isFlow}
diff --git a/frontend/src/lib/components/triggers/azure/AzureCapture.svelte b/frontend/src/lib/components/triggers/azure/AzureCapture.svelte
new file mode 100644
index 0000000000..e32ad07a85
--- /dev/null
+++ b/frontend/src/lib/components/triggers/azure/AzureCapture.svelte
@@ -0,0 +1,63 @@
+<script lang="ts">
+	import type { CaptureInfo } from '../CaptureSection.svelte'
+	import CaptureSection from '../CaptureSection.svelte'
+	import { Url } from '$lib/components/common'
+	import { fade } from 'svelte/transition'
+
+	interface Props {
+		captureInfo?: CaptureInfo | undefined
+		isValid?: boolean | undefined
+		hasPreprocessor?: boolean
+		isFlow?: boolean
+		captureLoading?: boolean
+		subscriptionName?: string | undefined
+	}
+
+	let {
+		captureInfo = undefined,
+		isValid = undefined,
+		hasPreprocessor = false,
+		isFlow = false,
+		captureLoading = false,
+		subscriptionName = undefined
+	}: Props = $props()
+
+	// Mirror the backend suffix in set_azure_trigger_config: truncate to 39 then
+	// append "-wm-capture". Azure rule: [A-Za-z0-9-]{3,50}.
+	const captureSubscriptionName = $derived(
+		subscriptionName
+			? `${subscriptionName.length > 39 ? subscriptionName.slice(0, 39) : subscriptionName}-wm-capture`
+			: undefined
+	)
+</script>
+
+{#if captureInfo}
+	<CaptureSection
+		captureType="azure"
+		disabled={isValid === false}
+		{captureInfo}
+		on:captureToggle
+		on:applyArgs
+		on:updateSchema
+		on:addPreprocessor
+		on:testWithArgs
+		{hasPreprocessor}
+		{isFlow}
+		{captureLoading}
+	>
+		{#snippet description()}
+			{#if captureInfo.active}
+				<p in:fade={{ duration: 100, delay: 50 }} out:fade={{ duration: 50 }}>
+					Listening to Azure Event Grid events...
+				</p>
+			{:else}
+				<p in:fade={{ duration: 100, delay: 50 }} out:fade={{ duration: 50 }}>
+					Start capturing to listen to Azure Event Grid events.
+				</p>
+			{/if}
+		{/snippet}
+		{#if captureSubscriptionName}
+			<Url label="Test subscription name" url={captureSubscriptionName} />
+		{/if}
+	</CaptureSection>
+{/if}
diff --git a/frontend/src/lib/components/triggers/azure/AzureTriggerEditor.svelte b/frontend/src/lib/components/triggers/azure/AzureTriggerEditor.svelte
new file mode 100644
index 0000000000..bf7dec9d8b
--- /dev/null
+++ b/frontend/src/lib/components/triggers/azure/AzureTriggerEditor.svelte
@@ -0,0 +1,29 @@
+<script lang="ts">
+	import { tick } from 'svelte'
+	import AzureTriggerEditorInner from './AzureTriggerEditorInner.svelte'
+
+	let { onUpdate }: { onUpdate?: (path?: string) => void } = $props()
+
+	let open = $state(false)
+	export async function openEdit(ePath: string, isFlow: boolean) {
+		open = true
+		await tick()
+		drawer?.openEdit(ePath, isFlow)
+	}
+
+	export async function openNew(
+		is_flow: boolean,
+		initial_script_path?: string,
+		defaultValues?: Record<string, any>
+	) {
+		open = true
+		await tick()
+		drawer?.openNew(is_flow, initial_script_path, defaultValues)
+	}
+
+	let drawer: AzureTriggerEditorInner | undefined = $state()
+</script>
+
+{#if open}
+	<AzureTriggerEditorInner {onUpdate} bind:this={drawer} />
+{/if}
diff --git a/frontend/src/lib/components/triggers/azure/AzureTriggerEditorConfigSection.svelte b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorConfigSection.svelte
new file mode 100644
index 0000000000..992fab62b6
--- /dev/null
+++ b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorConfigSection.svelte
@@ -0,0 +1,351 @@
+<script lang="ts">
+	import Section from '$lib/components/Section.svelte'
+	import ResourcePicker from '$lib/components/ResourcePicker.svelte'
+	import Subsection from '$lib/components/Subsection.svelte'
+	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
+	import Select from '$lib/components/select/Select.svelte'
+	import { Alert, Button } from '$lib/components/common'
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import type { AzureMode, AzureArmResource } from '$lib/gen'
+	import { AzureTriggerService } from '$lib/gen'
+	import { emptyStringTrimmed } from '$lib/utils'
+	import { workspaceStore } from '$lib/stores'
+	import { RefreshCw } from 'lucide-svelte'
+
+	interface Props {
+		can_write?: boolean
+		headless?: boolean
+		isValid?: boolean
+		azure_resource_path: string
+		azure_mode: AzureMode
+		scope_resource_id: string
+		topic_name?: string
+		subscription_name: string
+		event_type_filters?: string[]
+		path?: string
+	}
+
+	let {
+		can_write = false,
+		headless = false,
+		isValid = $bindable(false),
+		azure_resource_path = $bindable(),
+		azure_mode = $bindable(),
+		scope_resource_id = $bindable(),
+		topic_name = $bindable(),
+		subscription_name = $bindable(),
+		event_type_filters = $bindable(),
+		path = ''
+	}: Props = $props()
+
+	type Edition = 'basic' | 'namespace'
+	type Delivery = 'push' | 'pull'
+
+	const edition = $derived<Edition>(azure_mode === 'basic_push' ? 'basic' : 'namespace')
+	const delivery = $derived<Delivery>(azure_mode === 'namespace_pull' ? 'pull' : 'push')
+
+	function setEdition(next: Edition) {
+		if (next === 'basic') {
+			azure_mode = 'basic_push'
+		} else {
+			azure_mode = delivery === 'pull' ? 'namespace_pull' : 'namespace_push'
+		}
+	}
+
+	function setDelivery(next: Delivery) {
+		azure_mode = next === 'pull' ? 'namespace_pull' : 'namespace_push'
+	}
+
+	$effect(() => {
+		if (azure_mode === 'basic_push' && topic_name !== undefined && topic_name !== '') {
+			topic_name = undefined
+		}
+	})
+
+	$effect(() => {
+		if (emptyStringTrimmed(subscription_name) && !emptyStringTrimmed(path) && $workspaceStore) {
+			const generated = `windmill-${$workspaceStore}-${path.replaceAll(/[^A-Za-z0-9-]/g, '-')}`
+			subscription_name = generated.slice(0, 50)
+		}
+	})
+
+	const is_namespace = $derived(edition === 'namespace')
+
+	const has_sp = $derived(!emptyStringTrimmed(azure_resource_path))
+	const has_scope = $derived(!emptyStringTrimmed(scope_resource_id))
+	const has_topic = $derived(!is_namespace || !emptyStringTrimmed(topic_name))
+	const config_ready = $derived(has_sp && has_scope && has_topic)
+
+	const scopeLabel = $derived(is_namespace ? 'Namespace' : 'Topic')
+	const scopeTooltip = $derived(
+		is_namespace
+			? 'Event Grid Namespace — loaded via the service principal. Refresh after creating one.'
+			: 'Basic Event Grid topic or system topic — loaded via the service principal.'
+	)
+
+	// ARM resource loading -----------------------------------------------
+	let scopeResources = $state<AzureArmResource[]>([])
+	let scopeLoading = $state(false)
+	let scopeError = $state<string | undefined>(undefined)
+
+	async function loadScopeResources() {
+		if (!$workspaceStore || emptyStringTrimmed(azure_resource_path)) {
+			scopeResources = []
+			return
+		}
+		scopeLoading = true
+		scopeError = undefined
+		try {
+			const result = is_namespace
+				? await AzureTriggerService.listAzureNamespaces({
+						workspace: $workspaceStore,
+						path: azure_resource_path
+					})
+				: await AzureTriggerService.listAzureBasicTopics({
+						workspace: $workspaceStore,
+						path: azure_resource_path
+					})
+			scopeResources = result
+			// Clear selection if it no longer matches any entry in the new list
+			// (e.g. flipped edition, swapped SP).
+			if (scope_resource_id && !result.some((r) => r.id === scope_resource_id)) {
+				scope_resource_id = ''
+				topic_name = undefined
+			}
+		} catch (e: any) {
+			scopeError = e?.body?.error?.message ?? e?.message ?? String(e)
+			scopeResources = []
+		} finally {
+			scopeLoading = false
+		}
+	}
+
+	$effect(() => {
+		// Re-fetch when SP changes or edition flips.
