read thedocs.

[ docs // guides & reference ]

Connector setup guides, tool references, auth flows, and platform concepts — everything you need to run StackJack, in one place.

Browse the Docs All Connectors
34 connectors documented // 6,712 tools referenced // setup, auth & platform guides
↓

No pages match that search. Clear it

← All documentation

Huntress Tools

huntress_ · 92 tools · Free 55 · Pro 37 Huntress managed-detection API; raw JSON passthrough.

Account

Tool Plan Access Description
huntress_get_account Free Read-only [Huntress] Get the Huntress account associated with the current API credentials — name, subdomain, status, and high-level account metadata. Use this to confirm which account the key is operating against before drilling into agents, organizations, or billing with huntress_list_organizations / huntress_list_invoices.
huntress_get_actor Free Read-only [Huntress] Get the actor for the current API credentials — the set of entities (account, organizations, permissions) the key is authorized to act as. Use this to understand the effective scope and access of the credentials before making scoped calls.

Agents

Tool Plan Access Description
huntress_get_agent Free Read-only [Huntress] Get a single Huntress agent by its numeric ID — full host detail, OS, platform, version, last-seen, and organization. Discover agent IDs via huntress_list_agents.
huntress_isolate_agent Pro Write [Huntress] Network-isolate a Huntress agent's endpoint, cutting it off from the network except for Huntress communication. Optionally provide a reason and request strict isolation. Discover agent IDs via huntress_list_agents; reverse with huntress_release_agent_isolation.
huntress_list_agents Free Read-only [Huntress] List Huntress agents (deployed endpoint sensors) across the account. Returns a paginated list with host, OS, platform, version, and organization. Filter by organization, platform, hostname, OS, or version. Use huntress_get_agent for full detail on one agent, and huntress_list_organizations to discover organizationId values.
huntress_release_agent_isolation Pro Write [Huntress] Release network isolation on a Huntress agent's endpoint, restoring normal network connectivity. Reverses huntress_isolate_agent. Discover agent IDs via huntress_list_agents.
huntress_uninstall_agent Pro Destructive [Huntress] Uninstall the Huntress agent from an endpoint. This is an asynchronous, IRREVERSIBLE action — the sensor is removed and monitoring stops; reinstalling requires a fresh deployment. Discover agent IDs via huntress_list_agents.
huntress_update_agent Pro Write [Huntress] Update a Huntress agent — set its tags and/or tamper-protection-configured flag. Tags are supplied as a comma-separated list and replace the agent's existing tags. Discover agent IDs via huntress_list_agents.
huntress_get_agent parameters
Param Type Required Default Description
id integer yes Numeric agent ID (from huntress_list_agents).
huntress_isolate_agent parameters
Param Type Required Default Description
fieldsJson string no null Additional body fields as a JSON object, merged into the request.
id integer yes Numeric agent ID to isolate (from huntress_list_agents).
reason string no null Optional human-readable reason for the isolation.
strictIsolation boolean no null When true, request strict isolation (tighter lockdown).
huntress_list_agents parameters
Param Type Required Default Description
hostname string no null Filter by hostname (exact match).
limit integer no 50 Max results per page (default 50, capped at 500 by the API).
organizationId integer no null Filter to a single organization ID (from huntress_list_organizations).
os string no null Filter by operating system string.
pageToken string no null Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
platform string no null Filter by platform: windows|darwin|linux.
sortDirection string no null Sort direction: asc|desc. Omit for default ordering.
sortField string no null Field to sort by: id|created_at|updated_at. Omit for default ordering.
version string no null Filter by agent version string.
huntress_release_agent_isolation parameters
Param Type Required Default Description
id integer yes Numeric agent ID to release from isolation (from huntress_list_agents).
huntress_uninstall_agent parameters
Param Type Required Default Description
id integer yes Numeric agent ID to uninstall (from huntress_list_agents).
huntress_update_agent parameters
Param Type Required Default Description
fieldsJson string no null Additional body fields as a JSON object, merged into the request.
id integer yes Numeric agent ID to update (from huntress_list_agents).
tags string no null Comma-separated list of tags to set on the agent (replaces existing tags).
tamperProtectionConfigured boolean no null When true, mark tamper protection as configured for this agent.

Identities

Tool Plan Access Description
huntress_get_identity Free Read-only [Huntress] Get a single ITDR identity by its numeric ID — full user detail, risk level, MFA status, and tenant. Discover identity IDs via huntress_list_identities.
huntress_list_identities Free Read-only [Huntress] List ITDR identities (Microsoft 365 / Google Workspace users) monitored by Huntress. Returns a paginated list with risk level, MFA status, billable/enabled/external flags, and tenant. Filter by organization, tenant type, billable, enabled, external, risk level, or MFA status. Use huntress_get_identity for full detail on one identity.
huntress_get_identity parameters
Param Type Required Default Description
id integer yes Numeric identity ID (from huntress_list_identities).
huntress_list_identities parameters
Param Type Required Default Description
billable boolean no null Filter by billable status (true|false).
enabled boolean no null Filter by enabled status (true|false).
external boolean no null Filter by external status (true|false).
limit integer no 50 Max results per page (default 50, capped at 500 by the API).
mfaEnabled boolean no null Filter by MFA-enabled status (true|false).
organizationId integer no null Filter to a single organization ID (from huntress_list_organizations).
pageToken string no null Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
riskLevel string no null Filter by risk level: none|low|medium|high.
tenantType string no null Filter by tenant type: microsoft_365|google_workspace.

