Resource and Space tools

The MCP tools that read any resource by kind and id, search resources, list the Spaces the user can reach, and manage content packs.

get-resource and search-resources work on any resource kind, including kinds with no dedicated get tool. A client takes the spaceId for other tools from list-spaces, which returns the Spaces the user can reach.

Tool names and schemas can change at any time

An agent sees each change the next time it reads tools/list, while a script that hard-codes a tool name or schema breaks when that tool changes.

Each section below is one tool as MCP access registers it: its title, its description, the annotations it sets, and the input and output schemas from tools/list. Field paths use parent.child for a nested object, parent[].child for the items of an array, and parent[Value].child for one variant of a field that takes several shapes.

create-folder

Create folder.

Creates a folder in a draft changeset. Provide contentPackId to create it in a content pack; otherwise use the active space. Use folderPath for placement. Read the result with get-resource.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Required	Must not be empty. At most 256 characters.
folderPath	string	Required
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
id	string	The ID of the created folder.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-folder

Update folder.

Renames or moves a folder in a draft changeset. Read it with get-resource first and pass its baseVersion. folderPath identifies the parent folder. Provide contentPackId for pack-owned folders.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Optional	Must not be empty. At most 256 characters.
folderPath	string	Optional
baseVersion	integer	Optional
folderId	string	Required	The ID of the folder to update. Pattern: ^FLD_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
folder	object (two variants)
folder[variant 1].id	string	Pattern: ^FLD_[A-Z0-9]{1,7}$.
folder[variant 1].name	string	The folder name.
folder[variant 1].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
folder[variant 1].spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
folder[variant 1].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
folder[variant 1].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
folder[variant 1].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
folder[variant 1].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
folder[variant 1].parentFolderId	string	May be null. Pattern: ^FLD_[A-Z0-9]{1,7}$.
folder[variant 1].folderPath	string
folder[variant 1].readOnly	boolean
folder[variant 1].installedFrom	object (two variants)	May be null.
folder[variant 1].installedFrom[variant 1].linkMode	enum	One of Manual, Automatic.
folder[variant 1].installedFrom[variant 1].installationId	string	May be null. Pattern: ^PKI_[A-Z0-9]{1,7}$.
folder[variant 1].installedFrom[variant 1].templateId	string
folder[variant 1].installedFrom[variant 1].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
folder[variant 1].installedFrom[variant 2].linkMode	enum	One of Copy.
folder[variant 1].installedFrom[variant 2].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
folder[variant 1].version	integer	May be null. Greater than 0.
folder[variant 1].deleted	boolean	Defaults to false.
folder[variant 1].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
folder[variant 1].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
folder[variant 1].originKey	string	May be null.
folder[variant 2].id	string	Pattern: ^FLD_[A-Z0-9]{1,7}$.
folder[variant 2].name	string	The folder name.
folder[variant 2].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
folder[variant 2].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
folder[variant 2].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
folder[variant 2].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
folder[variant 2].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
folder[variant 2].parentFolderId	string	May be null. Pattern: ^FLD_[A-Z0-9]{1,7}$.
folder[variant 2].folderPath	string
folder[variant 2].version	integer	May be null. Greater than 0.
folder[variant 2].deleted	boolean	Defaults to false.
folder[variant 2].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
folder[variant 2].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
folder[variant 2].originKey	string	May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

delete-folder

Delete folder.

Deletes an empty folder in a draft changeset. Read it with get-resource first and pass its baseVersion. Provide contentPackId for pack-owned content. Move or delete its children first; this tool does not recursively delete content.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
folderId	string	Required	The ID of the folder to delete. Pattern: ^FLD_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
baseVersion	integer	Optional

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

get-content-work-item

Get content work item details.

Retrieves the complete details of a specific content work item by ID, including its name, description, status, and assignment information.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
workItemId	string	Required	The ID of the content work item to retrieve.

Outputs

Field	Type	Description
workItem	object
workItem.id	string	Pattern: ^CWI_[A-Z0-9]{1,7}$.
workItem.organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
workItem.spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
workItem.name	string
workItem.description	string
workItem.status	enum	One of Open, Done, Cancelled.
workItem.assignedToUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
workItem.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
workItem.createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
workItem.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
workItem.updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
workItem.implementationSkippedReason	enum	One of QuotaExceeded. May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

get-resource

Get resource.

Fetch a content or dataset resource by ID. The resource type is inferred from the ID prefix (e.g. TBL_ for tables, LKP_ for lookups, INT_ for integrations). Optionally read a draft version from a changeset.