+		void azure_resource_path
+		void edition
+		loadScopeResources()
+	})
+
+	const scopeItems = $derived(
+		scopeResources.map((r) => ({
+			label: r.name + (r.type?.toLowerCase().includes('systemtopic') ? ' (system)' : ''),
+			value: r.id,
+			subtext: r.id
+		}))
+	)
+
+	let topics = $state<{ name: string; id: string }[]>([])
+	let topicsLoading = $state(false)
+	let topicsError = $state<string | undefined>(undefined)
+
+	async function loadTopics() {
+		if (
+			!is_namespace ||
+			!$workspaceStore ||
+			emptyStringTrimmed(azure_resource_path) ||
+			emptyStringTrimmed(scope_resource_id)
+		) {
+			topics = []
+			return
+		}
+		topicsLoading = true
+		topicsError = undefined
+		try {
+			const result = await AzureTriggerService.listAzureNamespaceTopics({
+				workspace: $workspaceStore,
+				path: azure_resource_path,
+				requestBody: { scope_resource_id }
+			})
+			topics = (result as any[]).map((t) => ({ name: t.name, id: t.id }))
+			if (topic_name && !topics.some((t) => t.name === topic_name)) {
+				topic_name = undefined
+			}
+		} catch (e: any) {
+			topicsError = e?.body?.error?.message ?? e?.message ?? String(e)
+			topics = []
+		} finally {
+			topicsLoading = false
+		}
+	}
+
+	$effect(() => {
+		void scope_resource_id
+		void azure_resource_path
+		void is_namespace
+		loadTopics()
+	})
+
+	const topicItems = $derived(topics.map((t) => ({ label: t.name, value: t.name })))
+
+	const AZURE_SUB_NAME_RE = /^[A-Za-z0-9-]{3,50}$/
+
+	const subscriptionNameError = $derived.by(() => {
+		if (emptyStringTrimmed(subscription_name)) return ''
+		return AZURE_SUB_NAME_RE.test(subscription_name)
+			? ''
+			: 'Must be 3–50 chars, letters/digits/hyphens only.'
+	})
+
+	$effect(() => {
+		const resource_ok = !emptyStringTrimmed(azure_resource_path)
+		const scope_ok = !emptyStringTrimmed(scope_resource_id)
+		const sub_ok = !emptyStringTrimmed(subscription_name) && subscriptionNameError === ''
+		const topic_ok = !is_namespace || !emptyStringTrimmed(topic_name)
+		isValid = resource_ok && scope_ok && sub_ok && topic_ok
+	})
+
+	const filterText = $derived(event_type_filters?.join('\n') ?? '')
+	function setFilterText(value: string) {
+		const list = value
+			.split(/\n|,/)
+			.map((v) => v.trim())
+			.filter((v) => v.length > 0)
+		event_type_filters = list.length > 0 ? list : undefined
+	}
+</script>
+
+<Section label="Azure Event Grid" {headless}>
+	<div class="flex flex-col gap-6">
+		<Subsection
+			label="Service Principal"
+			tooltip="Windmill resource of type `azure` (azureTenantId, azureClientId, azureClientSecret)."
+		>
+			<ResourcePicker bind:value={azure_resource_path} resourceType="azure" disabled={!can_write} />
+		</Subsection>
+
+		{#if has_sp}
+			<Subsection
+				label="Event Grid edition"
+				tooltip="Namespace is the newer product (2024 GA) with push + pull delivery and CloudEvents 1.0. Basic is the legacy service — use it for Azure system topics (Storage / Key Vault events etc.)."
+			>
+				<ToggleButtonGroup
+					selected={edition}
+					onSelected={(v) => setEdition(v as Edition)}
+					disabled={!can_write}
+				>
+					{#snippet children({ item })}
+						<ToggleButton value="namespace" label="Namespace" {item} />
+						<ToggleButton value="basic" label="Basic" {item} />
+					{/snippet}
+				</ToggleButtonGroup>
+			</Subsection>
+
+			{#if is_namespace}
+				<Subsection
+					label="Delivery mode"
+					tooltip="Push: Azure POSTs events to this Windmill instance (requires a public URL). Pull: Windmill polls Azure, better for retries and not requiring inbound exposure."
+				>
+					<ToggleButtonGroup
+						selected={delivery}
+						onSelected={(v) => setDelivery(v as Delivery)}
+						disabled={!can_write}
+					>
+						{#snippet children({ item })}
+							<ToggleButton value="pull" label="Pull" {item} />
+							<ToggleButton value="push" label="Push" {item} />
+						{/snippet}
+					</ToggleButtonGroup>
+				</Subsection>
+			{/if}
+
+			<Subsection label={scopeLabel} tooltip={scopeTooltip}>
+				<div class="flex items-center gap-2">
+					<div class="flex-1">
+						<Select
+							bind:value={scope_resource_id}
+							items={scopeItems}
+							placeholder={scopeLoading ? 'Loading…' : `Select ${scopeLabel.toLowerCase()}`}
+							disabled={!can_write || scopeLoading}
+							clearable
+						/>
+					</div>
+					<Button
+						variant="subtle"
+						startIcon={{ icon: RefreshCw }}
+						iconOnly
+						disabled={!can_write || scopeLoading}
+						onclick={loadScopeResources}
+					/>
+				</div>
+				{#if scopeError}
+					<p class="text-xs text-red-600 mt-1">{scopeError}</p>
+				{:else if !scopeLoading && scopeResources.length === 0}
+					<p class="text-xs text-tertiary mt-1">
+						No {scopeLabel.toLowerCase()} found. Create one in Azure and click refresh.
+					</p>
+				{/if}
+			</Subsection>
+		{/if}
+
+		{#if has_sp && is_namespace && has_scope}
+			<Subsection label="Topic" tooltip="Topic inside the selected Namespace.">
+				<div class="flex items-center gap-2">
+					<div class="flex-1">
+						<Select
+							bind:value={topic_name}
+							items={topicItems}
+							placeholder={topicsLoading ? 'Loading…' : 'Select topic'}
+							disabled={!can_write || topicsLoading}
+							clearable
+						/>
+					</div>
+					<Button
+						variant="subtle"
+						startIcon={{ icon: RefreshCw }}
+						iconOnly
+						disabled={!can_write || topicsLoading}
+						onclick={loadTopics}
+					/>
+				</div>
+				{#if topicsError}
+					<p class="text-xs text-red-600 mt-1">{topicsError}</p>
+				{/if}
+			</Subsection>
+		{/if}
+
+		{#if config_ready}
+			<Subsection
+				label="Subscription name"
+				tooltip="Auto-generated from the trigger path. Windmill creates this subscription on Azure (or overwrites it) on save."
+			>
+				<TextInput
+					bind:value={subscription_name}
+					inputProps={{
+						placeholder: 'leave empty to auto-generate',
+						disabled: !can_write
+					}}
+					error={subscriptionNameError}
+				/>
+				{#if subscriptionNameError}
+					<p class="text-xs text-red-600 mt-1">{subscriptionNameError}</p>
+				{/if}
+				<div class="mt-2">
+					<Alert title="Saving overwrites this subscription on Azure" type="warning" size="xs">
+						If a subscription with this name already exists with an incompatible delivery mode
+						(Push↔Pull) or endpoint type, Windmill will delete and recreate it — any in-flight
+						events in its queue will be dropped.
+					</Alert>
+				</div>
+			</Subsection>
+
+			<Subsection
+				label="Event type filters"
+				tooltip="Optional. One per line (or comma-separated). Forwarded as includedEventTypes."
