read thedocs.

[ docs // guides & reference ]

Connector setup guides, tool references, auth flows, and platform concepts — everything you need to run StackJack, in one place.

Browse the Docs All Connectors
34 connectors documented // 6,712 tools referenced // setup, auth & platform guides
↓

No pages match that search. Clear it

← All documentation

Action1 Tools

action1_ · 144 tools · Free 73 · Pro 71 OAuth2 client-credentials (rotating refresh, JSON token body); per-org endpoints (); offset pagination (limit+from, max 100); discover orgs via action1_list_organizations.

Organizations

Tool Plan Access Description
action1_create_organization Pro Write [Action1] Create a new organization within the Action1 enterprise. Side effect: creates a new org tenant. The fieldsJson MUST include both `name` and `description` (e.g. {"name":"Contoso","description":"Primary client tenant"}). Use action1_list_organizations afterward to discover the new orgId.
action1_delete_organization Pro Destructive [Action1] Permanently delete an organization. Side effect: irrevocably removes the org and all its endpoints, deployers, automation schedules, and reports. This action CANNOT be undone. Use action1_list_organizations to confirm the orgId before deleting.
action1_list_organizations Free Read-only [Action1] List organizations within the current Action1 enterprise. Returns org IDs (GUIDs) you'll need for org-scoped tools like action1_list_endpoints, action1_search, and action1_list_endpoint_groups. When admin=true, returns every org the calling user can administer instead of only their default scope. Default 50, max 100. The response includes `next_page` and `prev_page` cursors — pass `next_page.from` as `from` to fetch the next page until no `next_page` is returned. MSPs with more than 100 orgs MUST page through all results when feeding org IDs into cross-org analytics tools.
action1_update_organization Pro Write [Action1] Update properties on an existing organization. Side effect: modifies org metadata. Only include fields you want to change in fieldsJson (e.g. {"name":"New Name","description":"Updated"}). Use action1_list_organizations to find valid orgIds.
action1_create_organization parameters
Param Type Required Default Description
fieldsJson string yes JSON object with the new org's fields. Required: `name` and `description`. Example: {"name":"Contoso","description":"Primary client tenant"}.
action1_delete_organization parameters
Param Type Required Default Description
orgId string yes The Action1 organization ID (GUID) to delete. Use action1_list_organizations to find valid IDs.
action1_list_organizations parameters
Param Type Required Default Description
admin boolean no null If true, list all orgs the admin can access instead of the default scope. Optional.
from integer no null Cursor for pagination. Pass the value of `next_page.from` from the previous response to continue. Optional; omit for the first page.
pageSize integer no 50 Page size. Default 50, max 100.
action1_update_organization parameters
Param Type Required Default Description
fieldsJson string yes JSON object with the fields to update. Only include changed fields.
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.

Enterprise

Tool Plan Access Description
action1_get_enterprise Free Read-only [Action1] Retrieve metadata about the current Action1 enterprise (the root tenant that contains all organizations). Returns enterprise name, settings, and pending closure status. Use this to verify connectivity and see top-level branding/policy values.
action1_request_enterprise_closure Pro Destructive [Action1] Request closure (deletion) of the entire Action1 enterprise. Side effect: schedules irreversible teardown of every organization, endpoint, and configuration in this tenant. Action1 will retain a closure window during which action1_revoke_enterprise_closure can cancel the request. Use with extreme caution. Vendor requires a non-empty 'reason' explaining why closure is requested.
action1_revoke_enterprise_closure Pro Write [Action1] Cancel a previously requested enterprise closure during the grace window. Side effect: aborts the scheduled teardown so the enterprise remains active. Idempotent — replaying after the closure is already revoked is a no-op. Vendor requires a non-empty 'reason' explaining why the closure is being revoked.
action1_update_enterprise Pro Write [Action1] Update enterprise-level settings. Side effect: modifies global enterprise configuration that affects every organization in the tenant. The vendor's `EnterprisePayload` PATCH schema only accepts `name` and `description` — other enterprise properties are read-only on this endpoint. Only include fields you want to change.
action1_request_enterprise_closure parameters
Param Type Required Default Description
reason string yes Required. Free-form reason for closing the enterprise (e.g. 'Temporary or test account.', 'Customer offboarding completed.'). Vendor's EnterpriseRequest schema rejects empty values with HTTP 400.
action1_revoke_enterprise_closure parameters
Param Type Required Default Description
reason string yes Required. Free-form reason for revoking the closure (e.g. 'Closure submitted in error.', 'Customer cancelled offboarding.'). Vendor's EnterpriseRequest schema rejects empty values with HTTP 400.
action1_update_enterprise parameters
Param Type Required Default Description
fieldsJson string yes JSON object with enterprise fields to update. Editable fields: `name`, `description`. Example: {"name":"Contoso MSP","description":"Production tenant"}.

Users

Tool Plan Access Description
action1_create_user Pro Write [Action1] Create a new user. Side effect: provisions a new identity in the enterprise. The body must match one of three vendor schemas: (a) Interactive Action1 user — required: email, password, first_name, last_name; (b) Interactive SSO user — required: email (and the SSO IdP must be pre-configured at the enterprise level); (c) API credentials — required: first_name, email, password, enabled, user_type:'API'. The wire field is `user_type`; valid values are 'Interactive' and 'API' (no 'sso' value — SSO is determined by your enterprise IdP config). Verify with action1_list_users afterward.
action1_delete_user Pro Destructive [Action1] Permanently delete a user from the enterprise. Side effect: removes the user identity and revokes any role assignments and API credentials they own. This cannot be undone. Verify the userId with action1_list_users first.
action1_get_me Free Read-only [Action1] Retrieve the profile of the currently authenticated user (the API credential's owning user). Returns the user's ID, email, timezone, and session timeout. Use this to confirm which identity the connector is using.
action1_get_user Free Read-only [Action1] Retrieve a single user by ID. Returns full user metadata including type, email, status, and timestamps. Use action1_list_users to discover valid IDs.
action1_list_user_roles Free Read-only [Action1] List the roles assigned to a specific user. Returns role IDs and names. Use this together with action1_list_roles to understand a user's permissions footprint.
action1_list_users Free Read-only [Action1] List all users in the enterprise (interactive admins, SSO users, and API service accounts). Returns user IDs, emails, and types. Use the IDs with action1_get_user, action1_list_user_roles, or role-assignment tools. Note: Action1's /users endpoint does not support a sort parameter — narrow results via `filter` or `userType`.
action1_update_me Pro Write [Action1] Update settings on the currently authenticated user. Side effect: modifies the calling user's preferences. Only `timezone` and `session_timeout` are updatable via this endpoint (e.g. {"timezone":"America/Chicago","session_timeout":3600}).
action1_update_user Pro Write [Action1] Update an existing user's properties. Side effect: modifies the user record. The PATCH body matches one of three vendor schemas (oneOf) — editable fields differ by user type: API user PATCH only accepts email, password, first_name; Interactive user PATCH accepts email, first_name, last_name, phone, timezone, session_timeout, enabled. Only include fields you want to change. Use action1_get_user first to inspect the current shape, and action1_list_users to find valid IDs.
action1_create_user parameters
Param Type Required Default Description
fieldsJson string yes JSON object with the new user definition. Examples — Interactive Action1: {"email":"alice@contoso.com","password":"...","first_name":"Alice","last_name":"Smith"}. Interactive SSO: {"email":"alice@contoso.com","user_type":"Interactive"}. API: {"first_name":"AgentBot","email":"agent@contoso.com","password":"...","enabled":true,"user_type":"API"}.
action1_delete_user parameters
Param Type Required Default Description
userId string yes The Action1 user ID to delete. Use action1_list_users to find valid IDs.
action1_get_user parameters
Param Type Required Default Description
userId string yes The Action1 user ID. Use action1_list_users to find valid IDs.
action1_list_user_roles parameters
Param Type Required Default Description
userId string yes The Action1 user ID. Use action1_list_users to find valid IDs.
action1_list_users parameters
Param Type Required Default Description
filter string no null Case-insensitive substring; matches if any object field contains this value (Action1's filter is a plain substring search, not a structured query). Optional.
from integer no null Skip first N records (offset). Optional.
pageSize integer no 50 Results per page (default 50, max 100).
userType string no null Filter to a single user category. One of 'Interactive' or 'API' (PascalCase). Optional.
action1_update_me parameters
Param Type Required Default Description
fieldsJson string yes JSON object with fields to update. Only `timezone` and `session_timeout` are accepted.
action1_update_user parameters
Param Type Required Default Description
fieldsJson string yes JSON object with the fields to update. Only include changed fields.
userId string yes The Action1 user ID. Use action1_list_users to find valid IDs.

Roles & Permissions

Tool Plan Access Description
action1_assign_user_to_role Pro Write [Action1] Assign a user to a role. Side effect: grants the user every permission in the role's bundle. Idempotent — re-assigning a user already in the role is a no-op.
action1_clone_role Pro Write [Action1] Clone an existing role into a new role with the same permission set. Side effect: creates a fresh role; rename it via action1_update_role afterwards. No body is sent to this endpoint — replaying creates a new role each time, so the operation is not replay-safe.
action1_create_role Pro Write [Action1] Create a new role. Side effect: defines a new permission bundle that can be assigned to users. Required fields: `name`, `description`, and `scoped_permissions` (an array of permission grants). Each entry in `scoped_permissions` requires `permission` (e.g. 'view_reports' — list with action1_list_permission_templates), `include_scope` (array — what the permission applies to), and `exclude_scope` (array — exclusions). Optional `restrictions` per entry can cap endpoint counts or types for `run_automations`/`manage_automations` permissions.
action1_delete_role Pro Destructive [Action1] Permanently delete a role. Side effect: revokes the role from every user that held it, potentially leaving them without administrative access. This cannot be undone. Confirm with action1_list_role_users first.
action1_get_role Free Read-only [Action1] Retrieve a single role by ID, including its full permission set. Use action1_list_roles to discover valid IDs.
action1_list_permission_templates Free Read-only [Action1] List the available permission templates Action1 ships with. Use these as building blocks (or starting points) when creating or updating roles via action1_create_role / action1_update_role.
action1_list_role_users Free Read-only [Action1] List every user assigned to a given role. Returns user IDs and emails. Use this before deleting or modifying a role to understand impact.
action1_list_roles Free Read-only [Action1] List all roles defined in the enterprise. Returns role IDs and names. Roles map users to bundles of permissions; use IDs with action1_get_role, action1_list_role_users, or assignment tools. Pass `fields=*` or `fields=users` to retrieve the role's user count.
action1_unassign_user_from_role Pro Destructive [Action1] Remove a user's assignment to a role. Side effect: revokes the role's permissions from that user. The user remains in the enterprise but loses any access uniquely granted by this role. Idempotent — re-removing a user already absent from the role is a no-op.
action1_update_role Pro Write [Action1] Update properties on an existing role (name, description, permission set). Side effect: changes the access granted to every user who holds this role. Only include fields you want to change in fieldsJson.
action1_assign_user_to_role parameters
Param Type Required Default Description
roleId string yes The Action1 role ID. Use action1_list_roles to find valid IDs.
userId string yes The Action1 user ID. Use action1_list_users to find valid IDs.
action1_clone_role parameters
Param Type Required Default Description
roleId string yes The source Action1 role ID to clone. Use action1_list_roles to find valid IDs.
action1_create_role parameters
Param Type Required Default Description
fieldsJson string yes JSON object with role definition. Example: {"name":"Tier-1 Support","description":"Read-only patch ops","scoped_permissions":[{"permission":"view_reports","include_scope":["all"],"exclude_scope":[]},{"permission":"run_automations","include_scope":["<orgId>"],"exclude_scope":[],"restrictions":{"max_endpoints":50}}]}.
action1_delete_role parameters
Param Type Required Default Description
roleId string yes The Action1 role ID to delete. Use action1_list_roles to find valid IDs.
action1_get_role parameters
Param Type Required Default Description
roleId string yes The Action1 role ID. Use action1_list_roles to find valid IDs.
action1_list_permission_templates parameters
Param Type Required Default Description
filter string no null Case-insensitive substring; matches if any object field contains this value (Action1's filter is a plain substring search, not a structured query). Optional.
from integer no null Skip first N records (offset). Optional.
pageSize integer no 50 Results per page (default 50, max 100).
sortBy string no null Optional sort expression (e.g. 'name asc'). Optional.
action1_list_role_users parameters
Param Type Required Default Description
filter string no null Case-insensitive substring; matches if any object field contains this value (Action1's filter is a plain substring search, not a structured query). Optional.
from integer no null Skip first N records (offset). Optional.
pageSize integer no 50 Results per page (default 50, max 100).
roleId string yes The Action1 role ID. Use action1_list_roles to find valid IDs.
sortBy string no null Optional sort expression (e.g. 'email asc'). Optional.
action1_list_roles parameters
Param Type Required Default Description
fields string no null Comma-separated extra fields to expand. Use 'users' or '*' to include the user count for each role. Optional.
filter string no null Case-insensitive substring; matches if any object field contains this value (Action1's filter is a plain substring search, not a structured query). Optional.
from integer no null Skip first N records (offset). Optional.
pageSize integer no 50 Results per page (default 50, max 100).
sortBy string no null Optional sort expression (e.g. 'name asc' or '-name'). Optional.
action1_unassign_user_from_role parameters
Param Type Required Default Description
roleId string yes The Action1 role ID. Use action1_list_roles to find valid IDs.
userId string yes The Action1 user ID. Use action1_list_users or action1_list_role_users to find valid IDs.
action1_update_role parameters
Param Type Required Default Description
fieldsJson string yes JSON object with the fields to update.
roleId string yes The Action1 role ID. Use action1_list_roles to find valid IDs.

