Liongard Tools
liongard_ · 78 tools · Free 45 · Pro 33
X-ROAR-API-KEY base64(key:secret); v1+v2 endpoints (v1 tools carry the _v1 suffix); max page size 2000; POST-for-search; v1 report downloads return SAS URLs.
Environments
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_count_environments |
Free | Read-only | [Liongard] Returns the total number of environments visible to the API key. Useful as a cheap health check or to size pagination loops before calling liongard_list_environments. |
liongard_create_environment |
Pro | Write | [Liongard] Create a new environment. Body requires Name, Description, Parent (nullable), ShortName, and Tier (must be 'Core' or 'Essentials'). Returns the created environment with its assigned ID. |
liongard_create_environments_bulk |
Pro | Write | [Liongard] Create multiple environments in one call. Body must be a JSON array of environment-create objects (same shape as liongard_create_environment). |
liongard_delete_environment |
Pro | Destructive | [Liongard] WARNING: Permanently delete an environment. Setting relatedEntities=true also deletes child agents, launchpoints, and integration mappings — non-reversible. Use liongard_get_environment_related_entities first to understand the blast radius. |
liongard_get_environment |
Free | Read-only | [Liongard] Get a single environment by ID. Returns full environment metadata including parent, short name, tier, creation date, and IDs of associated launchpoints/agents. Use liongard_list_environments to discover IDs. |
liongard_get_environment_related_entities |
Free | Read-only | [Liongard] Fetch all dependent objects for an environment in one call: launchpoints, agents, integration mappings, and child environments. Useful for impact analysis before deletion or drift discovery. |
liongard_list_environments |
Free | Read-only | [Liongard] List environments (top-level customer/site containers). Each environment groups inspectors, agents, launchpoints, and asset inventory. Returns paginated array with environment IDs, names, descriptions, and tier (Core or Essentials). Use liongard_get_environment for full details and liongard_get_environment_related_entities to fetch dependent objects. |
liongard_query_environment_dashboard |
Free | Read-only | [Liongard] Run dashboard-metric queries against a single environment. Body must contain a queryIdentifiers array of dashboard metric names (e.g. 'm365TotalUsers', 'workstationOsVersionPct', 'winServerEDRSoftware', 'macOSPctEncryptedAtRest'). See Liongard's UI dashboard for the full enum (60+ values). Use this for posture-snapshot reports. |
liongard_update_environment |
Pro | Write | [Liongard] Update a single environment by ID. Body uses the same shape as create (Name/Description/Parent/ShortName/Tier). Use liongard_list_environments to find IDs. |
liongard_update_environments_bulk |
Pro | Write | [Liongard] Update multiple environments in one call. Body must be a JSON array of {EnvironmentId, Name, Description, Parent, ShortName, Tier} objects. |
liongard_create_environment parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"Name": "Acme Corp", "Description": "...", "Parent": null, "ShortName": "acme", "Tier": "Core"}. |
liongard_create_environments_bulk parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON array of environment objects, each with Name/Description/Parent/ShortName/Tier. |
liongard_delete_environment parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
environmentId |
integer | yes | Environment ID (integer). | |
relatedEntities |
boolean | no | null | If true, cascade-delete child agents/launchpoints/mappings. Default false (delete fails if children exist). |
liongard_get_environment parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
environmentId |
integer | yes | Environment ID (integer). |
liongard_get_environment_related_entities parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
environmentId |
integer | yes | Environment ID (integer). |
liongard_list_environments parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
columns |
string | no | null | Optional CSV of column names to limit response shape (e.g. 'ID,Name,Tier'). |
orderBy |
string | no | null | Optional sort expression (e.g. 'Name', 'CreatedOn DESC'). |
page |
integer | no | 1 | Page number (1-based). Default 1. |
pageSize |
integer | no | 25 | Page size (default 25, max 2000). |
liongard_query_environment_dashboard parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
environmentId |
integer | yes | Environment ID (integer). | |
queryBodyJson |
string | yes | JSON body: {"queryIdentifiers": ["m365TotalUsers", "workstationOsVersionPct"]}. See Liongard dashboard for valid query names. |