+			>
+				<TextInput
+					value={filterText}
+					underlyingInputEl="textarea"
+					class="font-mono"
+					inputProps={{
+						placeholder: 'Microsoft.Storage.BlobCreated',
+						disabled: !can_write,
+						rows: 3,
+						oninput: (e) => setFilterText(e.currentTarget.value)
+					}}
+				/>
+			</Subsection>
+		{/if}
+	</div>
+</Section>
diff --git a/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
new file mode 100644
index 0000000000..87149dea68
--- /dev/null
+++ b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
@@ -0,0 +1,480 @@
+<script lang="ts">
+	import { Alert, Button } from '$lib/components/common'
+	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
+	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
+	import Path from '$lib/components/Path.svelte'
+	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
+	import { Loader2 } from 'lucide-svelte'
+	import Label from '$lib/components/Label.svelte'
+	import {
+		AzureTriggerService,
+		type AzureMode,
+		type Retry,
+		type ErrorHandler,
+		type TriggerMode
+	} from '$lib/gen'
+	import Section from '$lib/components/Section.svelte'
+	import ScriptPicker from '$lib/components/ScriptPicker.svelte'
+	import Required from '$lib/components/Required.svelte'
+	import AzureTriggerEditorConfigSection from './AzureTriggerEditorConfigSection.svelte'
+	import { type Snippet, untrack } from 'svelte'
+	import TriggerEditorToolbar from '../TriggerEditorToolbar.svelte'
+	import PermissionedAsLine from '../PermissionedAsLine.svelte'
+	import { saveAzureTriggerFromCfg } from './utils'
+	import { getHandlerType, handleConfigChange, type Trigger } from '../utils'
+	import { deepEqual } from 'fast-equals'
+	import TriggerSuspendedJobsAlert from '../TriggerSuspendedJobsAlert.svelte'
+	import TriggerSuspendedJobsModal from '../TriggerSuspendedJobsModal.svelte'
+	import { base } from '$lib/base'
+	import Tabs from '$lib/components/common/tabs/Tabs.svelte'
+	import Tab from '$lib/components/common/tabs/Tab.svelte'
+	import TriggerRetriesAndErrorHandler from '../TriggerRetriesAndErrorHandler.svelte'
+	import TriggerAdvancedBadges from '../TriggerAdvancedBadges.svelte'
+
+	let drawer: Drawer | undefined = $state(undefined)
+	let initialPath = $state('')
+	let edit = $state(true)
+	let itemKind: 'flow' | 'script' = $state('script')
+	let script_path = $state('')
+	let initialScriptPath = $state('')
+	let fixedScriptPath = $state('')
+	let path: string = $state('')
+	let pathError = $state('')
+	let mode = $state<TriggerMode>('enabled')
+	let dirtyPath = $state(false)
+	let can_write = $state(true)
+	let drawerLoading = $state(true)
+
+	let azure_resource_path: string = $state('')
+	let azure_mode: AzureMode = $state('namespace_pull')
+	let scope_resource_id: string = $state('')
+	let topic_name: string | undefined = $state(undefined)
+	let subscription_name: string = $state('')
+	let event_type_filters: string[] | undefined = $state(undefined)
+
+	let isValid = $state(false)
+	let initialConfig: Record<string, any> | undefined = undefined
+	let deploymentLoading = $state(false)
+	let permissionedAs = $state<string | undefined>(undefined)
+	let selectedPermissionedAs = $state<string | undefined>(undefined)
+	let preservePermissionedAs = $state(false)
+	let base_endpoint = $derived(`${window.location.origin}${base}`)
+
+	let optionTabSelected: 'error_handler' | 'retries' = $state('error_handler')
+	let errorHandlerSelected: ErrorHandler = $state('slack')
+	let error_handler_path: string | undefined = $state()
+	let error_handler_args: Record<string, any> = $state({})
+	let retry: Retry | undefined = $state()
+	let suspendedJobsModal = $state<TriggerSuspendedJobsModal | null>(null)
+	let originalConfig = $state<Record<string, any> | undefined>(undefined)
+
+	let {
+		useDrawer = true,
+		description = undefined,
+		hideTarget = false,
+		hideTooltips = false,
+		isEditor = false,
+		allowDraft = false,
+		trigger = undefined,
+		isDeployed = false,
+		customLabel = undefined,
+		onConfigChange = undefined,
+		onCaptureConfigChange = undefined,
+		onUpdate = undefined,
+		onDelete = undefined,
+		onReset = undefined,
+		cloudDisabled = false
+	}: {
+		useDrawer?: boolean
+		description?: Snippet | undefined
+		hideTarget?: boolean
+		hideTooltips?: boolean
+		isEditor?: boolean
+		allowDraft?: boolean
+		trigger?: Trigger
+		isDeployed?: boolean
+		customLabel?: Snippet
+		onConfigChange?: (cfg: Record<string, any>, saveDisabled: boolean, updated: boolean) => void
+		onCaptureConfigChange?: (cfg: Record<string, any>, isValid: boolean) => void
+		onUpdate?: (path?: string) => void
+		onDelete?: () => void
+		onReset?: () => void
+		cloudDisabled?: boolean
+	} = $props()
+
+	let hasChanged = $derived(!deepEqual(getAzureConfig(), originalConfig ?? {}))
+	const azureConfig = $derived.by(getAzureConfig)
+	const saveDisabled = $derived(
+		pathError != '' || emptyString(script_path) || !isValid || !can_write || !hasChanged
+	)
+	const captureConfig = $derived.by(untrack(() => isEditor) ? getAzureCaptureConfig : () => ({}))
+
+	export async function openEdit(
+		ePath: string,
+		isFlow: boolean,
+		defaultValues?: Record<string, any>
+	) {
+		drawerLoading = true
+		try {
+			drawer?.openDrawer()
+			initialPath = ePath
+			itemKind = isFlow ? 'flow' : 'script'
+			edit = true
+			dirtyPath = false
+			await loadTrigger(defaultValues)
+			originalConfig = structuredClone($state.snapshot(getAzureConfig()))
+		} catch (err) {
+			sendUserToast(`Could not load Azure trigger: ${err.body}`, true)
+		} finally {
+			drawerLoading = false
+			if (!defaultValues) {
+				initialConfig = structuredClone($state.snapshot(getAzureConfig()))
+			}
+		}
+	}
+
+	export async function openNew(
+		nis_flow: boolean,
+		fixedScriptPath_?: string,
+		defaultValues?: Record<string, any>
+	) {
+		drawerLoading = true
+		try {
+			drawer?.openDrawer()
+			itemKind = nis_flow ? 'flow' : 'script'
+			initialScriptPath = ''
+			fixedScriptPath = fixedScriptPath_ ?? ''
+			script_path = fixedScriptPath
+			azure_resource_path = defaultValues?.azure_resource_path ?? ''
+			azure_mode = defaultValues?.azure_mode ?? 'namespace_pull'
+			scope_resource_id = defaultValues?.scope_resource_id ?? ''
+			topic_name = defaultValues?.topic_name ?? undefined
+			subscription_name = defaultValues?.subscription_name ?? ''
+			event_type_filters = defaultValues?.event_type_filters ?? undefined
+			path = defaultValues?.path ?? ''
+			initialPath = ''
+			edit = false
+			dirtyPath = false
+			mode = defaultValues?.mode ?? 'enabled'
+			error_handler_path = defaultValues?.error_handler_path ?? undefined
+			error_handler_args = defaultValues?.error_handler_args ?? {}
+			retry = defaultValues?.retry ?? undefined
+			errorHandlerSelected = getHandlerType(error_handler_path ?? '')
+			permissionedAs = undefined
+			selectedPermissionedAs = undefined
+			preservePermissionedAs = false
+			originalConfig = undefined
+		} finally {
+			drawerLoading = false
+		}
+	}
+
+	async function loadTrigger(defaultConfig?: Record<string, any>): Promise<void> {
+		if (defaultConfig) {
+			loadTriggerConfig(defaultConfig)
+			return
+		}
+		try {
+			const s = await AzureTriggerService.getAzureTrigger({
+				workspace: $workspaceStore!,
+				path: initialPath
+			})
+			loadTriggerConfig(s)
+		} catch (error) {
+			sendUserToast(`Could not load Azure trigger: ${error.body}`, true)
+		}
+	}
+
+	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		script_path = cfg?.script_path
+		initialScriptPath = cfg?.script_path
+		azure_resource_path = cfg?.azure_resource_path
+		azure_mode = cfg?.azure_mode
+		scope_resource_id = cfg?.scope_resource_id
+		topic_name = cfg?.topic_name ?? undefined
+		subscription_name = cfg?.subscription_name
+		event_type_filters = cfg?.event_type_filters
+		path = cfg?.path
+		mode = cfg?.mode ?? 'enabled'
+		can_write = canWrite(cfg?.path, cfg?.extra_perms, $userStore)
+		error_handler_path = cfg?.error_handler_path
+		error_handler_args = cfg?.error_handler_args ?? {}
+		retry = cfg?.retry
+		errorHandlerSelected = getHandlerType(error_handler_path ?? '')
+		permissionedAs = cfg?.permissioned_as
+		selectedPermissionedAs = cfg?.permissioned_as
+		preservePermissionedAs = !!cfg?.permissioned_as
+	}
+
+	async function updateTrigger(): Promise<void> {
+		deploymentLoading = true
+		const cfg = azureConfig
+		if (!cfg) return
+		const isSaved = await saveAzureTriggerFromCfg(
+			initialPath,
+			cfg,
+			edit,
+			$workspaceStore!,
+			usedTriggerKinds
+		)
+		if (isSaved) {
+			onUpdate?.(cfg.path)
+			originalConfig = structuredClone($state.snapshot(getAzureConfig()))
+			initialPath = cfg.path
+			initialScriptPath = cfg.script_path
+			if (mode !== 'suspended') drawer?.closeDrawer()
+		}
+		deploymentLoading = false
+	}
+
+	function getAzureConfig() {
+		return {
+			azure_resource_path,
+			azure_mode,
+			scope_resource_id,
+			topic_name,
+			subscription_name,
+			event_type_filters,
+			base_endpoint,
+			path,
+			script_path,
+			mode,
+			is_flow: itemKind === 'flow',
+			error_handler_path,
+			error_handler_args,
+			retry,
+			permissioned_as: selectedPermissionedAs,
+			preserve_permissioned_as: preservePermissionedAs || undefined
+		}
+	}
+
+	function getAzureCaptureConfig() {
+		return {
+			azure_resource_path,
+			azure_mode,
+			scope_resource_id,
+			topic_name,
+			subscription_name,
+			event_type_filters,
+			base_endpoint,
+			path
+		}
+	}
+
+	async function handleToggleMode(newMode: TriggerMode) {
+		mode = newMode
+		if (!trigger?.draftConfig) {
+			await AzureTriggerService.setAzureTriggerMode({
+				path: initialPath,
+				workspace: $workspaceStore ?? '',
+				requestBody: { mode: newMode }
+			})
+			sendUserToast(`${capitalize(newMode)} Azure trigger ${initialPath}`)
+			onUpdate?.(initialPath)
+		}
+		if (originalConfig) originalConfig['mode'] = newMode
+	}
+
+	$effect(() => {
+		if (!drawerLoading) {
+			handleConfigChange(azureConfig, initialConfig, saveDisabled, edit, onConfigChange)
+		}
+	})
+
+	$effect(() => {
+		const args = [captureConfig, isValid] as const
+		untrack(() => onCaptureConfigChange?.(...args))
+	})
+</script>
+
+{#if mode === 'suspended'}
+	<TriggerSuspendedJobsModal
+		bind:this={suspendedJobsModal}
+		triggerPath={path}
+		triggerKind="azure"
+		{hasChanged}
+		onToggleMode={handleToggleMode}
+		runnableConfig={{
+			path: script_path,
+			kind: itemKind,
+			retry,
+			errorHandlerPath: error_handler_path,
+			errorHandlerArgs: error_handler_args
+		}}
+	/>
+{/if}
+
+{#if useDrawer}
+	<Drawer size="800px" bind:this={drawer}>
+		<DrawerContent
+			title={edit
+				? can_write
+					? `Edit Azure trigger ${initialPath}`
+					: `Azure trigger ${initialPath}`
+				: 'New Azure trigger'}
+			on:close={drawer?.closeDrawer}
+		>
+			{#snippet actions()}
+				{@render actionsButtons()}
+			{/snippet}
+			{@render config()}
+		</DrawerContent>
+	</Drawer>
+{:else}
+	<Section
+		label={!customLabel ? 'Azure Event Grid trigger' : ''}
+		headerClass="grow min-w-0 h-[30px]"
+	>
+		{#snippet header()}
+			{#if customLabel}
+				{@render customLabel()}
+			{/if}
+		{/snippet}
+		{#snippet action()}
+			{@render actionsButtons()}
+		{/snippet}
+		{@render config()}
+	</Section>
+{/if}
+
+{#snippet actionsButtons()}
+	{#if !drawerLoading && can_write}
+		<TriggerEditorToolbar
+			permissions={drawerLoading || !can_write ? 'none' : 'create'}
+			{saveDisabled}
+			{mode}
+			isLoading={deploymentLoading}
+			{edit}
+			{allowDraft}
+			{isDeployed}
+			onUpdate={updateTrigger}
+			{onReset}
+			{onDelete}
+			onToggleMode={handleToggleMode}
+			{cloudDisabled}
+			{trigger}
+			{suspendedJobsModal}
+		/>
+	{/if}
+{/snippet}
+
+{#snippet config()}
+	{#if drawerLoading}
+		<div class="flex flex-col items-center justify-center h-full w-full">
+			<Loader2 size="50" class="animate-spin" />
+			<p>Loading...</p>
+		</div>
+	{:else}
+		<PermissionedAsLine
+			{permissionedAs}
+			{path}
+			onPermissionedAsChange={(pa, preserve) => {
+				selectedPermissionedAs = pa
+				preservePermissionedAs = preserve
+			}}
+		/>
+		<div class="flex flex-col gap-5">
+			{#if mode === 'suspended'}
+				<TriggerSuspendedJobsAlert {suspendedJobsModal} />
+			{/if}
+			{#if description}
+				{@render description()}
+			{/if}
+			{#if !hideTooltips}
+				<Alert title="Info" type="info">
+					{#if edit}
+						Changes can take up to 30 seconds to take effect.