Incident Reports

Tool Plan Access Description
huntress_approve_remediations Pro Write [Huntress] Approve the remediations recommended for a Huntress incident report, authorizing Huntress to apply them. This is a bodyless action — the Huntress API approves all pending remediations for the report and takes no parameters beyond the report ID. Discover incident report IDs via huntress_list_incident_reports and remediations via huntress_list_remediations.
huntress_get_incident_report Free Read-only [Huntress] Get a single incident report by its numeric ID — full threat detail, indicators, severity, status, and SOC narrative. Discover report IDs via huntress_list_incident_reports; see remediation steps with huntress_list_remediations.
huntress_get_remediation Free Read-only [Huntress] Get a single remediation by its ID, scoped to its parent incident report — full remediation detail, type, and status. Discover remediation IDs via huntress_list_remediations.
huntress_list_incident_reports Free Read-only [Huntress] List incident reports — confirmed threats triaged by the Huntress SOC. Returns a paginated list with indicator type, status, severity, platform, and the affected organization/agent. Filter by indicator type, status, severity, platform, organization, or agent. Use huntress_get_incident_report for full detail, and huntress_list_remediations to see the remediation steps for a report.
huntress_list_remediations Free Read-only [Huntress] List the remediations attached to a specific incident report — the recommended or applied remediation steps (assisted, manual, or containment). Filter by remediation type or status. Paginated: when more pages exist, read next_page_token from the response's pagination object and pass it as pageToken. Use huntress_get_remediation for one remediation's full detail; discover incident report IDs via huntress_list_incident_reports.
huntress_reject_remediations Pro Write [Huntress] Reject the remediations recommended for a Huntress incident report, declining to apply them. The Huntress API REQUIRES comment and useful. Discover incident report IDs via huntress_list_incident_reports and remediations via huntress_list_remediations.
huntress_resolve_incident_report Pro Write [Huntress] Resolve a Huntress incident report. This is a bodyless action — the Huntress API takes no parameters beyond the report ID. Discover incident report IDs via huntress_list_incident_reports.
huntress_approve_remediations parameters
Param Type Required Default Description
incidentReportId integer yes Numeric incident report ID whose remediations to approve (from huntress_list_incident_reports).
huntress_get_incident_report parameters
Param Type Required Default Description
id integer yes Numeric incident report ID (from huntress_list_incident_reports).
huntress_get_remediation parameters
Param Type Required Default Description
incidentReportId integer yes Numeric incident report ID the remediation belongs to (from huntress_list_incident_reports).
remediationId integer yes Numeric remediation ID (from huntress_list_remediations).
huntress_list_incident_reports parameters
Param Type Required Default Description
agentId integer no null Filter to a single agent ID (from huntress_list_agents).
indicatorType string no null Filter by indicator type: footholds|monitored_files|ransomware_canaries|antivirus_detections|process_detections|managed_identity|mde_detections|siem_detections|favicon_detections|behavioral_detections|email_security_detections|app_control|ai_misuse.
limit integer no 50 Max results per page (default 50, capped at 500 by the API).
organizationId integer no null Filter to a single organization ID (from huntress_list_organizations).
pageToken string no null Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
platform string no null Filter by platform: windows|darwin|microsoft_365|google|linux|email_security|other.
severity string no null Filter by severity: low|high|critical.
sortDirection string no null Sort direction: asc|desc. Omit for default ordering.
sortField string no null Field to sort by: id|created_at|updated_at. Omit for default ordering.
status string no null Filter by status: sent|closed|dismissed|auto_remediating|deleting|partner_dismissed.
huntress_list_remediations parameters
Param Type Required Default Description
incidentReportId integer yes Numeric incident report ID the remediations belong to (from huntress_list_incident_reports).
limit integer no 50 Max results per page (default 50, capped at 500 by the API).
pageToken string no null Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
sortDirection string no null Sort direction: asc|desc. Omit for default ordering.
sortField string no null Field to sort by: id|created_at|updated_at. Omit for default ordering.
statuses string no null Filter by comma-separated statuses: unapproved|approved|completed|failed|cancelled.
types string no null Filter by comma-separated remediation types: assisted|manual|containment.
huntress_reject_remediations parameters
Param Type Required Default Description
comment string yes Why the remediations were rejected. Required. Helps the Huntress SOC fix the plan and re-issue the incident report.
email string no null Email for the Huntress SOC to contact. Falls back to the API key's user if omitted.
fieldsJson string no null Additional body fields as a JSON object, merged into the request after the typed fields.
incidentReportId integer yes Numeric incident report ID whose remediations to reject (from huntress_list_incident_reports).
name string no null Name of the user rejecting. Falls back to the API key's user if omitted.
phoneNumber string no null Phone number for the Huntress SOC to contact. Falls back to the API key's user if omitted.
useful boolean yes Whether the remediation plan was useful. Required.
huntress_resolve_incident_report parameters
Param Type Required Default Description
id integer yes Numeric incident report ID to resolve (from huntress_list_incident_reports).

Escalations

Tool Plan Access Description
huntress_get_escalation Free Read-only [Huntress] Get a single escalation by its numeric ID — full detail, severity, status, due date, and the related organization. Discover escalation IDs via huntress_list_escalations.
huntress_list_escalations Free Read-only [Huntress] List escalations — items the Huntress SOC has escalated to the partner for action. Returns a paginated list with status, severity, subtype, due date, and organization. Filter by status, severity, subtype, or organization. Use huntress_get_escalation for full detail on one escalation.
huntress_resolve_escalation Pro Write [Huntress] Resolve a Huntress escalation by recording a determination (expected vs unauthorized) and the scope it applies to (account, organization, or identity). Discover escalation IDs via huntress_list_escalations.
huntress_get_escalation parameters
Param Type Required Default Description
id integer yes Numeric escalation ID (from huntress_list_escalations).
huntress_list_escalations parameters
Param Type Required Default Description
limit integer no 50 Max results per page (default 50, capped at 500 by the API).
organizationId integer no null Filter to a single organization ID (from huntress_list_organizations).
pageToken string no null Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
severity string no null Filter by severity: low|high|critical.
sortDirection string no null Sort direction: asc|desc. Omit for default ordering.
sortField string no null Field to sort by: id|severity|due_at|created_at|updated_at. Omit for default ordering.
status string no null Filter by status: open|overdue|resolved.
subtype string no null Filter by escalation subtype.
huntress_resolve_escalation parameters
Param Type Required Default Description
determination string no null Determination: expected|unauthorized.
fieldsJson string no null Additional body fields as a JSON object, merged into the request.
id integer yes Numeric escalation ID to resolve (from huntress_list_escalations).
scope string no null Scope the determination applies to: account|organization|identity.

