Other content tools

The MCP tools that create, update, and delete the remaining content kinds: dashboards, webhooks, skills, HTTP tools, and MCP servers.

Each kind carries a create, update, and delete tool named for the kind. A write with a contentPackId argument can target a content pack instead of a Space. preview-webhook-config renders a webhook configuration against a sample event without sending a request.

Tool names and schemas can change at any time

An agent sees each change the next time it reads tools/list, while a script that hard-codes a tool name or schema breaks when that tool changes.

Each section below is one tool as MCP access registers it: its title, its description, the annotations it sets, and the input and output schemas from tools/list. Field paths use parent.child for a nested object, parent[].child for the items of an array, and parent[Value].child for one variant of a field that takes several shapes.

create-dashboard

Create a dashboard.

Creates a new dashboard, staging the change in a draft changeset.

Creates the resource in the active chat's space or, when contentPackId is set, in that content pack.

This creates the dashboard SHELL — name, time range, refresh interval. It has no panels field. Add panels afterwards with update-dashboard-panels, a few at a time: each panel is validated on its own, so a query that doesn't compile is reported against the panel that caused it. Add template variables with update-dashboard-variables.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Required
refreshInterval	integer	Optional	Defaults to 0.
defaultTimeRange	string	Optional	Defaults to -1h.
folderPath	string	Optional
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
id	string	The ID of the created dashboard.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-dashboard

Update a dashboard.

Updates an existing dashboard's own fields — name, default time range, refresh interval, folder — staging the change in a draft changeset when change batching is enabled.

Every field is optional: OMIT a field to leave it unchanged. name must be non-empty. To rename a dashboard, send only { "dashboardId": "...", "name": "New name" }.

This tool touches neither panels nor template variables — it has no panels or templateVariables field. Use update-dashboard-panels for panels and update-dashboard-variables for template variables; both address items individually, so you never resend a whole array.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Optional	Must not be empty. At most 256 characters.
refreshInterval	integer	Optional
defaultTimeRange	string	Optional
folderPath	string	Optional
baseVersion	integer	Optional
dashboardId	string	Required	The ID of the dashboard to update. Pattern: ^DSH_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
dashboard	object (two variants)
dashboard[variant 1].name	string
dashboard[variant 1].refreshInterval	integer
dashboard[variant 1].panels	array of object (four variants)
dashboard[variant 1].panels[][vega-lite].id	string
dashboard[variant 1].panels[][vega-lite].title	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 1].panels[][vega-lite].layout	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 1].panels[][vega-lite].type	string	Always vega-lite.
dashboard[variant 1].panels[][vega-lite].query	string
dashboard[variant 1].panels[][vega-lite].queries	array of object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 1].panels[][vega-lite].spec	object
dashboard[variant 1].panels[][vega-lite].timeRange	string	Defaults to .
dashboard[variant 1].panels[][markdown].id	string
dashboard[variant 1].panels[][markdown].title	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 1].panels[][markdown].layout	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 1].panels[][markdown].type	string	Always markdown.
dashboard[variant 1].panels[][markdown].content	string	Defaults to .
dashboard[variant 1].panels[][title].id	string
dashboard[variant 1].panels[][title].layout	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 1].panels[][title].type	string	Always title.
dashboard[variant 1].panels[][title].title	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 1].panels[][title].collapsed	boolean	Defaults to false.
dashboard[variant 1].panels[][table].id	string
dashboard[variant 1].panels[][table].title	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 1].panels[][table].layout	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 1].panels[][table].type	string	Always table.
dashboard[variant 1].panels[][table].query	string
dashboard[variant 1].panels[][table].timeRange	string	Defaults to .
dashboard[variant 1].defaultTimeRange	string
dashboard[variant 1].templateVariables	array of object (two variants)
dashboard[variant 1].templateVariables[][primitive].id	string	Must not be empty.
dashboard[variant 1].templateVariables[][primitive].name	string	Pattern: ^[a-zA-Z_][a-zA-Z_0-9]*$. Must not be empty. At most 64 characters.
dashboard[variant 1].templateVariables[][primitive].kind	string	Always primitive.
dashboard[variant 1].templateVariables[][primitive].type	enum	One of int, double, boolean, string, interval.
dashboard[variant 1].templateVariables[][primitive].values	array of string
dashboard[variant 1].templateVariables[][primitive].defaultValue	string	At most 1024 characters.
dashboard[variant 1].templateVariables[][primitive].description	string	At most 1024 characters.
dashboard[variant 1].templateVariables[][identifier_fragment].id	string	Must not be empty.
dashboard[variant 1].templateVariables[][identifier_fragment].name	string	Pattern: ^[a-zA-Z_][a-zA-Z_0-9]*$. Must not be empty. At most 64 characters.
dashboard[variant 1].templateVariables[][identifier_fragment].kind	string	Always identifier_fragment.
dashboard[variant 1].templateVariables[][identifier_fragment].values	array of string
dashboard[variant 1].templateVariables[][identifier_fragment].defaultValue	string	Pattern: ^[a-zA-Z0-9_]+$. At most 1024 characters.
dashboard[variant 1].templateVariables[][identifier_fragment].description	string	At most 1024 characters.
dashboard[variant 1].id	string	Pattern: ^DSH_[A-Z0-9]{1,7}$.
dashboard[variant 1].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
dashboard[variant 1].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
dashboard[variant 1].createdByUserId	string	May be null.
dashboard[variant 1].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
dashboard[variant 1].updatedByUserId	string	May be null.
dashboard[variant 1].folderId	string	May be null. Pattern: ^FLD_[A-Z0-9]{1,7}$.
dashboard[variant 1].folderPath	string
dashboard[variant 1].spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
dashboard[variant 1].fromDatasets	array of object
dashboard[variant 1].fromDatasets[].name	string
dashboard[variant 1].fromDatasets[].resourceName	string
dashboard[variant 1].fromDatasets[].resourceId	string
dashboard[variant 1].fromDatasets[].spaceId	string	Space containing the dependency dataset. Pattern: ^SPC_[A-Z0-9]{1,7}$.
dashboard[variant 1].readOnly	boolean
dashboard[variant 1].installedFrom	object (two variants)	May be null.
dashboard[variant 1].installedFrom[variant 1].linkMode	enum	One of Manual, Automatic.
dashboard[variant 1].installedFrom[variant 1].installationId	string	May be null. Pattern: ^PKI_[A-Z0-9]{1,7}$.
dashboard[variant 1].installedFrom[variant 1].templateId	string
dashboard[variant 1].installedFrom[variant 1].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
dashboard[variant 1].installedFrom[variant 2].linkMode	enum	One of Copy.
dashboard[variant 1].installedFrom[variant 2].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
dashboard[variant 1].version	integer	May be null. Greater than 0.
dashboard[variant 1].deleted	boolean	Defaults to false.
dashboard[variant 1].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
dashboard[variant 1].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
dashboard[variant 1].originKey	string	May be null.
dashboard[variant 2].name	string
dashboard[variant 2].refreshInterval	integer
dashboard[variant 2].panels	array of object (four variants)
dashboard[variant 2].panels[][vega-lite].id	string
dashboard[variant 2].panels[][vega-lite].title	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 2].panels[][vega-lite].layout	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 2].panels[][vega-lite].type	string	Always vega-lite.
dashboard[variant 2].panels[][vega-lite].query	string
dashboard[variant 2].panels[][vega-lite].queries	array of object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 2].panels[][vega-lite].spec	object
dashboard[variant 2].panels[][vega-lite].timeRange	string	Defaults to .
dashboard[variant 2].panels[][markdown].id	string
dashboard[variant 2].panels[][markdown].title	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 2].panels[][markdown].layout	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 2].panels[][markdown].type	string	Always markdown.
dashboard[variant 2].panels[][markdown].content	string	Defaults to .
dashboard[variant 2].panels[][title].id	string
dashboard[variant 2].panels[][title].layout	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 2].panels[][title].type	string	Always title.
dashboard[variant 2].panels[][title].title	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 2].panels[][title].collapsed	boolean	Defaults to false.
dashboard[variant 2].panels[][table].id	string
dashboard[variant 2].panels[][table].title	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 2].panels[][table].layout	object	Nested fields omitted; see the schema in tools/list.
dashboard[variant 2].panels[][table].type	string	Always table.
dashboard[variant 2].panels[][table].query	string
dashboard[variant 2].panels[][table].timeRange	string	Defaults to .
dashboard[variant 2].defaultTimeRange	string
dashboard[variant 2].templateVariables	array of object (two variants)
dashboard[variant 2].templateVariables[][primitive].id	string	Must not be empty.
dashboard[variant 2].templateVariables[][primitive].name	string	Pattern: ^[a-zA-Z_][a-zA-Z_0-9]*$. Must not be empty. At most 64 characters.
dashboard[variant 2].templateVariables[][primitive].kind	string	Always primitive.
dashboard[variant 2].templateVariables[][primitive].type	enum	One of int, double, boolean, string, interval.
dashboard[variant 2].templateVariables[][primitive].values	array of string
dashboard[variant 2].templateVariables[][primitive].defaultValue	string	At most 1024 characters.
dashboard[variant 2].templateVariables[][primitive].description	string	At most 1024 characters.
dashboard[variant 2].templateVariables[][identifier_fragment].id	string	Must not be empty.
dashboard[variant 2].templateVariables[][identifier_fragment].name	string	Pattern: ^[a-zA-Z_][a-zA-Z_0-9]*$. Must not be empty. At most 64 characters.
dashboard[variant 2].templateVariables[][identifier_fragment].kind	string	Always identifier_fragment.
dashboard[variant 2].templateVariables[][identifier_fragment].values	array of string
dashboard[variant 2].templateVariables[][identifier_fragment].defaultValue	string	Pattern: ^[a-zA-Z0-9_]+$. At most 1024 characters.
dashboard[variant 2].templateVariables[][identifier_fragment].description	string	At most 1024 characters.
dashboard[variant 2].id	string	Pattern: ^DSH_[A-Z0-9]{1,7}$.
dashboard[variant 2].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
dashboard[variant 2].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
dashboard[variant 2].createdByUserId	string	May be null.
dashboard[variant 2].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
dashboard[variant 2].updatedByUserId	string	May be null.
dashboard[variant 2].folderId	string	May be null. Pattern: ^FLD_[A-Z0-9]{1,7}$.
dashboard[variant 2].folderPath	string
dashboard[variant 2].readOnly	boolean
dashboard[variant 2].version	integer	May be null. Greater than 0.
dashboard[variant 2].deleted	boolean	Defaults to false.
dashboard[variant 2].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
dashboard[variant 2].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
dashboard[variant 2].originKey	string	May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-dashboard-panels

Change dashboard panels.