+					{:else}
+						New Azure triggers can take up to 30 seconds to start listening.
+					{/if}
+				</Alert>
+			{/if}
+		</div>
+		<div class="flex flex-col gap-12 mt-6">
+			<div class="flex flex-col gap-4">
+				<Label label="Path">
+					<Path
+						bind:dirty={dirtyPath}
+						bind:error={pathError}
+						bind:path
+						{initialPath}
+						checkInitialPathExistence={!edit}
+						namePlaceholder="azure_trigger"
+						kind="azure_trigger"
+						disabled={!can_write}
+						disableEditing={!can_write}
+					/>
+				</Label>
+			</div>
+
+			{#if !hideTarget}
+				<Section label="Runnable">
+					<p class="text-xs mb-1 text-primary">
+						Pick a script or flow to be triggered <Required required={true} />
+					</p>
+					<div class="flex flex-row mb-2">
+						<ScriptPicker
+							disabled={fixedScriptPath != '' || !can_write}
+							initialPath={fixedScriptPath || initialScriptPath}
+							kinds={['script']}
+							allowFlow={true}
+							bind:itemKind
+							bind:scriptPath={script_path}
+							allowRefresh={can_write}
+							allowEdit={!$userStore?.operator}
+							clearable
+						/>
+						{#if emptyString(script_path)}
+							<Button
+								btnClasses="ml-4"
+								variant="default"
+								unifiedSize="md"
+								disabled={!can_write}
+								href={itemKind === 'flow' ? '/flows/add?hub=81' : '/scripts/add?hub=hub%2F28214'}
+								target="_blank">Create from template</Button
+							>
+						{/if}
+					</div>
+				</Section>
+			{/if}
+
+			<AzureTriggerEditorConfigSection
+				bind:isValid
+				bind:azure_resource_path
+				bind:azure_mode
+				bind:scope_resource_id
+				bind:topic_name
+				bind:subscription_name
+				bind:event_type_filters
+				{path}
+				{can_write}
+				headless={true}
+			/>
+
+			<Section label="Advanced" collapsable>
+				{#snippet header()}
+					<TriggerAdvancedBadges {error_handler_path} {retry} />
+				{/snippet}
+				<div class="min-h-96">
+					<Tabs bind:selected={optionTabSelected}>
+						<Tab value="error_handler" label="Error Handler" />
+						<Tab value="retries" label="Retries" />
+					</Tabs>
+					<div class="mt-4">
+						<TriggerRetriesAndErrorHandler
+							{optionTabSelected}
+							{itemKind}
+							{can_write}
+							bind:errorHandlerSelected
+							bind:error_handler_path
+							bind:error_handler_args
+							bind:retry
+						/>
+					</div>
+				</div>
+			</Section>
+			<div class="pb-8" />
+		</div>
+	{/if}
+{/snippet}
diff --git a/frontend/src/lib/components/triggers/azure/AzureTriggerPanel.svelte b/frontend/src/lib/components/triggers/azure/AzureTriggerPanel.svelte
new file mode 100644
index 0000000000..c5d55957ad
--- /dev/null
+++ b/frontend/src/lib/components/triggers/azure/AzureTriggerPanel.svelte
@@ -0,0 +1,67 @@
+<script lang="ts">
+	import { isCloudHosted } from '$lib/cloud'
+	import { Alert } from '$lib/components/common'
+	import Description from '$lib/components/Description.svelte'
+	import { enterpriseLicense } from '$lib/stores'
+	import AzureTriggerEditorInner from './AzureTriggerEditorInner.svelte'
+	import { onMount } from 'svelte'
+
+	let {
+		selectedTrigger,
+		isFlow,
+		path,
+		isDeployed = false,
+		defaultValues = undefined,
+		customLabel = undefined,
+		...restProps
+	} = $props()
+	let azureTriggerEditor: AzureTriggerEditorInner | undefined = $state(undefined)
+
+	async function openAzureTriggerEditor(isFlow: boolean, isDraft: boolean) {
+		if (isDraft) {
+			azureTriggerEditor?.openNew(isFlow, path, defaultValues)
+		} else {
+			azureTriggerEditor?.openEdit(selectedTrigger.path, isFlow, defaultValues)
+		}
+	}
+
+	onMount(() => {
+		azureTriggerEditor && openAzureTriggerEditor(isFlow, selectedTrigger.isDraft ?? false)
+	})
+
+	const cloudDisabled = $derived(isCloudHosted())
+</script>
+
+{#if !$enterpriseLicense}
+	<Alert title="EE Only" type="warning" size="xs">
+		Azure Event Grid triggers are an enterprise only feature.
+	</Alert>
+{:else}
+	<div class="flex flex-col gap-4">
+		<AzureTriggerEditorInner
+			bind:this={azureTriggerEditor}
+			useDrawer={false}
+			hideTarget
+			hideTooltips={!isDeployed || cloudDisabled}
+			allowDraft={true}
+			trigger={selectedTrigger}
+			{customLabel}
+			{isDeployed}
+			{cloudDisabled}
+			{...restProps}
+		>
+			{#snippet description()}
+				{#if cloudDisabled}
+					<Alert title="Not compatible with multi-tenant cloud" type="warning" size="xs">
+						Azure Event Grid triggers are disabled in the multi-tenant cloud.
+					</Alert>
+				{:else}
+					<Description link="https://www.windmill.dev/docs/core_concepts/azure_triggers">
+						Azure Event Grid triggers execute scripts and flows in response to events from Azure
+						Event Grid (basic) or Event Grid Namespaces (push or pull).
