Deployable content tools

The MCP tools that create, update, delete, list, and validate deployable content: detections, integrations, integration parsers, integration mappers, and lookups.

Each of the five kinds carries a create, update, and delete tool named for the kind, and detections and integrations carry a list tool. A write takes an optional changesetId, and a write with a contentPackId argument can target a content pack instead of a Space. validate-detection-deployment checks a detection query against the deployment requirements without writing anything.

Tool names and schemas can change at any time

An agent sees each change the next time it reads tools/list, while a script that hard-codes a tool name or schema breaks when that tool changes.

Each section below is one tool as MCP access registers it: its title, its description, the annotations it sets, and the input and output schemas from tools/list. Field paths use parent.child for a nested object, parent[].child for the items of an array, and parent[Value].child for one variant of a field that takes several shapes.

create-detection

Create a detection.

Creates a new detection in Perpetual. A detection is a rule that can monitor data and trigger alerts or signals.

AI-created detections use a default 1-hour maximum latency. You can choose 1-hour or 1-day latency; the 15-minute option is only available to humans when enabled for the organization.

Omit folderPath to create at the root. A nonempty folderPath must already exist in the target space or content pack; this tool does not create folders. Use search-resources and get-resource to verify a folder before supplying its full path.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Required	The detection name (max 256 characters). At most 256 characters.
description	string	Required	May be null. At most 100000 characters.
maturity	enum	Required	One of EXPERIMENTAL, TEST, STABLE, DEPRECATED.
level	enum	Required	One of INFORMATIONAL, LOW, MEDIUM, HIGH, CRITICAL.
type	enum	Required	The detection type (required, only QUERY is supported currently). One of QUERY, SCENARIO.
query	string	Required	The Hamelin query for the detection (max 1,000,000 characters). At most 1000000 characters.
createCase	boolean	Optional	Whether to create a case for the detection. Defaults to false.
startsAt	string	Optional	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
retentionDays	integer	Optional	May be null. Greater than 0.
playbook	string	Optional	May be null. At most 10000 characters.
minimumPriority	integer	Optional	May be null. Minimum 1. Maximum 10.
accumulationKey	array of string	Optional	May be null.
archived	boolean	Optional	Defaults to false.
implementsContentWorkItemIds	array of string	Optional
folderPath	string	Optional
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
maximumLatency	enum	Optional	One of MAX_1H, MAX_1D.
spaceId	string	Optional	Pattern: ^SPC_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.
deploy	boolean	Optional

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
id	string	The ID of the created detection.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-detection

Update a detection.

Updates an existing detection's fields such as name, description, query, maturity, level, type, deploy status, and other properties. Use this tool when the user wants to modify properties of an existing detection.