Endpoints

Tool Plan Access Description
action1_delete_endpoint Pro Destructive [Action1] Permanently remove an endpoint from the organization and uninstall its agent. Side effect: irreversibly removes the endpoint. Use action1_list_endpoints first to find valid endpointId values.
action1_get_agent_installation_url Free Read-only [Action1] Returns a download URL for the Action1 agent installer for the specified organization. Use this URL to manually deploy the agent on endpoints; for automated network-wide deployment see action1_get_deployer_installation_url. Note this is the per-endpoint AGENT, not the network Deployer service. Use action1_list_organizations to find valid orgId values.
action1_get_endpoint Free Read-only [Action1] Get full details for a single endpoint including hardware, OS, agent version, custom fields, and group membership. Use action1_list_endpoints first to find valid endpointId values.
action1_get_endpoints_status Free Read-only [Action1] Returns 'Yes'/'No' indicating whether any endpoints are deployed in the org. Use this as a quick precheck before calling action1_list_endpoints. Use action1_list_organizations to find valid orgId values.
action1_list_endpoint_missing_updates Free Read-only [Action1] List all missing OS and third-party software updates for a single endpoint with offset-based pagination. Returns update IDs, KB numbers, severity, and release dates. Use action1_list_endpoints to find valid endpointId values; for organization-wide missing updates use the patches/updates tools.
action1_list_endpoints Free Read-only [Action1] List all endpoints (managed devices) in the organization with offset-based pagination. Returns endpoint GUIDs, hostnames, OS, last seen timestamps, status, and group membership. Use endpoint IDs with action1_get_endpoint, action1_list_endpoint_missing_updates, and action1_start_remote_session. Use action1_list_organizations to find valid orgId values.
action1_move_endpoint Pro Write [Action1] Move an endpoint from its current organization to another organization in the same enterprise. JSON body REQUIRED field: target_organization_id (UUID of the destination org). Example: {"target_organization_id":"9844e782-2506-7488-f599-a5693ce52109"}. Side effect: re-parents the endpoint and may re-apply policies. Replaying with the same target_organization_id once the endpoint already lives there is a no-op. Use action1_list_organizations to find both source and destination IDs.
action1_update_endpoint Pro Write [Action1] Update mutable endpoint properties. Supported writeable fields: name, comment, and any custom: key (the attribute must be predefined in Action1 Advanced Settings). Side effect: modifies endpoint metadata. Examples: {"name":"Conference Room PC"}; {"comment":"Replaced HDD 2026-01"}; {"custom:Graphic Adapter":"NVidia RTX 4080"}. Use action1_list_endpoints first to find valid endpointId values.
action1_delete_endpoint parameters
Param Type Required Default Description
endpointId string yes The endpoint GUID to delete. Use action1_list_endpoints to find valid IDs.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
action1_get_agent_installation_url parameters
Param Type Required Default Description
installType string yes Agent installer OS/format. MUST be exactly one of (case-sensitive PascalCase): 'WindowsMSI', 'MacPKG', 'LinuxDEB'. The download URL returned is publicly accessible and binary-specific to the org.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
action1_get_endpoint parameters
Param Type Required Default Description
endpointId string yes The endpoint GUID. Use action1_list_endpoints to find valid IDs.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
action1_get_endpoints_status parameters
Param Type Required Default Description
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
action1_list_endpoint_missing_updates parameters
Param Type Required Default Description
approvalStatus string no null Filter by approval status. One of: New, Approved, Declined, -Declined.
endpointId string yes The endpoint GUID. Use action1_list_endpoints to find valid IDs.
from integer no null Zero-based offset for pagination. Omit for the first page; pass the next offset for subsequent pages.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
pageSize integer no 50 Results per page. Default 50, max 100.
securitySeverity string no null Filter by security severity. One of: Critical, Important, Moderate, Low, Unspecified, Other, -Critical.
action1_list_endpoints parameters
Param Type Required Default Description
fields string no null Optional. Requests ADDITIONAL (non-default) fields on top of the ones already returned by default — Action1's 'fields' selects extended data, it is NOT a projection of the default columns. Use '*' to return all fields, or name specific extended fields (e.g. 'versions'). Omit to return just the default fields; do not list fields that are already returned by default.
filter string no null Optional plain substring filter — NOT a structured grammar; matches against hostname and other free-text fields.
from integer no null Zero-based offset for pagination. Omit for the first page; pass the next offset for subsequent pages.
onlineStatus string no null Filter by online status. Typical values: 'Online', 'Offline'.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
os string no null Comma-separated OS names to filter, e.g. 'Windows 11,Windows 10'.
pageSize integer no 50 Results per page. Default 50, max 100.
rebootRequired string no null Filter by reboot-required state. Values: 'Yes' or 'No'.
resetCache string no null Pass 'Yes' to force the vendor to refresh its cached endpoint list before returning.
sortBy string no null Optional sort expression (e.g. 'hostname asc'). Action1 sort syntax.
status string no null Filter by endpoint status (e.g. 'Active', 'Inactive'). Spec-defined enum.
updateStatus string no null Filter by update status (e.g. 'UpToDate', 'Pending'). Spec-defined enum.
vulnerabilityStatus string no null Filter by vulnerability status (e.g. 'Vulnerable', 'Safe'). Spec-defined enum.
action1_move_endpoint parameters
Param Type Required Default Description
endpointId string yes The endpoint GUID to move. Use action1_list_endpoints to find valid IDs.
fieldsJson string yes JSON body with required field target_organization_id (e.g. {"target_organization_id":"<destination-org-guid>"}).
orgId string yes The current (source) Action1 organization GUID. Use action1_list_organizations to find valid IDs.
action1_update_endpoint parameters
Param Type Required Default Description
endpointId string yes The endpoint GUID to update. Use action1_list_endpoints to find valid IDs.
fieldsJson string yes JSON body. Writeable fields: name, comment, and any custom: key. Examples: {"name":"Conference Room PC"}; {"comment":"Replaced HDD 2026-01"}; {"custom:Graphic Adapter":"NVidia RTX 4080"}. Only include fields you want to change.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.

Endpoint Groups

Tool Plan Access Description
action1_create_endpoint_group Pro Write [Action1] Create a new endpoint group in the organization. Side effect: creates a new group that can be targeted by automations. JSON body REQUIRED field: name. Optional: description, include_filter (array of {field_name, field_value, mode} criteria objects), exclude_filter (same), include_filter_logic / exclude_filter_logic (boolean expressions like "1 AND (2 OR 3)" referring to 1-based filter positions), uptime_alerts (offline/online notification config). Use action1_modify_group_endpoints AFTER creation to add manual members; criteria-based members are populated automatically from include/exclude filters. Example: {"name":"Windows 11 Production","description":"All Win11 endpoints in HQ","include_filter":[{"field_name":"OS","field_value":"Windows 11","mode":"include"}]}.
action1_delete_endpoint_group Pro Destructive [Action1] Permanently delete an endpoint group. Side effect: removes the group; member endpoints are NOT deleted but lose group membership. Any automations targeting this group will need reconfiguration. Use action1_list_endpoint_groups first to find valid groupId values.
action1_get_endpoint_group Free Read-only [Action1] Get full details for a single endpoint group including name, description, membership rules, and metadata. Use action1_list_endpoint_groups first to find valid groupId values; for the actual member list use action1_list_group_endpoints.
action1_list_endpoint_groups Free Read-only [Action1] List all endpoint groups (logical collections of endpoints) in the organization with offset-based pagination. Returns group IDs, names, descriptions, and member counts. Use group IDs with action1_get_endpoint_group, action1_list_group_endpoints, and as targeting selectors in automation tools. Use action1_list_organizations to find valid orgId values.
action1_list_group_endpoints Free Read-only [Action1] List all endpoints that are members of a specific group with offset-based pagination. Returns endpoint IDs, hostnames, and basic status. Use action1_list_endpoint_groups first to find valid groupId values; use action1_get_endpoint for full per-endpoint detail.
action1_modify_group_endpoints Pro Write [Action1] Add or remove endpoint members from a group. JSON body is an ARRAY of operation objects. Each object has a method field ("POST" to add, "DELETE" to remove). POST entries carry a data object — either {"endpoint_id":"<uuid>","type":"Endpoint"} (add by ID) or {"endpoint_name":"WKS232","type":"EndpointName"} (add by name). DELETE entries carry endpoint_id directly. You can mix POST and DELETE in one call. Example: [{"method":"POST","data":{"endpoint_id":"<uuid>","type":"Endpoint"}},{"method":"POST","data":{"endpoint_name":"WKS232","type":"EndpointName"}},{"method":"DELETE","endpoint_id":"<uuid>"}]. Side effect: changes group membership and may re-trigger group-targeted automations. Replaying the same operations is a no-op (already-present POST or already-absent DELETE). If an endpoint name/ID isn't found, the call still succeeds with the missing IDs returned in the response details. Use action1_list_endpoints and action1_list_group_endpoints to find valid endpoint IDs.
action1_update_endpoint_group Pro Write [Action1] Update endpoint group properties (name, description, filters). PATCH semantics — fields not present in the body are left unchanged. Important gotcha: include_filter and exclude_filter arrays are REPLACE semantics, not 'add to' — sending a new array replaces the entire previous criteria set. To change manual membership use action1_modify_group_endpoints instead. Use action1_list_endpoint_groups first to find valid groupId values.
action1_create_endpoint_group parameters
Param Type Required Default Description
fieldsJson string yes JSON body. REQUIRED: name. Optional: description, include_filter[], exclude_filter[], include_filter_logic, exclude_filter_logic, uptime_alerts. Manual membership goes through action1_modify_group_endpoints, not this call.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
action1_delete_endpoint_group parameters
Param Type Required Default Description
groupId string yes The endpoint group GUID to delete. Use action1_list_endpoint_groups to find valid IDs.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
action1_get_endpoint_group parameters
Param Type Required Default Description
groupId string yes The endpoint group GUID. Use action1_list_endpoint_groups to find valid IDs.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
action1_list_endpoint_groups parameters
Param Type Required Default Description
from integer no null Zero-based offset for pagination. Omit for the first page; pass the next offset for subsequent pages.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
pageSize integer no 50 Results per page. Default 50, max 100.
action1_list_group_endpoints parameters
Param Type Required Default Description
fields string no null Comma-separated list of endpoint fields to project, e.g. 'id,hostname,os'.
filter string no null Optional plain substring filter — NOT a structured grammar; matches against hostname and other free-text fields.
from integer no null Zero-based offset for pagination. Omit for the first page; pass the next offset for subsequent pages.
groupId string yes The endpoint group GUID. Use action1_list_endpoint_groups to find valid IDs.
onlineStatus string no null Filter by online status. Typical values: 'Online', 'Offline'.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
os string no null Comma-separated OS names to filter, e.g. 'Windows 11,Windows 10'.
pageSize integer no 50 Results per page. Default 50, max 100.
rebootRequired string no null Filter by reboot-required state. Values: 'Yes' or 'No'.
sortBy string no null Optional sort expression (e.g. 'hostname asc'). Action1 sort syntax.
status string no null Filter by endpoint status (e.g. 'Active', 'Inactive'). Spec-defined enum.
updateStatus string no null Filter by update status (e.g. 'UpToDate', 'Pending'). Spec-defined enum.
vulnerabilityStatus string no null Filter by vulnerability status (e.g. 'Vulnerable', 'Safe'). Spec-defined enum.
action1_modify_group_endpoints parameters
Param Type Required Default Description
fieldsJson string yes JSON ARRAY of operation objects. POST adds (data: OR ). DELETE removes by endpoint_id. POST and DELETE may be mixed in one array. Example: [{"method":"POST","data":{"endpoint_id":"<uuid>","type":"Endpoint"}},{"method":"DELETE","endpoint_id":"<uuid>"}].
groupId string yes The endpoint group GUID. Use action1_list_endpoint_groups to find valid IDs.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
action1_update_endpoint_group parameters
Param Type Required Default Description
fieldsJson string yes JSON body with fields to update (e.g. {"name":"New Name","description":"Updated"}). Only include fields you want to change. NOTE: include_filter / exclude_filter arrays REPLACE the existing arrays wholesale.
groupId string yes The endpoint group GUID to update. Use action1_list_endpoint_groups to find valid IDs.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.