Adds, patches, and removes panels on a dashboard, staging the change in a draft changeset. This is the ONLY way to write a dashboard's panels — create-dashboard and update-dashboard have no panels field.

Pass any combination of the three arrays in one call; they apply together as a single change:

• panelsToAdd — appended to the end of the dashboard.
• panelsToUpdate — { panelId, patch } pairs. Only the panels you name are touched; you never resend the whole dashboard.
• panelsToDelete — panel IDs to remove.
• panelsToMove — move and/or resize existing panels.

Name 2 to 4 panels per call, at most 6 across all four arrays. Each panel is validated on its own, so a query that doesn't compile is reported against the panel that caused it while the rest still apply. Build a dashboard by calling create-dashboard for the shell, then calling this tool a few panels at a time — do NOT try to send every panel at once.

Finding panel ids. Panel ids come from get-resource. On a dashboard with more than a handful of panels, call it with detail: "summary" to list every panel's id, type, and title cheaply, then detail: "fields" with fields: ["panels[<id>]"] to read the one you are about to change. Reading a large dashboard at full detail can exceed the tool-result limit.

Patch semantics: an OMITTED field is left unchanged. To fix one panel's query, send { "panelId": "...", "patch": { "queries": [...] } }. A present-but-EMPTY value is a deliberate wipe — "queries": [] clears the panel's queries — so never send an empty value to mean "leave it alone", omit the field instead.

Where added panels go. By default they are appended below everything, at full width (w 24 on a 24-column grid). To put them somewhere specific, send placement: { "kind": "at", "y": 3 } inserts at grid row 3 and pushes the panels below it down, exactly as dragging one there would. Row 0 is the top.

Several charts on one row. w is a width in columns and x is a starting column; both mean the same thing on an added panel and in panelsToMove, so any two panels share a row when their columns don't overlap — one at "w": 12 and one at "x": 12, "w": 12. Height stays automatic on an add.

Added panels with no x pack left to right across the batch and wrap when the next one does not fit, so two with "w": 12 need no x at all. Set x only to sit beside a panel already on the dashboard, and insert at that panel's row: "x": 12, "w": 12 with placement: { "kind": "at", "y": <row> }. An added panel with no w is full width, so an x always needs a w beside it. Never send a layout object on the panel itself.

Minimum sizes. Each panel type has a smallest width: 3 columns for a chart, 4 for a table, 2 for markdown. A title always spans all 24 columns, so never send w for one. An add below its minimum is rejected.

Moving and resizing existing panels is panelsToMove: { "panelId": "...", "y": 0 } moves a panel to a row, and x, w and h set its column, width and height. Send any combination. Other panels reflow around the change the same way they do when a user drags. The requested row is a target, not a coordinate: gaps close afterwards, so a panel sent to a row far below the last one simply ends up last.

An x and w sent together must fit inside the 24 columns, or the call is rejected. An x sent without w keeps the panel's current width, and the panel slides left if that width would run past column 24, so pair x with w when narrowing a full-width panel. A w or h below the panel type's minimum is raised to it. The result reports where each panel actually landed.

A panel's type cannot be patched. To convert a panel, name it in panelsToDelete and its replacement in panelsToAdd in the same call.

Content-pack dashboards need contentPackId. Pass it when the dashboard belongs to a pack you are authoring. Pack dashboards have no space, so their panel queries are NOT compile-validated — the result reports them as saved but unvalidated.

Prefer the chart intent over a raw spec. Pass chart with just a chartType and the spec is built from the panel's own queries. Send chart OR spec, never both. When you do write a raw spec, its encoding field references must match the query's RESULT column names — the names after any AGG ... BY alias = expr rename, not the source path.

Time range: on chart and table panels, leave timeRange empty ("") so the panel inherits the dashboard's. Only set one when the user explicitly asks. Other panel types have no timeRange field — sending one rejects the whole call.

The result reports validation per panel, plus removedPanelIds and unknownPanelIds (ids that aren't on this dashboard). If a panel's ok is false, fix the reported errors before moving on.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
dashboardId	string	Required	The ID of the dashboard to change. Pattern: ^DSH_[A-Z0-9]{1,7}$.
panelsToAdd	array of object	Optional
panelsToAdd[].x	integer	Optional	Minimum 0. Maximum 23.
panelsToAdd[].w	integer	Optional	Minimum 1. Maximum 24.
panelsToAdd[].panel	object (four variants)	Required
panelsToAdd[].panel[vega-lite].title	object	Optional	Nested fields omitted; see the schema in tools/list.
panelsToAdd[].panel[vega-lite].type	string	Required	Always vega-lite.
panelsToAdd[].panel[vega-lite].query	string	Required
panelsToAdd[].panel[vega-lite].queries	array of object	Optional	Nested fields omitted; see the schema in tools/list.
panelsToAdd[].panel[vega-lite].spec	object	Required
panelsToAdd[].panel[vega-lite].timeRange	string	Optional	Defaults to .
panelsToAdd[].panel[markdown].title	object	Optional	Nested fields omitted; see the schema in tools/list.
panelsToAdd[].panel[markdown].type	string	Required	Always markdown.
panelsToAdd[].panel[markdown].content	string	Optional	Defaults to .
panelsToAdd[].panel[title].type	string	Required	Always title.
panelsToAdd[].panel[title].title	object	Required	Nested fields omitted; see the schema in tools/list.
panelsToAdd[].panel[title].collapsed	boolean	Optional	Defaults to false.
panelsToAdd[].panel[table].title	object	Optional	Nested fields omitted; see the schema in tools/list.
panelsToAdd[].panel[table].type	string	Required	Always table.
panelsToAdd[].panel[table].query	string	Required
panelsToAdd[].panel[table].timeRange	string	Optional	Defaults to .
panelsToAdd[].chart	object	Optional
panelsToAdd[].chart.chartType	enum	Required	One of line-chart, area-chart, normalized-area-chart, pie-chart, bar-chart, horizontal-bar-chart, grouped-bar-chart, normalized-bar-chart, histogram, scatter-plot, bubble-plot, heat-map.
panelsToMove	array of object	Optional
panelsToMove[].x	integer	Optional	Minimum 0. Maximum 23.
panelsToMove[].w	integer	Optional	Minimum 1. Maximum 24.
panelsToMove[].panelId	string	Required	Must not be empty.
panelsToMove[].y	integer	Optional	Minimum 0.
panelsToMove[].h	integer	Optional	Minimum 1.
placement	object (two variants)	Optional
placement[end].kind	string	Required	Always end.
placement[at].kind	string	Required	Always at.
placement[at].y	integer	Required	The grid row to insert at; 0 is the top of the dashboard. Minimum 0.
panelsToUpdate	array of object	Optional
panelsToUpdate[].panelId	string	Required	The ID of the panel to patch. Must not be empty.
panelsToUpdate[].patch	object	Required
panelsToUpdate[].patch.title	object	Optional	Nested fields omitted; see the schema in tools/list.
panelsToUpdate[].patch.query	string	Optional
panelsToUpdate[].patch.queries	array of object	Optional	Nested fields omitted; see the schema in tools/list.
panelsToUpdate[].patch.spec	object	Optional
panelsToUpdate[].patch.timeRange	string	Optional
panelsToUpdate[].patch.content	string	Optional
panelsToUpdate[].patch.collapsed	boolean	Optional
panelsToUpdate[].chart	object	Optional
panelsToUpdate[].chart.chartType	enum	Required	One of line-chart, area-chart, normalized-area-chart, pie-chart, bar-chart, horizontal-bar-chart, grouped-bar-chart, normalized-bar-chart, histogram, scatter-plot, bubble-plot, heat-map.
panelsToDelete	array of string	Optional
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
dashboardId	string	Pattern: ^DSH_[A-Z0-9]{1,7}$.
panels	array of object
panels[].panelId	string
panels[].title	string
panels[].layout	object
panels[].layout.x	integer	Minimum 0. Maximum 23.
panels[].layout.y	integer	Minimum 0.
panels[].layout.w	integer	Minimum 1. Maximum 24.
panels[].layout.h	integer	Minimum 1.
panels[].validation	object
panels[].validation.ok	boolean
panels[].validation.errors	array of object	Nested fields omitted; see the schema in tools/list.
panels[].validation.warnings	array of object	Nested fields omitted; see the schema in tools/list.
removedPanelIds	array of string
unknownPanelIds	array of string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-dashboard-variables

Change dashboard template variables.

Adds, patches, and removes a dashboard's template variables, staging the change in a draft changeset. This is the only way to change them — create-dashboard and update-dashboard do not accept a templateVariables array, so you never resend the whole list.

Pass any combination of the three arrays in one call, up to six variables total:

• variablesToAdd — IDs are assigned for you; do not send one.
• variablesToUpdate — { name, patch } keyed by the variable's CURRENT name.
• variablesToDelete — names to remove.

Variables are addressed by NAME, not by ID. A query substitutes ${name}, so the name is the identity that matters. Names must be unique on a dashboard; adding one that already exists is rejected and reported in rejected.

Renaming or deleting a variable breaks the queries that use it. The result's orphanedReferences lists every panel whose query still substitutes a name the dashboard no longer defines — those queries will not compile. Follow up with update-dashboard-panels to repair each listed panel's query in the same changeset.

Placeholder syntax: ${name}, with no quotes around it.

• A primitive (type: "int" | "double" | "boolean" | "string") substitutes as a typed literal. A string variable is rendered as a quoted SQL string for you, so do NOT wrap the placeholder in your own quotes: WHERE labels.action == ${value}, never == '${value}'. A primitive with an empty values list is freeform (a text input); a non-empty list renders as a selector and requires a defaultValue.
• An identifier_fragment substitutes as raw identifier text, for use where a table name goes: FROM events_ecs.${integration}. It always needs a non-empty values list and a default, and its values may contain only letters, digits, and underscores.