You can set maximum latency to 1-hour or 1-day. The 15-minute option is only available to humans when enabled for the organization.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Optional	The detection name (max 256 characters). At most 256 characters.
description	string	Optional	May be null. At most 100000 characters.
maturity	enum	Optional	One of EXPERIMENTAL, TEST, STABLE, DEPRECATED.
level	enum	Optional	One of INFORMATIONAL, LOW, MEDIUM, HIGH, CRITICAL.
type	enum	Optional	The detection type (required, only QUERY is supported currently). One of QUERY, SCENARIO.
query	string	Optional	The Hamelin query for the detection (max 1,000,000 characters). At most 1000000 characters.
deploy	boolean	Optional	Whether to deploy the detection (required). It should only be set to true if the user explicitly asks it to be deployed.
createCase	boolean	Optional	Whether to create a case for the detection.
startsAt	string	Optional	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
retentionDays	integer	Optional	May be null. Greater than 0.
playbook	string	Optional	May be null. At most 10000 characters.
minimumPriority	integer	Optional	May be null. Minimum 1. Maximum 10.
accumulationKey	array of string	Optional	May be null.
archived	boolean	Optional
implementsContentWorkItemIds	array of string	Optional
folderPath	string	Optional
maximumLatency	enum	Optional	One of MAX_1H, MAX_1D.
detectionId	string	Required	The ID of the detection to update.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
detection	object (two variants)
detection[variant 1].name	string	The detection name (max 256 characters). At most 256 characters.
detection[variant 1].description	string	May be null. At most 100000 characters.
detection[variant 1].maturity	enum	One of EXPERIMENTAL, TEST, STABLE, DEPRECATED.
detection[variant 1].level	enum	One of INFORMATIONAL, LOW, MEDIUM, HIGH, CRITICAL.
detection[variant 1].type	enum	The detection type (required, only QUERY is supported currently). One of QUERY, SCENARIO.
detection[variant 1].query	string	The Hamelin query for the detection (max 1,000,000 characters). At most 1000000 characters.
detection[variant 1].maximumLatency	enum	One of MAX_1H, MAX_1D, MAX_15M.
detection[variant 1].deploy	boolean	Whether to deploy the detection (required). It should only be set to true if the user explicitly asks it to be deployed.
detection[variant 1].createCase	boolean	Whether to create a case for the detection.
detection[variant 1].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
detection[variant 1].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
detection[variant 1].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
detection[variant 1].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
detection[variant 1].startsAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
detection[variant 1].archived	boolean
detection[variant 1].retentionDays	integer	May be null. Greater than 0.
detection[variant 1].playbook	string	May be null. At most 10000 characters.
detection[variant 1].minimumPriority	integer	May be null. Minimum 1. Maximum 10.
detection[variant 1].accumulationKey	array of string	May be null.
detection[variant 1].version	integer	May be null. Greater than 0.
detection[variant 1].deleted	boolean	Defaults to false.
detection[variant 1].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
detection[variant 1].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
detection[variant 1].id	string	Pattern: ^DET_[A-Z0-9]{1,7}$.
detection[variant 1].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
detection[variant 1].view	object
detection[variant 1].view.id	string	Pattern: ^VIE_[A-Z0-9]{1,7}$.
detection[variant 1].view.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
detection[variant 1].view.status	enum	One of UNDEPLOYED, DEPLOYED, FAILED, DEGRADED, DEPLOY_PENDING, DEPLOY_IN_PROGRESS, UPDATE_PENDING, UPDATE_IN_PROGRESS, REFRESH_IN_PROGRESS, ARCHIVED, CLEANUP_PENDING, CLEANUP_IN_PROGRESS.
detection[variant 1].view.lastMaterializedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
detection[variant 1].table	object
detection[variant 1].table.id	string	Pattern: ^TBL_[A-Z0-9]{1,7}$.
detection[variant 1].table.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
detection[variant 1].table.status	enum	One of UNDEPLOYED, DEPLOYED, FAILED, DEGRADED, DEPLOY_PENDING, DEPLOY_IN_PROGRESS, UPDATE_PENDING, UPDATE_IN_PROGRESS, REFRESH_IN_PROGRESS, ARCHIVED, CLEANUP_PENDING, CLEANUP_IN_PROGRESS.
detection[variant 1].table.lastMaterializedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
detection[variant 1].deploymentStatus	enum	One of UNDEPLOYED, DEPLOYED, FAILED, DEGRADED, DEPLOY_PENDING, DEPLOY_IN_PROGRESS, UPDATE_PENDING, UPDATE_IN_PROGRESS, REFRESH_IN_PROGRESS, ARCHIVED, CLEANUP_PENDING, CLEANUP_IN_PROGRESS.
detection[variant 1].folderId	string	May be null. Pattern: ^FLD_[A-Z0-9]{1,7}$.
detection[variant 1].folderPath	string
detection[variant 1].spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
detection[variant 1].installedFromPack	object
detection[variant 1].installedFromPack.id	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
detection[variant 1].installedFromPack.name	string
detection[variant 1].installedFromPack.linkMode	enum	One of Manual, Copy, Automatic.
detection[variant 1].installedFrom	object (two variants)	May be null.
detection[variant 1].installedFrom[variant 1].linkMode	enum	One of Manual, Automatic.
detection[variant 1].installedFrom[variant 1].installationId	string	May be null. Pattern: ^PKI_[A-Z0-9]{1,7}$.
detection[variant 1].installedFrom[variant 1].templateId	string
detection[variant 1].installedFrom[variant 1].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
detection[variant 1].installedFrom[variant 2].linkMode	enum	One of Copy.
detection[variant 1].installedFrom[variant 2].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
detection[variant 1].readOnly	boolean	Whether this detection is read-only (e.g. installed from a content pack).
detection[variant 1].originKey	string	May be null.
detection[variant 2].name	string	The detection name (max 256 characters). At most 256 characters.
detection[variant 2].description	string	May be null. At most 100000 characters.
detection[variant 2].maturity	enum	One of EXPERIMENTAL, TEST, STABLE, DEPRECATED.
detection[variant 2].level	enum	One of INFORMATIONAL, LOW, MEDIUM, HIGH, CRITICAL.
detection[variant 2].type	enum	The detection type (required, only QUERY is supported currently). One of QUERY, SCENARIO.
detection[variant 2].query	string	The Hamelin query for the detection (max 1,000,000 characters). At most 1000000 characters.
detection[variant 2].maximumLatency	enum	One of MAX_1H, MAX_1D, MAX_15M.
detection[variant 2].createCase	boolean	Whether to create a case for the detection.
detection[variant 2].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
detection[variant 2].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
detection[variant 2].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
detection[variant 2].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
detection[variant 2].startsAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
detection[variant 2].archived	boolean
detection[variant 2].retentionDays	integer	May be null. Greater than 0.
detection[variant 2].playbook	string	May be null. At most 10000 characters.
detection[variant 2].minimumPriority	integer	May be null. Minimum 1. Maximum 10.
detection[variant 2].accumulationKey	array of string	May be null.
detection[variant 2].version	integer	May be null. Greater than 0.
detection[variant 2].deleted	boolean	Defaults to false.
detection[variant 2].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
detection[variant 2].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
detection[variant 2].id	string	Pattern: ^DET_[A-Z0-9]{1,7}$.
detection[variant 2].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
detection[variant 2].folderId	string	May be null. Pattern: ^FLD_[A-Z0-9]{1,7}$.
detection[variant 2].folderPath	string
detection[variant 2].installedFromPack	object
detection[variant 2].installedFromPack.id	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
detection[variant 2].installedFromPack.name	string
detection[variant 2].installedFromPack.linkMode	enum	One of Manual, Copy, Automatic.
detection[variant 2].readOnly	boolean	Whether this detection is read-only (e.g. installed from a content pack).
detection[variant 2].originKey	string	May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