Large resources: read a summary first. Dashboards with many panels, MCP configs with many discovered tools, and detections or parsers with long queries can be far too large to read whole — a big dashboard exceeds the tool-result limit on its own, and the result is then cut off mid-resource.

Use detail to control what comes back:

• full (default) — the whole resource. Right for small resources.
• summary — large fields are replaced by their size, and every sub-item is listed by its identifying field (a panel's id, a discovered MCP tool's name) along with its remaining small fields. That identifier is what goes in fields: ["<field>[<id>]"]. Use this to find the sub-item you want.
• fields — summary plus what you name in fields. Name an elided scalar field ("query") or one sub-item ("panels[panel-3]"). Sub-item arrays must be addressed one item at a time: a bare "panels" expands nothing, and the result's partial-read note tells you to address one item instead.

To edit one panel of a dashboard: call with detail: "summary" to list the panels and their ids, then call again with detail: "fields" and fields: ["panels[<id>]"] to read that panel's query and spec, then patch it with update-dashboard-panels. Do NOT read a large dashboard at full detail just to find a panel id.

fields names at most 6 entries per call, matching what update-dashboard-panels accepts. Entries that match no field or sub-item are reported in the result's partial-read note rather than failing the call.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
resourceId	string	Required
detail	enum	Optional	One of full, summary, fields.
fields	array of string	Optional
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
resource	object (17 variants)
contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
projection	object
projection.detail	enum	One of full, summary, fields.
projection.unknownFields	array of string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

search-resources

Search resources.

Searches the organization's resources by name or ID: every content kind (currently Folders, Detections, Dashboards, Integrations, Lookups, Webhooks, HTTP Tools, MCP Servers, Skills), every dataset kind (Tables, Views, Unions, Connectors), Cases, Threat Reports, and Content Work Items. Set contentPackId to search within one content pack, including its current changeset overlay.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
query	string	Required	The query string to search for.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.
limit	integer	Optional	Greater than 0. Maximum 50. Defaults to 10.

Outputs

Field	Type	Description
results	array of object
results[].resourceId	string	The ID of the resource.
results[].resourceKind	enum	The type of resource. One of Case, Connector, ContentWorkItem, Table, ThreatReport, Union, View, Folder, Detection, Dashboard, Integration, Lookup, WebhookConfig, HttpToolConfig, McpConfig, Skill.
results[].name	string	The name of the resource.
results[].organizationId	string	May be null.
results[].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
results[].updatedAt	string	The last updated timestamp.
results[].rank	number	The search relevance rank.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

list-spaces

List spaces.

Lists all spaces the user has access to.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

This tool takes no arguments.

Outputs

Field	Type	Description
spaces	array of object
spaces[].id	string	The space ID.
spaces[].name	string	The space name.
spaces[].readOnly	boolean	Whether the space is read-only.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

create-content-pack

Create content pack.

Create an organization content pack in the active draft changeset only when the user needs to share authored content across multiple spaces. For normal content in one space, create the content directly in that space instead. Use the returned content pack ID when you create integrations, parsers, mappers, or detections in the shared pack.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Required
description	string	Optional	May be null.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
contentPack	object
contentPack.id	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
contentPack.organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
contentPack.name	string
contentPack.description	string	May be null.
contentPack.releaseVersion	integer	Greater than 0.
contentPack.perpetualSupplied	boolean
contentPack.preview	boolean
contentPack.imageUrl	string	Pattern: ^/pack-images/[^/]+$.
contentPack.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
contentPack.createdByUserId	string	May be null.
contentPack.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
contentPack.updatedByUserId	string	May be null.
contentPack.version	integer	May be null. Greater than 0.
contentPack.deleted	boolean	Defaults to false.
contentPack.changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPack.changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-content-pack

Update content pack.

Update the name or description of a content pack in the active draft changeset. Content packs are for content shared across multiple spaces, not normal content authored in one space. Omit fields that must remain unchanged.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Optional
description	string	Optional	May be null.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
baseVersion	integer	Optional
contentPackId	string	Required	The ID of the content pack to update. Pattern: ^PAK_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
contentPack	object
contentPack.id	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
contentPack.organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
contentPack.name	string
contentPack.description	string	May be null.
contentPack.releaseVersion	integer	Greater than 0.
contentPack.perpetualSupplied	boolean
contentPack.preview	boolean
contentPack.imageUrl	string	Pattern: ^/pack-images/[^/]+$.
contentPack.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
contentPack.createdByUserId	string	May be null.
contentPack.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
contentPack.updatedByUserId	string	May be null.
contentPack.version	integer	May be null. Greater than 0.
contentPack.deleted	boolean	Defaults to false.
contentPack.changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
contentPack.changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

delete-content-pack

Delete content pack.

