Content packs

A content pack is an organization-scoped bundle of reusable content that you install into one or more Spaces as a versioned unit. A pack's id is prefixed PAK_.

A content pack holds its own copies of content resources, spanning detections, dashboards, integrations, lookups, webhooks, HTTP tools, MCP servers, skills, and the folders that organize them. The pack lives at the organization level, above any single Space. Installing a pack copies its content into a target Space under a chosen folder, and each installed resource carries an installedFromPack reference back to the pack it came from. A pack advertises a releaseVersion that bumps when committed changes require linked installations to update.

Pack content

A pack bundles copies of the resource kinds below. Pack content is authored and versioned inside the pack, separate from any Space that installs it.

Kind	Resource
Folder	Folders
Detection	Detections
Dashboard	Dashboards
Integration	Integrations
Lookup	Lookups
WebhookConfig	Webhooks
HttpToolConfig	HTTP tools
McpConfig	MCP servers
Skill	Skills

Installation

Installing a content pack copies its content into a target Space and records a content pack installation. The installation is a Space-scoped resource, prefixed PKI_, that tracks which pack was installed, at which release version, and how the copies stay linked to the source pack.

An installation carries no caller-writable fields of its own. The install action determines its contentPackId, spaceId, linkMode, and install folder, so the installation has no Inputs table, only the returned shape under Installation fields. Its name starts as the pack name at install time and updates when a linked update renames the install folder.

Installation status

An installation reports a status derived from its linkMode, its installedReleaseVersion against the pack's releaseVersion, and any pending draft changeset.

Value	Meaning
Copy	The installation was copied with Copy link mode and never tracks pack updates.
UpToDate	Linked, and installedReleaseVersion matches the pack's releaseVersion.
UpdateAvailable	Linked, and the pack's releaseVersion is higher than installedReleaseVersion.
UpdatePending	A linked update is staged in a draft changeset but not yet committed.
InstallPending	The install exists only as an uncommitted draft changeset.

Installed resources

Each resource an installation copies into a Space points back to its source pack. On detections and integrations this appears as installedFromPack, an object with the pack id and name. Resources installed under Manual link mode are readOnly in the Space and cannot be edited in place. A resource installed under Copy link mode has no installedFromPack and is editable like Space-native content.

Inputs

Field	Type	Required	Description
name	string	Required	Content pack name.
description	string	Optional	Free-text documentation. Null when unset.

Outputs

Field	Type	Description
releaseVersion	integer	Install-relevant version, starting at 1. Bumps when committed pack changes require linked installations to update. An installation compares its installedReleaseVersion against this to detect an available update.

Plus the common resource fields.

Installation fields

The fields an installation returns. There is no Inputs table because the install action determines every field.

Field	Type	Description
contentPackId	string	The PAK_ pack this installation was created from.
installedReleaseVersion	integer	The pack releaseVersion this installation currently holds. Lower than the pack's releaseVersion means an update is available.
linkMode	enum	How installed copies track the source pack. Manual keeps the link so you can apply updates on request. Copy copies the content with no installedFromPack link, so it never updates from the pack. Automatic is reserved and currently behaves as Manual.
installFolderId	string	The folder in the target Space that holds the installed copies.
installFolderPath	string	Resolved path of installFolderId, including any disambiguation suffix. Defaults to Packs at the Space root.
draftChangesetId	string	The changeset staging a linked update that is not yet committed. Null when no update is staged.

Plus the common resource fields.

Related

• Changesets, how pack and installation edits are staged and committed.
• Spaces, where a pack installs its content.
• Detections, a common pack content kind, and one that carries installedFromPack when installed.
• Folders, the install folder that holds a pack's copies.