Platform Actions

Tool Plan Access Description
huntress_get_platform_action Free Read-only [Huntress] Get a single platform action by its numeric ID — full detail, severity, status, and the related organization. Discover platform action IDs via huntress_list_platform_actions.
huntress_list_platform_actions Free Read-only [Huntress] List platform actions — actions requested or taken on the Huntress platform. Returns a paginated list with status, severity, subtype, and organization. Filter by status, severity, subtype, or organization. Use huntress_get_platform_action for full detail on one action.
huntress_get_platform_action parameters
Param Type Required Default Description
id integer yes Numeric platform action ID (from huntress_list_platform_actions).
huntress_list_platform_actions parameters
Param Type Required Default Description
limit integer no 50 Max results per page (default 50, capped at 500 by the API).
organizationId integer no null Filter to a single organization ID (from huntress_list_organizations).
pageToken string no null Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
severity string no null Filter by severity: low|high|critical.
sortDirection string no null Sort direction: asc|desc. Omit for default ordering.
sortField string no null Field to sort by: id|severity|due_at|created_at|updated_at. Omit for default ordering.
status string no null Filter by status: open|overdue|resolved.
subtype string no null Filter by platform action subtype.

Signals

Tool Plan Access Description
huntress_get_signal Free Read-only [Huntress] Get a single security signal by its numeric ID — full detail, type, status, related entity, and investigation timeline. Discover signal IDs via huntress_list_signals.
huntress_list_signals Free Read-only [Huntress] List security signals — investigated detections tied to entities (users, mailboxes, agents, identities). Returns a paginated list with status, type, the related entity, and investigation timestamps. Filter by investigated-at window, entity, organization, type, or status. Use huntress_get_signal for full detail on one signal.
huntress_get_signal parameters
Param Type Required Default Description
id integer yes Numeric signal ID (from huntress_list_signals).
huntress_list_signals parameters
Param Type Required Default Description
entityId string no null Filter to a single entity ID. Must be paired with entityType.
entityType string no null Filter by entity type: user_entity|source|mailbox|service_principal|agent|identity. Required when entityId is supplied.
investigatedAtMax string no null Filter to signals investigated at or before this ISO-8601 timestamp.
investigatedAtMin string no null Filter to signals investigated at or after this ISO-8601 timestamp.
limit integer no 50 Max results per page (default 50, capped at 500 by the API).
organizationId integer no null Filter to a single organization ID (from huntress_list_organizations).
pageToken string no null Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
sortDirection string no null Sort direction: asc|desc. Omit for default ordering.
sortField string no null Field to sort by: id|created_at|updated_at|status. Omit for default ordering.
statuses string no null Filter by comma-separated statuses: reported|closed.
types string no null Filter by comma-separated signal types.

Organizations

Tool Plan Access Description
huntress_create_organization Pro Write [Huntress] Create a new organization within the Huntress account. Both name and key are REQUIRED by the Huntress API. List existing organizations via huntress_list_organizations.
huntress_delete_organization Pro Destructive [Huntress] Delete a Huntress organization. This is IRREVERSIBLE — the organization and its associations are removed. Discover organization IDs via huntress_list_organizations.
huntress_get_organization Free Read-only [Huntress] Get a single organization by its numeric ID — full detail, name, key, and metadata. Discover organization IDs via huntress_list_organizations.
huntress_list_organizations Free Read-only [Huntress] List the customer organizations under the account. Returns a paginated list with name, key, and metadata. The organization `id` returned here is the `organizationId` filter used across huntress_list_agents, huntress_list_identities, huntress_list_incident_reports, huntress_list_signals, and more. Filter by name or key; use huntress_get_organization for full detail.
huntress_update_organization Pro Write [Huntress] Update a Huntress organization — rename it. Discover organization IDs via huntress_list_organizations.
huntress_create_organization parameters
Param Type Required Default Description
fieldsJson string no null Additional body fields as a JSON object, merged into the request after the typed fields.
key string yes Unique key/identifier for the new organization. Required.
name string yes Name for the new organization. Required.
huntress_delete_organization parameters
Param Type Required Default Description
id integer yes Numeric organization ID to delete (from huntress_list_organizations).
huntress_get_organization parameters
Param Type Required Default Description
id integer yes Numeric organization ID (from huntress_list_organizations).
huntress_list_organizations parameters
Param Type Required Default Description
key string no null Filter by organization key.
limit integer no 50 Max results per page (default 50, capped at 500 by the API).
name string no null Filter by organization name.
pageToken string no null Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
sortDirection string no null Sort direction: asc|desc. Omit for default ordering.
sortField string no null Field to sort by: id|created_at|updated_at|name|key. Omit for default ordering.
huntress_update_organization parameters
Param Type Required Default Description
fieldsJson string no null Additional body fields as a JSON object, merged into the request.
id integer yes Numeric organization ID to update (from huntress_list_organizations).
name string no null New name for the organization.