Delete a content pack and its authored shared content in the active draft changeset. Content packs are for content shared across multiple spaces, not normal content authored in one space. Use this only when the user explicitly asks to delete the content pack.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
contentPackId	string	Required	The ID of the content pack to delete. Pattern: ^PAK_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
baseVersion	integer	Optional

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

list-content-packs

List content packs.

Lists the organization's content pack catalog, including Perpetual-supplied packs, with IDs, names, and descriptions. Use filter: "contains(name,'AWS')" to find AWS packs, or filter: "name eq 'AWS'" for an exact name. Use orderby, top, and skip to sort and page through results. Pass a returned ID to get-resource to read the pack, or as contentPackId to list or search its content.

Pass changesetId to include draft changes; otherwise the active session changeset is used when present.

Content packs are organization-scoped and do not require a space.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
filter	string	Optional
orderby	string	Optional
top	integer	Optional	Greater than 0. Maximum 200. Defaults to 100.
skip	integer	Optional	Minimum 0. Defaults to 0.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
contentPacks	array of object
contentPacks[].id	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
contentPacks[].name	string
contentPacks[].description	string	May be null.
totalCount	integer	Minimum 0.
skip	integer	Minimum 0.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

add-to-content-pack

Add resources to content pack.

Copies existing space content into a content pack in a draft changeset. Supports folders, detections, dashboards, integrations, lookups, webhooks, HTTP tools, MCP configs, and skills. Selecting a folder copies its children into the pack root, preserving deeper nesting; the selected folder itself is not recreated. Integration children are copied too. Source resources remain in their space. All items must belong to the active space. Up to 500 selected items are copied atomically. The added count is the number of normalized selected items, not individual descendants. Use get-resource and search-resources to find source IDs and inspect the target pack first.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
contentPackId	string	Required	Pattern: ^PAK_[A-Z0-9]{1,7}$.
items	array of object	Required
items[].type	enum	Required	One of Folder, Detection, Dashboard, Integration, Lookup, WebhookConfig, HttpToolConfig, McpConfig, Skill.
items[].id	string	Required	Must not be empty.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.
spaceId	string	Required	The ID of the space to target for this operation. Pattern: ^SPC_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
added	integer	Minimum 0.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

install-content-pack

Install content pack.

