Domain type system

Each identifier is a distinct, self-validating value object in the Camunda\Orchestration\Semantic namespace. Concrete identifier types implement Stringable and JsonSerializable and expose ::of(), ->value(), and ->equals(). ResourceKey and ScopeKey are factories that lift a raw string into the matching concrete type via ::of().

Type	Pattern	Length	Description
AgentDefinitionKey	/^-?[0-9]+$/u	1–25	System-generated key for an agent definition.
AgentHistoryItemKey	/^-?[0-9]+$/u	1–25	System-generated key for an agent history item.
AgentInstanceKey	/^-?[0-9]+$/u	1–25	System-generated key for an agent instance.
AuditLogEntityKey	—	—	System-generated entity key for an audit log entry.
AuditLogKey	/^-?[0-9]+$/u	1–25	System-generated key for an audit log entry.
AuthorizationKey	/^-?[0-9]+$/u	1–25	System-generated key for an authorization.
BatchOperationKey	—	—	System-generated key for an batch operation.
BusinessId	—	1–256	An optional, user-defined string identifier that identifies the process instance within the scope of a process definition (scoped by tenant). If provided and uniqueness enforcement is enabled, the engine will reject creation if another root process instance with the same business id is already active for the same process definition. Note that any active child process instances with the same business id are not taken into account.
ClientId	/^[a-zA-Z0-9_~@.+-]+$/u	1–256	The unique identifier of an OAuth client. Minted outside the Camunda REST API: in SaaS by Console, in Self-Managed with OIDC by the external identity provider (e.g. EntraID, Keycloak, Okta). In Self-Managed with Basic authentication, machine-to-machine applications are modelled as users instead — see the user identifier.
ClusterVariableName	/^[a-zA-Z0-9_~@.+-]+$/u	1–256	The name of a cluster variable. Unique within its scope (global or tenant-specific).
ConditionalEvaluationKey	/^-?[0-9]+$/u	1–25	System-generated key for a conditional evaluation.
DecisionDefinitionId	/^[\p{L}][\p{L}\p{N}-.]*$/u	≥ 1	Id of a decision definition, from the model. Only ids of decision definitions that are deployed are useful.
DecisionDefinitionKey	/^-?[0-9]+$/u	1–25	System-generated key for a decision definition.
DecisionEvaluationInstanceKey	/^[0-9]+-[0-9]+$/u	3–30	System-generated identifier for a decision evaluation instance. It is composed of the parent decision evaluation key and the 1-based index of the evaluated decision within that evaluation, joined by a hyphen (format: <decisionEvaluationKey>-<index>).
DecisionEvaluationKey	/^-?[0-9]+$/u	1–25	System-generated key for a decision evaluation.
DecisionInstanceKey	/^-?[0-9]+$/u	1–25	System-generated key for a deployed decision instance.
DecisionRequirementsKey	/^-?[0-9]+$/u	1–25	System-generated key for a deployed decision requirements definition.
DeploymentKey	/^-?[0-9]+$/u	1–25	Key for a deployment.
DocumentId	—	—	Document Id that uniquely identifies a document.
ElementId	—	—	The model-defined id of an element.
ElementInstanceKey	/^-?[0-9]+$/u	1–25	System-generated key for a element instance.
EndCursor	/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}(?:==)?|[A-Za-z0-9+/]{3}=)?$/u	—	The end cursor in a search query result set.
FormId	—	—	The user-defined id for the form
FormKey	/^-?[0-9]+$/u	1–25	System-generated key for a deployed form.
GlobalListenerId	/^[a-zA-Z0-9_~@.+-]+$/u	1–256	The user-defined id for the global listener
GroupId	—	1–256	The unique identifier of a group.
HistoryItemId	—	1–256	The client-supplied identifier this item was created with.
IncidentKey	/^-?[0-9]+$/u	1–25	System-generated key for a incident.
JobKey	/^-?[0-9]+$/u	1–25	System-generated key for a job.
JobLeaseToken	—	≥ 1	An opaque, engine-minted fencing token identifying a single activation of a job. Returned by Activate Jobs as ActivatedJobResult.jobLeaseToken when the job is activated with a lease, and passed back under the same name on fenced job commands and on agent-instance creation/updates, to prove the caller holds the current lease. The token is opaque: clients may rely on its presence and equality only, and must never construct, parse, or otherwise interpret it beyond equality checks. It cannot be minted client-side; only the engine produces it, exactly once per leased activation, and clients must not depend on any particular internal format.
MappingRuleId	/^[a-zA-Z0-9_~@.+-]+$/u	1–256	The unique identifier of a mapping rule.
MessageKey	/^-?[0-9]+$/u	1–25	System-generated key for an message.
MessageSubscriptionKey	/^-?[0-9]+$/u	1–25	System-generated key for a message subscription.
ProcessDefinitionId	/^[\p{L}][\p{L}\p{N}-.]*$/u	≥ 1	Id of a process definition, from the model. Only ids of process definitions that are deployed are useful.
ProcessDefinitionKey	/^-?[0-9]+$/u	1–25	System-generated key for a deployed process definition.
ProcessInstanceKey	/^-?[0-9]+$/u	1–25	System-generated key for a process instance.
ResourceKey	—	—	Semantic identifier that accepts any of: ProcessDefinitionKey, DecisionRequirementsKey, FormKey, DecisionDefinitionKey.
RoleId	/^[a-zA-Z0-9_~@.+-]+$/u	1–256	The unique identifier of a role.
ScopeKey	—	—	Semantic identifier that accepts any of: ProcessInstanceKey, ElementInstanceKey.
SignalKey	/^-?[0-9]+$/u	1–25	System-generated key for an signal.
StartCursor	/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}(?:==)?|[A-Za-z0-9+/]{3}=)?$/u	—	The start cursor in a search query result set.
Tag	/^[A-Za-z][A-Za-z0-9_-:.]{0,99}$/u	1–100	A tag. Needs to start with a letter; then alphanumerics, _, -, :, or .; length ≤ 100.
TenantId	/^(<default>|[\w.-]{1,31})$/u	1–31	The unique identifier of the tenant.
UserTaskKey	/^-?[0-9]+$/u	1–25	System-generated key for a user task.
Username	/^[a-zA-Z0-9_~@.+-]+$/u	1–256	The unique name of a user.
VariableKey	/^-?[0-9]+$/u	1–25	System-generated key for a variable.