delete-detection

Delete detection.

Deletes a detection. Use this tool when the user wants to permanently remove a detection.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
detectionId	string	Required	The ID of the detection to delete.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

list-detections

List detections.

Lists detections with their IDs and names. Use filter, orderby, top, and skip to narrow, sort, and page — each parameter documents the fields and syntax it accepts. When contentPackId is set, the pack's contents are listed instead and filter/orderby are not supported. Use this tool to discover what detections are available before calling get-resource.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
filter	string	Optional
orderby	string	Optional
top	integer	Optional	Greater than 0. Maximum 200. Defaults to 100.
skip	integer	Optional	Minimum 0. Defaults to 0.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
detections	array of object
detections[].id	string	The detection ID.
detections[].name	string	The detection name.
totalCount	integer	Minimum 0.
skip	integer	Minimum 0.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

validate-detection-deployment

Validate a detection query for deployment.

Validates a Hamelin query against all detection deployment requirements. This checks that the query compiles, conforms to the signal schema, is eligible for incremental analysis, and can calculate a deterministic event ID. Use this before creating a detection with deploy: true to catch deployment errors early.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
hamelinQuery	string	Required	The Hamelin detection query to validate for deployment.
spaceId	string	Required	The ID of the space to target for this operation. Pattern: ^SPC_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
success	boolean	Whether the detection query passes all deployment validations.
errorCount	number
errors	array of object
errors[].message	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

create-integration

Create integration.