Memberships

Tool Plan Access Description
huntress_create_membership Pro Write [Huntress] Invite a user to the Huntress account by creating a membership. The Huntress API REQUIRES email, first name, last name, and permissions. Optionally scope the membership to an organization. List existing memberships via huntress_list_memberships.
huntress_delete_membership Pro Destructive [Huntress] Delete a Huntress membership, revoking the member's access to the account. This is IRREVERSIBLE — it removes the membership but does NOT delete the underlying user. Discover membership IDs via huntress_list_memberships.
huntress_get_membership Free Read-only [Huntress] Get a single membership by its numeric ID — full detail, the user, organization, and permission role. Discover membership IDs via huntress_list_memberships.
huntress_list_memberships Free Read-only [Huntress] List memberships — the user-to-organization access grants and their permission roles. Returns a paginated list with user, organization, and permissions. Filter by organization, user, or permission role. Use huntress_get_membership for full detail on one membership.
huntress_update_membership Pro Write [Huntress] Update a Huntress membership — change the member's permissions. Discover membership IDs via huntress_list_memberships.
huntress_create_membership parameters
Param Type Required Default Description
email string yes Email address of the user to invite. Required.
fieldsJson string no null Additional body fields as a JSON object, merged into the request after the typed fields.
firstName string yes First name of the user. Required.
lastName string yes Last name of the user. Required.
organizationId integer no null Optional organization ID to scope the membership to (from huntress_list_organizations).
permissions string yes Permissions to grant the new member. Required. One of: Admin, Security Engineer, User, Read-only, Finance, Marketing, Provisioner.
huntress_delete_membership parameters
Param Type Required Default Description
id integer yes Numeric membership ID to delete (from huntress_list_memberships).
huntress_get_membership parameters
Param Type Required Default Description
id integer yes Numeric membership ID (from huntress_list_memberships).
huntress_list_memberships parameters
Param Type Required Default Description
limit integer no 50 Max results per page (default 50, capped at 500 by the API).
organizationId integer no null Filter to a single organization ID (from huntress_list_organizations).
pageToken string no null Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
permissions string no null Filter by permission role: Admin|Security Engineer|User|Read-only|Finance|Marketing|Provisioner.
sortDirection string no null Sort direction: asc|desc. Omit for default ordering.
sortField string no null Field to sort by: id|user_id|created_at|updated_at. Omit for default ordering.
userId integer no null Filter to a single user ID.
huntress_update_membership parameters
Param Type Required Default Description
fieldsJson string no null Additional body fields as a JSON object, merged into the request.
id integer yes Numeric membership ID to update (from huntress_list_memberships).
permissions string no null New permissions to set for the member.

Invoices

Tool Plan Access Description
huntress_get_invoice Free Read-only [Huntress] Get a single invoice by its numeric ID — full billing detail, status, line items, and amounts. Discover invoice IDs via huntress_list_invoices.
huntress_list_invoices Free Read-only [Huntress] List billing invoices for the account. Returns a paginated list with status, amounts, and usage flags. Filter by status or whether the invoice has usage. Use huntress_get_invoice for full detail on one invoice.
huntress_get_invoice parameters
Param Type Required Default Description
id integer yes Numeric invoice ID (from huntress_list_invoices).
huntress_list_invoices parameters
Param Type Required Default Description
hasUsage boolean no null Filter to invoices that have (true) or do not have (false) usage.
limit integer no 50 Max results per page (default 50, capped at 500 by the API).
pageToken string no null Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
sortDirection string no null Sort direction: asc|desc. Omit for default ordering.
sortField string no null Field to sort by: id|created_at|updated_at|status. Omit for default ordering.
status string no null Filter by status: open|paid|failed|partial_refund|full_refund|draft|voided|processing.

External Recon

Tool Plan Access Description
huntress_get_external_port Free Read-only [Huntress] Get a single External Recon port finding by its numeric ID — full detail, protocol, port, service, and risk classification. Discover finding IDs via huntress_list_external_ports.
huntress_list_external_ports Free Read-only [Huntress] List externally-discovered open ports and exposed services found by Huntress External Recon. Returns a paginated list with protocol, port, service, and risky-service flag. Filter by organization, protocol, port, risky-service, or service name. Use huntress_get_external_port for full detail on one finding.
huntress_get_external_port parameters
Param Type Required Default Description
id integer yes Numeric external port finding ID (from huntress_list_external_ports).
huntress_list_external_ports parameters
Param Type Required Default Description
limit integer no 50 Max results per page (default 50, capped at 500 by the API).
organizationId integer no null Filter to a single organization ID (from huntress_list_organizations).
pageToken string no null Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
port integer no null Filter to a single port number.
protocol string no null Filter by protocol: TCP|UDP.
riskyService boolean no null Filter to only risky (true) or non-risky (false) services.
service string no null Filter by service name.
sortDirection string no null Sort direction: asc|desc. Omit for default ordering.
sortField string no null Field to sort by: id|port|protocol|created_at|updated_at. Omit for default ordering.

Summary Reports

Tool Plan Access Description
huntress_get_report Free Read-only [Huntress] Get a single summary report by its numeric ID — full report detail, type, period, and the related organization. Discover report IDs via huntress_list_reports.
huntress_list_reports Free Read-only [Huntress] List summary reports — periodic monthly/quarterly/yearly account and organization summaries. Returns a paginated list with report type, period, and organization. Filter by period window, organization, or report type. Use huntress_get_report for full detail on one report.
huntress_get_report parameters
Param Type Required Default Description
id integer yes Numeric summary report ID (from huntress_list_reports).
huntress_list_reports parameters
Param Type Required Default Description
limit integer no 50 Max results per page (default 50, capped at 500 by the API).
organizationId integer no null Filter to a single organization ID (from huntress_list_organizations).
pageToken string no null Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
periodMax string no null Filter to reports whose period is at or before this ISO-8601 timestamp.
periodMin string no null Filter to reports whose period is at or after this ISO-8601 timestamp.
sortDirection string no null Sort direction: asc|desc. Omit for default ordering.
sortField string no null Field to sort by: id|created_at|updated_at. Omit for default ordering.
type string no null Filter by report type: monthly_summary|quarterly_summary|yearly_summary.