Remote Sessions

Tool Plan Access Description
action1_get_remote_session Free Read-only [Action1] Get the current state of an active remote session including status (connected field is "yes"/"no"), connected user, monitor_count for multi-display endpoints, and connection metadata. Use action1_start_remote_session first to obtain a sessionId; poll this until connected=="yes".
action1_start_remote_session Pro Destructive [Action1] Starts a new browser-based remote-assist session to the endpoint (not RDP). JSON body REQUIRED field: connection_type (must be the literal string "assistance" — only session type currently supported); optional current_ip (your current public IP). Returns a RemoteSession object whose remote_session field is a URL the operator opens in a browser. Side effect: prompts the end user (per org settings) to accept. After this call, poll action1_get_remote_session until the connected field == "yes". Use action1_list_endpoints to find valid endpointId values.
action1_switch_remote_session_monitor Pro Write [Action1] Switches the active monitor on a multi-display endpoint during an active remote session. JSON body REQUIRED field: current_monitor (1-based STRING index of the target monitor). Example: {"current_monitor":"2"}. Replaying with the same monitor index is a no-op vendor-side. Use action1_get_remote_session first to read monitor_count for the upper bound.
action1_get_remote_session parameters
Param Type Required Default Description
endpointId string yes The endpoint GUID hosting the session. Use action1_list_endpoints to find valid IDs.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
sessionId string yes The remote session ID returned by action1_start_remote_session.
action1_start_remote_session parameters
Param Type Required Default Description
endpointId string yes The endpoint GUID to connect to. Use action1_list_endpoints to find valid IDs.
fieldsJson string yes JSON body. Required: connection_type="assistance" (literal string, only valid value). Optional: current_ip (your current public IP). Example: {"connection_type":"assistance"}.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
action1_switch_remote_session_monitor parameters
Param Type Required Default Description
endpointId string yes The endpoint GUID hosting the session. Use action1_list_endpoints to find valid IDs.
fieldsJson string yes JSON body. Required: current_monitor (string, 1-based monitor index — note vendor types this as a string even though the value is numeric). Example: {"current_monitor":"2"}. Cross-reference monitor_count from action1_get_remote_session.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
sessionId string yes The remote session ID returned by action1_start_remote_session.

Agent Deployment

Tool Plan Access Description
action1_delete_deployer Pro Destructive [Action1] Permanently remove a Deployer service registration from the organization. Side effect: irreversibly removes the deployer record. Already-deployed agents remain installed. If the deployer status is 'Connected' or 'Disconnected', call action1_uninstall_deployer first — this endpoint refuses DELETE unless status is 'Pending Install'. Use action1_list_deployers first to find valid deployerId values.
action1_get_agent_deployment_settings Free Read-only [Action1] Get the agent deployment settings for the organization, including auto-discovery, network scan ranges, credentials, and deployer behavior. Use action1_list_organizations to find valid orgId values; modify with action1_update_agent_deployment_settings.
action1_get_deployer Free Read-only [Action1] Get full details for a single Deployer service including host machine, version, status, last contact timestamp, and discovered network ranges. Use action1_list_deployers first to find valid deployerId values.
action1_get_deployer_installation_url Free Read-only [Action1] Returns a JSON object containing the download URL for the Action1 Deployer Windows EXE installer for the org. Action1 Deployer is a Windows-only network service: install on one Windows host per network segment to auto-discover and install agents on the other endpoints. Returns JSON with a download_URL field (not the binary itself). For per-endpoint manual installs use action1_get_agent_installation_url. Use action1_list_organizations to find valid orgId values.
action1_list_deployers Free Read-only [Action1] List all installed Deployer services for the organization with offset-based pagination. Each Deployer is a Windows-only service that auto-discovers and installs agents on networked endpoints. Returns deployer IDs, host machine names, status, and last contact. Use deployer IDs with action1_get_deployer, action1_uninstall_deployer, and action1_delete_deployer.
action1_uninstall_deployer Pro Destructive [Action1] Initiate uninstall of an Action1 Deployer service from the Windows host. Side effect: stops and removes the Deployer service; status transitions to 'Pending Install' once complete. Required workflow: call this BEFORE action1_delete_deployer if the Deployer is currently 'Connected' or 'Disconnected'. Use action1_list_deployers to find valid deployerId values.
action1_update_agent_deployment_settings Pro Write [Action1] Update the org's Agent Deployment configuration. Side effect: changes how Deployer services discover and install agents on new endpoints. Available fields (all optional, only include what you want to change): ad_domain ("1"=AD domain mode, "0"=computer list mode); domain_name (comma-separated AD domains); exclude_DCs / exclude_workstations / exclude_servers (each "yes"/"no"); exclude_computer_list_enabled ("yes"/"no"); exclude_computer_list (string[] of computer names to skip); computer_list (string[] of computers to target when ad_domain="0"). Use action1_get_agent_deployment_settings first to inspect current values.
action1_delete_deployer parameters
Param Type Required Default Description
deployerId string yes The deployer GUID to delete. Use action1_list_deployers to find valid IDs.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
action1_get_agent_deployment_settings parameters
Param Type Required Default Description
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
action1_get_deployer parameters
Param Type Required Default Description
deployerId string yes The deployer GUID. Use action1_list_deployers to find valid IDs.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
action1_get_deployer_installation_url parameters
Param Type Required Default Description
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
action1_list_deployers parameters
Param Type Required Default Description
filter string no null Optional plain substring filter — NOT a structured grammar; matches against host name and other free-text fields.
from integer no null Zero-based offset for pagination. Omit for the first page; pass the next offset for subsequent pages.
installedSince string no null Filter to deployers installed since this ISO 8601 timestamp.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
os string no null Comma-separated OS names to filter (Action1 Deployer is Windows-only, so practical values are Windows variants).
pageSize integer no 50 Results per page. Default 50, max 100.
sortBy string no null Optional sort expression (e.g. 'host_name asc'). Action1 sort syntax.
status string no null Filter by deployer status. Typical values: 'Connected', 'Disconnected', 'Pending Install'.
action1_uninstall_deployer parameters
Param Type Required Default Description
deployerId string yes The deployer GUID to uninstall. Use action1_list_deployers to find valid IDs.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs.
action1_update_agent_deployment_settings parameters
Param Type Required Default Description
fieldsJson string yes JSON body with deployment settings to update. All fields optional, include only what you want to change. ad_domain ("1"|"0"), domain_name, exclude_DCs/exclude_workstations/exclude_servers ("yes"|"no"), exclude_computer_list_enabled ("yes"|"no"), exclude_computer_list (string[]), computer_list (string[]). Inspect the current shape via action1_get_agent_deployment_settings before modifying.
orgId string yes The Action1 organization GUID. Use action1_list_organizations to find valid IDs. NOTE: orgId="all" is rejected by the API.

Data Sources

Tool Plan Access Description
action1_create_data_source Pro Write [Action1] Create a new custom data source (a scripting template that queries endpoint data). Required fields: `name`, `status`, `description`, `language`, `script_text`, `columns`. `language` MUST be `"PowerShell"` (only valid value - Bash/Command are NOT valid for data sources, only for Scripts). `status` is `"Published"` or `"Draft"` (vendor warns Draft is currently deferred). `columns` is an array of strings naming the output columns (e.g. `["Endpoint Name", "Display Name"]`). `script_text` is PowerShell that emits objects whose properties match `columns`. Use action1_list_data_sources afterward to discover the new dataSourceId.
action1_delete_data_source Pro Destructive [Action1] Permanently delete a custom data source. Side effect: removes the template; reports and automations referencing it will break. This action CANNOT be undone. Built-in data sources cannot be deleted. Use action1_list_data_sources to confirm the dataSourceId before deleting.
action1_get_data_source Free Read-only [Action1] Get the full definition of a single data source including the script body, output column schema, and built-in/custom flag. Use action1_list_data_sources to find valid dataSourceIds.
action1_list_data_sources Free Read-only [Action1] Lists scripting templates that query endpoint data (built-in + custom). Built-in cannot be modified. Returns vendor-assigned IDs (integers/slugs, not GUIDs) used by reports and automations to collect inventory or telemetry. Use action1_get_data_source for full template details, action1_create_data_source to add a custom script-driven source.
action1_update_data_source Pro Write [Action1] Update an existing custom data source's script, schema, or metadata. Side effect: modifies the template; subsequent report runs will use the new definition. Built-in data sources cannot be modified. Only include fields you want to change in fieldsJson. Use action1_get_data_source to inspect current shape before editing.
action1_create_data_source parameters
Param Type Required Default Description
fieldsJson string yes JSON object with the new data source. Required: name, status (Published or Draft), description, language (PowerShell only), script_text, columns (array of strings).
action1_delete_data_source parameters
Param Type Required Default Description
dataSourceId string yes The data source ID (vendor-assigned) to delete. Use action1_list_data_sources to find valid IDs.
action1_get_data_source parameters
Param Type Required Default Description
dataSourceId string yes The data source ID (vendor-assigned). Use action1_list_data_sources to find valid IDs.
action1_list_data_sources parameters
Param Type Required Default Description
builtin string no null Yes or No - filter to Action1-maintained built-in data sources only when Yes.
from integer no null Cursor offset (zero-based index of the first record). Omit for the first page. Use the value returned in the previous response to fetch the next page.
pageSize integer no 50 Results per page. Default 50, max 100.
action1_update_data_source parameters
Param Type Required Default Description
dataSourceId string yes The data source ID (vendor-assigned) to update. Use action1_list_data_sources to find valid IDs. Built-in sources will reject the update.
fieldsJson string yes JSON object with the fields to update. Only include changed fields.