Creates a new integration with the given name and optional settings. Use this tool when the user wants to set up a new data integration.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Required
retentionDays	integer	Optional	May be null. Greater than 0.
folderPath	string	Optional
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
spaceId	string	Optional	Pattern: ^SPC_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
integration	object (two variants)
integration[variant 1].id	string	Pattern: ^INT_[A-Z0-9]{1,7}$.
integration[variant 1].name	string
integration[variant 1].viewId	string	May be null.
integration[variant 1].viewName	string	May be null.
integration[variant 1].defaultConnectorKind	string	May be null. Must not be empty.
integration[variant 1].status	enum	One of DEPLOYED, UNDEPLOYED, UPDATE_PENDING, FAILED, DEGRADED.
integration[variant 1].retentionDays	integer	May be null. Greater than 0.
integration[variant 1].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
integration[variant 1].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
integration[variant 1].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
integration[variant 1].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
integration[variant 1].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
integration[variant 1].folderId	string	May be null.
integration[variant 1].folderPath	string
integration[variant 1].spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
integration[variant 1].parsers	array of object
integration[variant 1].parsers[].id	string	Pattern: ^PRS_[A-Z0-9]{1,7}$.
integration[variant 1].parsers[].name	string
integration[variant 1].mappers	array of object
integration[variant 1].mappers[].id	string	Pattern: ^MPR_[A-Z0-9]{1,7}$.
integration[variant 1].mappers[].name	string
integration[variant 1].readOnly	boolean	Whether this integration is read-only (e.g. installed from a content pack).
integration[variant 1].installedFromPack	object
integration[variant 1].installedFromPack.id	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
integration[variant 1].installedFromPack.name	string
integration[variant 1].installedFromPack.linkMode	enum	One of Manual, Copy, Automatic.
integration[variant 1].installedFrom	object (two variants)	May be null.
integration[variant 1].installedFrom[variant 1].linkMode	enum	One of Manual, Automatic.
integration[variant 1].installedFrom[variant 1].installationId	string	May be null. Pattern: ^PKI_[A-Z0-9]{1,7}$.
integration[variant 1].installedFrom[variant 1].templateId	string
integration[variant 1].installedFrom[variant 1].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
integration[variant 1].installedFrom[variant 2].linkMode	enum	One of Copy.
integration[variant 1].installedFrom[variant 2].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
integration[variant 1].version	integer	May be null. Greater than 0.
integration[variant 1].deleted	boolean	Defaults to false.
integration[variant 1].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
integration[variant 1].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
integration[variant 1].originKey	string	May be null.
integration[variant 2].id	string	Pattern: ^INT_[A-Z0-9]{1,7}$.
integration[variant 2].name	string
integration[variant 2].viewName	string	May be null.
integration[variant 2].defaultConnectorKind	string	May be null. Must not be empty.
integration[variant 2].retentionDays	integer	May be null. Greater than 0.
integration[variant 2].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
integration[variant 2].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
integration[variant 2].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
integration[variant 2].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
integration[variant 2].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
integration[variant 2].folderId	string	May be null.
integration[variant 2].folderPath	string
integration[variant 2].parsers	array of object
integration[variant 2].parsers[].id	string	Pattern: ^PRS_[A-Z0-9]{1,7}$.
integration[variant 2].parsers[].name	string
integration[variant 2].mappers	array of object
integration[variant 2].mappers[].id	string	Pattern: ^MPR_[A-Z0-9]{1,7}$.
integration[variant 2].mappers[].name	string
integration[variant 2].readOnly	boolean	Whether this integration is read-only (e.g. installed from a content pack).
integration[variant 2].installedFromPack	object
integration[variant 2].installedFromPack.id	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
integration[variant 2].installedFromPack.name	string
integration[variant 2].installedFromPack.linkMode	enum	One of Manual, Copy, Automatic.
integration[variant 2].version	integer	May be null. Greater than 0.
integration[variant 2].deleted	boolean	Defaults to false.
integration[variant 2].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
integration[variant 2].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
integration[variant 2].originKey	string	May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-integration

Update integration.

Updates an existing integration's fields such as name, retention days, or view name. Use this tool when the user wants to modify properties of an existing integration.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Optional
retentionDays	integer	Optional	May be null. Greater than 0.
folderPath	string	Optional
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
baseVersion	integer	Optional
integrationId	string	Required	The ID of the integration to update. Pattern: ^INT_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
integration	object (two variants)
integration[variant 1].id	string	Pattern: ^INT_[A-Z0-9]{1,7}$.
integration[variant 1].name	string
integration[variant 1].viewId	string	May be null.
integration[variant 1].viewName	string	May be null.
integration[variant 1].defaultConnectorKind	string	May be null. Must not be empty.
integration[variant 1].status	enum	One of DEPLOYED, UNDEPLOYED, UPDATE_PENDING, FAILED, DEGRADED.
integration[variant 1].retentionDays	integer	May be null. Greater than 0.
integration[variant 1].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
integration[variant 1].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
integration[variant 1].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
integration[variant 1].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
integration[variant 1].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
integration[variant 1].folderId	string	May be null.
integration[variant 1].folderPath	string
integration[variant 1].spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
integration[variant 1].parsers	array of object
integration[variant 1].parsers[].id	string	Pattern: ^PRS_[A-Z0-9]{1,7}$.
integration[variant 1].parsers[].name	string
integration[variant 1].mappers	array of object
integration[variant 1].mappers[].id	string	Pattern: ^MPR_[A-Z0-9]{1,7}$.
integration[variant 1].mappers[].name	string
integration[variant 1].readOnly	boolean	Whether this integration is read-only (e.g. installed from a content pack).
integration[variant 1].installedFromPack	object
integration[variant 1].installedFromPack.id	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
integration[variant 1].installedFromPack.name	string
integration[variant 1].installedFromPack.linkMode	enum	One of Manual, Copy, Automatic.
integration[variant 1].installedFrom	object (two variants)	May be null.
integration[variant 1].installedFrom[variant 1].linkMode	enum	One of Manual, Automatic.
integration[variant 1].installedFrom[variant 1].installationId	string	May be null. Pattern: ^PKI_[A-Z0-9]{1,7}$.
integration[variant 1].installedFrom[variant 1].templateId	string
integration[variant 1].installedFrom[variant 1].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
integration[variant 1].installedFrom[variant 2].linkMode	enum	One of Copy.
integration[variant 1].installedFrom[variant 2].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
integration[variant 1].version	integer	May be null. Greater than 0.
integration[variant 1].deleted	boolean	Defaults to false.
integration[variant 1].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
integration[variant 1].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
integration[variant 1].originKey	string	May be null.
integration[variant 2].id	string	Pattern: ^INT_[A-Z0-9]{1,7}$.
integration[variant 2].name	string
integration[variant 2].viewName	string	May be null.
integration[variant 2].defaultConnectorKind	string	May be null. Must not be empty.
integration[variant 2].retentionDays	integer	May be null. Greater than 0.
integration[variant 2].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
integration[variant 2].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
integration[variant 2].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
integration[variant 2].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
integration[variant 2].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
integration[variant 2].folderId	string	May be null.
integration[variant 2].folderPath	string
integration[variant 2].parsers	array of object
integration[variant 2].parsers[].id	string	Pattern: ^PRS_[A-Z0-9]{1,7}$.
integration[variant 2].parsers[].name	string
integration[variant 2].mappers	array of object
integration[variant 2].mappers[].id	string	Pattern: ^MPR_[A-Z0-9]{1,7}$.
integration[variant 2].mappers[].name	string
integration[variant 2].readOnly	boolean	Whether this integration is read-only (e.g. installed from a content pack).
integration[variant 2].installedFromPack	object
integration[variant 2].installedFromPack.id	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
integration[variant 2].installedFromPack.name	string
integration[variant 2].installedFromPack.linkMode	enum	One of Manual, Copy, Automatic.
integration[variant 2].version	integer	May be null. Greater than 0.
integration[variant 2].deleted	boolean	Defaults to false.
integration[variant 2].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
integration[variant 2].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
integration[variant 2].originKey	string	May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