Unwanted Access Rules

Tool Plan Access Description
huntress_create_unwanted_access_rule Pro Write [Huntress] Create an unwanted-access rule that classifies identity sign-ins as expected or unauthorized. The Huntress API REQUIRES type (expected|unauthorized). Set an optional category (country|vpn) and its match (countryCode or vpn), the matching logic, an active window (startsAt/expiresAt), and notes. List existing rules via huntress_list_unwanted_access_rules.
huntress_delete_unwanted_access_rule Pro Destructive [Huntress] Delete an unwanted-access rule. This is IRREVERSIBLE — the rule is removed and no longer classifies sign-ins. Discover rule IDs via huntress_list_unwanted_access_rules.
huntress_get_unwanted_access_rule Free Read-only [Huntress] Get a single unwanted access rule by its numeric ID — full detail, type, status, scope, category, and matching logic. Discover rule IDs via huntress_list_unwanted_access_rules.
huntress_list_known_vpns Free Read-only [Huntress] List the reference catalog of known VPN providers recognized by Huntress ITDR. Returns the full list (no pagination, no parameters). Use these VPN identifiers when interpreting or building vpn-category unwanted access rules (see huntress_list_unwanted_access_rules).
huntress_list_unwanted_access_rules Free Read-only [Huntress] List unwanted access rules — ITDR location/VPN access policies that flag expected vs. unauthorized sign-in sources. Returns a paginated list with type, status, scope, category, and matching logic. Filter by organization, identity, type, status, scope, category, country code, VPN, or logic. Use huntress_get_unwanted_access_rule for full detail, and huntress_list_known_vpns for the VPN reference list.
huntress_update_unwanted_access_rule Pro Write [Huntress] Update an unwanted-access rule. Only the active window (startsAt/expiresAt) and notes can be changed. Discover rule IDs via huntress_list_unwanted_access_rules.
huntress_create_unwanted_access_rule parameters
Param Type Required Default Description
category string no null Rule category: country|vpn.
countryCode string no null Country code to match when category=country.
expiresAt string no null ISO-8601 timestamp when the rule expires.
fieldsJson string no null Additional body fields as a JSON object, merged into the request.
identityId integer no null Limit the rule to a single identity ID (from huntress_list_identities).
logic string no null Matching logic: standard|catchall|catchall_exception.
notes string no null Free-text notes for the rule.
organizationId integer no null Limit the rule to a single organization ID (from huntress_list_organizations).
startsAt string no null ISO-8601 timestamp when the rule becomes active.
type string yes Rule type. Required. One of: expected|unauthorized.
vpn string no null VPN to match when category=vpn (from huntress_list_known_vpns).
huntress_delete_unwanted_access_rule parameters
Param Type Required Default Description
id integer yes Numeric rule ID to delete (from huntress_list_unwanted_access_rules).
huntress_get_unwanted_access_rule parameters
Param Type Required Default Description
id integer yes Numeric unwanted access rule ID (from huntress_list_unwanted_access_rules).
huntress_list_unwanted_access_rules parameters
Param Type Required Default Description
category string no null Filter by category: country|vpn.
countryCode string no null Filter by ISO country code (for country-category rules).
identityId integer no null Filter to a single identity ID (from huntress_list_identities).
limit integer no 50 Max results per page (default 50, capped at 500 by the API).
logic string no null Filter by matching logic: standard|catchall|catchall_exception.
organizationId integer no null Filter to a single organization ID (from huntress_list_organizations).
pageToken string no null Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
scope string no null Filter by scope: account|organization|identity.
status string no null Filter by status: active|scheduled|expired.
type string no null Filter by rule type: expected|unauthorized.
vpn string no null Filter by VPN provider (for vpn-category rules).
huntress_update_unwanted_access_rule parameters
Param Type Required Default Description
expiresAt string no null ISO-8601 timestamp when the rule expires.
fieldsJson string no null Additional body fields as a JSON object, merged into the request.
id integer yes Numeric rule ID to update (from huntress_list_unwanted_access_rules).
notes string no null Free-text notes for the rule.
startsAt string no null ISO-8601 timestamp when the rule becomes active.

Managed Accounts (Reseller)