+					</Description>
+				{/if}
+			{/snippet}
+		</AzureTriggerEditorInner>
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/triggers/azure/utils.ts b/frontend/src/lib/components/triggers/azure/utils.ts
new file mode 100644
index 0000000000..4f9e7faf6c
--- /dev/null
+++ b/frontend/src/lib/components/triggers/azure/utils.ts
@@ -0,0 +1,63 @@
+import { AzureTriggerService, type AzureTriggerData } from '$lib/gen'
+import { sendUserToast } from '$lib/toast'
+import { get, type Writable } from 'svelte/store'
+
+export async function saveAzureTriggerFromCfg(
+	initialPath: string,
+	cfg: Record<string, any>,
+	edit: boolean,
+	workspace: string,
+	usedTriggerKinds: Writable<string[]>
+): Promise<boolean> {
+	try {
+		const errorHandlerAndRetries = !cfg.is_flow
+			? {
+					error_handler_path: cfg.error_handler_path,
+					error_handler_args: cfg.error_handler_path ? cfg.error_handler_args : undefined,
+					retry: cfg.retry
+				}
+			: {}
+
+		const requestBody: AzureTriggerData = {
+			azure_resource_path: cfg.azure_resource_path,
+			azure_mode: cfg.azure_mode,
+			scope_resource_id: cfg.scope_resource_id,
+			topic_name: cfg.topic_name,
+			subscription_name: cfg.subscription_name,
+			base_endpoint: cfg.base_endpoint,
+			event_type_filters: cfg.event_type_filters,
+			path: cfg.path,
+			script_path: cfg.script_path,
+			mode: cfg.mode,
+			is_flow: cfg.is_flow,
+			permissioned_as: cfg.permissioned_as,
+			preserve_permissioned_as: cfg.preserve_permissioned_as,
+			...errorHandlerAndRetries
+		}
+		if (edit) {
+			await AzureTriggerService.updateAzureTrigger({
+				workspace,
+				path: initialPath,
+				requestBody
+			})
+			sendUserToast(`Azure Event Grid trigger ${cfg.path} updated`)
+		} else {
+			await AzureTriggerService.createAzureTrigger({
+				workspace,
+				requestBody: {
+					...requestBody,
+					mode: 'enabled'
+				}
+			})
+			sendUserToast(`Azure Event Grid trigger ${cfg.path} created`)
+		}
+
+		if (!get(usedTriggerKinds).includes('azure')) {
+			usedTriggerKinds.update((t) => [...t, 'azure'])
+		}
+		return true
+	} catch (error) {
+		sendUserToast(error.body || error.message, true)
+		return false
+	}
+}
diff --git a/frontend/src/lib/components/triggers/triggers.svelte.ts b/frontend/src/lib/components/triggers/triggers.svelte.ts
index 2852baa244..c10907b8d3 100644
--- a/frontend/src/lib/components/triggers/triggers.svelte.ts
+++ b/frontend/src/lib/components/triggers/triggers.svelte.ts
@@ -8,6 +8,7 @@ import {
 	WebsocketTriggerService,
 	NativeTriggerService,
 	type GcpTrigger,
+	type AzureTrigger,
 	type KafkaTrigger,
 	type PostgresTrigger,
 	type Schedule,
@@ -15,6 +16,7 @@ import {
 	type HttpTrigger,
 	HttpTriggerService,
 	GcpTriggerService,
+	AzureTriggerService,
 	type EmailTrigger,
 	EmailTriggerService,
 	type NativeTrigger,
@@ -412,6 +414,32 @@ export class Triggers {
 		}
 	}
 
+	async fetchAzureTriggers(
+		triggersCountStore: Writable<TriggersCount | undefined>,
+		workspaceId: string | undefined,
+		path: string,
+		isFlow: boolean,
+		user: UserExt | undefined = undefined
+	): Promise<void> {
+		if (!workspaceId) return
+		try {
+			const azureTriggers: AzureTrigger[] = await AzureTriggerService.listAzureTriggers({
+				workspace: workspaceId,
+				path,
+				isFlow
+			})
+			const azureCount = this.updateTriggers(azureTriggers, 'azure', user)
+			triggersCountStore.update((triggersCount) => {
+				return {
+					...(triggersCount ?? {}),
+					azure_count: azureCount
+				}
+			})
+		} catch (error) {
+			console.error('Failed to fetch Azure triggers:', error)
+		}
+	}
+
 	async fetchHttpTriggers(
 		triggersCountStore: Writable<TriggersCount | undefined>,
 		workspaceId: string | undefined,
@@ -526,6 +554,7 @@ export class Triggers {
 						this.fetchKafkaTriggers(triggersCountStore, workspaceId, path, isFlow, user),
 						this.fetchSqsTriggers(triggersCountStore, workspaceId, path, isFlow, user),
 						this.fetchGcpTriggers(triggersCountStore, workspaceId, path, isFlow, user),
+						this.fetchAzureTriggers(triggersCountStore, workspaceId, path, isFlow, user),
 						this.fetchEmailTriggers(triggersCountStore, workspaceId, path, isFlow, user),
 						this.fetchNatsTriggers(triggersCountStore, workspaceId, path, isFlow, user)
 					]
diff --git a/frontend/src/lib/components/triggers/utils.ts b/frontend/src/lib/components/triggers/utils.ts
index 20a28060da..711d84aea9 100644
--- a/frontend/src/lib/components/triggers/utils.ts
+++ b/frontend/src/lib/components/triggers/utils.ts
@@ -4,6 +4,7 @@ import NatsIcon from '$lib/components/icons/NatsIcon.svelte'
 import MqttIcon from '$lib/components/icons/MqttIcon.svelte'
 import AwsIcon from '$lib/components/icons/AwsIcon.svelte'
 import GoogleCloudIcon from '$lib/components/icons/GoogleCloudIcon.svelte'
+import AzureIcon from '$lib/components/icons/AzureIcon.svelte'
 import type {
 	CaptureTriggerKind,
 	ErrorHandler,
@@ -24,6 +25,7 @@ import { saveSqsTriggerFromCfg } from './sqs/utils'
 import { saveNatsTriggerFromCfg } from './nats/utils'
 import { saveMqttTriggerFromCfg } from './mqtt/utils'
 import { saveGcpTriggerFromCfg } from './gcp/utils'
+import { saveAzureTriggerFromCfg } from './azure/utils'
 import type { Triggers } from './triggers.svelte'
 import { emptyString } from '$lib/utils'
 import { saveEmailTriggerFromCfg } from './email/utils'
@@ -38,6 +40,7 @@ export const CLOUD_DISABLED_TRIGGER_TYPES = [
 	'sqs',
 	'mqtt',
 	'gcp',
+	'azure',
 	'websocket',
 	'postgres'
 ]
@@ -55,6 +58,7 @@ export type TriggerType =
 	| 'mqtt'
 	| 'sqs'
 	| 'gcp'
+	| 'azure'
 	| 'email'
 	| 'poll'
 	| 'cli'
@@ -75,6 +79,7 @@ export const jobTriggerKinds: JobTriggerKind[] = [
 	'postgres',
 	'schedule',
 	'gcp',
+	'azure',
 	'google',
 	'github'
 ]
@@ -106,6 +111,7 @@ export const triggerIconMap = {
 	mqtt: MqttIcon,
 	sqs: AwsIcon,
 	gcp: GoogleCloudIcon,
+	azure: AzureIcon,
 	primary_schedule: Calendar,
 	poll: SchedulePollIcon,
 	cli: Terminal,
@@ -124,6 +130,7 @@ export const triggerDisplayNamesMap = {
 	mqtt: 'MQTT',
 	sqs: 'SQS',
 	gcp: 'GCP Pub/Sub',
+	azure: 'Azure Event Grid',
 	email: 'Email',
 	poll: 'Scheduled Poll',
 	webhook: 'Webhook',
@@ -153,6 +160,7 @@ export function triggerTypeToCaptureKind(triggerType: TriggerType): CaptureTrigg
 		'mqtt',
 		'sqs',
 		'gcp',
+		'azure',
 		'cli'
 	]
 
@@ -183,6 +191,7 @@ export function updateTriggersCount(
 		mqtt: 'mqtt_count',
 		sqs: 'sqs_count',
 		gcp: 'gcp_count',
+		azure: 'azure_count',
 		email: 'email_count',
 		poll: undefined,
 		cli: undefined,
@@ -255,6 +264,8 @@ export function triggerKindToTriggerType(kind: TriggerKind): TriggerType | undef
 			return 'sqs'
 		case 'gcp':
 			return 'gcp'
+		case 'azure':
+			return 'azure'
 		case 'scheduledPoll':
 			return 'poll'
 		default:
@@ -360,6 +371,14 @@ export async function deployTriggers(
 				workspaceId,
 				usedTriggerKinds
 			),
+		azure: (trigger: Trigger) =>
+			saveAzureTriggerFromCfg(
+				trigger.path ?? trigger.draftConfig?.path ?? '',
+				trigger.draftConfig ?? {},
+				!trigger.isDraft,
+				workspaceId,
+				usedTriggerKinds
+			),
 		email: (trigger: Trigger) =>
 			saveEmailTriggerFromCfg(
 				trigger.path ?? trigger.draftConfig?.path ?? '',
@@ -493,6 +512,13 @@ export function getLightConfig(
 		return { queue_url: trigger.queue_url }
 	} else if (triggerType === 'gcp') {
 		return { gcp_resource_path: trigger.gcp_resource_path, topic: trigger.topic }
+	} else if (triggerType === 'azure') {
+		return {
+			azure_resource_path: trigger.azure_resource_path,
+			azure_mode: trigger.azure_mode,
+			scope_resource_id: trigger.scope_resource_id,
+			topic_name: trigger.topic_name
+		}
 	} else if (triggerType === 'email') {
 		return { local_part: trigger.local_part }
 	} else if (triggerType === 'nextcloud') {
@@ -590,6 +616,7 @@ export function sortTriggers(triggers: Trigger[]): Trigger[] {
 		'mqtt',
 		'sqs',
 		'gcp',
+		'azure',
 		'email',
 		'nextcloud',
 		'google',
diff --git a/frontend/src/routes/(root)/(logged)/+layout.svelte b/frontend/src/routes/(root)/(logged)/+layout.svelte
index eb27b57109..38c226e4b8 100644