delete-integration

Delete integration.

Deletes an integration and all its child parsers and mappers. Use this tool when the user wants to permanently remove an integration and all of its associated components.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
integrationId	string	Required	The ID of the integration to delete. Pattern: ^INT_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

list-integrations

List integrations.

Lists integrations with their IDs, names, configuration status, parsers, and mappers. Use filter, orderby, top, and skip to narrow, sort, and page — each parameter documents the fields and syntax it accepts, which apply to the integration itself rather than to its nested parsers and mappers. When contentPackId is set, the pack's contents are listed instead and filter/orderby are not supported. Use this tool to discover integrations before calling get-resource.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
filter	string	Optional
orderby	string	Optional
top	integer	Optional	Greater than 0. Maximum 200. Defaults to 100.
skip	integer	Optional	Minimum 0. Defaults to 0.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
integrations	array of object
integrations[].id	string	The integration ID.
integrations[].name	string	The integration name.
integrations[].status	string	The configuration status of the integration (e.g. configured, unconfigured).
integrations[].parsers	array of object
integrations[].parsers[].id	string	The parser ID.
integrations[].parsers[].name	string	The parser name.
integrations[].mappers	array of object
integrations[].mappers[].id	string	The mapper ID.
integrations[].mappers[].name	string	The mapper name.
totalCount	integer	Minimum 0.
skip	integer	Minimum 0.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

create-integration-parser

Create integration parser.

Stages a new parser in the active changeset. Pass deploy: true on create unless the user asked otherwise.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Required
query	string	Required	At most 1000000 characters.
deploy	boolean	Optional
connectorIds	array of string	Optional
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
baseVersion	integer	Optional
integrationId	string	Required	The ID of the integration to create the parser in. Pattern: ^INT_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
parser	object
parser.id	string	Pattern: ^PRS_[A-Z0-9]{1,7}$.
parser.name	string
parser.query	string
parser.deploy	boolean
parser.deploymentStatus	enum	One of UNDEPLOYED, DEPLOYED, FAILED, DEGRADED, DEPLOY_PENDING, DEPLOY_IN_PROGRESS, UPDATE_PENDING, UPDATE_IN_PROGRESS, REFRESH_IN_PROGRESS, ARCHIVED, CLEANUP_PENDING, CLEANUP_IN_PROGRESS.
parser.connectorIds	array of string
parser.tableId	string	May be null. Pattern: ^TBL_[A-Z0-9]{1,7}$.
parser.tableName	string	May be null.
parser.organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
parser.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
parser.createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
parser.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
parser.updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
parser.installedFrom	object (two variants)	May be null.
parser.installedFrom[variant 1].linkMode	enum	One of Manual, Automatic.
parser.installedFrom[variant 1].installationId	string	May be null. Pattern: ^PKI_[A-Z0-9]{1,7}$.
parser.installedFrom[variant 1].templateId	string
parser.installedFrom[variant 1].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
parser.installedFrom[variant 2].linkMode	enum	One of Copy.
parser.installedFrom[variant 2].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
parser.version	integer	May be null. Greater than 0.
parser.deleted	boolean	Defaults to false.
parser.changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
parser.changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
parser.originKey	string	May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-integration-parser

Update integration parser.