Stages installation of a content pack into the explicit target spaceIds in a draft changeset. Use list-spaces and list-content-packs first. Defaults to Automatic links and undeployed content. Copy mode creates independent content without an installation to update or uninstall. Supports connector creation and parser bindings for deployed integrations. Returns installation IDs and the draft changeset; does not commit.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
contentPackId	string	Required	Pattern: ^PAK_[A-Z0-9]{1,7}$.
spaceIds	array of string	Required
linkMode	enum	Optional	One of Manual, Copy, Automatic.
installPath	string	Optional	Defaults to Packs.
installDeployed	boolean	Optional	Defaults to false.
deployResourceTypes	array of enum	Optional	Defaults to [].
newConnectors	array of object	Optional	Defaults to [].
newConnectors[].spaceId	string	Required	Pattern: ^SPC_[A-Z0-9]{1,7}$.
newConnectors[].name	string	Required	Constrained by a pattern; see the schema in tools/list.
newConnectors[].type	enum	Required	One of ObjectStorageConnector, ApiPollingConnector, StreamingConnector, HttpSourceConnector.
newConnectors[].config	object (four variants)	Required
newConnectors[].config[ObjectStorageConnector].type	string	Required	Always ObjectStorageConnector.
newConnectors[].config[ObjectStorageConnector].initialLookbackDays	integer	Optional	Greater than 0. Defaults to 14.
newConnectors[].config[ObjectStorageConnector].scanIntervalMinutes	integer	Optional	Minimum 5.
newConnectors[].config[ObjectStorageConnector].bucket	string	Required	Constrained by a pattern; see the schema in tools/list. At most 63 characters.
newConnectors[].config[ObjectStorageConnector].prefix	string	Required
newConnectors[].config[ObjectStorageConnector].region	string	Optional	Defaults to not-used.
newConnectors[].config[ObjectStorageConnector].manageBucketNotifications	boolean	Optional
newConnectors[].config[ObjectStorageConnector].objectStore	object	Required	Nested fields omitted; see the schema in tools/list.
newConnectors[].config[ApiPollingConnector].type	string	Required	Always ApiPollingConnector.
newConnectors[].config[ApiPollingConnector].connectorKind	string	Required	Catalog connector kind (e.g. "google-workspace", "gcp-pubsub") or "custom" for a customer ECR image. Must not be empty.
newConnectors[].config[ApiPollingConnector].credentialIds	map of string	Optional
newConnectors[].config[ApiPollingConnector].intervalMinutes	integer	Required	Minimum 1.
newConnectors[].config[ApiPollingConnector].initialLookbackDays	integer	Optional	Greater than 0.
newConnectors[].config[ApiPollingConnector].settings	object	Required
newConnectors[].config[ApiPollingConnector].ecrImageUrl	string	Optional	ECR image URL for a custom connector Lambda container. Must not be empty.
newConnectors[].config[StreamingConnector].type	string	Required	Always StreamingConnector.
newConnectors[].config[StreamingConnector].connectorKind	string	Required	Catalog connector kind (e.g. "google-workspace", "gcp-pubsub") or "custom" for a customer ECR image. Must not be empty.
newConnectors[].config[StreamingConnector].credentialIds	map of string	Optional
newConnectors[].config[StreamingConnector].settings	object	Required
newConnectors[].config[StreamingConnector].ecrImageUrl	string	Optional	ECR image URL for a custom connector Lambda container. Must not be empty.
newConnectors[].config[HttpSourceConnector].type	string	Required	Always HttpSourceConnector.
newConnectors[].config[HttpSourceConnector].authMode	enum	Required	One of bearer, presigned, hmac.
newConnectors[].config[HttpSourceConnector].credentialId	string	Optional	Pattern: ^CRD_[A-Z0-9]{1,7}$.
newConnectors[].clientKey	string	Required	Must not be empty.
parserBindings	array of object	Optional	Defaults to [].
parserBindings[].spaceId	string	Required	Pattern: ^SPC_[A-Z0-9]{1,7}$.
parserBindings[].templateParserId	string	Required	Pattern: ^PRS_[A-Z0-9]{1,7}$.
parserBindings[].connectorIds	array of string	Optional
parserBindings[].newConnectorKeys	array of string	Optional
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
results	array of object
results[].spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
results[].installation	object	May be null.
results[].installation.id	string	Pattern: ^PKI_[A-Z0-9]{1,7}$.
results[].installation.organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
results[].installation.spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
results[].installation.contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
results[].installation.name	string
results[].installation.installedReleaseVersion	integer	Greater than 0.
results[].installation.linkMode	enum	One of Manual, Copy, Automatic.
results[].installation.installFolderId	string	Folder this installation installed its content into. It carries no installedFrom; identify the install folder by this id. Pattern: ^FLD_[A-Z0-9]{1,7}$.
results[].installation.installDeployed	boolean
results[].installation.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
results[].installation.createdByUserId	string	May be null.
results[].installation.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
results[].installation.updatedByUserId	string	May be null.
results[].installation.version	integer	May be null. Greater than 0.
results[].installation.deleted	boolean	Defaults to false.
results[].installation.changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
results[].installation.changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
results[].installation.installFolderPath	string
results[].installation.draftChangesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
results[].installation.packReleaseVersion	integer	Greater than 0.
results[].installation.perpetualSupplied	boolean
results[].installFolderId	string	Folder this installation installed its content into. It carries no installedFrom; identify the install folder by this id. Pattern: ^FLD_[A-Z0-9]{1,7}$.
changeset	object
changeset.id	string	Pattern: ^CHG_[A-Z0-9]{1,7}$.
changeset.organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
changeset.name	string	May be null.
changeset.description	string	May be null.
changeset.status	enum	One of draft, proposed, committed, declined.
changeset.createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
changeset.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
changeset.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
changeset.proposedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
changeset.proposedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
changeset.committedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
changeset.committedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
changeset.declinedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
changeset.declinedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
changeset.createdByChatId	string	May be null. Pattern: ^CHT_[A-Z0-9]{1,7}$.
createdConnectors	array of object	Defaults to [].
createdConnectors[].clientKey	string	Must not be empty.
createdConnectors[].id	string	Pattern: ^CON_[A-Z0-9]{1,7}$.
createdConnectors[].generatedSecret	string	Must not be empty.
createdConnectors[].generatedIngestUrl	string	Format: uri.
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

list-content-pack-installations

List content pack installations.