Each variable is validated on its own: one that fails is reported in rejected and skipped, while the rest of the batch still applies.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
dashboardId	string	Required	The ID of the dashboard to change. Pattern: ^DSH_[A-Z0-9]{1,7}$.
variablesToAdd	array of object (two variants)	Optional
variablesToAdd[][primitive].name	string	Required	Pattern: ^[a-zA-Z_][a-zA-Z_0-9]*$. Must not be empty. At most 64 characters.
variablesToAdd[][primitive].kind	string	Required	Always primitive.
variablesToAdd[][primitive].type	enum	Required	One of int, double, boolean, string, interval.
variablesToAdd[][primitive].values	array of string	Required
variablesToAdd[][primitive].defaultValue	string	Optional	At most 1024 characters.
variablesToAdd[][primitive].description	string	Optional	At most 1024 characters.
variablesToAdd[][identifier_fragment].name	string	Required	Pattern: ^[a-zA-Z_][a-zA-Z_0-9]*$. Must not be empty. At most 64 characters.
variablesToAdd[][identifier_fragment].kind	string	Required	Always identifier_fragment.
variablesToAdd[][identifier_fragment].values	array of string	Required
variablesToAdd[][identifier_fragment].defaultValue	string	Required	Pattern: ^[a-zA-Z0-9_]+$. At most 1024 characters.
variablesToAdd[][identifier_fragment].description	string	Optional	At most 1024 characters.
variablesToUpdate	array of object	Optional
variablesToUpdate[].name	string	Required	The CURRENT name of the variable to patch. Must not be empty.
variablesToUpdate[].patch	object	Required
variablesToUpdate[].patch.name	string	Optional
variablesToUpdate[].patch.kind	enum	Optional	One of primitive, identifier_fragment.
variablesToUpdate[].patch.type	enum	Optional	One of int, double, boolean, string, interval.
variablesToUpdate[].patch.values	array of string	Optional
variablesToUpdate[].patch.defaultValue	string	Optional
variablesToUpdate[].patch.description	string	Optional
variablesToDelete	array of string	Optional
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
dashboardId	string	Pattern: ^DSH_[A-Z0-9]{1,7}$.
variables	array of object
variables[].id	string
variables[].name	string
removedNames	array of string
unknownNames	array of string
rejected	array of object
rejected[].name	string
rejected[].message	string
orphanedReferences	array of object
orphanedReferences[].name	string
orphanedReferences[].panelIds	array of string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

create-http-tool-config

Create HTTP tool.

Creates a HTTP tool in a draft changeset. Provide contentPackId to create it in a content pack; otherwise use the active space. Use folderPath for placement. Read the result with get-resource.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
method	enum	Required	One of GET, POST, PUT, PATCH, DELETE.
headers	map of string	Optional
body	string	Optional	May be null. At most 1000000 characters.
folderPath	string	Optional
description	string	Required
inputSchema	object	Required
readOnlyHint	boolean	Required
requiresApproval	boolean	Required
name	string	Required
url	string	Required
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
id	string	The ID of the created HTTP tool.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-http-tool-config

Update HTTP tool.

Updates an HTTP tool, staging the change in a draft changeset. Read the HTTP tool first with get-resource, and only pass fields that must change. A header value of "[redacted]" is a stored plain-text secret: pass it back unchanged to keep it. Plain-text values on secret headers such as Authorization are rejected; use {{ credential.<name> }}.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
method	enum	Optional	One of GET, POST, PUT, PATCH, DELETE.
headers	map of string	Optional
body	string	Optional	May be null. At most 1000000 characters.
folderPath	string	Optional
description	string	Optional
inputSchema	object	Optional
readOnlyHint	boolean	Optional
requiresApproval	boolean	Optional
name	string	Optional
url	string	Optional
baseVersion	integer	Optional
httpToolConfigId	string	Required	The ID of the HTTP tool to update. Pattern: ^HTT_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
httpToolConfig	object (two variants)
httpToolConfig[variant 1].id	string	Pattern: ^HTT_[A-Z0-9]{1,7}$.
httpToolConfig[variant 1].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
httpToolConfig[variant 1].spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
httpToolConfig[variant 1].name	string
httpToolConfig[variant 1].description	string
httpToolConfig[variant 1].inputSchema	object
httpToolConfig[variant 1].url	string
httpToolConfig[variant 1].method	enum	One of GET, POST, PUT, PATCH, DELETE.
httpToolConfig[variant 1].headers	map of string
httpToolConfig[variant 1].body	string	May be null. At most 1000000 characters.
httpToolConfig[variant 1].readOnlyHint	boolean
httpToolConfig[variant 1].requiresApproval	boolean
httpToolConfig[variant 1].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
httpToolConfig[variant 1].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
httpToolConfig[variant 1].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
httpToolConfig[variant 1].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
httpToolConfig[variant 1].folderId	string	May be null.
httpToolConfig[variant 1].folderPath	string
httpToolConfig[variant 1].readOnly	boolean
httpToolConfig[variant 1].installedFrom	object (two variants)	May be null.
httpToolConfig[variant 1].installedFrom[variant 1].linkMode	enum	One of Manual, Automatic.
httpToolConfig[variant 1].installedFrom[variant 1].installationId	string	May be null. Pattern: ^PKI_[A-Z0-9]{1,7}$.
httpToolConfig[variant 1].installedFrom[variant 1].templateId	string
httpToolConfig[variant 1].installedFrom[variant 1].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
httpToolConfig[variant 1].installedFrom[variant 2].linkMode	enum	One of Copy.
httpToolConfig[variant 1].installedFrom[variant 2].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
httpToolConfig[variant 1].version	integer	May be null. Greater than 0.
httpToolConfig[variant 1].deleted	boolean	Defaults to false.
httpToolConfig[variant 1].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
httpToolConfig[variant 1].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
httpToolConfig[variant 1].originKey	string	May be null.
httpToolConfig[variant 2].id	string	Pattern: ^HTT_[A-Z0-9]{1,7}$.
httpToolConfig[variant 2].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
httpToolConfig[variant 2].name	string
httpToolConfig[variant 2].description	string
httpToolConfig[variant 2].inputSchema	object
httpToolConfig[variant 2].url	string
httpToolConfig[variant 2].method	enum	One of GET, POST, PUT, PATCH, DELETE.
httpToolConfig[variant 2].headers	map of string
httpToolConfig[variant 2].body	string	May be null. At most 1000000 characters.
httpToolConfig[variant 2].readOnlyHint	boolean
httpToolConfig[variant 2].requiresApproval	boolean
httpToolConfig[variant 2].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
httpToolConfig[variant 2].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
httpToolConfig[variant 2].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
httpToolConfig[variant 2].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
httpToolConfig[variant 2].folderId	string	May be null.
httpToolConfig[variant 2].folderPath	string
httpToolConfig[variant 2].readOnly	boolean
httpToolConfig[variant 2].version	integer	May be null. Greater than 0.
httpToolConfig[variant 2].deleted	boolean	Defaults to false.
httpToolConfig[variant 2].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
httpToolConfig[variant 2].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
httpToolConfig[variant 2].originKey	string	May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

delete-http-tool-config

Delete HTTP tool.

Deletes a HTTP tool in a draft changeset. Read it with get-resource first and pass its baseVersion. Provide contentPackId for pack-owned content.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
httpToolConfigId	string	Required	The ID of the HTTP tool to delete. Pattern: ^HTT_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
baseVersion	integer	Optional

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

preview-http-tool-config

Preview HTTP tool.

Renders an HTTP tool request from inline config and parameters. Credential values are redacted. Does not send a request or save the config.

Annotations: readOnlyHint true, destructiveHint false, idempotentHint true.

Inputs

Field	Type	Required	Description
config	object	Required
config.url	string	Required
config.headers	map of string	Optional
config.method	enum	Required	One of GET, POST, PUT, PATCH, DELETE.
config.body	string	Optional
parameters	object	Required

Outputs

Field	Type	Description
config	object
config.headers	map of string
config.method	enum	One of GET, POST, PUT, PATCH, DELETE.
config.body	string
config.url	string	Must not be empty.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

test-http-tool-config

Test HTTP tool.

Sends a real HTTP request from inline config and parameters using real credentials. This can modify the remote service. Preview with preview-http-tool-config first. Returns the redacted request and HTTP response; does not save the config. Requires approval in Simba.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
config	object	Required
config.url	string	Required
config.headers	map of string	Optional
config.method	enum	Required	One of GET, POST, PUT, PATCH, DELETE.
config.body	string	Optional
parameters	object	Required

Outputs

Field	Type	Description
config	object
config.url	string	Format: uri.
config.headers	map of string
config.method	enum	One of GET, POST, PUT, PATCH, DELETE.
config.body	string
response	object
response.status	number
response.statusText	string
response.headers	map of string
response.body	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

create-mcp-config

Create MCP config.

Creates a MCP config in a draft changeset. Provide contentPackId to create it in a content pack; otherwise use the active space. Use folderPath for placement. Read the result with get-resource.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
headers	map of string	Optional
authentication	object	Optional	May be null.
authentication.type	string	Required	Always oauth.
authentication.credentialId	string	Required	Pattern: ^CRD_[A-Z0-9]{1,7}$.
folderPath	string	Optional
discoveredTools	array of object	Optional	Defaults to [].
discoveredTools[].name	string	Required
discoveredTools[].description	string	Optional
discoveredTools[].inputSchema	object	Optional
discoveredTools[].readOnlyHint	boolean	Optional
discoveredTools[].destructiveHint	boolean	Optional
discoveredTools[].enabled	boolean	Optional	Defaults to true.
discoveredTools[].requiresApprovalOverride	boolean	Optional
name	string	Required
url	string	Required
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
id	string	The ID of the created MCP config.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-mcp-config

Update MCP config.