liongard_update_environment parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body with fields to update (same shape as create). | |
environmentId |
integer | yes | Environment ID (integer). |
liongard_update_environments_bulk parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON array, each object containing EnvironmentId + fields to update. |
Environment Groups
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_create_environment_group |
Pro | Write | [Liongard] Create an environment group. Body requires AutoAddNewEnvironments (bool), Description, Environments (int[]), Name, Users (array of {UserID, GroupID}). |
liongard_delete_environment_groups |
Pro | Destructive | [Liongard] WARNING: Permanently delete one or more environment groups. Liongard quirk: this is a DELETE with a JSON BODY (not a path-based delete). Body shape: {"EnvironmentGroupIDs": [1, 2, 3]}. Environments inside the groups are NOT deleted — only the group association. |
liongard_list_environment_groups |
Free | Read-only | [Liongard] List environment groups. Each group bundles environment IDs and user permission assignments. Use to discover group IDs before applying group-level permissions. |
liongard_update_environment_group |
Pro | Write | [Liongard] Update a single environment group. Body shape matches liongard_create_environment_group. Use liongard_list_environment_groups to find IDs. |
liongard_create_environment_group parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"AutoAddNewEnvironments": true, "Description": "...", "Environments": [1,2], "Name": "...", "Users": [{"UserID":N, "GroupID":M}]}. |
liongard_delete_environment_groups parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"EnvironmentGroupIDs": [1, 2, 3]}. |
liongard_list_environment_groups parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
ids |
string | no | null | Optional comma-separated environment-group IDs to filter to specific groups. |
page |
integer | no | 1 | Page number (1-based). Default 1. |
pageSize |
integer | no | 25 | Page size (default 25, max 2000). |
liongard_update_environment_group parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body with fields to update. | |
environmentGroupId |
string | yes | Environment group ID (string-of-integer per Liongard spec). |
Agents
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_delete_agents |
Pro | Destructive | [Liongard] WARNING: Permanently delete one or more agents. Liongard quirk: this is a DELETE with a JSON BODY (not path-based). Body shape: {"AgentIDs": [1,2,3]}. Optional disableLaunchpoints flag also disables every launchpoint that pointed at the deleted agents. Use liongard_list_agents first to confirm IDs. |
liongard_generate_agent_installer |
Pro | Write | [Liongard] Generate a one-time installer download URL for a new agent in a specific environment. Body requires os ('windows', 'mac', or 'linux') and environmentID. Returns an installer URL or installer artifact metadata. |
liongard_list_agents |
Free | Read-only | [Liongard] List agents (Liongard collectors deployed in customer networks). Liongard quirk: this is a POST-for-search endpoint at /view/agents. Body envelope: {Filters, Sorting, Pagination}. Liongard requires empty arrays even when not filtering — this tool sends defaults automatically when bodyJson is null. Optional flags excludeSummary/excludeAgents/excludeManaged trim the response shape. |
liongard_delete_agents parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"AgentIDs": [1, 2, 3]}. | |
disableLaunchpoints |
boolean | no | null | If true, also disable launchpoints that referenced the deleted agents. |
liongard_generate_agent_installer parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"os": "windows"|"mac"|"linux", "environmentID": N}. |
liongard_list_agents parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | no | null | JSON body: {"Filters": [], "Sorting": [], "Pagination": {"Page": 1, "PageSize": 25}}. Pass null for defaults. |
excludeAgents |
boolean | no | null | Set true to skip the agents array in the response. |
excludeManaged |
boolean | no | null | Set true to skip Liongard-managed (cloud) agents and return only customer-deployed agents. |
excludeSummary |
boolean | no | null | Set true to skip the summary block in the response. |
Asset Inventory — Identities
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_get_identity |
Free | Read-only | [Liongard] Get a single identity by UUID. Returns full identity details including type, status, location, manual-curation flag. |
liongard_list_identities |
Free | Read-only | [Liongard] Query identities (users, service accounts, admins, guests, etc.) within an environment's asset inventory. POST-for-search: body requires Environment (int, REQUIRED) and Filters/Pagination/Sorting (Liongard requires empty arrays even when unused). Returns identity records with type, status, location, inventory state, and isManual flag. |