Updates an existing parser's fields such as name, query, connectors, or deployment settings. Use this tool when the user wants to modify properties of an existing integration parser.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Optional
query	string	Optional	At most 1000000 characters.
deploy	boolean	Optional
connectorIds	array of string	Optional
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
baseVersion	integer	Optional
integrationId	string	Required	The ID of the integration containing the parser. Pattern: ^INT_[A-Z0-9]{1,7}$.
parserId	string	Required	The ID of the parser to update. Pattern: ^PRS_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
parser	object
parser.id	string	Pattern: ^PRS_[A-Z0-9]{1,7}$.
parser.name	string
parser.query	string
parser.deploy	boolean
parser.deploymentStatus	enum	One of UNDEPLOYED, DEPLOYED, FAILED, DEGRADED, DEPLOY_PENDING, DEPLOY_IN_PROGRESS, UPDATE_PENDING, UPDATE_IN_PROGRESS, REFRESH_IN_PROGRESS, ARCHIVED, CLEANUP_PENDING, CLEANUP_IN_PROGRESS.
parser.connectorIds	array of string
parser.tableId	string	May be null. Pattern: ^TBL_[A-Z0-9]{1,7}$.
parser.tableName	string	May be null.
parser.organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
parser.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
parser.createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
parser.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
parser.updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
parser.installedFrom	object (two variants)	May be null.
parser.installedFrom[variant 1].linkMode	enum	One of Manual, Automatic.
parser.installedFrom[variant 1].installationId	string	May be null. Pattern: ^PKI_[A-Z0-9]{1,7}$.
parser.installedFrom[variant 1].templateId	string
parser.installedFrom[variant 1].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
parser.installedFrom[variant 2].linkMode	enum	One of Copy.
parser.installedFrom[variant 2].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
parser.version	integer	May be null. Greater than 0.
parser.deleted	boolean	Defaults to false.
parser.changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
parser.changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
parser.originKey	string	May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

delete-integration-parser

Delete integration parser.

Deletes a parser from an integration. Use this tool when the user wants to permanently remove a specific parser from an integration.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
integrationId	string	Required	The ID of the integration containing the parser. Pattern: ^INT_[A-Z0-9]{1,7}$.
parserId	string	Required	The ID of the parser to delete. Pattern: ^PRS_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

create-integration-mapper

Create integration mapper.

Stages a new mapper in the active changeset.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Required
query	string	Required	At most 1000000 characters.
deploy	boolean	Optional
parserIds	array of string	Optional
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
baseVersion	integer	Optional
integrationId	string	Required	The ID of the integration to create the mapper in. Pattern: ^INT_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
mapper	object
mapper.id	string	Pattern: ^MPR_[A-Z0-9]{1,7}$.
mapper.name	string
mapper.query	string
mapper.deploy	boolean
mapper.deploymentStatus	enum	One of UNDEPLOYED, DEPLOYED, FAILED, DEGRADED, DEPLOY_PENDING, DEPLOY_IN_PROGRESS, UPDATE_PENDING, UPDATE_IN_PROGRESS, REFRESH_IN_PROGRESS, ARCHIVED, CLEANUP_PENDING, CLEANUP_IN_PROGRESS.
mapper.parserIds	array of string
mapper.organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
mapper.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mapper.createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
mapper.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mapper.updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
mapper.installedFrom	object (two variants)	May be null.
mapper.installedFrom[variant 1].linkMode	enum	One of Manual, Automatic.
mapper.installedFrom[variant 1].installationId	string	May be null. Pattern: ^PKI_[A-Z0-9]{1,7}$.
mapper.installedFrom[variant 1].templateId	string
mapper.installedFrom[variant 1].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
mapper.installedFrom[variant 2].linkMode	enum	One of Copy.
mapper.installedFrom[variant 2].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
mapper.version	integer	May be null. Greater than 0.
mapper.deleted	boolean	Defaults to false.
mapper.changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
mapper.changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
mapper.originKey	string	May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-integration-mapper

Update integration mapper.