Updates an MCP config, staging the change in a draft changeset. Read the MCP config first with get-resource, and only pass fields that must change. A header value of "[redacted]" is a stored plain-text secret: pass it back unchanged to keep it. Plain-text values on secret headers such as Authorization are rejected; use {{ credential.<name> }}.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
headers	map of string	Optional
authentication	object	Optional	May be null.
authentication.type	string	Required	Always oauth.
authentication.credentialId	string	Required	Pattern: ^CRD_[A-Z0-9]{1,7}$.
folderPath	string	Optional
discoveredTools	array of object	Optional
discoveredTools[].name	string	Required
discoveredTools[].description	string	Optional
discoveredTools[].inputSchema	object	Optional
discoveredTools[].readOnlyHint	boolean	Optional
discoveredTools[].destructiveHint	boolean	Optional
discoveredTools[].enabled	boolean	Optional	Defaults to true.
discoveredTools[].requiresApprovalOverride	boolean	Optional
name	string	Optional
url	string	Optional
baseVersion	integer	Optional
mcpConfigId	string	Required	The ID of the MCP config to update. Pattern: ^MCP_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
mcpConfig	object (two variants)
mcpConfig[variant 1].id	string	Pattern: ^MCP_[A-Z0-9]{1,7}$.
mcpConfig[variant 1].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
mcpConfig[variant 1].spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
mcpConfig[variant 1].name	string
mcpConfig[variant 1].url	string
mcpConfig[variant 1].headers	map of string
mcpConfig[variant 1].authentication	object	May be null.
mcpConfig[variant 1].authentication.type	string	Always oauth.
mcpConfig[variant 1].authentication.credentialId	string	Pattern: ^CRD_[A-Z0-9]{1,7}$.
mcpConfig[variant 1].discoveredTools	array of object
mcpConfig[variant 1].discoveredTools[].name	string
mcpConfig[variant 1].discoveredTools[].description	string
mcpConfig[variant 1].discoveredTools[].inputSchema	object
mcpConfig[variant 1].discoveredTools[].readOnlyHint	boolean
mcpConfig[variant 1].discoveredTools[].destructiveHint	boolean
mcpConfig[variant 1].discoveredTools[].enabled	boolean	Defaults to true.
mcpConfig[variant 1].discoveredTools[].requiresApprovalOverride	boolean
mcpConfig[variant 1].lastDiscoveredAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mcpConfig[variant 1].connectionStatus	enum	One of unchecked, authentication_required, connected, error.
mcpConfig[variant 1].connectionErrorCode	string	May be null.
mcpConfig[variant 1].connectionErrorMessage	string	May be null.
mcpConfig[variant 1].lastCheckedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mcpConfig[variant 1].lastConnectedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mcpConfig[variant 1].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mcpConfig[variant 1].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
mcpConfig[variant 1].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mcpConfig[variant 1].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
mcpConfig[variant 1].folderId	string	May be null.
mcpConfig[variant 1].folderPath	string
mcpConfig[variant 1].readOnly	boolean
mcpConfig[variant 1].installedFrom	object (two variants)	May be null.
mcpConfig[variant 1].installedFrom[variant 1].linkMode	enum	One of Manual, Automatic.
mcpConfig[variant 1].installedFrom[variant 1].installationId	string	May be null. Pattern: ^PKI_[A-Z0-9]{1,7}$.
mcpConfig[variant 1].installedFrom[variant 1].templateId	string
mcpConfig[variant 1].installedFrom[variant 1].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
mcpConfig[variant 1].installedFrom[variant 2].linkMode	enum	One of Copy.
mcpConfig[variant 1].installedFrom[variant 2].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
mcpConfig[variant 1].version	integer	May be null. Greater than 0.
mcpConfig[variant 1].deleted	boolean	Defaults to false.
mcpConfig[variant 1].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
mcpConfig[variant 1].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
mcpConfig[variant 1].originKey	string	May be null.
mcpConfig[variant 2].id	string	Pattern: ^MCP_[A-Z0-9]{1,7}$.
mcpConfig[variant 2].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
mcpConfig[variant 2].name	string
mcpConfig[variant 2].url	string
mcpConfig[variant 2].headers	map of string
mcpConfig[variant 2].authentication	object	May be null.
mcpConfig[variant 2].authentication.type	string	Always oauth.
mcpConfig[variant 2].authentication.credentialId	string	Pattern: ^CRD_[A-Z0-9]{1,7}$.
mcpConfig[variant 2].discoveredTools	array of object
mcpConfig[variant 2].discoveredTools[].name	string
mcpConfig[variant 2].discoveredTools[].description	string
mcpConfig[variant 2].discoveredTools[].inputSchema	object
mcpConfig[variant 2].discoveredTools[].readOnlyHint	boolean
mcpConfig[variant 2].discoveredTools[].destructiveHint	boolean
mcpConfig[variant 2].discoveredTools[].enabled	boolean	Defaults to true.
mcpConfig[variant 2].discoveredTools[].requiresApprovalOverride	boolean
mcpConfig[variant 2].lastDiscoveredAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mcpConfig[variant 2].connectionStatus	enum	One of unchecked, authentication_required, connected, error.
mcpConfig[variant 2].connectionErrorCode	string	May be null.
mcpConfig[variant 2].connectionErrorMessage	string	May be null.
mcpConfig[variant 2].lastCheckedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mcpConfig[variant 2].lastConnectedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mcpConfig[variant 2].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mcpConfig[variant 2].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
mcpConfig[variant 2].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mcpConfig[variant 2].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
mcpConfig[variant 2].folderId	string	May be null.
mcpConfig[variant 2].folderPath	string
mcpConfig[variant 2].readOnly	boolean
mcpConfig[variant 2].version	integer	May be null. Greater than 0.
mcpConfig[variant 2].deleted	boolean	Defaults to false.
mcpConfig[variant 2].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
mcpConfig[variant 2].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
mcpConfig[variant 2].originKey	string	May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

delete-mcp-config

Delete MCP config.

Deletes a MCP config in a draft changeset. Read it with get-resource first and pass its baseVersion. Provide contentPackId for pack-owned content.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
mcpConfigId	string	Required	The ID of the MCP config to delete. Pattern: ^MCP_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
baseVersion	integer	Optional

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

probe-mcp-server

Probe MCP server.

Checks an MCP endpoint for connectivity, available tools, and OAuth requirements using the active space for credential access. Does not create or modify an MCP config or call any discovered tool. Use rediscover-mcp-tools to refresh a saved config.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
url	string	Required	Format: uri.
headers	map of string	Optional
authentication	object	Optional	May be null.
authentication.type	string	Required	Always oauth.
authentication.credentialId	string	Required	Pattern: ^CRD_[A-Z0-9]{1,7}$.
spaceId	string	Required	The ID of the space to target for this operation. Pattern: ^SPC_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
connection	object (four variants)
connection[variant 1].status	string	Always connected.
connection[variant 1].reason	enum	One of authless, credential_connected.
connection[variant 1].resourceName	string	May be null.
connection[variant 1].discoveredTools	array of object
connection[variant 1].discoveredTools[].name	string
connection[variant 1].discoveredTools[].description	string
connection[variant 1].discoveredTools[].inputSchema	object
connection[variant 1].discoveredTools[].readOnlyHint	boolean
connection[variant 1].discoveredTools[].destructiveHint	boolean
connection[variant 1].discoveredTools[].enabled	boolean	Defaults to true.
connection[variant 1].discoveredTools[].requiresApprovalOverride	boolean
connection[variant 2].status	string	Always authentication_required.
connection[variant 2].reason	string	Always oauth_discovered.
connection[variant 2].resourceName	string	May be null.
connection[variant 2].oauth	object
connection[variant 2].oauth.setupMode	string	Always discovered.
connection[variant 2].oauth.resourceUrl	string	May be null. Format: uri.
connection[variant 2].oauth.resourceName	string	May be null.
connection[variant 2].oauth.authorizationServerIssuer	string	Format: uri.
connection[variant 2].oauth.authorizationUrl	string	May be null. Format: uri.
connection[variant 2].oauth.tokenUrl	string	Format: uri.
connection[variant 2].oauth.registrationUrl	string	May be null. Format: uri.
connection[variant 2].oauth.scopes	array of string
connection[variant 2].oauth.registrationModes	array of enum
connection[variant 2].oauth.recommendedRegistrationMode	enum	One of pre_registered, client_id_metadata, dynamic. May be null.
connection[variant 2].oauth.tokenEndpointAuthMethods	array of enum
connection[variant 2].oauth.recommendedTokenEndpointAuthMethod	enum	One of client_secret_basic, client_secret_post, none. May be null.
connection[variant 2].oauth.discoveredAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
connection[variant 3].status	string	Always authentication_required.
connection[variant 3].reason	enum	One of unsupported_auth, credential_reauthorization_required.
connection[variant 3].resourceName	string	May be null.
connection[variant 3].errorCode	string
connection[variant 3].errorMessage	string
connection[variant 4].status	string	Always error.
connection[variant 4].reason	enum	One of unreachable, protocol_error, credential_url_policy_mismatch, credential_invalid.
connection[variant 4].resourceName	string	May be null.
connection[variant 4].errorCode	string
connection[variant 4].errorMessage	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

rediscover-mcp-tools

Rediscover MCP tools.

Reconnects to a saved MCP server and refreshes its tool list and connection status. Preserves enabled and approval overrides for existing tools. Does not call discovered tools. Pass changesetId to read a staged config, and contentPackId for pack-owned configs. Updates connection metadata immediately on that config version; it does not create or commit a changeset.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint true.

Inputs

Field	Type	Required	Description
mcpConfigId	string	Required	Pattern: ^MCP_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
mcpConfig	object
mcpConfig.id	string	Pattern: ^MCP_[A-Z0-9]{1,7}$.
mcpConfig.organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
mcpConfig.spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
mcpConfig.name	string
mcpConfig.url	string
mcpConfig.headers	map of string
mcpConfig.authentication	object	May be null.
mcpConfig.authentication.type	string	Always oauth.
mcpConfig.authentication.credentialId	string	Pattern: ^CRD_[A-Z0-9]{1,7}$.
mcpConfig.discoveredTools	array of object
mcpConfig.discoveredTools[].name	string
mcpConfig.discoveredTools[].description	string
mcpConfig.discoveredTools[].inputSchema	object
mcpConfig.discoveredTools[].readOnlyHint	boolean
mcpConfig.discoveredTools[].destructiveHint	boolean
mcpConfig.discoveredTools[].enabled	boolean	Defaults to true.
mcpConfig.discoveredTools[].requiresApprovalOverride	boolean
mcpConfig.lastDiscoveredAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mcpConfig.connectionStatus	enum	One of unchecked, authentication_required, connected, error.
mcpConfig.connectionErrorCode	string	May be null.
mcpConfig.connectionErrorMessage	string	May be null.
mcpConfig.lastCheckedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mcpConfig.lastConnectedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mcpConfig.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mcpConfig.createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
mcpConfig.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mcpConfig.updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
mcpConfig.folderId	string	May be null.
mcpConfig.folderPath	string
mcpConfig.readOnly	boolean
mcpConfig.installedFrom	object (two variants)	May be null.
mcpConfig.installedFrom[variant 1].linkMode	enum	One of Manual, Automatic.
mcpConfig.installedFrom[variant 1].installationId	string	May be null. Pattern: ^PKI_[A-Z0-9]{1,7}$.
mcpConfig.installedFrom[variant 1].templateId	string
mcpConfig.installedFrom[variant 1].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
mcpConfig.installedFrom[variant 2].linkMode	enum	One of Copy.
mcpConfig.installedFrom[variant 2].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
mcpConfig.version	integer	May be null. Greater than 0.
mcpConfig.deleted	boolean	Defaults to false.
mcpConfig.changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
mcpConfig.changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
mcpConfig.originKey	string	May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

delete-dashboard

Delete a dashboard.