--- a/frontend/src/routes/(root)/(logged)/+layout.svelte
+++ b/frontend/src/routes/(root)/(logged)/+layout.svelte
@@ -254,6 +254,7 @@
 			sqs_used,
 			mqtt_used,
 			gcp_used,
+			azure_used,
 			email_used,
 			nextcloud_used,
 			google_used,
@@ -285,6 +286,9 @@
 		if (gcp_used) {
 			usedKinds.push('gcp')
 		}
+		if (azure_used) {
+			usedKinds.push('azure')
+		}
 		if (email_used) {
 			usedKinds.push('email')
 		}
diff --git a/frontend/src/routes/(root)/(logged)/azure_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/azure_triggers/+page.svelte
new file mode 100644
index 0000000000..f987d6cb1a
--- /dev/null
+++ b/frontend/src/routes/(root)/(logged)/azure_triggers/+page.svelte
@@ -0,0 +1,635 @@
+<script lang="ts">
+	import { run } from 'svelte/legacy'
+
+	import {
+		AzureTriggerService,
+		WorkspaceService,
+		type AzureTrigger,
+		type WorkspaceDeployUISettings,
+		type TriggerMode
+	} from '$lib/gen'
+	import {
+		canWrite,
+		copyToClipboard,
+		displayDate,
+		getLocalSetting,
+		sendUserToast,
+		storeLocalSetting,
+		removeTriggerKindIfUnused
+	} from '$lib/utils'
+	import { base } from '$app/paths'
+	import { page } from '$app/stores'
+	import CenteredPage from '$lib/components/CenteredPage.svelte'
+	import { Alert, Button, Skeleton } from '$lib/components/common'
+	import Dropdown from '$lib/components/DropdownV2.svelte'
+	import PageHeader from '$lib/components/PageHeader.svelte'
+	import SharedBadge from '$lib/components/SharedBadge.svelte'
+	import ShareModal from '$lib/components/ShareModal.svelte'
+	import Toggle from '$lib/components/Toggle.svelte'
+	import { enterpriseLicense, usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import {
+		Code,
+		Eye,
+		Pen,
+		Plus,
+		Shield,
+		Trash,
+		Circle,
+		FileUp,
+		ClipboardCopy,
+		Pause
+	} from 'lucide-svelte'
+	import { goto } from '$lib/navigation'
+	import SearchItems from '$lib/components/SearchItems.svelte'
+	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
+	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
+	import ListFilters from '$lib/components/home/ListFilters.svelte'
+	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
+	import { setQuery } from '$lib/navigation'
+	import { onDestroy, onMount } from 'svelte'
+	import Popover from '$lib/components/Popover.svelte'
+	import { isCloudHosted } from '$lib/cloud'
+	import { ALL_DEPLOYABLE, isDeployable } from '$lib/utils_deployable'
+	import DeployWorkspaceDrawer from '$lib/components/DeployWorkspaceDrawer.svelte'
+	import AzureTriggerEditor from '$lib/components/triggers/azure/AzureTriggerEditor.svelte'
+	import { AzureIcon } from '$lib/components/icons'
+	import { getHttpRoute } from '$lib/components/triggers/http/utils'
+	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
+	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
+
+	type TriggerD = AzureTrigger & { canWrite: boolean }
+
+	let triggers: TriggerD[] = $state([])
+	let shareModal: ShareModal | undefined = $state()
+	let loading = $state(true)
+	let deploymentDrawer: DeployWorkspaceDrawer | undefined = $state()
+	let deployUiSettings: WorkspaceDeployUISettings | undefined = $state(undefined)
+	let isDeleting = $state(false)
+	async function getDeployUiSettings() {
+		if (!$enterpriseLicense) {
+			deployUiSettings = ALL_DEPLOYABLE
+			return
+		}
+		let settings = await WorkspaceService.getSettings({ workspace: $workspaceStore! })
+		deployUiSettings = settings.deploy_ui ?? ALL_DEPLOYABLE
+	}
+	getDeployUiSettings()
+	async function loadTriggers(): Promise<void> {
+		triggers = (await AzureTriggerService.listAzureTriggers({ workspace: $workspaceStore! })).map(
+			(x) => {
+				return { canWrite: canWrite(x.path, x.extra_perms!, $userStore), ...x }
+			}
+		)
+		$usedTriggerKinds = removeTriggerKindIfUnused(triggers.length, 'azure', $usedTriggerKinds)
+		loading = false
+	}
+
+	let interval = setInterval(async () => {
+		try {
+			const newTriggers = await AzureTriggerService.listAzureTriggers({
+				workspace: $workspaceStore!
+			})
+			for (let i = 0; i < triggers.length; i++) {
+				const newTrigger = newTriggers.find((x) => x.path === triggers[i].path)
+				if (newTrigger) {
+					triggers[i] = {
+						...triggers[i],
+						error: newTrigger.error,
+						last_server_ping: newTrigger.last_server_ping,
+						mode: newTrigger.mode,
+						server_id: newTrigger.server_id
+					}
+				}
+			}
+		} catch (err) {
+			console.error(err)
+		}
+	}, 5000)
+
+	onDestroy(() => {
+		clearInterval(interval)
+	})
+
+	async function onToggleMode(path: string, mode: TriggerMode): Promise<void> {
+		try {
+			await AzureTriggerService.setAzureTriggerMode({
+				path,
+				workspace: $workspaceStore!,
+				requestBody: { mode }
+			})
+		} catch (err) {
+			sendUserToast(
+				`Cannot ${mode === 'enabled' ? 'enable' : mode === 'disabled' ? 'disable' : 'suspend'} Azure Event Grid trigger: ${err.body}`,
+				true
+			)
+		} finally {
+			loadTriggers()
+		}
+	}
+
+	run(() => {
+		if ($workspaceStore && $userStore) {
+			loadTriggers()
+		}
+	})
+	let azureTriggerEditor: AzureTriggerEditor | undefined = $state()
+
+	let hashHandled = false
+	$effect(() => {
+		if (!hashHandled && triggers.length > 0 && azureTriggerEditor) {
+			let hash = $page.url.hash
+			if (hash.length > 1) {
+				let path = hash.slice(1)
+				let trigger = triggers.find((t) => t.path === path)
+				if (trigger) {
+					hashHandled = true
+					azureTriggerEditor?.openEdit(path, trigger.is_flow)
+				}
+			}
+		}
+	})
+
+	let filteredItems: (TriggerD & { marked?: any })[] | undefined = $state([])
+	let items: typeof filteredItems | undefined = $state([])
+	let preFilteredItems: typeof filteredItems | undefined = $state([])
+	let filter = $state('')
+	let ownerFilter: string | undefined = $state(undefined)
+	let nbDisplayed = $state(15)
+	let deleteAzureTriggerCallback: (() => Promise<void>) | undefined = $state(undefined)
+	let deleteSubscription = $state(false)
+	let subscriptionToDelete: string | undefined = $state(undefined)
+	let subscriptionDeletePayload:
+		| {
+				azure_mode: AzureTrigger['azure_mode']
+				scope_resource_id: string
+				topic_name?: string
+				subscription_name: string
+				azure_resource_path: string
+		  }
+		| undefined = $state(undefined)
+	const TRIGGER_PATH_KIND_FILTER_SETTING = 'filter_path_of'
+	const FILTER_USER_FOLDER_SETTING_NAME = 'user_and_folders_only'
+	let selectedFilterKind = $state(
+		(getLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING) as 'trigger' | 'script_flow') ?? 'trigger'
+	)
+	let filterUserFolders = $state(getLocalSetting(FILTER_USER_FOLDER_SETTING_NAME) == 'true')
+
+	run(() => {
+		storeLocalSetting(TRIGGER_PATH_KIND_FILTER_SETTING, selectedFilterKind)
+	})
+	run(() => {
+		storeLocalSetting(FILTER_USER_FOLDER_SETTING_NAME, filterUserFolders ? 'true' : undefined)
+	})
+
+	function filterItemsPathsBaseOnUserFilters(
+		item: TriggerD,
+		selectedFilterKind: 'trigger' | 'script_flow',
+		filterUserFolders: boolean
+	) {
+		if ($workspaceStore == 'admins') return true
+		if (filterUserFolders) {
+			if (selectedFilterKind === 'trigger') {
+				return (
+					!item.path.startsWith('u/') || item.path.startsWith('u/' + $userStore?.username + '/')
+				)
+			} else {
+				return (
+					!item.script_path.startsWith('u/') ||
+					item.script_path.startsWith('u/' + $userStore?.username + '/')
+				)
+			}
+		} else {
+			return true
+		}
+	}
+
+	run(() => {
+		preFilteredItems =
+			ownerFilter != undefined
+				? selectedFilterKind === 'trigger'
+					? triggers?.filter(
+							(x) =>
+								x.path.startsWith(ownerFilter + '/') &&
+								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
+						)
+					: triggers?.filter(
+							(x) =>
+								x.script_path.startsWith(ownerFilter + '/') &&
+								filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
+						)
+				: triggers?.filter((x) =>
+						filterItemsPathsBaseOnUserFilters(x, selectedFilterKind, filterUserFolders)
+					)
+	})
+
+	run(() => {
+		if ($workspaceStore) {
+			ownerFilter = undefined
+		}
+	})
+
+	let owners = $derived(
+		selectedFilterKind === 'trigger'
+			? Array.from(