Scripts

Tool Plan Access Description
action1_create_script Pro Write [Action1] Create a new custom executable script. Required fields: `name`, `language`, `script_text`, `platform`. `language` enum: PowerShell, Command, or Bash. `platform` enum: Windows, Mac, or Linux. Optional: `description`, `reboot_exit_codes` (string like `"1, 3010"`). Note: `params` is read-only/derived from the script text - agents passing `params` on POST will have it ignored. `success_codes` is response-only, not writable. Parameter syntax in script body: `$paramname` (PowerShell), `%paramname%` (Command), none for Bash. Use action1_list_scripts afterward to discover the new scriptId.
action1_delete_script Pro Destructive [Action1] Permanently delete a custom script. Side effect: removes the script; automations referencing it will break. This action CANNOT be undone. Built-in scripts cannot be deleted. Use action1_list_scripts to confirm the scriptId before deleting.
action1_get_script Free Read-only [Action1] Get the full definition of a single script including its language, body, derived parameter list, and built-in/custom flag. Use action1_list_scripts to find valid scriptIds.
action1_list_scripts Free Read-only [Action1] Lists ready-to-use PowerShell/CMD/Bash scripts (built-in + custom). Returns vendor-assigned script IDs you can reference from action templates and automation schedules. Use action1_get_script for the full script body and parameters.
action1_update_script Pro Write [Action1] Update an existing custom script's body or metadata. Side effect: modifies the script; subsequent runs use the new definition. Built-in scripts cannot be modified. Note: `platform` is POST-only; cannot be changed via PATCH. `params` is derived from script_text - re-edit the body to change parameter shape. Use action1_get_script to inspect current shape before editing.
action1_create_script parameters
Param Type Required Default Description
fieldsJson string yes JSON object with the new script. Required: name, language (PowerShell|Command|Bash), script_text, platform (Windows|Mac|Linux). Optional: description, reboot_exit_codes.
action1_delete_script parameters
Param Type Required Default Description
scriptId string yes The script ID (vendor-assigned) to delete. Use action1_list_scripts to find valid IDs.
action1_get_script parameters
Param Type Required Default Description
scriptId string yes The script ID (vendor-assigned). Use action1_list_scripts to find valid IDs.
action1_list_scripts parameters
Param Type Required Default Description
builtin string no null Yes or No - filter to Action1-maintained built-in scripts only when Yes.
from integer no null Cursor offset (zero-based index of the first record). Omit for the first page.
pageSize integer no 50 Results per page. Default 50, max 100.
platform string no null Filter by platform. One of: Windows, Mac, or Linux.
action1_update_script parameters
Param Type Required Default Description
fieldsJson string yes JSON object with the fields to update. Only include changed fields. `platform` is not patchable.
scriptId string yes The script ID (vendor-assigned) to update. Use action1_list_scripts to find valid IDs. Built-in scripts will reject the update.

Settings

Tool Plan Access Description
action1_create_setting Pro Write [Action1] Create a new setting value bound to a template at a given scope. Required: `template_id`, `value`, `scope`. `scope` is an ARRAY of SettingScope objects: `[{type: "Enterprise"|"Organization"|"Group", object: "all"|"<orgId>"|"<groupId>"}]` (NOT a flat string). `value` is a string (often a JSON-stringified payload - e.g. `value: "[{"name":"Custom Attribute 11"}]"` is itself a JSON string, not a nested object). Use action1_list_setting_templates first to find a valid template_id and its value schema.
action1_delete_setting Pro Destructive [Action1] Permanently delete a setting. Side effect: removes the configured value; the scope reverts to the template default or higher-scope inheritance. This action CANNOT be undone. Use action1_list_settings to confirm the settingId before deleting.
action1_get_setting Free Read-only [Action1] Get a single setting's full detail including the template reference, scope, and current value. Use action1_list_settings to find valid settingIds.
action1_get_setting_template Free Read-only [Action1] Get the full definition of a setting template including the value schema and supported scopes. Note: `scope` on the Setting payload is an array of `{type, object}` objects (not a flat string). Use action1_list_setting_templates to find valid templateIds.
action1_list_setting_templates Free Read-only [Action1] Templates that drive what kinds of settings can be created. Returns templateIds and a description of each template's value schema and applicable scope. Use action1_get_setting_template for a single template's full schema, then action1_create_setting to apply a value.
action1_list_settings Free Read-only [Action1] List all configured settings (template + applied value at a given scope). Returns settingIds, the template they reference, the scope, and the current value. Use action1_get_setting for a single entry's full detail.
action1_update_setting Pro Write [Action1] Update the value of an existing setting. Side effect: modifies the configuration; agents and policies pick up the new value on their next sync. Only include fields you want to change in fieldsJson (typically `value`). Use action1_get_setting to inspect current shape before editing.
action1_create_setting parameters
Param Type Required Default Description
fieldsJson string yes JSON object with the new setting. Required: template_id (string), value (string - often a JSON-stringified payload), scope (array of {type, object}). Example: {"template_id":"setting_endpoint_custom_attributes","value":"[{"name":"Custom Attribute 11"}]","scope":[{"type":"Organization","object":"<orgId>"}]}.
action1_delete_setting parameters
Param Type Required Default Description
settingId string yes The setting ID to delete. Use action1_list_settings to find valid IDs.
action1_get_setting parameters
Param Type Required Default Description
settingId string yes The setting ID. Use action1_list_settings to find valid IDs.
action1_get_setting_template parameters
Param Type Required Default Description
templateId string yes The setting template ID. Use action1_list_setting_templates to find valid IDs.
action1_list_setting_templates parameters
Param Type Required Default Description
filter string no null Optional case-insensitive substring search across visible fields.
from integer no null Cursor offset (zero-based index of the first record). Omit for the first page.
pageSize integer no 50 Results per page. Default 50, max 100.
action1_list_settings parameters
Param Type Required Default Description
advancedSettingCategory string no null Filter by advanced setting category. One of: remote_desktop, custom_branding, sla, sso, software_repository.
filter string no null Optional case-insensitive substring search across visible fields.
from integer no null Cursor offset (zero-based index of the first record). Omit for the first page.
pageSize integer no 50 Results per page. Default 50, max 100.
sortBy string no null Optional sort key (column name). Omit for server default.
action1_update_setting parameters
Param Type Required Default Description
fieldsJson string yes JSON object with the fields to update. Only include changed fields.
settingId string yes The setting ID to update. Use action1_list_settings to find valid IDs.

Report Definitions

Tool Plan Access Description
action1_create_custom_report Pro Write [Action1] Create a new custom report definition. Required fields: `name`, `description`, `data_sources`, `simple_columns`, `summary_columns`, `drilldown_columns`, `filter_set`. Shape: `data_sources` is an array of full URI strings like `/API/data-sources/all/2041`. `simple_columns`/`summary_columns`/`drilldown_columns` are arrays of `{name, enabled: "yes"|"no", sort: "none"|"asc"|"desc", data_source_id: <int>}` (data_source_id is the integer parsed out of the URI). `filter_set` is `{filters: [{name, data_source_id, operator: "="|"<"|">"|"<="|">="|"<>", value}], filter_logic: "1 OR 2"}`. Wildcards (e.g. `Adobe*`) are accepted in `value`. Optional `column_aliases`: `[{data_source_id, original_name, new_name}]`. Use action1_get_data_source for the column list before constructing this body.
action1_delete_custom_report Pro Destructive [Action1] Permanently delete a custom report definition. Side effect: removes the report; report subscriptions referencing it will break. This action CANNOT be undone. Built-in reports cannot be deleted. Use action1_list_reports to confirm the reportId before deleting.
action1_get_reports_in_category Free Read-only [Action1] Returns the children of a category, or the resolved-detail of a report when given a report ID. Used to walk the report taxonomy hierarchically. Use action1_list_reports to discover root nodes.
action1_list_reports Free Read-only [Action1] Lists report definitions (built-in + custom). Use action1_get_report_data to fetch actual data rows. Returns vendor-assigned reportIds, category, name, and built-in/custom flag. Reports are categorized hierarchically; pass `subtree=Yes` to return the full subtree, or use action1_get_reports_in_category to walk the tree manually.
action1_update_custom_report Pro Write [Action1] Update a custom report's columns, filters, or metadata via PATCH semantics. Side effect: modifies the report definition; subsequent action1_get_report_data calls return data shaped by the new definition. Built-in reports cannot be edited - this call rejects them. Only include fields you want to change in fieldsJson.
action1_create_custom_report parameters
Param Type Required Default Description
fieldsJson string yes JSON object with the new report's fields. Required: name, description, data_sources, simple_columns, summary_columns, drilldown_columns, filter_set. See tool description for the shape.
action1_delete_custom_report parameters
Param Type Required Default Description
reportId string yes The report ID to delete. Use action1_list_reports to find valid IDs.
action1_get_reports_in_category parameters
Param Type Required Default Description
from integer no null Cursor offset (zero-based index of the first record). Omit for the first page.
pageSize integer no 50 Results per page. Default 50, max 100.
reportOrCategoryId string yes The report or category ID whose children should be listed. Use action1_list_reports to find valid IDs.
action1_list_reports parameters
Param Type Required Default Description
from integer no null Cursor offset (zero-based index of the first record). Omit for the first page.
pageSize integer no 50 Results per page. Default 50, max 100.
subtree string no null Yes to return the entire report subtree; No (default) returns the top level only.
action1_update_custom_report parameters
Param Type Required Default Description
fieldsJson string yes JSON object with the fields to update. Only include changed fields (PATCH semantics).
reportId string yes The report ID to update. Use action1_list_reports to find valid IDs. Built-in reports will reject the update.