Deletes a dashboard, staging the change in a draft changeset.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
dashboardId	string	Required	The ID of the dashboard to delete. Pattern: ^DSH_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
baseVersion	integer	Optional
spaceId	string	Required	The ID of the space to target for this operation. Pattern: ^SPC_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

create-webhook

Create a webhook.

Creates a new webhook, staging the change in a draft changeset.

Creates the resource in the active chat's space or, when contentPackId is set, in that content pack.

Call get-resource-engineering-guide with topic webhook first, then preview-webhook-config to verify the rendered JSON body before staging.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
eventName	enum	Required	The event that triggers this webhook. One of CaseCreated, CaseClosed, CaseInitialAnalysisCompleted, ContentWorkItemCreated, ThreatReportCreated, CircuitBreakerTripped, SimbaUsageAlert, AlertQueued, AlertInitialScoreCompleted, AlertPromoted, AlertExpired, AlertTriageFailure, CaseNewAlertEvidenceAttached.
method	enum	Required	One of GET, POST, PUT, PATCH, DELETE.
headers	map of string	Optional
body	string	Optional	May be null. At most 1000000 characters.
triggerExpression	string	Optional	May be null. At most 1000000 characters.
folderPath	string	Optional
name	string	Required
url	string	Required
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
id	string	The ID of the created webhook.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-webhook

Update a webhook.

Updates an existing webhook, staging the change in a draft changeset. Call get-resource-engineering-guide with topic webhook first, then preview-webhook-config to verify the rendered JSON body before staging. Only pass fields you intend to change. Omit headers, body, and other fields to preserve them. Never pass headers: {} unless you mean to remove all headers. A header value of "[redacted]" is a stored plain-text secret: pass it back unchanged to keep it. Plain-text values on secret headers such as Authorization are rejected; use {{ credential.<name> }}.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
eventName	enum	Optional	The event that triggers this webhook. One of CaseCreated, CaseClosed, CaseInitialAnalysisCompleted, ContentWorkItemCreated, ThreatReportCreated, CircuitBreakerTripped, SimbaUsageAlert, AlertQueued, AlertInitialScoreCompleted, AlertPromoted, AlertExpired, AlertTriageFailure, CaseNewAlertEvidenceAttached.
method	enum	Optional	One of GET, POST, PUT, PATCH, DELETE.
headers	map of string	Optional
body	string	Optional	May be null. At most 1000000 characters.
triggerExpression	string	Optional	May be null. At most 1000000 characters.
folderPath	string	Optional
name	string	Optional
url	string	Optional
baseVersion	integer	Optional
webhookConfigId	string	Required	The ID of the webhook to update. Pattern: ^WHK_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
webhookConfig	object (two variants)
webhookConfig[variant 1].id	string	Pattern: ^WHK_[A-Z0-9]{1,7}$.
webhookConfig[variant 1].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
webhookConfig[variant 1].spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
webhookConfig[variant 1].name	string
webhookConfig[variant 1].eventName	enum	The event that triggers this webhook. One of CaseCreated, CaseClosed, CaseInitialAnalysisCompleted, ContentWorkItemCreated, ThreatReportCreated, CircuitBreakerTripped, SimbaUsageAlert, AlertQueued, AlertInitialScoreCompleted, AlertPromoted, AlertExpired, AlertTriageFailure, CaseNewAlertEvidenceAttached.
webhookConfig[variant 1].url	string
webhookConfig[variant 1].method	enum	One of GET, POST, PUT, PATCH, DELETE.
webhookConfig[variant 1].headers	map of string
webhookConfig[variant 1].body	string	May be null. At most 1000000 characters.
webhookConfig[variant 1].triggerExpression	string	May be null. At most 1000000 characters.
webhookConfig[variant 1].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
webhookConfig[variant 1].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
webhookConfig[variant 1].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
webhookConfig[variant 1].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
webhookConfig[variant 1].folderId	string	May be null.
webhookConfig[variant 1].folderPath	string
webhookConfig[variant 1].readOnly	boolean
webhookConfig[variant 1].installedFrom	object (two variants)	May be null.
webhookConfig[variant 1].installedFrom[variant 1].linkMode	enum	One of Manual, Automatic.
webhookConfig[variant 1].installedFrom[variant 1].installationId	string	May be null. Pattern: ^PKI_[A-Z0-9]{1,7}$.
webhookConfig[variant 1].installedFrom[variant 1].templateId	string
webhookConfig[variant 1].installedFrom[variant 1].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
webhookConfig[variant 1].installedFrom[variant 2].linkMode	enum	One of Copy.
webhookConfig[variant 1].installedFrom[variant 2].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
webhookConfig[variant 1].version	integer	May be null. Greater than 0.
webhookConfig[variant 1].deleted	boolean	Defaults to false.
webhookConfig[variant 1].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
webhookConfig[variant 1].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
webhookConfig[variant 1].originKey	string	May be null.
webhookConfig[variant 2].id	string	Pattern: ^WHK_[A-Z0-9]{1,7}$.
webhookConfig[variant 2].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
webhookConfig[variant 2].name	string
webhookConfig[variant 2].eventName	enum	The event that triggers this webhook. One of CaseCreated, CaseClosed, CaseInitialAnalysisCompleted, ContentWorkItemCreated, ThreatReportCreated, CircuitBreakerTripped, SimbaUsageAlert, AlertQueued, AlertInitialScoreCompleted, AlertPromoted, AlertExpired, AlertTriageFailure, CaseNewAlertEvidenceAttached.
webhookConfig[variant 2].url	string
webhookConfig[variant 2].method	enum	One of GET, POST, PUT, PATCH, DELETE.
webhookConfig[variant 2].headers	map of string
webhookConfig[variant 2].body	string	May be null. At most 1000000 characters.
webhookConfig[variant 2].triggerExpression	string	May be null. At most 1000000 characters.
webhookConfig[variant 2].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
webhookConfig[variant 2].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
webhookConfig[variant 2].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
webhookConfig[variant 2].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
webhookConfig[variant 2].folderId	string	May be null.
webhookConfig[variant 2].folderPath	string
webhookConfig[variant 2].readOnly	boolean
webhookConfig[variant 2].version	integer	May be null. Greater than 0.
webhookConfig[variant 2].deleted	boolean	Defaults to false.
webhookConfig[variant 2].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
webhookConfig[variant 2].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
webhookConfig[variant 2].originKey	string	May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

delete-webhook

Delete a webhook.

Deletes a webhook, staging the change in a draft changeset.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
webhookConfigId	string	Required	The ID of the webhook to delete. Pattern: ^WHK_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
baseVersion	integer	Optional
spaceId	string	Required	The ID of the space to target for this operation. Pattern: ^SPC_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

preview-webhook-config

Preview webhook config rendering.

