The Process REST API v2 (BAW 21.0.2+, CP4BA, Workflow Process Service) is a modern, Swagger-described API for the core runtime objects: process instances, user tasks, and system login. The classic /rest/bpm/wle/v1 stays for everything else (users / groups, exposed items, models, documents, tokens, search query). Coverage of v2 on 24.0.x:
POST /bpm/system/login CSRF token (mandatory header BPMCSRFToken on every /bpm call, also GET)
GET /bpm/processes?states=running&model=…&containers=…&versions=…&search_term=…&sort=creation_time:desc&size=100&offset=0
POST /bpm/processes?model=Order Handling&container=ORD[&branch_name=Main|&version=…] body { "input": [ { "name": "order", "data": {...} } ] }
GET /bpm/processes/{id}?optional_parts=data,actions DELETE /bpm/processes/{id}
GET /bpm/user-tasks?states=ready,claimed&model=…&process_id=…&sort=due_date:asc
GET /bpm/user-tasks/{id}?optional_parts=data,actions,team_details,container_data
POST /bpm/user-tasks/{id}/claim | /complete (body {"output":[…]}) | /fail (body {"code":"…","data":…})
GET /bpm/docs Swagger of the installed levelDifferences to v1: JSON bodies instead of params= query strings; ids in the same 2072.123 form; states use v2 names (running, finished, terminated, suspended, stopped = failed, did_not_start) instead of Active / Completed / Failed; page size must be below 500; the actions part tells the caller what the user may do (claim, complete, set_data, terminate…) instead of trial and error; errors come as {error_number, error_message}; every call, GET included, requires the CSRF token. Not in v2 (use v1 or Operations REST): assign / reassign, priority and due date changes, set data on a running task, token moves, send message, users and groups, exposed items, documents, search query.
Migration advice: new clients use v2 for instances / tasks and v1 for the rest; existing v1 integrations keep working (v1 is not deprecated) - migrate only where you want typed, Swagger-generated clients or where v1 lacked something (state filters, sort, paging). The Operations REST API (/ops) is the third family: administration (snapshots, servers, instance cleanup, event manager) - use it for tooling, never for end-user actions.
References