Tool Plan Access Description
huntress_approve_managed_account_remediations Pro Write [Huntress] Approve remediations for an incident report within a reseller-managed account selected by accountId. This is a bodyless action — the Huntress API approves all pending remediations for the report and takes no parameters beyond the path identifiers. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.
huntress_create_managed_account Pro Write [Huntress] Create a new reseller-managed account. The Huntress API REQUIRES name, subdomain, phone number, and an initial admin user (first name, last name, email). Requires reseller-level API credentials.
huntress_create_managed_account_membership Pro Write [Huntress] Invite a user (create a membership) within a reseller-managed account selected by accountId. The Huntress API REQUIRES email, first name, last name, and permissions. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.
huntress_create_managed_account_organization Pro Write [Huntress] Create an organization within a reseller-managed account selected by accountId. The Huntress API REQUIRES name and key. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.
huntress_delete_managed_account_membership Pro Destructive [Huntress] Delete a user membership within a reseller-managed account selected by accountId. This removes the membership only; it does not delete the user. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.
huntress_delete_managed_account_organization Pro Destructive [Huntress] Delete an organization within a reseller-managed account selected by accountId. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.
huntress_disable_managed_account Pro Destructive [Huntress] PERMANENTLY disable a reseller-managed account. This is irreversible: it disables the account and uninstalls ALL of its agents after 10 days. Requires reseller-level API credentials.
huntress_get_managed_account Free Read-only [Huntress] Get a single reseller-managed account by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.
huntress_get_managed_account_agent Free Read-only [Huntress] Get a single agent within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.
huntress_get_managed_account_external_port Free Read-only [Huntress] Get a single external-recon open port within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.
huntress_get_managed_account_incident_report Free Read-only [Huntress] Get a single incident report within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.
huntress_get_managed_account_invoice Free Read-only [Huntress] Get a single invoice for a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.
huntress_get_managed_account_membership Free Read-only [Huntress] Get a single membership within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.
huntress_get_managed_account_organization Free Read-only [Huntress] Get a single organization within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.
huntress_get_managed_account_remediation Free Read-only [Huntress] Get a single remediation for an incident report within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.
huntress_get_managed_account_report Free Read-only [Huntress] Get a single summary report within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.
huntress_get_managed_account_signal Free Read-only [Huntress] Get a single investigation signal within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.
huntress_isolate_managed_account_agent Pro Write [Huntress] Network-isolate an agent within a reseller-managed account selected by accountId. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.
huntress_list_managed_account_agents Free Read-only [Huntress] List deployed agents within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.
huntress_list_managed_account_external_ports Free Read-only [Huntress] List external-recon open ports discovered within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.
huntress_list_managed_account_incident_reports Free Read-only [Huntress] List incident reports within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.
huntress_list_managed_account_invoices Free Read-only [Huntress] List invoices for a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.
huntress_list_managed_account_memberships Free Read-only [Huntress] List user memberships within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.
huntress_list_managed_account_organizations Free Read-only [Huntress] List organizations within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.
huntress_list_managed_account_remediations Free Read-only [Huntress] List remediations for an incident report within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated: when more pages exist, read next_page_token from the response's pagination object and pass it as pageToken.
huntress_list_managed_account_reports Free Read-only [Huntress] List summary reports within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.
huntress_list_managed_account_signals Free Read-only [Huntress] List investigation signals within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.
huntress_list_managed_accounts Free Read-only [Huntress] List the reseller-managed accounts available to the current credentials. Use this to discover the accountId required by every other Managed Account tool. Requires reseller-level API credentials. Paginated.
huntress_reject_managed_account_remediations Pro Write [Huntress] Reject remediations for an incident report within a reseller-managed account selected by accountId. The Huntress API REQUIRES comment and useful. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.
huntress_release_managed_account_agent_isolation Pro Write [Huntress] Release network isolation on an agent within a reseller-managed account selected by accountId. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.
huntress_resolve_managed_account_incident_report Pro Write [Huntress] Resolve an incident report within a reseller-managed account selected by accountId. This is a bodyless action — the Huntress API takes no parameters beyond the path identifiers. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.
huntress_uninstall_managed_account_agent Pro Destructive [Huntress] Uninstall an agent within a reseller-managed account selected by accountId. This is an asynchronous, irreversible removal of the agent. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.
huntress_update_managed_account Pro Write [Huntress] Update a reseller-managed account. Requires reseller-level API credentials.
huntress_update_managed_account_agent Pro Write [Huntress] Update an agent within a reseller-managed account selected by accountId (tags, tamper-protection config). Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.
huntress_update_managed_account_membership Pro Write [Huntress] Update a user membership's permissions within a reseller-managed account selected by accountId. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.
huntress_update_managed_account_organization Pro Write [Huntress] Update an organization within a reseller-managed account selected by accountId. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.
huntress_approve_managed_account_remediations parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
incidentReportId integer yes Numeric ID of the incident report whose remediations to approve.
huntress_create_managed_account parameters
Param Type Required Default Description
adminEmail string yes Email address of the initial admin user for this account. Required.
adminFirstName string yes First name of the initial admin user for this account. Required.
adminLastName string yes Last name of the initial admin user for this account. Required.
fieldsJson string no null Additional body fields (e.g. support_type, products, billing_address) as a JSON object, merged into the request after the typed fields.
name string yes Display name of the managed account. Required.
phoneNumber string yes Primary phone number used to contact the account owner. Required.
subdomain string yes Subdomain for the managed account (e.g. 'acme' for acme.huntress.io). Required.
huntress_create_managed_account_membership parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
email string yes Email address of the user to invite. Required.
fieldsJson string no null Additional body fields as a JSON object, merged into the request after the typed fields.
firstName string yes First name of the user. Required.
lastName string yes Last name of the user. Required.
organizationId integer no null Optional organization ID to scope the membership to.
permissions string yes Permission/role to grant. Required. One of: Admin, Security Engineer, User, Read-only, Finance, Marketing, Provisioner.
huntress_create_managed_account_organization parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
fieldsJson string no null Additional body fields as a JSON object, merged into the request after the typed fields.
key string yes Unique key/identifier for the organization. Required.
name string yes Name of the organization to create. Required.
huntress_delete_managed_account_membership parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
id integer yes Numeric ID of the membership to delete.
huntress_delete_managed_account_organization parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
id integer yes Numeric ID of the organization to delete.
huntress_disable_managed_account parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account to disable (from huntress_list_managed_accounts).
huntress_get_managed_account parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
huntress_get_managed_account_agent parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
id integer yes Numeric ID of the agent.
huntress_get_managed_account_external_port parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
id integer yes Numeric ID of the external port record.
huntress_get_managed_account_incident_report parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
id integer yes Numeric ID of the incident report.
huntress_get_managed_account_invoice parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
id integer yes Numeric ID of the invoice.
huntress_get_managed_account_membership parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
id integer yes Numeric ID of the membership.
huntress_get_managed_account_organization parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