Renders a webhook configuration template against a sample event without sending an HTTP request. Pass validateBodyAsJson: true for JSON bodies and confirm bodyJsonValidation.valid before staging. Credentials are redacted in the result.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
config	object	Required
config.url	string	Required
config.headers	map of string	Optional
config.method	enum	Required	One of GET, POST, PUT, PATCH, DELETE.
config.body	string	Optional
event	object (13 variants)	Required
event[CaseCreated].type	string	Required	Always CaseCreated.
event[CaseCreated].case	object	Required
event[CaseCreated].case.id	string	Required	Pattern: ^CAS_[A-Z0-9]{1,7}$.
event[CaseCreated].case.name	string	Required	Must not be empty.
event[CaseCreated].case.status	enum	Required	One of Open, On-Hold, Closed.
event[CaseCreated].case.closureCode	enum	Required	One of True Positive - Suspicious Activity, Benign Positive - Suspicious But Expected, False Positive - Incorrect Detection Logic, False Positive - Inaccurate Data, Other, Testing. May be null.
event[CaseCreated].case.suggestedClosureCode	enum	Required	One of True Positive - Suspicious Activity, Benign Positive - Suspicious But Expected, False Positive - Incorrect Detection Logic, False Positive - Inaccurate Data, Other, Testing. May be null.
event[CaseCreated].case.suggestedClosureCodeDismissed	boolean	Required
event[CaseCreated].case.typeId	integer	Required	May be null. Greater than 0.
event[CaseCreated].case.severityId	integer	Required	May be null. Greater than 0.
event[CaseCreated].case.phaseId	integer	Required	Greater than 0.
event[CaseCreated].case.assignedToUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseCreated].case.summary	string	Required
event[CaseCreated].case.entities	array of object	Required	Nested fields omitted; see the schema in tools/list.
event[CaseCreated].case.createdByDetectionId	string	Required	May be null. Pattern: ^DET_[A-Z0-9]{1,7}$.
event[CaseCreated].case.organizationId	string	Required	Pattern: ^ORG_[A-Z0-9]{1,7}$.
event[CaseCreated].case.spaceId	string	Required	Pattern: ^SPC_[A-Z0-9]{1,7}$.
event[CaseCreated].case.createdAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseCreated].case.createdByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseCreated].case.updatedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseCreated].case.updatedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseCreated].case.version	number	Required
event[CaseCreated].case.timeToDetectMs	integer	Required	May be null. Minimum 0.
event[CaseCreated].case.timeToInvestigateMs	integer	Required	May be null. Minimum 0.
event[CaseCreated].case.timeToContainMs	integer	Required	May be null. Minimum 0.
event[CaseCreated].case.timeToEradicateMs	integer	Required	May be null. Minimum 0.
event[CaseCreated].case.timeToResolveMs	integer	Required	May be null. Minimum 0.
event[CaseCreated].case.initialAnalysisStatus	enum	Required	One of PENDING, IN_PROGRESS, PARTIAL, COMPLETED, FAILED, SKIPPED, STOPPED.
event[CaseCreated].case.initialAnalysisCompletedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseCreated].case.closedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseCreated].case.closedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseCreated].case.closedByChatId	string	Required	May be null. Pattern: ^CHT_[A-Z0-9]{1,7}$.
event[CaseCreated].case.analysisSkippedReason	enum	Optional	One of QuotaExceeded, BudgetExhausted, PromoteAllConfigured, UserRequested, RateLimited, AutomaticAnalysisDisabled. May be null.
event[CaseCreated].case.analysisStoppedReason	enum	Required	One of QuotaExceeded. May be null.
event[CaseCreated].case.blocks	array of object (five variants)	Required	Nested fields omitted; see the schema in tools/list.
event[CaseClosed].type	string	Required	Always CaseClosed.
event[CaseClosed].case	object	Required
event[CaseClosed].case.id	string	Required	Pattern: ^CAS_[A-Z0-9]{1,7}$.
event[CaseClosed].case.name	string	Required	Must not be empty.
event[CaseClosed].case.status	enum	Required	One of Open, On-Hold, Closed.
event[CaseClosed].case.closureCode	enum	Required	One of True Positive - Suspicious Activity, Benign Positive - Suspicious But Expected, False Positive - Incorrect Detection Logic, False Positive - Inaccurate Data, Other, Testing. May be null.
event[CaseClosed].case.suggestedClosureCode	enum	Required	One of True Positive - Suspicious Activity, Benign Positive - Suspicious But Expected, False Positive - Incorrect Detection Logic, False Positive - Inaccurate Data, Other, Testing. May be null.
event[CaseClosed].case.suggestedClosureCodeDismissed	boolean	Required
event[CaseClosed].case.typeId	integer	Required	May be null. Greater than 0.
event[CaseClosed].case.severityId	integer	Required	May be null. Greater than 0.
event[CaseClosed].case.phaseId	integer	Required	Greater than 0.
event[CaseClosed].case.assignedToUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseClosed].case.summary	string	Required
event[CaseClosed].case.entities	array of object	Required	Nested fields omitted; see the schema in tools/list.
event[CaseClosed].case.createdByDetectionId	string	Required	May be null. Pattern: ^DET_[A-Z0-9]{1,7}$.
event[CaseClosed].case.organizationId	string	Required	Pattern: ^ORG_[A-Z0-9]{1,7}$.
event[CaseClosed].case.spaceId	string	Required	Pattern: ^SPC_[A-Z0-9]{1,7}$.
event[CaseClosed].case.createdAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseClosed].case.createdByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseClosed].case.updatedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseClosed].case.updatedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseClosed].case.version	number	Required
event[CaseClosed].case.timeToDetectMs	integer	Required	May be null. Minimum 0.
event[CaseClosed].case.timeToInvestigateMs	integer	Required	May be null. Minimum 0.
event[CaseClosed].case.timeToContainMs	integer	Required	May be null. Minimum 0.
event[CaseClosed].case.timeToEradicateMs	integer	Required	May be null. Minimum 0.
event[CaseClosed].case.timeToResolveMs	integer	Required	May be null. Minimum 0.
event[CaseClosed].case.initialAnalysisStatus	enum	Required	One of PENDING, IN_PROGRESS, PARTIAL, COMPLETED, FAILED, SKIPPED, STOPPED.
event[CaseClosed].case.initialAnalysisCompletedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseClosed].case.closedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseClosed].case.closedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseClosed].case.closedByChatId	string	Required	May be null. Pattern: ^CHT_[A-Z0-9]{1,7}$.
event[CaseClosed].case.analysisSkippedReason	enum	Optional	One of QuotaExceeded, BudgetExhausted, PromoteAllConfigured, UserRequested, RateLimited, AutomaticAnalysisDisabled. May be null.
event[CaseClosed].case.analysisStoppedReason	enum	Required	One of QuotaExceeded. May be null.
event[CaseClosed].case.blocks	array of object (five variants)	Required	Nested fields omitted; see the schema in tools/list.
event[CaseInitialAnalysisCompleted].type	string	Required	Always CaseInitialAnalysisCompleted.
event[CaseInitialAnalysisCompleted].case	object	Required
event[CaseInitialAnalysisCompleted].case.id	string	Required	Pattern: ^CAS_[A-Z0-9]{1,7}$.
event[CaseInitialAnalysisCompleted].case.name	string	Required	Must not be empty.
event[CaseInitialAnalysisCompleted].case.status	enum	Required	One of Open, On-Hold, Closed.
event[CaseInitialAnalysisCompleted].case.closureCode	enum	Required	One of True Positive - Suspicious Activity, Benign Positive - Suspicious But Expected, False Positive - Incorrect Detection Logic, False Positive - Inaccurate Data, Other, Testing. May be null.
event[CaseInitialAnalysisCompleted].case.suggestedClosureCode	enum	Required	One of True Positive - Suspicious Activity, Benign Positive - Suspicious But Expected, False Positive - Incorrect Detection Logic, False Positive - Inaccurate Data, Other, Testing. May be null.
event[CaseInitialAnalysisCompleted].case.suggestedClosureCodeDismissed	boolean	Required
event[CaseInitialAnalysisCompleted].case.typeId	integer	Required	May be null. Greater than 0.
event[CaseInitialAnalysisCompleted].case.severityId	integer	Required	May be null. Greater than 0.
event[CaseInitialAnalysisCompleted].case.phaseId	integer	Required	Greater than 0.
event[CaseInitialAnalysisCompleted].case.assignedToUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseInitialAnalysisCompleted].case.summary	string	Required
event[CaseInitialAnalysisCompleted].case.entities	array of object	Required	Nested fields omitted; see the schema in tools/list.
event[CaseInitialAnalysisCompleted].case.createdByDetectionId	string	Required	May be null. Pattern: ^DET_[A-Z0-9]{1,7}$.
event[CaseInitialAnalysisCompleted].case.organizationId	string	Required	Pattern: ^ORG_[A-Z0-9]{1,7}$.
event[CaseInitialAnalysisCompleted].case.spaceId	string	Required	Pattern: ^SPC_[A-Z0-9]{1,7}$.
event[CaseInitialAnalysisCompleted].case.createdAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseInitialAnalysisCompleted].case.createdByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseInitialAnalysisCompleted].case.updatedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseInitialAnalysisCompleted].case.updatedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseInitialAnalysisCompleted].case.version	number	Required
event[CaseInitialAnalysisCompleted].case.timeToDetectMs	integer	Required	May be null. Minimum 0.
event[CaseInitialAnalysisCompleted].case.timeToInvestigateMs	integer	Required	May be null. Minimum 0.
event[CaseInitialAnalysisCompleted].case.timeToContainMs	integer	Required	May be null. Minimum 0.
event[CaseInitialAnalysisCompleted].case.timeToEradicateMs	integer	Required	May be null. Minimum 0.
event[CaseInitialAnalysisCompleted].case.timeToResolveMs	integer	Required	May be null. Minimum 0.
event[CaseInitialAnalysisCompleted].case.initialAnalysisStatus	enum	Required	One of PENDING, IN_PROGRESS, PARTIAL, COMPLETED, FAILED, SKIPPED, STOPPED.
event[CaseInitialAnalysisCompleted].case.initialAnalysisCompletedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseInitialAnalysisCompleted].case.closedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseInitialAnalysisCompleted].case.closedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseInitialAnalysisCompleted].case.closedByChatId	string	Required	May be null. Pattern: ^CHT_[A-Z0-9]{1,7}$.
event[CaseInitialAnalysisCompleted].case.analysisSkippedReason	enum	Optional	One of QuotaExceeded, BudgetExhausted, PromoteAllConfigured, UserRequested, RateLimited, AutomaticAnalysisDisabled. May be null.
event[CaseInitialAnalysisCompleted].case.analysisStoppedReason	enum	Required	One of QuotaExceeded. May be null.
event[CaseInitialAnalysisCompleted].case.blocks	array of object (five variants)	Required	Nested fields omitted; see the schema in tools/list.
event[ContentWorkItemCreated].type	string	Required	Always ContentWorkItemCreated.
event[ContentWorkItemCreated].contentWorkItem	object	Required
event[ContentWorkItemCreated].contentWorkItem.id	string	Required	Pattern: ^CWI_[A-Z0-9]{1,7}$.
event[ContentWorkItemCreated].contentWorkItem.organizationId	string	Required	Pattern: ^ORG_[A-Z0-9]{1,7}$.
event[ContentWorkItemCreated].contentWorkItem.spaceId	string	Required	Pattern: ^SPC_[A-Z0-9]{1,7}$.
event[ContentWorkItemCreated].contentWorkItem.name	string	Required
event[ContentWorkItemCreated].contentWorkItem.description	string	Required
event[ContentWorkItemCreated].contentWorkItem.status	enum	Required	One of Open, Done, Cancelled.
event[ContentWorkItemCreated].contentWorkItem.assignedToUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[ContentWorkItemCreated].contentWorkItem.createdAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[ContentWorkItemCreated].contentWorkItem.createdByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[ContentWorkItemCreated].contentWorkItem.updatedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[ContentWorkItemCreated].contentWorkItem.updatedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[ContentWorkItemCreated].contentWorkItem.implementationSkippedReason	enum	Optional	One of QuotaExceeded. May be null.
event[ThreatReportCreated].type	string	Required	Always ThreatReportCreated.
event[ThreatReportCreated].threatReport	object	Required
event[ThreatReportCreated].threatReport.id	string	Required	Pattern: ^THR_[A-Z0-9]{1,7}$.
event[ThreatReportCreated].threatReport.organizationId	string	Required	Pattern: ^ORG_[A-Z0-9]{1,7}$.
event[ThreatReportCreated].threatReport.name	string	Required
event[ThreatReportCreated].threatReport.summary	string	Required
event[ThreatReportCreated].threatReport.content	string	Required
event[ThreatReportCreated].threatReport.publishedDate	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[ThreatReportCreated].threatReport.url	string	Required	Format: uri.
event[ThreatReportCreated].threatReport.author	string	Optional	May be null.
event[ThreatReportCreated].threatReport.imageUrl	string	Optional	May be null. Format: uri.
event[ThreatReportCreated].threatReport.createdAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[ThreatReportCreated].threatReport.createdByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[ThreatReportCreated].threatReport.updatedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[ThreatReportCreated].threatReport.updatedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[ThreatReportCreated].threatReport.version	number	Required
event[ThreatReportCreated].threatReport.triageComplete	boolean	Required
event[ThreatReportCreated].threatReport.contentWorkItems	array of object	Required	Nested fields omitted; see the schema in tools/list.
event[ThreatReportCreated].threatReport.triageQuotaSkippedSpaces	map of string	Optional
event[CircuitBreakerTripped].type	string	Required	Always CircuitBreakerTripped.
event[CircuitBreakerTripped].circuitBreaker	object	Required
event[CircuitBreakerTripped].circuitBreaker.breakerType	string	Required
event[CircuitBreakerTripped].circuitBreaker.params	map of string	Required
event[CircuitBreakerTripped].circuitBreaker.cutoff	number	Required
event[SimbaUsageAlert].type	string	Required	Always SimbaUsageAlert.
event[SimbaUsageAlert].alert	object	Required
event[SimbaUsageAlert].alert.category	enum	Required	One of Cases, ContentEngineering, Chat, Misc, Total.
event[SimbaUsageAlert].alert.spaceId	string	Required	May be null.
event[SimbaUsageAlert].alert.budgetAmountUsd	number	Required
event[SimbaUsageAlert].alert.currentUsageUsd	number	Required
event[SimbaUsageAlert].alert.rule	object (two variants)	Required	Nested fields omitted; see the schema in tools/list.
event[AlertQueued].type	string	Required	Always AlertQueued.
event[AlertQueued].alert	object	Required
event[AlertQueued].alert.id	string	Required	Pattern: ^ALR_[A-Z0-9]{1,7}$.
event[AlertQueued].alert.name	string	Required
event[AlertQueued].alert.status	enum	Required	One of Queued, Accumulating, Processing, Promoted, Merged, Expired, TriageFailure.