Lists content pack installations with IDs, target spaces, link modes, versions, and pending status. Optionally filter by contentPackId or OData fields. Restricts to the active space when one is selected; otherwise lists accessible installations across spaces. Pass changesetId to include staged changes.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
filter	string	Optional
orderby	string	Optional
top	integer	Optional	Greater than 0. Maximum 200. Defaults to 100.
skip	integer	Optional	Minimum 0. Defaults to 0.
contentPackId	string	Optional	Pattern: ^PAK_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
installations	array of object
installations[].id	string	Pattern: ^PKI_[A-Z0-9]{1,7}$.
installations[].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
installations[].spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
installations[].contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
installations[].name	string
installations[].installedReleaseVersion	integer	Greater than 0.
installations[].linkMode	enum	One of Manual, Copy, Automatic.
installations[].installFolderId	string	Folder this installation installed its content into. It carries no installedFrom; identify the install folder by this id. Pattern: ^FLD_[A-Z0-9]{1,7}$.
installations[].installDeployed	boolean
installations[].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
installations[].createdByUserId	string	May be null.
installations[].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
installations[].updatedByUserId	string	May be null.
installations[].version	integer	May be null. Greater than 0.
installations[].deleted	boolean	Defaults to false.
installations[].changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
installations[].changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
installations[].installFolderPath	string
installations[].draftChangesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
installations[].packReleaseVersion	integer	Greater than 0.
installations[].perpetualSupplied	boolean
totalCount	integer	Minimum 0.
skip	integer	Minimum 0.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-content-pack-installation

Update content pack installation.

Stages an update of a linked installation to its current pack version. Use list-content-pack-installations to find the installationId. Uses an explicit or active draft changeset, creating one if needed. Does not commit, delete an entire changeset, or operate on Copy-mode installs.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
installationId	string	Required	Pattern: ^PKI_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changeset	object	May be null.
changeset.id	string	Pattern: ^CHG_[A-Z0-9]{1,7}$.
changeset.organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
changeset.name	string	May be null.
changeset.description	string	May be null.
changeset.status	enum	One of draft, proposed, committed, declined.
changeset.createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
changeset.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
changeset.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
changeset.proposedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
changeset.proposedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
changeset.committedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
changeset.committedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
changeset.declinedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
changeset.declinedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
changeset.createdByChatId	string	May be null. Pattern: ^CHT_[A-Z0-9]{1,7}$.
installation	object
installation.id	string	Pattern: ^PKI_[A-Z0-9]{1,7}$.
installation.organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
installation.spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
installation.contentPackId	string	Pattern: ^PAK_[A-Z0-9]{1,7}$.
installation.name	string
installation.installedReleaseVersion	integer	Greater than 0.
installation.linkMode	enum	One of Manual, Copy, Automatic.
installation.installFolderId	string	Folder this installation installed its content into. It carries no installedFrom; identify the install folder by this id. Pattern: ^FLD_[A-Z0-9]{1,7}$.
installation.installDeployed	boolean
installation.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
installation.createdByUserId	string	May be null.
installation.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
installation.updatedByUserId	string	May be null.
installation.version	integer	May be null. Greater than 0.
installation.deleted	boolean	Defaults to false.
installation.changesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
installation.changesetStatus	enum	One of Unchanged, Added, Modified, Deleted. May be null.
installation.installFolderPath	string
installation.draftChangesetId	string	May be null. Pattern: ^CHG_[A-Z0-9]{1,7}$.
installation.packReleaseVersion	integer	Greater than 0.
installation.perpetualSupplied	boolean
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

uninstall-content-pack-installation

Uninstall content pack installation.

Stages removal of a linked content pack installation and its installed content. Use list-content-pack-installations to find the installationId. Uses an explicit or active draft changeset, creating one if needed. Does not commit, delete an entire changeset, or operate on Copy-mode installs.

Annotations: readOnlyHint false, destructiveHint true, idempotentHint false.

Inputs

Field	Type	Required	Description
installationId	string	Required	Pattern: ^PKI_[A-Z0-9]{1,7}$.
changesetId	string	Optional	Pattern: ^CHG_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
changeset	object	May be null.
changeset.id	string	Pattern: ^CHG_[A-Z0-9]{1,7}$.
changeset.organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
changeset.name	string	May be null.
changeset.description	string	May be null.
changeset.status	enum	One of draft, proposed, committed, declined.
changeset.createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
changeset.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
changeset.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
changeset.proposedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
changeset.proposedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
changeset.committedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
changeset.committedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
changeset.declinedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
changeset.declinedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
changeset.createdByChatId	string	May be null. Pattern: ^CHT_[A-Z0-9]{1,7}$.
changesetId	string	The exact changeset containing this mutation. Pattern: ^CHG_[A-Z0-9]{1,7}$.
validation	object
validation.valid	boolean
validation.errors	array of object
validation.errors[].resourceId	string
validation.errors[].resourceKind	string
validation.errors[].resourceName	string
validation.errors[].message	string
validation.errors[].field	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

Related

• MCP access, the surface these tools are registered on.
• Resource, the model every tool reaches.
• Spaces, the scope a call names.