Updates an existing mapper's fields such as name, query, deployment settings, or associated parsers. Use this tool when the user wants to modify properties of an existing integration mapper.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Optional
query	string	Optional	At most 1000000 characters.
deploy	boolean	Optional
parserIds	array of string	Optional
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
baseVersion	integer	Optional
integrationId	string	Required	The ID of the integration containing the mapper. Pattern: ^INT_[A-Z0-9]{1,7}$.
mapperId	string	Required	The ID of the mapper to update. Pattern: ^MPR_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
mapper	object
mapper.id	string	Pattern: ^MPR_[A-Z0-9]{1,7}$.
mapper.name	string
mapper.query	string
mapper.deploy	boolean
mapper.deploymentStatus	enum	One of UNDEPLOYED, DEPLOYED, FAILED, DEGRADED, DEPLOY_PENDING, DEPLOY_IN_PROGRESS, UPDATE_PENDING, UPDATE_IN_PROGRESS, REFRESH_IN_PROGRESS, ARCHIVED, CLEANUP_PENDING, CLEANUP_IN_PROGRESS.
mapper.parserIds	array of string
mapper.organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
mapper.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mapper.createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
mapper.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
mapper.updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
mapper.installedFrom	object (two variants)	May be null.
mapper.installedFrom[variant 1].linkMode	enum	One of Manual, Automatic.
mapper.installedFrom[variant 1].installationId	string	May be null. Pattern: ^PKI_[A-Z0-9]{1,7}$.
mapper.installedFrom[variant 1].templateId	string
mapper.installedFrom[variant 1].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
mapper.installedFrom[variant 2].linkMode	enum	One of Copy.
mapper.installedFrom[variant 2].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
mapper.version	integer	May be null. Greater than 0.
mapper.deleted	boolean	Defaults to false.
mapper.changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
mapper.changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
mapper.originKey	string	May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

delete-integration-mapper

Delete integration mapper.

Deletes a mapper from an integration. Use this tool when the user wants to permanently remove a specific mapper from an integration.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
integrationId	string	Required	The ID of the integration containing the mapper. Pattern: ^INT_[A-Z0-9]{1,7}$.
mapperId	string	Required	The ID of the mapper to delete. Pattern: ^MPR_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

create-lookup

Create a lookup.

Creates a new lookup, staging the change in a draft changeset.

Creates the resource in the active chat's space or, when contentPackId is set, in that content pack.

A lookup whose query is FROM source is a Static (file-upload) lookup — after creating one, tell the user to upload a data file on the lookup's Uploads tab; any other query is a Computed lookup, fully created here.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Required
query	string	Required	At most 1000000 characters.
sourceFormat	enum	Optional	One of parsed_lines, csv.
deploy	boolean	Required	Whether the lookup is deployed. A deployed lookup has a backing dataset that queries can join against.
archived	boolean	Optional	Defaults to false.
keyColumns	array of string	Optional	Defaults to [].
folderPath	string	Required
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
id	string	The ID of the created lookup.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-lookup

Update a lookup.