event[AlertQueued].alert.createdByDetectionId	string	Required	May be null. Pattern: ^DET_[A-Z0-9]{1,7}$.
event[AlertQueued].alert.createdByDetectionName	string	Required	May be null.
event[AlertQueued].alert.primarySignalId	string	Required
event[AlertQueued].alert.signalIds	array of string	Required
event[AlertQueued].alert.currentPriority	integer	Required	May be null. Minimum 1. Maximum 10.
event[AlertQueued].alert.summary	string	Required
event[AlertQueued].alert.playbookSnapshot	string	Required	May be null.
event[AlertQueued].alert.accumulationKeyValue	string	Required	May be null.
event[AlertQueued].alert.organizationId	string	Required	Pattern: ^ORG_[A-Z0-9]{1,7}$.
event[AlertQueued].alert.spaceId	string	Required	Pattern: ^SPC_[A-Z0-9]{1,7}$.
event[AlertQueued].alert.createdAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[AlertQueued].alert.createdByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[AlertQueued].alert.updatedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[AlertQueued].alert.updatedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[AlertQueued].alert.version	number	Required
event[AlertQueued].alert.primarySignal	object	Optional	Nested fields omitted; see the schema in tools/list.
event[AlertQueued].alert.signals	array of object	Optional	Nested fields omitted; see the schema in tools/list.
event[AlertInitialScoreCompleted].type	string	Required	Always AlertInitialScoreCompleted.
event[AlertInitialScoreCompleted].alert	object	Required
event[AlertInitialScoreCompleted].alert.id	string	Required	Pattern: ^ALR_[A-Z0-9]{1,7}$.
event[AlertInitialScoreCompleted].alert.name	string	Required
event[AlertInitialScoreCompleted].alert.status	enum	Required	One of Queued, Accumulating, Processing, Promoted, Merged, Expired, TriageFailure.
event[AlertInitialScoreCompleted].alert.createdByDetectionId	string	Required	May be null. Pattern: ^DET_[A-Z0-9]{1,7}$.
event[AlertInitialScoreCompleted].alert.createdByDetectionName	string	Required	May be null.
event[AlertInitialScoreCompleted].alert.primarySignalId	string	Required
event[AlertInitialScoreCompleted].alert.signalIds	array of string	Required
event[AlertInitialScoreCompleted].alert.currentPriority	integer	Required	May be null. Minimum 1. Maximum 10.
event[AlertInitialScoreCompleted].alert.summary	string	Required
event[AlertInitialScoreCompleted].alert.playbookSnapshot	string	Required	May be null.
event[AlertInitialScoreCompleted].alert.accumulationKeyValue	string	Required	May be null.
event[AlertInitialScoreCompleted].alert.organizationId	string	Required	Pattern: ^ORG_[A-Z0-9]{1,7}$.
event[AlertInitialScoreCompleted].alert.spaceId	string	Required	Pattern: ^SPC_[A-Z0-9]{1,7}$.
event[AlertInitialScoreCompleted].alert.createdAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[AlertInitialScoreCompleted].alert.createdByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[AlertInitialScoreCompleted].alert.updatedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[AlertInitialScoreCompleted].alert.updatedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[AlertInitialScoreCompleted].alert.version	number	Required
event[AlertInitialScoreCompleted].alert.primarySignal	object	Optional	Nested fields omitted; see the schema in tools/list.
event[AlertInitialScoreCompleted].alert.signals	array of object	Optional	Nested fields omitted; see the schema in tools/list.
event[AlertPromoted].type	string	Required	Always AlertPromoted.
event[AlertPromoted].alert	object	Required
event[AlertPromoted].alert.id	string	Required	Pattern: ^ALR_[A-Z0-9]{1,7}$.
event[AlertPromoted].alert.name	string	Required
event[AlertPromoted].alert.status	enum	Required	One of Queued, Accumulating, Processing, Promoted, Merged, Expired, TriageFailure.
event[AlertPromoted].alert.createdByDetectionId	string	Required	May be null. Pattern: ^DET_[A-Z0-9]{1,7}$.
event[AlertPromoted].alert.createdByDetectionName	string	Required	May be null.
event[AlertPromoted].alert.primarySignalId	string	Required
event[AlertPromoted].alert.signalIds	array of string	Required
event[AlertPromoted].alert.currentPriority	integer	Required	May be null. Minimum 1. Maximum 10.
event[AlertPromoted].alert.summary	string	Required
event[AlertPromoted].alert.playbookSnapshot	string	Required	May be null.
event[AlertPromoted].alert.accumulationKeyValue	string	Required	May be null.
event[AlertPromoted].alert.organizationId	string	Required	Pattern: ^ORG_[A-Z0-9]{1,7}$.
event[AlertPromoted].alert.spaceId	string	Required	Pattern: ^SPC_[A-Z0-9]{1,7}$.
event[AlertPromoted].alert.createdAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[AlertPromoted].alert.createdByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[AlertPromoted].alert.updatedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[AlertPromoted].alert.updatedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[AlertPromoted].alert.version	number	Required
event[AlertPromoted].alert.primarySignal	object	Optional	Nested fields omitted; see the schema in tools/list.
event[AlertPromoted].alert.signals	array of object	Optional	Nested fields omitted; see the schema in tools/list.
event[AlertPromoted].caseId	string	Required	Pattern: ^CAS_[A-Z0-9]{1,7}$.
event[AlertPromoted].promotedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[AlertExpired].type	string	Required	Always AlertExpired.
event[AlertExpired].alert	object	Required
event[AlertExpired].alert.id	string	Required	Pattern: ^ALR_[A-Z0-9]{1,7}$.
event[AlertExpired].alert.name	string	Required
event[AlertExpired].alert.status	enum	Required	One of Queued, Accumulating, Processing, Promoted, Merged, Expired, TriageFailure.
event[AlertExpired].alert.createdByDetectionId	string	Required	May be null. Pattern: ^DET_[A-Z0-9]{1,7}$.
event[AlertExpired].alert.createdByDetectionName	string	Required	May be null.
event[AlertExpired].alert.primarySignalId	string	Required
event[AlertExpired].alert.signalIds	array of string	Required
event[AlertExpired].alert.currentPriority	integer	Required	May be null. Minimum 1. Maximum 10.
event[AlertExpired].alert.summary	string	Required
event[AlertExpired].alert.playbookSnapshot	string	Required	May be null.
event[AlertExpired].alert.accumulationKeyValue	string	Required	May be null.
event[AlertExpired].alert.organizationId	string	Required	Pattern: ^ORG_[A-Z0-9]{1,7}$.
event[AlertExpired].alert.spaceId	string	Required	Pattern: ^SPC_[A-Z0-9]{1,7}$.
event[AlertExpired].alert.createdAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[AlertExpired].alert.createdByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[AlertExpired].alert.updatedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[AlertExpired].alert.updatedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[AlertExpired].alert.version	number	Required
event[AlertExpired].alert.primarySignal	object	Optional	Nested fields omitted; see the schema in tools/list.
event[AlertExpired].alert.signals	array of object	Optional	Nested fields omitted; see the schema in tools/list.
event[AlertTriageFailure].type	string	Required	Always AlertTriageFailure.
event[AlertTriageFailure].alert	object	Required
event[AlertTriageFailure].alert.id	string	Required	Pattern: ^ALR_[A-Z0-9]{1,7}$.
event[AlertTriageFailure].alert.name	string	Required
event[AlertTriageFailure].alert.status	enum	Required	One of Queued, Accumulating, Processing, Promoted, Merged, Expired, TriageFailure.
event[AlertTriageFailure].alert.createdByDetectionId	string	Required	May be null. Pattern: ^DET_[A-Z0-9]{1,7}$.
event[AlertTriageFailure].alert.createdByDetectionName	string	Required	May be null.
event[AlertTriageFailure].alert.primarySignalId	string	Required
event[AlertTriageFailure].alert.signalIds	array of string	Required
event[AlertTriageFailure].alert.currentPriority	integer	Required	May be null. Minimum 1. Maximum 10.
event[AlertTriageFailure].alert.summary	string	Required
event[AlertTriageFailure].alert.playbookSnapshot	string	Required	May be null.
event[AlertTriageFailure].alert.accumulationKeyValue	string	Required	May be null.
event[AlertTriageFailure].alert.organizationId	string	Required	Pattern: ^ORG_[A-Z0-9]{1,7}$.
event[AlertTriageFailure].alert.spaceId	string	Required	Pattern: ^SPC_[A-Z0-9]{1,7}$.
event[AlertTriageFailure].alert.createdAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[AlertTriageFailure].alert.createdByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[AlertTriageFailure].alert.updatedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[AlertTriageFailure].alert.updatedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[AlertTriageFailure].alert.version	number	Required
event[AlertTriageFailure].alert.primarySignal	object	Optional	Nested fields omitted; see the schema in tools/list.
event[AlertTriageFailure].alert.signals	array of object	Optional	Nested fields omitted; see the schema in tools/list.
event[AlertTriageFailure].reason	string	Required	May be null. At most 4000 characters.
event[CaseNewAlertEvidenceAttached].type	string	Required	Always CaseNewAlertEvidenceAttached.
event[CaseNewAlertEvidenceAttached].case	object	Required
event[CaseNewAlertEvidenceAttached].case.id	string	Required	Pattern: ^CAS_[A-Z0-9]{1,7}$.
event[CaseNewAlertEvidenceAttached].case.name	string	Required	Must not be empty.
event[CaseNewAlertEvidenceAttached].case.status	enum	Required	One of Open, On-Hold, Closed.
event[CaseNewAlertEvidenceAttached].case.closureCode	enum	Required	One of True Positive - Suspicious Activity, Benign Positive - Suspicious But Expected, False Positive - Incorrect Detection Logic, False Positive - Inaccurate Data, Other, Testing. May be null.
event[CaseNewAlertEvidenceAttached].case.suggestedClosureCode	enum	Required	One of True Positive - Suspicious Activity, Benign Positive - Suspicious But Expected, False Positive - Incorrect Detection Logic, False Positive - Inaccurate Data, Other, Testing. May be null.
event[CaseNewAlertEvidenceAttached].case.suggestedClosureCodeDismissed	boolean	Required
event[CaseNewAlertEvidenceAttached].case.typeId	integer	Required	May be null. Greater than 0.
event[CaseNewAlertEvidenceAttached].case.severityId	integer	Required	May be null. Greater than 0.
event[CaseNewAlertEvidenceAttached].case.phaseId	integer	Required	Greater than 0.
event[CaseNewAlertEvidenceAttached].case.assignedToUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseNewAlertEvidenceAttached].case.summary	string	Required
event[CaseNewAlertEvidenceAttached].case.entities	array of object	Required	Nested fields omitted; see the schema in tools/list.
event[CaseNewAlertEvidenceAttached].case.createdByDetectionId	string	Required	May be null. Pattern: ^DET_[A-Z0-9]{1,7}$.
event[CaseNewAlertEvidenceAttached].case.organizationId	string	Required	Pattern: ^ORG_[A-Z0-9]{1,7}$.
event[CaseNewAlertEvidenceAttached].case.spaceId	string	Required	Pattern: ^SPC_[A-Z0-9]{1,7}$.
event[CaseNewAlertEvidenceAttached].case.createdAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseNewAlertEvidenceAttached].case.createdByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseNewAlertEvidenceAttached].case.updatedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseNewAlertEvidenceAttached].case.updatedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseNewAlertEvidenceAttached].case.version	number	Required
event[CaseNewAlertEvidenceAttached].case.timeToDetectMs	integer	Required	May be null. Minimum 0.
event[CaseNewAlertEvidenceAttached].case.timeToInvestigateMs	integer	Required	May be null. Minimum 0.
event[CaseNewAlertEvidenceAttached].case.timeToContainMs	integer	Required	May be null. Minimum 0.
event[CaseNewAlertEvidenceAttached].case.timeToEradicateMs	integer	Required	May be null. Minimum 0.
event[CaseNewAlertEvidenceAttached].case.timeToResolveMs	integer	Required	May be null. Minimum 0.
event[CaseNewAlertEvidenceAttached].case.initialAnalysisStatus	enum	Required	One of PENDING, IN_PROGRESS, PARTIAL, COMPLETED, FAILED, SKIPPED, STOPPED.
event[CaseNewAlertEvidenceAttached].case.initialAnalysisCompletedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseNewAlertEvidenceAttached].case.closedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseNewAlertEvidenceAttached].case.closedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseNewAlertEvidenceAttached].case.closedByChatId	string	Required	May be null. Pattern: ^CHT_[A-Z0-9]{1,7}$.
event[CaseNewAlertEvidenceAttached].case.analysisSkippedReason	enum	Optional	One of QuotaExceeded, BudgetExhausted, PromoteAllConfigured, UserRequested, RateLimited, AutomaticAnalysisDisabled. May be null.
event[CaseNewAlertEvidenceAttached].case.analysisStoppedReason	enum	Required	One of QuotaExceeded. May be null.
event[CaseNewAlertEvidenceAttached].case.blocks	array of object (five variants)	Required	Nested fields omitted; see the schema in tools/list.
event[CaseNewAlertEvidenceAttached].alert	object	Required
event[CaseNewAlertEvidenceAttached].alert.id	string	Required	Pattern: ^ALR_[A-Z0-9]{1,7}$.
event[CaseNewAlertEvidenceAttached].alert.name	string	Required
event[CaseNewAlertEvidenceAttached].alert.status	enum	Required	One of Queued, Accumulating, Processing, Promoted, Merged, Expired, TriageFailure.
event[CaseNewAlertEvidenceAttached].alert.createdByDetectionId	string	Required	May be null. Pattern: ^DET_[A-Z0-9]{1,7}$.
event[CaseNewAlertEvidenceAttached].alert.createdByDetectionName	string	Required	May be null.
event[CaseNewAlertEvidenceAttached].alert.primarySignalId	string	Required
event[CaseNewAlertEvidenceAttached].alert.signalIds	array of string	Required
event[CaseNewAlertEvidenceAttached].alert.currentPriority	integer	Required	May be null. Minimum 1. Maximum 10.
event[CaseNewAlertEvidenceAttached].alert.summary	string	Required
event[CaseNewAlertEvidenceAttached].alert.playbookSnapshot	string	Required	May be null.
event[CaseNewAlertEvidenceAttached].alert.accumulationKeyValue	string	Required	May be null.
event[CaseNewAlertEvidenceAttached].alert.organizationId	string	Required	Pattern: ^ORG_[A-Z0-9]{1,7}$.
event[CaseNewAlertEvidenceAttached].alert.spaceId	string	Required	Pattern: ^SPC_[A-Z0-9]{1,7}$.
event[CaseNewAlertEvidenceAttached].alert.createdAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseNewAlertEvidenceAttached].alert.createdByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseNewAlertEvidenceAttached].alert.updatedAt	string	Required	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
event[CaseNewAlertEvidenceAttached].alert.updatedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
event[CaseNewAlertEvidenceAttached].alert.version	number	Required
event[CaseNewAlertEvidenceAttached].alert.primarySignal	object	Optional	Nested fields omitted; see the schema in tools/list.
event[CaseNewAlertEvidenceAttached].alert.signals	array of object	Optional	Nested fields omitted; see the schema in tools/list.
event[CaseNewAlertEvidenceAttached].promotedByUserId	string	Required	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
properties	object	Optional
validateBodyAsJson	boolean	Optional