Report Data

Tool Plan Access Description
action1_drilldown_report_row Free Read-only [Action1] Drill into a single report row to retrieve its underlying detail records (e.g. expand an aggregate row into the per-endpoint detail it summarises). Use action1_get_report_data first to discover reportRowIds. Supports paging via from/pageSize plus a substring filter, sort key, and `liveOnly`.
action1_export_report Free Read-only [Action1] Export an Action1 report to CSV or HTML. Returns a short-lived SAS URL (valid for 1 hour) to the file in blob storage - the agent should fetch the file from the URL within the expiry window; do NOT attempt to decode the URL as content. Reports larger than 100 MB fail with HTTP 413. Use action1_list_organizations and action1_list_reports to find valid IDs.
action1_export_report_row_details Free Read-only [Action1] Export the drilled-down details for a single report row to CSV or HTML. Returns a short-lived SAS URL (valid for 1 hour) to the file in blob storage - the agent should fetch the file from the URL within the expiry window; do NOT attempt to decode the URL as content. Reports larger than 100 MB fail with HTTP 413. Use action1_get_report_data first to discover reportRowIds.
action1_get_report_data Free Read-only [Action1] Fetch the data rows produced by a previously generated report for a specific organization. Use action1_list_reports (catalog) to discover reportIds and action1_list_organizations to find orgIds. Supports paging via from/pageSize, optional sort key, and a substring filter. Use `liveOnly=Yes` to skip cached endpoint responses; `details=yes` to expand details (Summary reports only); `endpointId` to scope rows to a single endpoint. Pair with action1_requery_report when you need fresh data before reading.
action1_get_report_errors Free Read-only [Action1] List per-endpoint or per-row errors that occurred while a report was being generated for an organization. Useful for diagnosing why action1_get_report_data is missing rows or shows stale data. Use action1_list_organizations and action1_list_reports to find valid IDs.
action1_requery_report Pro Write [Action1] Triggers async report re-fetch. Pair with action1_get_report_data to read fresh results once requery completes. Returns immediately; the report runs server-side. Optionally pass `endpointId` to requery just one endpoint instead of the whole org. Use action1_list_organizations and action1_list_reports to find valid IDs.
action1_drilldown_report_row parameters
Param Type Required Default Description
filter string no null Optional case-insensitive substring search across visible fields.
from integer no null Zero-based row offset for pagination. Omit for the first page.
liveOnly string no null Yes or No - skip cached endpoint responses when Yes.
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.
pageSize integer no 50 Rows per page. Default 50, max 100.
reportId string yes The Action1 report ID. Use action1_list_reports to find valid IDs.
reportRowId string yes The report row ID to drill into. Discover via action1_get_report_data.
sortBy string no null Optional sort key (column name). Omit for server default.
action1_export_report parameters
Param Type Required Default Description
filter string no null Optional case-insensitive substring search across visible fields.
format string no null Export format. Spec accepts 'csv' or 'html'; default 'csv'. Action1 rejects other values.
from integer no null Zero-based row offset for pagination. Omit to start at the beginning.
limit integer no null Maximum rows to include in the export. Omit for server default.
liveOnly string no null Yes or No - skip cached endpoint responses when Yes.
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.
reportId string yes The Action1 report ID. Use action1_list_reports to find valid IDs.
sortBy string no null Optional sort key (column name). Omit for server default.
action1_export_report_row_details parameters
Param Type Required Default Description
format string no null Export format. Spec accepts 'csv' or 'html'; default 'csv'. Action1 rejects other values.
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.
reportId string yes The Action1 report ID. Use action1_list_reports to find valid IDs.
reportRowId string yes The report row ID whose details to export. Discover via action1_get_report_data.
action1_get_report_data parameters
Param Type Required Default Description
details string no null yes or no - expand details (Summary reports only).
endpointId string no null Restrict data to a single endpoint. Use action1_list_endpoints to find valid IDs.
filter string no null Optional case-insensitive substring search across visible fields.
from integer no null Zero-based row offset for pagination. Omit for the first page.
liveOnly string no null Yes or No - skip cached endpoint responses when Yes.
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.
pageSize integer no 50 Rows per page. Default 50, max 100.
reportId string yes The Action1 report ID. Use action1_list_reports to find valid IDs.
sortBy string no null Optional sort key (column name). Omit for server default.
action1_get_report_errors parameters
Param Type Required Default Description
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.
reportId string yes The Action1 report ID. Use action1_list_reports to find valid IDs.
action1_requery_report parameters
Param Type Required Default Description
endpointId string no null Optional endpoint ID to scope the requery to a single endpoint. Use action1_list_endpoints to find valid IDs.
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.
reportId string yes The Action1 report ID. Use action1_list_reports to find valid IDs.

Software Repository

Tool Plan Access Description
action1_check_package_match_conflicts Free Read-only [Action1] Pre-flight check: ask Action1 whether a proposed `app_name_match` regex would collide with another package's version (i.e. would two different versions match the same installed software on the endpoint). Use this regex BEFORE calling action1_create_software_package / action1_create_package_version. Pass the regex you intend to put on the new version's `app_name_match` field.
action1_check_package_version_match_conflicts Free Read-only [Action1] Pre-flight check: ask Action1 whether a proposed `app_name_match` regex would collide with another version of the SAME package. Use BEFORE calling action1_create_package_version. Pass the regex you intend to put on the new version's `app_name_match` field.
action1_clone_software_package Pro Write [Action1] Duplicate an existing package and all its versions into a new custom package. No body parameters - vendor assigns a new packageId. Use this to fork a built-in package so you can edit its versions afterwards via action1_update_package_version. Note: cloned built-in packages are no longer maintained by Action1.
action1_create_package_version Pro Write [Action1] Add a new version (with install/uninstall actions) to an existing software package. Required fields: `version` (e.g. "1.2.3.4"), `app_name_match` (regex matching the installed product as it appears in Apps & Features - e.g. `^Mozilla +Firefox.+$`), `release_date` (YYYY-MM-DD). Common optional fields: `notes`, `update_type`, `security_severity`, `security_CVE`, `silent_install_switches`, `success_exit_codes`, `additional_actions[]`. Windows-only: `install_type` (`msi|exe|msix`), `uninstall_app_name_match`, `silent_uninstall_switches`, `reboot_exit_codes`, `file_name.{Windows_32|Windows_64|Windows_ARM64}` as `{name, type: "cloud"|"unc"}`. Mac-only: `file_name.{Mac_IntelCPU|Mac_AppleSilicon}` (cloud only). The package must already exist (POST action1_create_software_package). The actual binary upload is a separate two-stage flow not exposed by StackJack - use the Action1 console for binary uploads.
action1_create_software_package Pro Write [Action1] Register a new software package shell in the org's repository. Required fieldsJson keys: `name`, `vendor`, `description`, `platform` (`Windows` or `Mac`). Optional: `internal_notes`. Versions (with install commands and matching rules) are added separately via action1_create_package_version. Side effect: creates a new (custom) package row; built-in Action1 packages cannot be created this way.
action1_delete_package_version Pro Destructive [Action1] Permanently delete a specific version from a software package. Side effect: irrevocably removes the version and its actions; automations targeting this version will fail. Use action1_get_software_package (with fields=*) to confirm versionId before deleting. Built-in package versions cannot be deleted.
action1_delete_software_package Pro Destructive [Action1] Permanently delete a software package and ALL of its versions/actions from the org's repository. Side effect: irrevocably removes the package; automations referencing it may fail. Use action1_list_software_packages to confirm packageId before deleting.
action1_delete_version_action Pro Destructive [Action1] Permanently delete a single additional action (install / uninstall / detection step) from a CUSTOM package version while keeping the version itself. Side effect: irrevocably removes the action; the version may no longer install or detect correctly. Built-in packages reject this DELETE. Use action1_get_package_version to find actionIds in the additional_actions[] array.
action1_get_package_version Free Read-only [Action1] Get full detail for a specific version of a software package, including its install / uninstall / detection actions. Use action1_get_software_package (with fields=*) or action1_list_software_packages first to discover versionIds.
action1_get_software_package Free Read-only [Action1] Get full detail for a single software package. Without `fields=` or `fields=versions` the response omits the versions[] array; pass `fields=` to retrieve the full version list. Use action1_list_software_packages to discover packageIds.
action1_list_software_packages Free Read-only [Action1] Lists packages registered in the org's repository (vendor, product name, latest version, package type). Use the returned packageIds with action1_get_software_package, action1_create_package_version, etc. Use action1_list_organizations to find valid orgIds. Filter parameters use Yes/No strings; matchName/matchVersion accept a regex; fields=*/versions expands version arrays.
action1_update_package_version Pro Write [Action1] Update a specific version of a software package (e.g. tweak install command line or detection rule). Side effect: modifies the version row. Only include changed fields in fieldsJson. Use action1_get_package_version to inspect current shape before editing.
action1_update_software_package Pro Write [Action1] Update properties on an existing CUSTOM software package (rename, description, internal_notes). Built-in packages reject this call except for `EULA_accepted`. fieldsJson should contain only the fields you want to change.
action1_check_package_match_conflicts parameters
Param Type Required Default Description
appNameMatch string no null The regex you intend to put on the new version's app_name_match field (e.g. ^Mozilla.+$). NOT a plain product name.
orgId string yes The Action1 organization ID. Use action1_list_organizations to find valid IDs. Use the literal string "all" to span every organization (Software Repository only - Updates and Installed Software endpoints require a real orgId).
action1_check_package_version_match_conflicts parameters
Param Type Required Default Description
appNameMatch string no null The regex you intend to put on the new version's app_name_match field (e.g. ^Mozilla.+$). NOT a plain product name.
orgId string yes The Action1 organization ID. Use action1_list_organizations to find valid IDs. Use the literal string "all" to span every organization (Software Repository only - Updates and Installed Software endpoints require a real orgId).
packageId string yes The parent package ID. Use action1_list_software_packages to find valid IDs.
action1_clone_software_package parameters
Param Type Required Default Description
orgId string yes The Action1 organization ID. Use action1_list_organizations to find valid IDs. Use the literal string "all" to span every organization (Software Repository only - Updates and Installed Software endpoints require a real orgId).
packageId string yes The source package ID to clone. Use action1_list_software_packages to find valid IDs.
action1_create_package_version parameters
Param Type Required Default Description
fieldsJson string yes JSON object describing the new version. Required: version, app_name_match (regex), release_date (YYYY-MM-DD). The shape varies by parent package's platform (Windows vs Mac); see tool description.
orgId string yes The Action1 organization ID. Use action1_list_organizations to find valid IDs. Use the literal string "all" to span every organization (Software Repository only - Updates and Installed Software endpoints require a real orgId).
packageId string yes The parent package ID. Use action1_list_software_packages to find valid IDs.
action1_create_software_package parameters
Param Type Required Default Description
fieldsJson string yes JSON object describing the new package. Required: name, vendor, description, platform (Windows or Mac). Optional: internal_notes. Example: {"name":"Adobe Illustrator","vendor":"Adobe","description":"Vector design tool","platform":"Windows"}.
orgId string yes The Action1 organization ID. Use action1_list_organizations to find valid IDs. Use the literal string "all" to span every organization (Software Repository only - Updates and Installed Software endpoints require a real orgId).
action1_delete_package_version parameters
Param Type Required Default Description
orgId string yes The Action1 organization ID. Use action1_list_organizations to find valid IDs. Use the literal string "all" to span every organization (Software Repository only - Updates and Installed Software endpoints require a real orgId).
packageId string yes The parent package ID. Use action1_list_software_packages to find valid IDs.
versionId string yes The version ID to delete. Discover via action1_get_software_package with fields=*.
action1_delete_software_package parameters
Param Type Required Default Description
orgId string yes The Action1 organization ID. Use action1_list_organizations to find valid IDs. Use the literal string "all" to span every organization (Software Repository only - Updates and Installed Software endpoints require a real orgId).
packageId string yes The package ID to delete. Use action1_list_software_packages to find valid IDs.
action1_delete_version_action parameters
Param Type Required Default Description
actionId string yes The action ID to delete. Discover via action1_get_package_version (in additional_actions[]).
orgId string yes The Action1 organization ID. Use action1_list_organizations to find valid IDs. Use the literal string "all" to span every organization (Software Repository only - Updates and Installed Software endpoints require a real orgId).
packageId string yes The parent package ID. Use action1_list_software_packages to find valid IDs.
versionId string yes The version ID. Discover via action1_get_software_package with fields=*.
action1_get_package_version parameters
Param Type Required Default Description
orgId string yes The Action1 organization ID. Use action1_list_organizations to find valid IDs. Use the literal string "all" to span every organization (Software Repository only - Updates and Installed Software endpoints require a real orgId).
packageId string yes The parent package ID. Use action1_list_software_packages to find valid IDs.
versionId string yes The version ID. Discover via action1_get_software_package with fields=*.
action1_get_software_package parameters
Param Type Required Default Description
fields string no null Use 'fields=*' or 'fields=versions' to expand the versions[] array. Without this, versions are omitted by default.
orgId string yes The Action1 organization ID. Use action1_list_organizations to find valid IDs. Use the literal string "all" to span every organization (Software Repository only - Updates and Installed Software endpoints require a real orgId).
packageId string yes The package ID. Use action1_list_software_packages to find valid IDs.
action1_list_software_packages parameters
Param Type Required Default Description
builtin string no null Yes or No - filter to Action1-maintained built-in packages only when Yes.
custom string no null Yes or No - filter to org-defined custom packages only when Yes.
fields string no null Use 'fields=*' or 'fields=versions' to expand the versions[] array in the response. Without this, versions are omitted by default.
filter string no null Optional case-insensitive substring search across visible fields.
from integer no null Zero-based row offset for pagination. Omit for the first page.
matchName string no null Optional regex matching a package's app_name_match field.
matchVersion string no null Optional regex matching a version's version string.
orgId string yes The Action1 organization ID. Use action1_list_organizations to find valid IDs. Use the literal string "all" to span every organization (Software Repository only - Updates and Installed Software endpoints require a real orgId).
pageSize integer no 50 Rows per page. Default 50, max 100.
platform string no null Filter by platform. One of: Windows, Mac.
sortBy string no null Optional sort key (column name). Omit for server default.
action1_update_package_version parameters
Param Type Required Default Description
fieldsJson string yes JSON object with fields to update. Only include changed fields.
orgId string yes The Action1 organization ID. Use action1_list_organizations to find valid IDs. Use the literal string "all" to span every organization (Software Repository only - Updates and Installed Software endpoints require a real orgId).
packageId string yes The parent package ID. Use action1_list_software_packages to find valid IDs.
versionId string yes The version ID to update. Discover via action1_get_software_package with fields=*.
action1_update_software_package parameters
Param Type Required Default Description
fieldsJson string yes JSON object with fields to update. Only include changed fields. Built-in packages accept only `EULA_accepted`.
orgId string yes The Action1 organization ID. Use action1_list_organizations to find valid IDs. Use the literal string "all" to span every organization (Software Repository only - Updates and Installed Software endpoints require a real orgId).
packageId string yes The package ID. Use action1_list_software_packages to find valid IDs.