Updates an existing lookup (name, query, key columns, source format, deploy, or folder), staging the change in a draft changeset. The Static/Computed variant is fixed at creation and cannot change.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Optional
query	string	Optional	At most 1000000 characters.
sourceFormat	enum	Optional	One of parsed_lines, csv.
deploy	boolean	Optional	Whether the lookup is deployed. A deployed lookup has a backing dataset that queries can join against.
archived	boolean	Optional
keyColumns	array of string	Optional
folderPath	string	Optional
baseVersion	integer	Optional
lookupId	string	Required	The ID of the lookup to update. Pattern: ^LKP_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
lookup	object (two variants)
lookup[variant 1].id	string	Pattern: ^LKP_[A-Z0-9]{1,7}$.
lookup[variant 1].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
lookup[variant 1].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
lookup[variant 1].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
lookup[variant 1].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
lookup[variant 1].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
lookup[variant 1].spaceId	string	May be null. Pattern: ^SPC_[A-Z0-9]{1,7}$.
lookup[variant 1].deploymentStatus	enum	One of UNDEPLOYED, DEPLOYED, FAILED, DEGRADED, DEPLOY_PENDING, DEPLOY_IN_PROGRESS, UPDATE_PENDING, UPDATE_IN_PROGRESS, REFRESH_IN_PROGRESS, ARCHIVED, CLEANUP_PENDING, CLEANUP_IN_PROGRESS.
lookup[variant 1].name	string	The lookup's freeform display name. The backing dataset's schema.name is derived from this server-side.
lookup[variant 1].query	string	At most 1000000 characters.
lookup[variant 1].sourceFormat	enum	One of parsed_lines, csv.
lookup[variant 1].deploy	boolean	Whether the lookup is deployed. A deployed lookup has a backing dataset that queries can join against.
lookup[variant 1].archived	boolean
lookup[variant 1].keyColumns	array of string
lookup[variant 1].folderId	string	May be null.
lookup[variant 1].folderPath	string
lookup[variant 1].table	object	May be null.
lookup[variant 1].table.id	string
lookup[variant 1].table.resourceKind	enum	One of Table, View.
lookup[variant 1].table.name	string	Constrained by a pattern; see the schema in tools/list.
lookup[variant 1].table.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
lookup[variant 1].table.deploymentStatus	enum	One of UNDEPLOYED, DEPLOYED, FAILED, DEGRADED, DEPLOY_PENDING, DEPLOY_IN_PROGRESS, UPDATE_PENDING, UPDATE_IN_PROGRESS, REFRESH_IN_PROGRESS, ARCHIVED, CLEANUP_PENDING, CLEANUP_IN_PROGRESS.
lookup[variant 1].table.status	enum	One of Online, UpdatePending, UpdateFailed, UpdateInProgress, DeployPending, DeployInProgress, DeployFailed, Degraded, Archived, RefreshPending, RefreshFailed, RefreshInProgress, CleanupPending, CleanupInProgress, CleanupFailed, CleanupSucceeded.
lookup[variant 1].table.statusDetails	object
lookup[variant 1].table.lastMaterializedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
lookup[variant 1].table.lastAttemptedIngestionId	string	May be null.
lookup[variant 1].table.sourceFormat	enum	One of parsed_lines, csv.
lookup[variant 1].table.keyColumns	array of string
lookup[variant 1].readOnly	boolean	Whether this lookup is read-only (e.g. installed from a content pack).
lookup[variant 1].installedFromPack	object
lookup[variant 1].installedFromPack.id	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
lookup[variant 1].installedFromPack.name	string
lookup[variant 1].installedFromPack.linkMode	enum	One of Manual, Copy, Automatic.
lookup[variant 1].installedFrom	object (two variants)	May be null.
lookup[variant 1].installedFrom[variant 1].linkMode	enum	One of Manual, Automatic.
lookup[variant 1].installedFrom[variant 1].installationId	string	May be null. Pattern: ^PKI_[A-Z0-9]{1,7}$.
lookup[variant 1].installedFrom[variant 1].templateId	string
lookup[variant 1].installedFrom[variant 1].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
lookup[variant 1].installedFrom[variant 2].linkMode	enum	One of Copy.
lookup[variant 1].installedFrom[variant 2].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
lookup[variant 1].version	integer	May be null. Greater than 0.
lookup[variant 1].deleted	boolean	Defaults to false.
lookup[variant 1].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
lookup[variant 1].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
lookup[variant 1].originKey	string	May be null.
lookup[variant 2].id	string	Pattern: ^LKP_[A-Z0-9]{1,7}$.
lookup[variant 2].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
lookup[variant 2].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
lookup[variant 2].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
lookup[variant 2].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
lookup[variant 2].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
lookup[variant 2].name	string	The lookup's freeform display name. The backing dataset's schema.name is derived from this server-side.
lookup[variant 2].query	string	At most 1000000 characters.
lookup[variant 2].sourceFormat	enum	One of parsed_lines, csv.
lookup[variant 2].archived	boolean
lookup[variant 2].keyColumns	array of string
lookup[variant 2].folderId	string	May be null.
lookup[variant 2].folderPath	string
lookup[variant 2].readOnly	boolean	Whether this lookup is read-only (e.g. installed from a content pack).
lookup[variant 2].installedFromPack	object
lookup[variant 2].installedFromPack.id	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
lookup[variant 2].installedFromPack.name	string
lookup[variant 2].installedFromPack.linkMode	enum	One of Manual, Copy, Automatic.
lookup[variant 2].version	integer	May be null. Greater than 0.
lookup[variant 2].deleted	boolean	Defaults to false.
lookup[variant 2].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
lookup[variant 2].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
lookup[variant 2].originKey	string	May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

delete-lookup

Delete a lookup.

Deletes a lookup, staging the change in a draft changeset.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
lookupId	string	Required	The ID of the lookup to delete. Pattern: ^LKP_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
baseVersion	integer	Optional
spaceId	string	Required	The ID of the space to target for this operation. Pattern: ^SPC_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

Related

• MCP access, the surface these tools are registered on.
• Deployable content, the category these tools write.
• Detections, Integrations, Parsers, Mappers, and Lookups, the resources.