Outputs

Field	Type	Description
config	object
config.headers	map of string
config.method	enum	One of GET, POST, PUT, PATCH, DELETE.
config.body	string
config.url	string	Must not be empty.
bodyJsonValidation	object
bodyJsonValidation.valid	boolean
bodyJsonValidation.error	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

create-skill

Create a skill.

Creates a new skill, staging the change in a draft changeset.

Creates the resource in the active chat's space or, when contentPackId is set, in that content pack.

Content-pack skills are organization-scoped and cannot have a folder.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
description	string	Required
instructions	string	Required
argumentHint	string	Optional	May be null. At most 1000 characters.
folderPath	string	Optional
name	string	Required	Pattern: ^[a-z0-9]+(?:-[a-z0-9]+)*$. Must not be empty. At most 64 characters.
disableModelInvocation	boolean	Optional
userInvocable	boolean	Optional
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
id	string	The ID of the created skill.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-skill

Update a skill.

Updates an existing skill (its name, description, instructions, argument hint, invocation flags, or folder), staging the change in a draft changeset. Set contentPackId when updating a content-pack skill; pack skills cannot have a folder. Read the skill first with get-resource to see its current instructions before editing.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
description	string	Optional
instructions	string	Optional
argumentHint	string	Optional	May be null. At most 1000 characters.
folderPath	string	Optional
name	string	Optional	Pattern: ^[a-z0-9]+(?:-[a-z0-9]+)*$. Must not be empty. At most 64 characters.
baseVersion	integer	Optional
disableModelInvocation	boolean	Optional
userInvocable	boolean	Optional
skillId	string	Required	The ID of the skill to update. Pattern: ^SKL_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
skill	object (two variants)
skill[variant 1].id	string	Pattern: ^SKL_[A-Z0-9]{1,7}$.
skill[variant 1].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
skill[variant 1].spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
skill[variant 1].name	string
skill[variant 1].description	string
skill[variant 1].instructions	string
skill[variant 1].disableModelInvocation	boolean
skill[variant 1].userInvocable	boolean
skill[variant 1].argumentHint	string	May be null. At most 1000 characters.
skill[variant 1].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
skill[variant 1].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
skill[variant 1].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
skill[variant 1].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
skill[variant 1].folderId	string	May be null.
skill[variant 1].folderPath	string
skill[variant 1].readOnly	boolean
skill[variant 1].installedFrom	object (two variants)	May be null.
skill[variant 1].installedFrom[variant 1].linkMode	enum	One of Manual, Automatic.
skill[variant 1].installedFrom[variant 1].installationId	string	May be null. Pattern: ^PKI_[A-Z0-9]{1,7}$.
skill[variant 1].installedFrom[variant 1].templateId	string
skill[variant 1].installedFrom[variant 1].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
skill[variant 1].installedFrom[variant 2].linkMode	enum	One of Copy.
skill[variant 1].installedFrom[variant 2].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
skill[variant 1].installedFromPack	object
skill[variant 1].installedFromPack.id	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
skill[variant 1].installedFromPack.name	string
skill[variant 1].installedFromPack.linkMode	enum	One of Manual, Copy, Automatic.
skill[variant 1].version	integer	May be null. Greater than 0.
skill[variant 1].deleted	boolean	Defaults to false.
skill[variant 1].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
skill[variant 1].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
skill[variant 1].originKey	string	May be null.
skill[variant 2].id	string	Pattern: ^SKL_[A-Z0-9]{1,7}$.
skill[variant 2].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
skill[variant 2].name	string
skill[variant 2].description	string
skill[variant 2].instructions	string
skill[variant 2].disableModelInvocation	boolean
skill[variant 2].userInvocable	boolean
skill[variant 2].argumentHint	string	May be null. At most 1000 characters.
skill[variant 2].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
skill[variant 2].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
skill[variant 2].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
skill[variant 2].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
skill[variant 2].folderId	string	May be null.
skill[variant 2].folderPath	string
skill[variant 2].readOnly	boolean
skill[variant 2].installedFromPack	object
skill[variant 2].installedFromPack.id	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
skill[variant 2].installedFromPack.name	string
skill[variant 2].installedFromPack.linkMode	enum	One of Manual, Copy, Automatic.
skill[variant 2].version	integer	May be null. Greater than 0.
skill[variant 2].deleted	boolean	Defaults to false.
skill[variant 2].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
skill[variant 2].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
skill[variant 2].originKey	string	May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

delete-skill

Delete a skill.

Deletes a skill, staging the change in a draft changeset. Set contentPackId when deleting a content-pack skill.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
skillId	string	Required	The ID of the skill to delete. Pattern: ^SKL_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
baseVersion	integer	Optional

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

Related

• MCP access, the surface these tools are registered on.
• Content, the category these tools write.
• Dashboards, Webhooks, and Skills, the resources.