id integer yes Numeric ID of the organization.
huntress_get_managed_account_remediation parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
incidentReportId integer yes Numeric ID of the incident report the remediation belongs to.
remediationId integer yes Numeric ID of the remediation.
huntress_get_managed_account_report parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
id integer yes Numeric ID of the summary report.
huntress_get_managed_account_signal parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
id integer yes Numeric ID of the signal.
huntress_isolate_managed_account_agent parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
fieldsJson string no null Additional body fields as a JSON object, merged into the request.
id integer yes Numeric ID of the agent to isolate.
reason string no null Optional reason for the isolation.
strictIsolation boolean no null When true, applies strict isolation (blocks all traffic except Huntress).
huntress_list_managed_account_agents parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
hostname string no null Filter by hostname.
limit integer no 50 Max results per page (default 50, max 500).
organizationId integer no null Filter by organization ID.
os string no null Filter by operating system.
pageToken string no null Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
platform string no null Filter by platform: windows|darwin|linux.
sortDirection string no null Sort direction: asc|desc.
sortField string no null Field to sort by: id|created_at|updated_at.
version string no null Filter by agent version.
huntress_list_managed_account_external_ports parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
limit integer no 50 Max results per page (default 50, max 500).
organizationId integer no null Filter by organization ID.
pageToken string no null Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
port integer no null Filter by port number.
protocol string no null Filter by protocol: TCP|UDP.
riskyService boolean no null Filter to risky services only (true/false).
service string no null Filter by service name.
sortDirection string no null Sort direction: asc|desc.
sortField string no null Field to sort by: id|port|protocol|created_at|updated_at.
huntress_list_managed_account_incident_reports parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
agentId integer no null Filter by agent ID.
indicatorType string no null Filter by indicator type: footholds|monitored_files|ransomware_canaries|antivirus_detections|process_detections|managed_identity|mde_detections|siem_detections|favicon_detections|behavioral_detections|email_security_detections|app_control|ai_misuse.
limit integer no 50 Max results per page (default 50, max 500).
organizationId integer no null Filter by organization ID.
pageToken string no null Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
platform string no null Filter by platform: windows|darwin|microsoft_365|google|linux|email_security|other.
severity string no null Filter by severity: low|high|critical.
sortDirection string no null Sort direction: asc|desc.
sortField string no null Field to sort by (e.g. id, created_at, updated_at).
status string no null Filter by status: sent|closed|dismissed|auto_remediating|deleting|partner_dismissed.
huntress_list_managed_account_invoices parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
hasUsage boolean no null Filter to invoices that have usage (true/false).
limit integer no 50 Max results per page (default 50, max 500).
pageToken string no null Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
sortDirection string no null Sort direction: asc|desc.
sortField string no null Field to sort by: id|created_at|updated_at|status.
status string no null Filter by status: open|paid|failed|partial_refund|full_refund|draft|voided|processing.
huntress_list_managed_account_memberships parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
limit integer no 50 Max results per page (default 50, max 500).
organizationId integer no null Filter by organization ID.
pageToken string no null Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
permissions string no null Filter by permission: Admin|Security Engineer|User|Read-only|Finance|Marketing|Provisioner.
sortDirection string no null Sort direction: asc|desc.
sortField string no null Field to sort by: id|user_id|created_at|updated_at.
userId integer no null Filter by user ID.
huntress_list_managed_account_organizations parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
key string no null Filter by organization key.
limit integer no 50 Max results per page (default 50, max 500).
name string no null Filter by organization name.
pageToken string no null Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
sortDirection string no null Sort direction: asc|desc.
sortField string no null Field to sort by: id|created_at|updated_at|name|key.
huntress_list_managed_account_remediations parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
incidentReportId integer yes Numeric ID of the incident report whose remediations to list.
limit integer no 50 Max results per page (default 50, max 500).
pageToken string no null Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
sortDirection string no null Sort direction: asc|desc.
sortField string no null Field to sort by (e.g. id, created_at, updated_at).
statuses string no null Comma-separated list of remediation statuses: unapproved|approved|completed|failed|cancelled.
types string no null Comma-separated list of remediation types: assisted|manual|containment.
huntress_list_managed_account_reports parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
limit integer no 50 Max results per page (default 50, max 500).
organizationId integer no null Filter by organization ID.
pageToken string no null Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
periodMax string no null Filter to reports with period on/before this ISO-8601 timestamp.
periodMin string no null Filter to reports with period on/after this ISO-8601 timestamp.
sortDirection string no null Sort direction: asc|desc.
sortField string no null Field to sort by: id|created_at|updated_at.
type string no null Filter by report type: monthly_summary|quarterly_summary|yearly_summary.
huntress_list_managed_account_signals parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
entityId string no null Filter by entity ID. Must be paired with entityType.
entityType string no null Filter by entity type: user_entity|source|mailbox|service_principal|agent|identity. Required when entityId is set.
investigatedAtMax string no null Filter to signals investigated on/before this ISO-8601 timestamp.
investigatedAtMin string no null Filter to signals investigated on/after this ISO-8601 timestamp.
limit integer no 50 Max results per page (default 50, max 500).
organizationId integer no null Filter by organization ID.
pageToken string no null Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
sortDirection string no null Sort direction: asc|desc.
sortField string no null Field to sort by: id|created_at|updated_at|status.
statuses string no null Comma-separated list of signal statuses: reported|closed.
types string no null Comma-separated list of signal types.
huntress_list_managed_accounts parameters
Param Type Required Default Description
limit integer no 50 Max results per page (default 50, max 500).
name string no null Filter by account name.
pageToken string no null Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
sortDirection string no null Sort direction: asc|desc.
sortField string no null Field to sort by (e.g. id, created_at, updated_at, name).
status string no null Filter by account status: enabled|disabled.
subdomain string no null Filter by account subdomain.
huntress_reject_managed_account_remediations parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
comment string yes Why the remediations were rejected. Required. Helps the Huntress SOC fix the plan and re-issue the incident report.
email string no null Email for the Huntress SOC to contact. Falls back to the API key's user if omitted.
fieldsJson string no null Additional body fields as a JSON object, merged into the request after the typed fields.
incidentReportId integer yes Numeric ID of the incident report whose remediations to reject.
name string no null Name of the user rejecting. Falls back to the API key's user if omitted.
phoneNumber string no null Phone number for the Huntress SOC to contact. Falls back to the API key's user if omitted.
useful boolean yes Whether the remediation plan was useful. Required.
huntress_release_managed_account_agent_isolation parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
id integer yes Numeric ID of the agent whose isolation to release.
huntress_resolve_managed_account_incident_report parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
id integer yes Numeric ID of the incident report to resolve.
huntress_uninstall_managed_account_agent parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
id integer yes Numeric ID of the agent to uninstall.
huntress_update_managed_account parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts).
fieldsJson string no null Additional body fields as a JSON object, merged into the request.
name string no null New display name for the managed account.
huntress_update_managed_account_agent parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
fieldsJson string no null Additional body fields as a JSON object, merged into the request.
id integer yes Numeric ID of the agent to update.
tags string no null Comma-separated list of tags to set on the agent.
tamperProtectionConfigured boolean no null Whether tamper protection is configured for the agent.
huntress_update_managed_account_membership parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
fieldsJson string no null Additional body fields as a JSON object, merged into the request.
id integer yes Numeric ID of the membership to update.
permissions string no null New permission/role to grant (e.g. Admin, Security Engineer, User, Read-only).
huntress_update_managed_account_organization parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
fieldsJson string no null Additional body fields as a JSON object, merged into the request.
id integer yes Numeric ID of the organization to update.
name string no null New name for the organization.