Updates / Patches

Tool Plan Access Description
action1_list_endpoints_missing_update Free Read-only [Action1] For a specific package version, list every endpoint that is currently missing it. Use action1_list_missing_updates or action1_list_package_updates to discover packageId/versionId pairs first. Pair with action1_apply_automation to remediate.
action1_list_missing_updates Free Read-only [Action1] List patches/updates currently missing across endpoints in an organization. Returns one row per missing-update / package combination (rows include severity, KB references, and CVE list). Common filters: approval_status, security_severity, builtin/custom, SLA-window. The `filter` parameter is a plain case-insensitive substring search across visible fields - for severity / approval / etc. use the dedicated parameters. Pair with action1_list_endpoints_missing_update to drill into a specific update before remediation.
action1_list_package_updates Free Read-only [Action1] List the available update versions for a specific package across the organization. Use action1_list_software_packages to discover packageIds, then this tool to see which versions Action1 considers an upgrade target. The `filter` parameter is a plain case-insensitive substring search - for severity / approval / etc. use the dedicated parameters.
action1_list_endpoints_missing_update parameters
Param Type Required Default Description
filter string no null Optional case-insensitive substring search across visible fields.
from integer no null Zero-based row offset for pagination. Omit for the first page.
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.
packageId string yes The package ID. Use action1_list_software_packages to find valid IDs.
pageSize integer no 50 Rows per page. Default 50, max 100.
sortBy string no null Optional sort key (column name). Omit for server default.
versionId string yes The package version ID. Use action1_list_package_updates to find valid IDs.
action1_list_missing_updates parameters
Param Type Required Default Description
approvalStatus string no null Filter by approval. One of: New, Approved, Declined, -Declined.
builtin string no null Yes or No - filter to Action1-maintained built-in updates only when Yes.
custom string no null Yes or No - filter to org-defined custom updates only when Yes.
fields string no null Use '*' to expand sub-objects (notably versions[]).
filter string no null Optional case-insensitive substring search across visible fields. For severity / approval / etc. use the dedicated parameters.
from integer no null Zero-based row offset for pagination. Omit for the first page.
onlyLatest string no null Yes (default) or No - show only the latest version of each update or all versions.
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.
pageSize integer no 50 Rows per page. Default 50, max 100.
securitySeverity string no null Filter by severity. One of: Critical, Important, Moderate, Low, Unspecified, Other, -Critical.
sortBy string no null Optional sort key (column name). Omit for server default.
updateSlaEndDay string no null SLA-window day filter (string). Upper bound of the SLA day window.
updateSlaStartDay string no null SLA-window day filter (string). Lower bound of the SLA day window.
action1_list_package_updates parameters
Param Type Required Default Description
approvalStatus string no null Filter by approval. One of: New, Approved, Declined, -Declined.
builtin string no null Yes or No - filter to Action1-maintained built-in updates only when Yes.
custom string no null Yes or No - filter to org-defined custom updates only when Yes.
fields string no null Use '*' to expand sub-objects (notably versions[]).
filter string no null Optional case-insensitive substring search across visible fields. For severity / approval / etc. use the dedicated parameters.
from integer no null Zero-based row offset for pagination. Omit for the first page.
onlyLatest string no null Yes (default) or No - show only the latest version of each update or all versions.
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.
packageId string yes The package ID. Use action1_list_software_packages to find valid IDs.
pageSize integer no 50 Rows per page. Default 50, max 100.
securitySeverity string no null Filter by severity. One of: Critical, Important, Moderate, Low, Unspecified, Other, -Critical.
sortBy string no null Optional sort key (column name). Omit for server default.

Installed Software

Tool Plan Access Description
action1_get_endpoint_installed_software Free Read-only [Action1] List the installed software inventory for a single endpoint (vendor, product, version, install date). Use action1_list_endpoints to find valid endpointIds. Supports paging via from/pageSize plus a substring filter and sort key.
action1_get_installed_software_errors Free Read-only [Action1] Returns the per-endpoint errors encountered during installed-software collection. Useful for diagnosing endpoints that failed to report their installed software list. Paginated - use from/pageSize.
action1_list_installed_software Free Read-only [Action1] List all installed software titles aggregated across the org's endpoints, with install counts. Use `liveOnly=Yes` to suppress cached rows. The `filter` parameter is a plain case-insensitive substring search across visible fields. Use action1_get_endpoint_installed_software to drill into a specific endpoint's inventory.
action1_requery_endpoint_installed_software Pro Write [Action1] Trigger an asynchronous re-scan of installed software for a single endpoint. Returns 200 once queued; does NOT guarantee the endpoint has processed. Online endpoints respond within seconds; offline endpoints process when they next reconnect. Verify freshness via `response_type` field on subsequent list calls (`live` = post-requery, `cache` = pre-requery). Action1 auto-updates inventory every 15 min - only requery for out-of-band changes or real-time needs.
action1_requery_installed_software Pro Write [Action1] Trigger an asynchronous re-scan of installed software across all endpoints in the org. Returns 200 once queued; does NOT guarantee endpoints have processed. Online endpoints respond within seconds; offline endpoints process when they reconnect. Verify freshness via `response_type` field on subsequent list calls (`live` = post-requery, `cache` = pre-requery). Action1 auto-updates inventory every 15 min and immediately after Action1-driven installs/uninstalls - only requery for out-of-band changes or real-time needs.
action1_get_endpoint_installed_software parameters
Param Type Required Default Description
endpointId string yes The endpoint ID. Use action1_list_endpoints to find valid IDs.
filter string no null Optional case-insensitive substring search across visible fields.
from integer no null Zero-based row offset for pagination. Omit for the first page.
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.
pageSize integer no 50 Rows per page. Default 50, max 100.
sortBy string no null Optional sort key (column name). Omit for server default.
action1_get_installed_software_errors parameters
Param Type Required Default Description
filter string no null Optional case-insensitive substring search across visible fields.
from integer no null Zero-based row offset for pagination. Omit for the first page.
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.
pageSize integer no 50 Rows per page. Default 50, max 100.
sortBy string no null Optional sort key (column name). Omit for server default.
action1_list_installed_software parameters
Param Type Required Default Description
filter string no null Optional case-insensitive substring search across visible fields.
from integer no null Zero-based row offset for pagination. Omit for the first page.
liveOnly string no null Yes to skip cached endpoint responses; No (default) to include cached.
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.
pageSize integer no 50 Rows per page. Default 50, max 100.
sortBy string no null Optional sort key (column name). Omit for server default.
action1_requery_endpoint_installed_software parameters
Param Type Required Default Description
endpointId string yes The endpoint ID. Use action1_list_endpoints to find valid IDs.
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.
action1_requery_installed_software parameters
Param Type Required Default Description
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.

Action Templates

Tool Plan Access Description
action1_get_action_template Free Read-only [Action1] Retrieve a single action template by ID. Returns id, name, description, and applicable_to surface only — the endpoint does NOT return per-template parameter schemas at runtime. The detailed params shape per template_id is documented inside the action1_create_automation_schedule and action1_apply_automation tool descriptions. Use action1_list_action_templates to discover valid IDs.
action1_list_action_templates Free Read-only [Action1] List the available action templates (the reusable building blocks Action1 uses for automations, e.g. install package, run script, reboot). Returns template IDs and names. Use the IDs when constructing automation schedules. Valid template_id values are a closed set: deploy_package, deploy_update, uninstall_program, run_script, reboot, update_ring.
action1_get_action_template parameters
Param Type Required Default Description
templateId string yes The Action1 action-template ID. Use action1_list_action_templates to find valid IDs.
action1_list_action_templates parameters
Param Type Required Default Description
applicableTo string no null Optional context URL like '/API/installed-software' to scope templates to a specific surface.
from integer no null Skip first N records (offset). Optional.
pageSize integer no 50 Results per page (default 50, max 100).