+					new Set(filteredItems?.map((x) => x.path.split('/').slice(0, 2).join('/')) ?? [])
+				).sort()
+			: Array.from(
+					new Set(filteredItems?.map((x) => x.script_path.split('/').slice(0, 2).join('/')) ?? [])
+				).sort()
+	)
+
+	run(() => {
+		items = filter !== '' ? filteredItems : preFilteredItems
+	})
+
+	function updateQueryFilters(selectedFilterKind, filterUserFolders) {
+		setQuery(
+			new URL(window.location.href),
+			TRIGGER_PATH_KIND_FILTER_SETTING,
+			selectedFilterKind,
+			window.location.hash || undefined
+		).then(() => {
+			setQuery(
+				new URL(window.location.href),
+				FILTER_USER_FOLDER_SETTING_NAME,
+				String(filterUserFolders),
+				window.location.hash || undefined
+			)
+		})
+	}
+
+	function loadQueryFilters() {
+		let url = new URL(window.location.href)
+		let queryFilterKind = url.searchParams.get(TRIGGER_PATH_KIND_FILTER_SETTING)
+		let queryFilterUserFolders = url.searchParams.get(FILTER_USER_FOLDER_SETTING_NAME)
+		if (queryFilterKind) {
+			selectedFilterKind = queryFilterKind as 'trigger' | 'script_flow'
+		}
+		if (queryFilterUserFolders) {
+			filterUserFolders = queryFilterUserFolders == 'true'
+		}
+	}
+	onMount(() => {
+		loadQueryFilters()
+	})
+
+	run(() => {
+		updateQueryFilters(selectedFilterKind, filterUserFolders)
+	})
+</script>
+
+<ConfirmationModal
+	open={Boolean(deleteAzureTriggerCallback)}
+	title="Delete Azure Event Grid trigger"
+	confirmationText="Remove"
+	loading={isDeleting}
+	on:canceled={() => {
+		deleteAzureTriggerCallback = undefined
+	}}
+	on:confirmed={async () => {
+		if (deleteAzureTriggerCallback) {
+			isDeleting = true
+			if (deleteSubscription && subscriptionDeletePayload) {
+				try {
+					const msg = await AzureTriggerService.deleteAzureSubscription({
+						workspace: $workspaceStore ?? '',
+						path: subscriptionDeletePayload.azure_resource_path,
+						requestBody: {
+							azure_mode: subscriptionDeletePayload.azure_mode,
+							scope_resource_id: subscriptionDeletePayload.scope_resource_id,
+							topic_name: subscriptionDeletePayload.topic_name,
+							subscription_name: subscriptionDeletePayload.subscription_name
+						}
+					})
+					sendUserToast(msg)
+				} catch (error) {
+					isDeleting = false
+					sendUserToast(error.body || error.message, true)
+					return
+				}
+			}
+			await deleteAzureTriggerCallback()
+		}
+		deleteAzureTriggerCallback = undefined
+		subscriptionToDelete = undefined
+		subscriptionDeletePayload = undefined
+	}}
+>
+	<div class="flex flex-col w-full space-y-4">
+		<span>Are you sure you want to remove this trigger?</span>
+
+		{#if subscriptionToDelete}
+			<Toggle
+				options={{
+					left: `Also delete Azure subscription "${subscriptionToDelete}" on Azure?`
+				}}
+				bind:checked={deleteSubscription}
+			/>
+		{/if}
+	</div>
+</ConfirmationModal>
+
+<DeployWorkspaceDrawer bind:this={deploymentDrawer} />
+<AzureTriggerEditor onUpdate={loadTriggers} bind:this={azureTriggerEditor} />
+
+<SearchItems
+	{filter}
+	items={preFilteredItems}
+	bind:filteredItems
+	f={(x) => (x.summary ?? '') + ' ' + x.path + ' (' + x.script_path + ')'}
+/>
+
+<CenteredPage>
+	<PageHeader title="Azure Event Grid triggers" tooltip="Azure Event Grid trigger">
+		<Button
+			unifiedSize="md"
+			variant="accent"
+			startIcon={{ icon: Plus }}
+			on:click={() => azureTriggerEditor?.openNew(false)}
+		>
+			New&nbsp;Azure Event Grid trigger
+		</Button>
+	</PageHeader>
+
+	{#if isCloudHosted()}
+		<Alert title="Not compatible with multi-tenant cloud" type="warning">
+			Azure Event Grid triggers are disabled in the multi-tenant cloud.
+		</Alert>
+	{/if}
+	<div class="w-full h-full flex flex-col">
+		<div class="w-full pb-4 pt-6">
+			<input type="text" placeholder="Search triggers" bind:value={filter} class="search-item" />
+			<div class="flex flex-row items-center gap-2 mt-6">
+				<div class="text-sm shrink-0"> Filter by path of </div>
+				<ToggleButtonGroup bind:selected={selectedFilterKind}>
+					{#snippet children({ item })}
+						<ToggleButton
+							value="trigger"
+							label="Azure Event Grid trigger"
+							icon={AzureIcon}
+							{item}
+						/>
+						<ToggleButton value="script_flow" label="Script/Flow" icon={Code} {item} />
+					{/snippet}
+				</ToggleButtonGroup>
+			</div>
+			<ListFilters syncQuery bind:selectedFilter={ownerFilter} filters={owners} />
+
+			<div class="flex flex-row items-center justify-end gap-4">
+				{#if $userStore?.is_super_admin && $userStore.username.includes('@')}
+					<Toggle size="xs" bind:checked={filterUserFolders} options={{ right: 'Only f/*' }} />
+				{:else if $userStore?.is_admin || $userStore?.is_super_admin}
+					<Toggle
+						size="xs"
+						bind:checked={filterUserFolders}
+						options={{ right: `Only u/${$userStore.username} and f/*` }}
+					/>
+				{/if}
+			</div>
+		</div>
+		{#if loading}
+			{#each new Array(6) as _}
+				<Skeleton layout={[[6], 0.4]} />
+			{/each}
+		{:else if !triggers?.length}
+			<div class="text-center text-sm text-primary mt-2"> No Azure Event Grid triggers </div>
+		{:else if items?.length}
+			<div class="border rounded-md divide-y">
+				{#each items.slice(0, nbDisplayed) as { azure_resource_path, azure_mode, scope_resource_id, topic_name, subscription_name, workspace_id, path, edited_by, error, edited_at, script_path, is_flow, extra_perms, canWrite, mode, server_id, retry, error_handler_path, error_handler_args } (path)}
+					{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
+					{@const ping = new Date()}
+					{@const pinging = ping && ping.getTime() > new Date().getTime() - 15 * 1000}
+					{@const enabled = mode === 'enabled' || mode === 'suspended'}
+					{@const is_pull = azure_mode === 'namespace_pull'}
+					{@const topic_label = topic_name
+						? topic_name
+						: (scope_resource_id?.split('/')?.pop() ?? '')}
+
+					<div
+						class="hover:bg-surface-hover w-full items-center px-4 py-2 gap-4 first-of-type:!border-t-0
+				first-of-type:rounded-t-md last-of-type:rounded-b-md flex flex-col"
+					>
+						<div class="w-full flex gap-5 items-center">
+							<RowIcon kind={is_flow ? 'flow' : 'script'} />
+
+							<a
+								href="#{path}"
+								onclick={() => azureTriggerEditor?.openEdit(path, is_flow)}
+								class="min-w-0 grow hover:underline decoration-gray-400"
+							>
+								<div class="text-emphasis flex-wrap text-left text-xs font-semibold mb-1 truncate">
+									{path} - {topic_label} ({azure_mode}, {subscription_name})
+								</div>
+								<div class="text-secondary text-xs truncate text-left font-light">
+									runnable: {script_path}
+								</div>
+							</a>
+
+							<div class="hidden lg:flex flex-row gap-1 items-center">
+								<SharedBadge {canWrite} extraPerms={extra_perms} />
+							</div>
+
+							{#if is_pull}
+								<div class="w-10">
+									{#if (enabled && (!pinging || error)) || (!enabled && error) || (enabled && !server_id)}
+										<Popover notClickable>
+											<span class="flex h-4 w-4">
+												<Circle
+													class="text-red-600 animate-ping absolute inline-flex fill-current"
+													size={12}
+												/>
+												<Circle class="text-red-600 relative inline-flex fill-current" size={12} />
+											</span>
+											{#snippet text()}
+												<div>
+													{#if enabled}
+														{#if !server_id}
+															Azure Event Grid trigger is starting...
+														{:else}
+															Could not connect to Azure Event Grid{error ? ': ' + error : ''}
+														{/if}
+													{:else}
+														Disabled because of an error: {error}
+													{/if}
+												</div>
+											{/snippet}
+										</Popover>
+									{:else if enabled}
+										<Popover notClickable>
+											<span class="flex h-4 w-4">
+												<Circle
+													class="text-green-600 relative inline-flex fill-current"
+													size={12}
+												/>
+											</span>
+											{#snippet text()}
+												<div>
+													Connected to Azure Event Grid{!server_id
+														? ' (shutting down...)'