Reseller Billing

Tool Plan Access Description
huntress_create_reseller_subscription Pro Write [Huntress] Create a new reseller subscription. The Huntress API REQUIRES account_id, product, minimum (seat count), and purchase_order. Requires reseller-level API credentials.
huntress_get_reseller_invoice Free Read-only [Huntress] Get a single reseller invoice by id; these require reseller-level API credentials.
huntress_get_reseller_subscription Free Read-only [Huntress] Get a single reseller subscription by id; these require reseller-level API credentials.
huntress_list_reseller_account_usage_line_items Free Read-only [Huntress] List per-account usage line items for a reseller invoice; these require reseller-level API credentials. Paginated — use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
huntress_list_reseller_invoices Free Read-only [Huntress] List reseller invoices; these require reseller-level API credentials. Paginated — use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
huntress_list_reseller_organization_usage_line_items Free Read-only [Huntress] List per-organization usage line items for a reseller invoice; these require reseller-level API credentials. Paginated — use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
huntress_list_reseller_subscriptions Free Read-only [Huntress] List reseller subscriptions; these require reseller-level API credentials. Paginated — use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
huntress_update_reseller_subscription Pro Write [Huntress] Update a reseller subscription. Requires reseller-level API credentials.
huntress_upgrade_reseller_subscription Pro Write [Huntress] Upgrade a reseller subscription (e.g. raise the seat minimum). The Huntress API REQUIRES the new minimum. Requires reseller-level API credentials.
huntress_create_reseller_subscription parameters
Param Type Required Default Description
accountId integer yes Numeric ID of the managed account this subscription is for (from huntress_list_managed_accounts). Required.
billingInterval string no null Optional billing interval for the subscription.
fieldsJson string no null Additional body fields as a JSON object, merged into the request after the typed fields.
minimum integer yes Seat/unit minimum for the subscription. Required.
product string yes Product for the subscription. Required. One of: edr, sat, itdr, siem.
purchaseOrder string yes Purchase order reference. Required.
huntress_get_reseller_invoice parameters
Param Type Required Default Description
id integer yes Numeric ID of the reseller invoice (from huntress_list_reseller_invoices).
huntress_get_reseller_subscription parameters
Param Type Required Default Description
id integer yes Numeric ID of the reseller subscription (from huntress_list_reseller_subscriptions).
huntress_list_reseller_account_usage_line_items parameters
Param Type Required Default Description
invoiceId integer yes Numeric ID of the reseller invoice to list usage line items for (from huntress_list_reseller_invoices).
limit integer no 50 Maximum number of results per page (default 50, max 500).
pageToken string no null Pagination cursor: pass the `next_page_token` from the previous response's `pagination` object to fetch the next page. Omit for the first page.
huntress_list_reseller_invoices parameters
Param Type Required Default Description
limit integer no 50 Maximum number of results per page (default 50, max 500).
pageToken string no null Pagination cursor: pass the `next_page_token` from the previous response's `pagination` object to fetch the next page. Omit for the first page.
status string no null Filter by invoice status: open|paid|failed|partial_refund|full_refund|draft|voided|processing.
huntress_list_reseller_organization_usage_line_items parameters
Param Type Required Default Description
invoiceId integer yes Numeric ID of the reseller invoice to list usage line items for (from huntress_list_reseller_invoices).
limit integer no 50 Maximum number of results per page (default 50, max 500).
pageToken string no null Pagination cursor: pass the `next_page_token` from the previous response's `pagination` object to fetch the next page. Omit for the first page.
huntress_list_reseller_subscriptions parameters
Param Type Required Default Description
limit integer no 50 Maximum number of results per page (default 50, max 500).
pageToken string no null Pagination cursor: pass the `next_page_token` from the previous response's `pagination` object to fetch the next page. Omit for the first page.
product string no null Filter by product: edr|sat|itdr|siem.
sortDirection string no null Sort direction: asc|desc.
sortField string no null Field to sort by: id|status|minimum|created_at|updated_at.
status string no null Filter by subscription status: draft|approved|accepted|active|completed.
huntress_update_reseller_subscription parameters
Param Type Required Default Description
fieldsJson string no null Additional body fields as a JSON object, merged into the request.
id integer yes Numeric ID of the reseller subscription (from huntress_list_reseller_subscriptions).
huntress_upgrade_reseller_subscription parameters
Param Type Required Default Description
fieldsJson string no null Additional body fields as a JSON object, merged into the request after the typed fields.
id integer yes Numeric ID of the reseller subscription (from huntress_list_reseller_subscriptions).
minimum integer yes New seat minimum for the subscription. Required.
onRenewal boolean no null Whether the upgrade applies on renewal rather than immediately.
purchaseOrder string no null Purchase order reference for the upgrade.

SIEM

Tool Plan Access Description
huntress_query_siem Pro Write [Huntress] Query SIEM logs with ES|QL. The `esql` query must begin with "FROM logs". Requires the SIEM product to be enabled on the account (returns 404 if not). Returns {logs:[...], pagination:{next_page_token?}}; pass the returned token as `pageToken` for the next page. Maximum 200 rows per page.
huntress_query_siem parameters
Param Type Required Default Description
esql string yes ES|QL query string. Required. Must begin with "FROM logs".
fieldsJson string no null Additional body fields as a JSON object, merged into the request after the typed fields.
pageToken string no null Pagination cursor: pass the `next_page_token` from the previous response's `pagination` object to fetch the next page. Omit for the first page.
rangeEnd string yes End of the time range to query (ISO 8601 timestamp). Required.
rangeStart string yes Start of the time range to query (ISO 8601 timestamp). Required.