Automations

Tool Plan Access Description
action1_apply_automation Pro Destructive [Action1] Trigger a one-shot automation run. Side effect: creates a new automation instance and starts execution immediately, fanning out install/uninstall/reboot/script work across the targeted endpoints. This call FAILS if orgId is "all". Body is AutomationInstancePayload — required: name, retry_minutes (string), actions[], endpoints[]. Note endpoints[] is REQUIRED for apply (unlike schedule create where it is optional). See action1_create_automation_schedule for the full actions[] / endpoints[] / template_id / reboot_options shapes.
action1_create_automation_schedule Pro Write [Action1] Create a scheduled automation (one or more actions executed on a schedule against a scope of endpoints). Side effect: creates a recurring or one-time task. Endpoint paths in this connector use orgId from action1_list_organizations. The body is the AutomationSchedulePayload — required: name, retry_minutes (STRING, e.g. "1440"), actions[], settings (schedule grammar). endpoints[] optional on schedules; if omitted the schedule has no targets until you add some.
action1_delete_automation_action Pro Destructive [Action1] Remove a specific action from a schedule without deleting the entire schedule. Side effect: the schedule's instance history for the removed action is also removed.
action1_delete_automation_schedule Pro Destructive [Action1] Hard-delete an automation schedule. Side effect: schedule and its instance history are both removed (irreversible).
action1_get_automation_deployment_statuses Free Read-only [Action1] Get the deployment statuses (per-target endpoint) for an automation schedule.
action1_get_automation_endpoint_details Free Read-only [Action1] Get full execution detail for a single endpoint within an automation instance (logs, exit codes, timing).
action1_get_automation_instance Free Read-only [Action1] Get details of a specific automation instance (run).
action1_get_automation_schedule Free Read-only [Action1] Get a single automation schedule by ID.
action1_list_automation_instances Free Read-only [Action1] List automation instances (one row per execution of a schedule). Use to track recent runs and their statuses.
action1_list_automation_results Free Read-only [Action1] List per-endpoint results for an automation instance. Pair with action1_get_automation_endpoint_details for richer per-endpoint info.
action1_list_automation_schedules Free Read-only [Action1] List automation schedules within an organization. Schedules combine actions, scope, and timing. Use action1_list_organizations to find valid orgId values.
action1_stop_automation Pro Write [Action1] Stop a running automation instance. Side effect: pending endpoint runs are cancelled.
action1_update_automation_schedule Pro Write [Action1] Update a scheduled automation. PATCH semantics — provide only the fields you want to change. Body shape is AutomationSchedulePayload (same shape as create). See action1_create_automation_schedule for the full schema, settings grammar, endpoints[]/actions[] shapes, and the closed template_id enum.
action1_apply_automation parameters
Param Type Required Default Description
fieldsJson string yes JSON body. Required top-level: name (string); retry_minutes (string, e.g. "1440"); actions[] (minItems 1); endpoints[] (REQUIRED for apply, unlike schedule create). See action1_create_automation_schedule for the full actions[] / endpoints[] / template_id (closed enum: deploy_package, deploy_update, uninstall_program, run_script, reboot, update_ring) / reboot_options shapes.
orgId string yes Organization ID.
action1_create_automation_schedule parameters
Param Type Required Default Description
fieldsJson string yes JSON body for the schedule. REQUIRED top-level fields: name (string); retry_minutes (string, e.g. "1440" — minutes to keep retrying offline endpoints); actions (array, minItems 1); settings (string, schedule grammar). OPTIONAL: endpoints[]; settings_timezone ("UTC"|"LOCALTIME", default UTC). settings grammar (single-line string): "ENABLED <recurrence> [AT:HH-MM-SS] [DATE:YYYY-MM-DD]" or "DISABLED". recurrence is one of: ONCE (requires DATE and AT); EVERY:<minutes> (requires DATE and AT; first run at DATE/AT, repeat every N minutes); WEEKLY:<weekdays> (e.g. WEEKLY:Mon,Wed,Fri; weekdays: Sun Mon Tue Wed Thu Fri Sat; DATE ignored); MONTHLY:<day> (1-31; DATE ignored); MONTHLYWEEK:<weeknum>:<weekday> (e.g. MONTHLYWEEK:2:Mon = 2nd Monday of every month). Examples: "ENABLED ONCE AT:08-31-00 DATE:2025-06-08"; "ENABLED EVERY:60 AT:09-00-00 DATE:2025-01-15"; "ENABLED WEEKLY:Mon,Fri AT:08-33-00"; "ENABLED MONTHLY:5 AT:07-47-00"; "ENABLED MONTHLYWEEK:2:Mon AT:07-47-00"; "DISABLED". endpoints[] item shape (use to scope the schedule): {"id":"<endpoint-uuid>","type":"Endpoint"}; {"id":"<group-id>","type":"EndpointGroup"}; {"id":"all","type":"EndpointGroup"} (special "all endpoints in org"). actions[] item shape: {"name":"<display name>","template_id":"<one of below>","params":}. template_id is a CLOSED ENUM. Allowed values and their REQUIRED params: "reboot": {display_summary, reboot_options}; "deploy_package": {display_summary, packages:[{"<pkg-id>":"<version>"}], reboot_options}; "uninstall_program": {display_summary, packages:[{"<pkg-id>":"<version>"}], reboot_options}; "deploy_update": {display_summary, reboot_options, scope:"All"|"MatchingFilters"|"Specified"; + when scope=Specified: packages:[{"<update-id>":"<version>"}]; + when scope=MatchingFilters: filters:[{name, values[], operator:"include"|"exclude"}]}; "update_ring": {display_summary, reboot_options, scope:"PreviousRing", previous_ring_options:{ring_id, success_rate_at_least?, first_deployed_minutes_ago?}}; "run_script": {display_summary, run_script_params:[], + EITHER run_script_id (use library script) OR (run_script_text + run_script_language: "PowerShell"|"Command"|"Bash"); optional: condition_script_text, condition_script_language, reboot_exit_codes, reboot_options, platform:"Windows"|"Mac"|"Linux"}. reboot_options is polymorphic: {"auto_reboot":"no"} or {"auto_reboot":"yes","show_message":"yes"|"no","message_text":"...","timeout":<minutes>}. Full minimal example (run a library script weekly on one endpoint): {"name":"Run SFC weekly","retry_minutes":"1440","settings":"ENABLED WEEKLY:Mon AT:09-00-00","endpoints":[{"id":"caf1e1e7-7657-438b-aaf1-6ee05765e44b","type":"Endpoint"}],"actions":[{"name":"Run PowerShell","template_id":"run_script","params":{"display_summary":"Run System File Checker","run_script_id":"Run_System_FIle_Checker__SFC__1642471988325","run_script_params":[],"reboot_options":{"auto_reboot":"no"}}}]}.
orgId string yes Organization ID.
action1_delete_automation_action parameters
Param Type Required Default Description
actionId string yes Action ID to remove.
automationId string yes Automation schedule ID.
orgId string yes Organization ID.
action1_delete_automation_schedule parameters
Param Type Required Default Description
automationId string yes Automation schedule ID to delete.
orgId string yes Organization ID.
action1_get_automation_deployment_statuses parameters
Param Type Required Default Description
automationId string yes Automation schedule ID.
orgId string yes Organization ID.
action1_get_automation_endpoint_details parameters
Param Type Required Default Description
endpointId string yes Endpoint ID.
instanceId string yes Automation instance ID.
orgId string yes Organization ID.
action1_get_automation_instance parameters
Param Type Required Default Description
automationId string yes Automation instance ID.
orgId string yes Organization ID.
action1_get_automation_schedule parameters
Param Type Required Default Description
automationId string yes Automation schedule ID.
orgId string yes Organization ID.
action1_list_automation_instances parameters
Param Type Required Default Description
automationHistoryStatus string no null Filter by automation history status. One of: Pending, Stopped, Running, Success, Warning, Error.
completed string no null Filter by completion. Values: yes or no.
endpointId string no null Restrict results to a single endpoint.
filter string no null Optional plain substring filter — NOT a structured grammar.
from integer no null Skip first N records (offset).
orgId string yes Organization ID.
pageSize integer no 50 Results per page (default 50, max 100).
sortBy string no null Optional sort expression (e.g. 'started_at desc'). Action1 sort syntax.
action1_list_automation_results parameters
Param Type Required Default Description
filter string no null Optional plain substring filter — NOT a structured grammar.
from integer no null Skip first N records (offset).
instanceId string yes Automation instance ID.
lastStatus string no null Filter by last per-endpoint status. One of: Pending, Stopped, Running, Success, Warning, Error.
orgId string yes Organization ID.
pageSize integer no 50 Results per page (default 50, max 100).
sortBy string no null Optional sort expression (e.g. 'finished_at desc'). Action1 sort syntax.
action1_list_automation_schedules parameters
Param Type Required Default Description
filter string no null Optional plain substring filter — NOT a structured grammar; matches against schedule name and free-text fields.
from integer no null Skip first N records (offset).
orgId string yes Organization ID. Use action1_list_organizations to discover.
pageSize integer no 50 Results per page (default 50, max 100).
sortBy string no null Optional sort expression (e.g. 'name asc'). Action1 sort syntax.
action1_stop_automation parameters
Param Type Required Default Description
instanceId string yes Automation instance ID to stop.
orgId string yes Organization ID.
action1_update_automation_schedule parameters
Param Type Required Default Description
automationId string yes Automation schedule ID.
fieldsJson string yes JSON body. Send only fields you want to change. Same shape as create_automation_schedule (see action1_create_automation_schedule for the schema, settings grammar, endpoints[]/actions[] shapes, template_id enum, and reboot_options polymorphism).
orgId string yes Organization ID.

Vulnerabilities & CVEs

Tool Plan Access Description
action1_create_vulnerability_remediation Pro Write [Action1] Document a compensating control for a CVE in an organization. Side effect: writes a permanent remediation record. fieldsJson must include both `product_name` (the affected software) and `comment` (description of the control). Both fields are required by Action1's vendor schema.
action1_delete_vulnerability_remediation Pro Destructive [Action1] Delete a remediation record. Side effect: history of compensating controls is lost.
action1_get_cve_description Free Read-only [Action1] Get the global description of a CVE (not org-scoped). Use this when you need the CVE's general details independent of any specific organization's exposure.
action1_get_vulnerability Free Read-only [Action1] Get detailed information for a specific vulnerability within an organization, including affected products and remediation history.
action1_list_vulnerabilities Free Read-only [Action1] List vulnerable software detected on endpoints in an organization. Returns CVE details, severity, and exploit availability. Use action1_list_organizations to find valid orgIds. Use the typed parameters (`score`, `remediationStatus`, `cveIds`, etc.) for structured patch-triage queries; `filter` is a plain substring search.
action1_list_vulnerability_endpoints Free Read-only [Action1] List endpoints affected by a specific CVE within an organization. Use to drill from a CVE down to the affected endpoint set.
action1_list_vulnerability_remediations Free Read-only [Action1] List recorded remediation/compensating-control actions for a specific CVE. Useful for documenting what's already been done before recommending new actions.
action1_update_vulnerability_remediation Pro Write [Action1] Update an existing remediation record. Action1 only allows the `comment` field to be edited; product_name and other fields are fixed at create time. Body shape: {"comment":"Updated explanation..."}.
action1_create_vulnerability_remediation parameters
Param Type Required Default Description
cveId string yes CVE ID.
fieldsJson string yes JSON body. Required fields: `product_name` and `comment`. Example: {"product_name":"Python 3.10 (64-bit)","comment":"Disabled WAN port; firewall rule R5; risk accepted by CISO"}.
orgId string yes Organization ID.
action1_delete_vulnerability_remediation parameters
Param Type Required Default Description
cveId string yes CVE ID.
orgId string yes Organization ID.
remediationId string yes Remediation record ID.
action1_get_cve_description parameters
Param Type Required Default Description
cveId string yes CVE ID (e.g. CVE-2024-12345).
action1_get_vulnerability parameters
Param Type Required Default Description
cveId string yes CVE ID.
orgId string yes Organization ID.
action1_list_vulnerabilities parameters
Param Type Required Default Description
cveIds string no null Comma-separated CVE IDs, e.g. 'CVE-2024-1,CVE-2024-2'. Optional.
endpointId string no null Filter to vulnerabilities affecting this endpoint ID. Optional.
filter string no null Case-insensitive substring; matches if any object field contains this value (Action1's filter is a plain substring search, not a structured query). Optional.
from integer no null Skip first N records (offset).
orgId string yes Organization ID.
pageSize integer no 50 Results per page (default 50, max 100).
publishedDateEnd string no null Latest CVE publish date in 'YYYY-MM-DD' format. Optional.
publishedDateStart string no null Earliest CVE publish date in 'YYYY-MM-DD' format. Optional.
remediationRequiredEndDay string no null Latest remediation-required day number. Optional.
remediationRequiredStartDay string no null Earliest remediation-required day number. Optional.
remediationStatus string no null Filter by remediation state. One of: 'Overdue', 'Due_soon', 'Overdue_due_soon', 'Due_later', 'Control_applied', 'All_except_control_applied'. Optional.
resetCache string no null Force a fresh recompute instead of returning cached results. 'Yes' or 'No'. Optional.
score string no null Filter by CVE severity. One of: 'Critical', 'High', 'Medium', 'Low'. Optional.
sortBy string no null Optional sort expression (e.g. '-score' for highest severity first). Optional.
action1_list_vulnerability_endpoints parameters
Param Type Required Default Description
cveId string yes CVE ID (e.g. CVE-2024-12345).
filter string no null Case-insensitive substring; matches if any object field contains this value (Action1's filter is a plain substring search, not a structured query). Optional.
from integer no null Skip first N records (offset).
orgId string yes Organization ID.
pageSize integer no 50 Results per page (default 50, max 100).
productNames string no null Comma-separated product names to scope the result (e.g. 'Adobe Reader,Mozilla Firefox'). Optional.
sortBy string no null Optional sort expression (e.g. 'name asc'). Optional.
action1_list_vulnerability_remediations parameters
Param Type Required Default Description
cveId string yes CVE ID.
filter string no null Case-insensitive substring; matches if any object field contains this value (Action1's filter is a plain substring search, not a structured query). Optional.
from integer no null Skip first N records (offset). Optional.
orgId string yes Organization ID.
pageSize integer no 50 Results per page (default 50, max 100).
sortBy string no null Optional sort expression (e.g. '-created_at' for newest first). Optional.
action1_update_vulnerability_remediation parameters
Param Type Required Default Description
cveId string yes CVE ID.
fieldsJson string yes JSON body. Only `comment` is editable. Example: {"comment":"Re-validated 2026-04-15; control still in place"}.
orgId string yes Organization ID.
remediationId string yes Remediation record ID.