+														: ''}</div
+												>
+											{/snippet}
+										</Popover>
+									{/if}
+								</div>
+							{/if}
+
+							{#if is_pull}
+								<TriggerModeToggle
+									onToggleMode={(newMode) => onToggleMode(path, newMode)}
+									triggerMode={mode}
+									includeModalConfig={{
+										triggerPath: path,
+										triggerKind: 'azure',
+										runnableConfig: {
+											path: script_path,
+											kind: is_flow ? 'flow' : 'script',
+											retry,
+											errorHandlerPath: error_handler_path,
+											errorHandlerArgs: error_handler_args
+										}
+									}}
+									{canWrite}
+									hideToggleLabels
+									hideDropdown
+								/>
+							{/if}
+
+							<div class="flex gap-2 items-center justify-end">
+								{#if !is_pull}
+									<Button
+										on:click={() =>
+											copyToClipboard(getHttpRoute('azure/w', path, true, workspace_id))}
+										variant="subtle"
+										size="xs"
+										startIcon={{ icon: ClipboardCopy }}
+									>
+										Copy URL
+									</Button>
+								{/if}
+								<Button
+									on:click={() => azureTriggerEditor?.openEdit(path, is_flow)}
+									size="xs"
+									startIcon={canWrite
+										? { icon: Pen }
+										: {
+												icon: Eye
+											}}
+									variant="subtle"
+								>
+									{canWrite ? 'Edit' : 'View'}
+								</Button>
+								<Dropdown
+									items={[
+										{
+											displayName: `View ${is_flow ? 'Flow' : 'Script'}`,
+											icon: Eye,
+											action: () => {
+												goto(href)
+											}
+										},
+										...(canWrite && mode !== 'suspended'
+											? [
+													{
+														displayName: 'Suspend job execution',
+														icon: Pause,
+														action: () => {
+															onToggleMode(path, 'suspended')
+														}
+													}
+												]
+											: []),
+										{
+											displayName: canWrite ? 'Edit' : 'View',
+											icon: canWrite ? Pen : Eye,
+											action: () => {
+												azureTriggerEditor?.openEdit(path, is_flow)
+											}
+										},
+										...(isDeployable('trigger', path, deployUiSettings)
+											? [
+													{
+														displayName: 'Deploy to prod/staging',
+														icon: FileUp,
+														action: () => {
+															deploymentDrawer?.openDrawer(path, 'trigger', {
+																triggers: {
+																	kind: 'azure'
+																}
+															})
+														}
+													}
+												]
+											: []),
+										{
+											displayName: 'Audit logs',
+											icon: Eye,
+											href: `${base}/audit_logs?resource=${path}`
+										},
+										{
+											displayName: 'Permissions',
+											icon: Shield,
+											action: () => {
+												shareModal?.openDrawer(path, 'azure_trigger')
+											}
+										},
+										{
+											displayName: 'Delete',
+											type: 'delete',
+											icon: Trash,
+											disabled: !canWrite,
+											action: async () => {
+												isDeleting = false
+												deleteSubscription = false
+												subscriptionToDelete = subscription_name
+												subscriptionDeletePayload = {
+													azure_mode,
+													scope_resource_id,
+													topic_name: topic_name ?? undefined,
+													subscription_name,
+													azure_resource_path
+												}
+												deleteAzureTriggerCallback = async () => {
+													const message = await AzureTriggerService.deleteAzureTrigger({
+														workspace: $workspaceStore ?? '',
+														path
+													})
+													sendUserToast(message)
+													loadTriggers()
+												}
+											}
+										}
+									]}
+								/>
+							</div>
+						</div>
+						<div class="w-full flex justify-between items-baseline">
+							<div
+								class="flex flex-wrap text-[0.7em] text-primary gap-1 items-center justify-end truncate pr-2"
+								><div class="truncate">edited by {edited_by}</div><div class="truncate"
+									>the {displayDate(edited_at)}</div
+								></div
+							></div
+						>
+					</div>
+				{/each}
+			</div>
+		{:else}
+			<NoItemFound />
+		{/if}
+	</div>
+	{#if items && items?.length > 15 && nbDisplayed < items.length}
+		<span class="text-xs"
+			>{nbDisplayed} items out of {items.length}
+			<button class="ml-4" onclick={() => (nbDisplayed += 30)}>load 30 more</button></span
+		>
+	{/if}
+</CenteredPage>
+
+<ShareModal
+	bind:this={shareModal}
+	on:change={() => {
+		loadTriggers()
+	}}
+/>
diff --git a/system_prompts/auto-generated/cli/cli-commands.md b/system_prompts/auto-generated/cli/cli-commands.md
index ed823f5ade..0c370a5b61 100644
--- a/system_prompts/auto-generated/cli/cli-commands.md
+++ b/system_prompts/auto-generated/cli/cli-commands.md
@@ -502,12 +502,12 @@ trigger related commands
   - `--json` - Output as JSON (for piping to jq)
 - `trigger get <path:string>` - get a trigger's details
   - `--json` - Output as JSON (for piping to jq)
-  - `--kind <kind:string>` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email). Recommended for faster lookup
+  - `--kind <kind:string>` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup
 - `trigger new <path:string>` - create a new trigger locally
-  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email)
+  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
 - `trigger push <file_path:string> <remote_path:string>` - push a local trigger spec. This overrides any remote versions.
 - `trigger set-permissioned-as <path:string> <email:string>` - Set the email (run-as user) for a trigger (requires admin or wm_deployers group)
-  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email)
+  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
 
 ### user
 
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index b7d525add4..965ba76bcd 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -2261,12 +2261,12 @@ trigger related commands
   - \`--json\` - Output as JSON (for piping to jq)
 - \`trigger get <path:string>\` - get a trigger's details
   - \`--json\` - Output as JSON (for piping to jq)
-  - \`--kind <kind:string>\` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email). Recommended for faster lookup
+  - \`--kind <kind:string>\` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup
 - \`trigger new <path:string>\` - create a new trigger locally
-  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email)
+  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
 - \`trigger push <file_path:string> <remote_path:string>\` - push a local trigger spec. This overrides any remote versions.
 - \`trigger set-permissioned-as <path:string> <email:string>\` - Set the email (run-as user) for a trigger (requires admin or wm_deployers group)
-  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email)
+  - \`--kind <kind:string>\` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
 
 ### user
 
diff --git a/system_prompts/auto-generated/schemas/azure_trigger.schema.yaml b/system_prompts/auto-generated/schemas/azure_trigger.schema.yaml
new file mode 100644
index 0000000000..12612b1be5
--- /dev/null
+++ b/system_prompts/auto-generated/schemas/azure_trigger.schema.yaml
@@ -0,0 +1,84 @@
+type: object
+properties:
+  script_path:
+    type: string
+    description: Path to the script or flow to execute when triggered
+  permissioned_as:
+    type: string
+    description: The user or group this trigger runs as (permissioned_as)
+  is_flow:
+    type: boolean
+    description: True if script_path points to a flow, false if it points to a script
+  labels:
+    type: array
+    items:
+      type: string
+  azure_resource_path:
+    type: string
+  azure_mode:
+    type: string
+    enum:
+    - basic_push
+    - namespace_push
+    - namespace_pull
+    description: Azure Event Grid trigger mode.
+  scope_resource_id:
+    type: string
+    description: ARM resource ID of the topic (basic) or namespace (namespace modes).
+  topic_name:
+    type: string
+    description: Topic name within the namespace (namespace modes only).
+  subscription_name:
+    type: string
+  event_type_filters:
+    type: array
+    items:
+      type: string
+  error_handler_path:
+    type: string
+  error_handler_args:
+    type: object
+    description: The arguments to pass to the script or flow
+  retry:
+    type: object
+    properties:
+      constant:
+        type: object
+        description: Retry with constant delay between attempts
+        properties:
+          attempts:
+            type: integer
+            description: Number of retry attempts
+          seconds:
+            type: integer
+            description: Seconds to wait between retries
+      exponential:
+        type: object
+        description: Retry with exponential backoff (delay doubles each time)
+        properties:
+          attempts:
+            type: integer
+            description: Number of retry attempts
+          multiplier:
+            type: integer
+            description: Multiplier for exponential backoff
+          seconds:
+            type: integer
+            minimum: 1
+            description: Initial delay in seconds
+          random_factor:
+            type: integer
+            minimum: 0
+            maximum: 100
+            description: Random jitter percentage (0-100) to avoid thundering herd
+      retry_if:
+        $ref: '#/components/schemas/RetryIf'
+    description: Retry configuration for failed module executions
+required:
+- script_path
+- permissioned_as
+- is_flow
+- azure_resource_path
+- azure_mode
+- scope_resource_id
+- subscription_name
diff --git a/system_prompts/auto-generated/skills/cli-commands/SKILL.md b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
index 4c7d35b1ae..e88034838a 100644
--- a/system_prompts/auto-generated/skills/cli-commands/SKILL.md
+++ b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
@@ -507,12 +507,12 @@ trigger related commands
   - `--json` - Output as JSON (for piping to jq)
 - `trigger get <path:string>` - get a trigger's details
   - `--json` - Output as JSON (for piping to jq)
-  - `--kind <kind:string>` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email). Recommended for faster lookup
+  - `--kind <kind:string>` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup
 - `trigger new <path:string>` - create a new trigger locally
-  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email)
+  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
 - `trigger push <file_path:string> <remote_path:string>` - push a local trigger spec. This overrides any remote versions.
 - `trigger set-permissioned-as <path:string> <email:string>` - Set the email (run-as user) for a trigger (requires admin or wm_deployers group)
-  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email)
+  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)
 
 ### user
 
diff --git a/system_prompts/generate.py b/system_prompts/generate.py
index b24fd6ca0b..aa9cf2b85b 100644
--- a/system_prompts/generate.py
+++ b/system_prompts/generate.py
@@ -912,6 +912,7 @@ SKILL_DEFINITIONS = [
             ('MqttTrigger', 'mqtt_trigger'),
             ('SqsTrigger', 'sqs_trigger'),
             ('GcpTrigger', 'gcp_trigger'),
+            ('AzureTrigger', 'azure_trigger'),
         ],
     },
     {
@@ -1307,6 +1308,7 @@ def main():
             'MqttTrigger', 'NewMqttTrigger',
             'SqsTrigger', 'NewSqsTrigger',
             'GcpTrigger',
+            'AzureTrigger',
         ]
         for schema_name in schema_names:
             if schema_name in backend_schemas:
diff --git a/system_prompts/utils.py b/system_prompts/utils.py
index 4318b81642..779fbc56bb 100644
--- a/system_prompts/utils.py
+++ b/system_prompts/utils.py
@@ -48,6 +48,7 @@ SCHEMA_MAPPINGS = {
         ('MqttTrigger', 'mqtt_trigger'),
         ('SqsTrigger', 'sqs_trigger'),
         ('GcpTrigger', 'gcp_trigger'),
+        ('AzureTrigger', 'azure_trigger'),
     ],
     'schedules': [
         ('Schedule', 'schedule'),