Audit Trail

Tool Plan Access Description
action1_export_audit_trail Free Read-only [Action1] Export the audit trail as CSV. Returns a short-lived (1 hour) read-only SAS URL to the exported CSV stored in blob storage — fetch the file from the URL, do not interpret the URL as JSON. Hard cap: 100 MB; exports above that fail with HTTP 413, so scope with timefrom/timeto/events to keep the export bounded. Use the optional time/event/filter parameters to scope before exporting.
action1_get_audit_event Free Read-only [Action1] Retrieve full details for a single audit event including before/after values where applicable. Use action1_list_audit_events to discover valid event IDs.
action1_list_audit_events Free Read-only [Action1] List audit trail entries (admin actions, logins, API calls, etc.). Use `events` to comma-separate event names (e.g. 'Login,Remote Connect,POST'), `timefrom`/`timeto` to bound the window, and `fromId` for sequential resume. `filter` is a plain substring search across all event fields.
action1_export_audit_trail parameters
Param Type Required Default Description
events string no null Comma-separated event names to filter by. Examples: 'Login', 'Remote Connect', 'POST', 'PATCH', 'DELETE'. Optional.
filter string no null Case-insensitive substring; matches if any object field contains this value (Action1's filter is a plain substring search, not a structured query). Optional.
format string no null Export format. Action1 currently accepts only 'csv' per spec. Optional; server defaults to 'csv'.
from integer no null Skip first N records (offset). Optional.
fromId string no null Sequential event ID to resume from (vendor key 'from_id'). Optional.
pageSize integer no null Results per page (default 50, max 100). Optional.
sortBy string no null Optional sort expression (e.g. '-time' for newest first). Optional.
timefrom string no null Earliest event timestamp in 'YYYY-MM-DD_HH-MM-SS' format. Optional.
timeto string no null Latest event timestamp in 'YYYY-MM-DD_HH-MM-SS' format. Optional.
action1_get_audit_event parameters
Param Type Required Default Description
id string yes The audit event ID. Use action1_list_audit_events to find valid IDs.
action1_list_audit_events parameters
Param Type Required Default Description
events string no null Comma-separated event names to filter by. Examples: 'Login', 'Remote Connect', 'Remote Disconnect', 'POST', 'PATCH', 'DELETE'. Optional.
filter string no null Case-insensitive substring; matches if any object field contains this value (Action1's filter is a plain substring search, not a structured query). Optional.
from integer no null Skip first N records (offset). Optional.
fromId string no null Sequential event ID to resume from (vendor key 'from_id'); use the largest ID from the previous batch to continue. Optional.
pageSize integer no 50 Results per page (default 50, max 100).
sortBy string no null Optional sort expression (e.g. '-time' for newest first). Optional.
timefrom string no null Earliest event timestamp in 'YYYY-MM-DD_HH-MM-SS' format. Optional.
timeto string no null Latest event timestamp in 'YYYY-MM-DD_HH-MM-SS' format. Optional.

Subscription & Usage

Tool Plan Access Description
action1_get_enterprise_subscription Free Read-only [Action1] Get current Action1 license/subscription details for the enterprise (plan, seat counts, expiration).
action1_get_enterprise_usage Free Read-only [Action1] Get usage statistics for the entire enterprise (cross-organization rollup of agents, automations, etc).
action1_get_organization_usage Free Read-only [Action1] Get usage statistics for a single organization.
action1_get_organizations_usage Free Read-only [Action1] Get usage statistics broken out per organization. Useful for MSP billing and capacity planning across clients.
action1_request_quote Pro Write [Action1] Request a price quote for an Action1 plan. Side effect: contacts Action1 sales. The vendor's `SubscriptionQuotePayload` body requires `endpoint_count`, `comments`, and `product` (the company name to attach to the quote).
action1_request_trial Pro Write [Action1] Request a free trial or trial extension. Side effect: contacts Action1 sales/operations and may schedule the trial seats once approved. The vendor's `SubscriptionPayload` body requires `endpoint_count` (number of seats requested) and `comments` (free-form context for the sales team).
action1_get_organization_usage parameters
Param Type Required Default Description
orgId string yes Organization ID. Use action1_list_organizations to find valid IDs.
action1_get_organizations_usage parameters
Param Type Required Default Description
from integer no null Skip first N records (offset).
pageSize integer no 50 Results per page (default 50, max 100).
action1_request_quote parameters
Param Type Required Default Description
fieldsJson string yes JSON body. Required fields: `endpoint_count` (integer), `comments` (string), `product` (string — your company name as it should appear on the quote). Example: {"endpoint_count":500,"comments":"Annual term, USD invoicing","product":"Contoso MSP"}.
action1_request_trial parameters
Param Type Required Default Description
fieldsJson string yes JSON body. Required fields: `endpoint_count` (integer) and `comments` (string). Example: {"endpoint_count":250,"comments":"Evaluating for SOC2 controls; please extend trial by 14 days."}.

Report Subscriptions

Tool Plan Access Description
action1_create_report_subscription Pro Write [Action1] Create a new email report subscription. Required fields: `name`, `report_id`, `schedule`. `report_id` is enum-restricted to 'daily_patch_statistics' or 'weekly_patch_statistics' — you cannot subscribe to a custom report. `schedule` is a single string in the form '(ENABLED|DISABLED) WEEKLY:Sun|Mon|Tue|Wed|Thu|Fri|Sat AT:HH-MM-SS' (note: time uses DASHES, not colons; weekdays are 3-letter capitalized). Delivery is HTML-only — any `format` value the agent supplies is silently ignored.
action1_delete_report_subscription Pro Destructive [Action1] Cancel a scheduled report subscription.
action1_list_report_subscriptions Free Read-only [Action1] List the current user's scheduled email-report subscriptions. Hard cap: only the two patch-statistics reports ('daily_patch_statistics' and 'weekly_patch_statistics') are subscribable — custom reports cannot be subscribed to. Delivery is HTML-only; the vendor ignores any `format` value.
action1_update_report_subscription Pro Write [Action1] Update an existing email report subscription. Only include fields you want to change. Same field rules as create — `report_id` is enum-restricted to 'daily_patch_statistics' or 'weekly_patch_statistics'; `schedule` follows the format '(ENABLED|DISABLED) WEEKLY:Sun|Mon|Tue|Wed|Thu|Fri|Sat AT:HH-MM-SS' (DASHES in time, 3-letter capitalized weekdays). Delivery remains HTML-only regardless of any `format` value.
action1_create_report_subscription parameters
Param Type Required Default Description
fieldsJson string yes JSON body. Required fields: `name`, `report_id` ('daily_patch_statistics' or 'weekly_patch_statistics'), `schedule`. Example: {"name":"Mon morning patch summary","report_id":"weekly_patch_statistics","schedule":"ENABLED WEEKLY:Mon AT:04-00-00"}.
action1_delete_report_subscription parameters
Param Type Required Default Description
subscriptionId string yes Subscription ID to cancel.
action1_list_report_subscriptions parameters
Param Type Required Default Description
from integer no null Skip first N records (offset). Optional.
pageSize integer no 50 Results per page (default 50, max 100).
action1_update_report_subscription parameters
Param Type Required Default Description
fieldsJson string yes JSON body. Only include changed fields. Example schedule change: {"schedule":"ENABLED WEEKLY:Fri AT:18-30-00"}. Example name + schedule: {"name":"Friday close-out","schedule":"ENABLED WEEKLY:Fri AT:17-00-00"}.
subscriptionId string yes Subscription ID.
Tool Plan Access Description
action1_search Free Read-only [Action1] Universal case-insensitive substring search across multiple resource types (reports, endpoints, and App Store applications) within a specific organization. Returns up to 10 results by default. Useful as a first hop when you have a hostname, app name, or report keyword but no IDs. Use action1_list_organizations to find a valid orgId.
action1_search parameters
Param Type Required Default Description
limit integer no null Maximum number of results to return. Action1 caps at 10 by default. Optional.
orgId string yes The Action1 organization ID (GUID) to search within. Use action1_list_organizations to find valid IDs.
query string yes Search query string. Matches reports, endpoint hostnames, and App Store apps within the org.

Diagnostics

Tool Plan Access Description
action1_get_diagnostic_logs Free Read-only [Action1] Retrieve diagnostic log entries for a specific organization. Covers agent issues, deployment failures, and automation problems. Use `level` to suppress chatty Debug/Normal entries when triaging incidents, and `sortBy='-time'` for newest first. Use action1_list_organizations to find a valid orgId.
action1_get_diagnostic_logs parameters
Param Type Required Default Description
from integer no null Skip first N records (offset). Optional.
level string no null Minimum log level. One of: 'Debug', 'Normal', 'Internal', 'Important', 'Error'. Optional.
orgId string yes The Action1 organization ID (GUID). Use action1_list_organizations to find valid IDs.
pageSize integer no 50 Results per page (default 50, max 100).
sortBy string no null Sort expression (e.g. '-time' for newest first). Optional.

Analytics

Tool Plan Access Description
action1_automation_success_rate Pro Read-only [Action1] Combines automation instances with their endpoint results to compute success vs failure rate per organization. Use to spot trending automation failures.
action1_endpoint_health_rollup Pro Read-only [Action1] Combines endpoints, missing updates, and vulnerabilities into a single org-level health snapshot. Useful as the entry point for endpoint-health reporting.
action1_patch_compliance_summary Pro Read-only [Action1] Combines endpoint inventory and missing-updates data for a single organization to show patch posture (% endpoints up to date, top missing patches).
action1_software_inventory_rollup Pro Read-only [Action1] Cross-organization installed-software rollup. Pages through every org's installed-software list; useful for shadow-IT discovery and license consolidation. Hard ceiling on fan-out is 50 orgs; the response includes `truncated` and `totalOrganizationsAvailable`.
action1_summarize_vulnerabilities Pro Read-only [Action1] Cross-organization rollup of vulnerabilities. Pages through every org the credential can see (no silent first-page truncation) and aggregates CVE counts per org. Hard ceiling on fan-out is 50 orgs; pass `topOrgs` to lower this. The response includes `truncated` (boolean) and `totalOrganizationsAvailable` so the agent can detect partial coverage.
action1_top_vulnerable_endpoints Pro Read-only [Action1] Cross-organization ranking of vulnerabilities. Pages through every org and aggregates CVE counts. Hard ceiling on fan-out is 50 orgs; the response includes `truncated` and `totalOrganizationsAvailable` so the agent knows whether it saw the full set.
action1_automation_success_rate parameters
Param Type Required Default Description
orgId string yes Organization ID.
action1_endpoint_health_rollup parameters
Param Type Required Default Description
orgId string yes Organization ID.
action1_patch_compliance_summary parameters
Param Type Required Default Description
orgId string yes Organization ID.
action1_software_inventory_rollup parameters
Param Type Required Default Description
maxOrgs integer no null Optional cap on number of organizations to fan out to. Default 50 (hard maximum).
topN integer no 50 How many top applications to return (default 50). Affects the ranked output, not fan-out scope.
action1_summarize_vulnerabilities parameters
Param Type Required Default Description
topOrgs integer no null Optional: cap the rollup at the first N organizations. Hard maximum is 50. Useful for quick scans on large enterprises.
action1_top_vulnerable_endpoints parameters
Param Type Required Default Description
maxOrgs integer no null Optional cap on number of organizations to fan out to. Default 50 (hard maximum).
topN integer no 20 How many top results to surface (default 20). Affects the ranked output, not fan-out scope.