liongard_update_identities_bulk |
Pro | Write | [Liongard] Bulk-update inventory state, status, and type across many identities. Liongard quirk: this is a POST-for-update (not a PUT), per the bulk-mutate convention. Body: {"Environment": N, "IDs": ["uuid1","uuid2"], "InventoryState": "Archive", "Status": "inactive", "Type": "user"}. |
liongard_update_identity |
Pro | Write | [Liongard] Update a single identity's classification (type, status, location, inventoryState, isManual). Type values: service|user|admin|guest|shared|system|application. Status values: suspended|active|inactive|expired|deactivated|deleted|pending-activation. InventoryState: Inventory|Archive|Discovery. |
liongard_get_identity parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
identityId |
string | yes | Identity UUID (e.g. 'f67ed3a3-ab41-4a03-ba96-aee435534fce'). |
liongard_list_identities parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"Environment": <envId>, "Filters": [], "Sorting": [], "Pagination": {"Page":1,"PageSize":25}}. Environment is required. |
liongard_update_identities_bulk parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"Environment": N, "IDs": ["uuid1"], "InventoryState": "...", "Status": "...", "Type": "..."}. |
liongard_update_identity parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"Environment": N, "Type": "user", "Status": "active", "Location": "...", "IsLocationManaged": true, "InventoryState": "Inventory", "IsManual": false}. | |
identityId |
string | yes | Identity UUID. |
Asset Inventory — Devices
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_get_device |
Free | Read-only | [Liongard] Get a single device profile by UUID. Returns full device metadata: alias, class, status, category, type, role, location, host info, asset tag, purchase date, warranty/EOL dates, environment. |
liongard_list_devices |
Free | Read-only | [Liongard] Query device profiles within an environment's asset inventory. POST-for-search: body requires Environment, Filters, Pagination, Sorting (empty arrays required). Returns devices with class, status, category, type, role, location, and asset metadata. |
liongard_update_device |
Pro | Write | [Liongard] Update a device's classification or asset metadata. Many enum fields: Class (critical|standar — Liongard spec typo, pass through as 'standar'), Status (active|inactive|idle|standby), Category (compute|network|iot-printer|storage), Type (server|host|desktop|laptop|smartphone|tablet), Role (15 values incl. domain-directory|vm-host|vm-guest|pbx|voip|dns|sql|backup|user-device). See Liongard docs for the full enum tree. |
liongard_update_devices_bulk |
Pro | Write | [Liongard] Bulk-update inventory state, status, and type across many device profiles. Liongard quirk: POST-for-update. Body: {"Environment": N, "IDs": ["uuid1","uuid2"], "InventoryState": "Archive", "Status": "inactive", "Type": "server"}. |
liongard_get_device parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
deviceId |
string | yes | Device profile UUID. |
liongard_list_devices parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"Environment": N, "Filters": [], "Sorting": [], "Pagination": {"Page":1,"PageSize":25}}. Environment is required. |
liongard_update_device parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body with fields to update (Alias, Class, Status, Category, Type, Role, Location, Environment, asset metadata, etc.). | |
deviceId |
string | yes | Device profile UUID. |
liongard_update_devices_bulk parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"Environment": N, "IDs": ["uuid1"], "InventoryState": "...", "Status": "...", "Type": "..."}. |
Metrics
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_evaluate_metrics |
Free | Read-only | [Liongard] Evaluate one or more metrics across systems and return the values. WARNING: this endpoint has a STRICTER rate limit (100 req/min vs the platform-wide 2000 req/5min). Batch metric IDs into a single call rather than firing per-metric. Body: {"Metrics": [<int or UUID>], "Filters": [{"Field":"EnvironmentID","Op":"equal_to","Values":[1]}], "Sorting": [], "Pagination": {"Page":1,"PageSize":25}}. Filters/Sorting empty arrays required even when unused. |
liongard_evaluate_metrics_by_system |
Free | Read-only | [Liongard] Evaluate ALL enabled metrics for a list of system IDs. Returns metric values per system. Useful when you want a posture snapshot for specific systems rather than a metric-first view. Body: {"Systems": [N1, N2], "Filters": [], "Sorting": [], "Pagination": }. |
liongard_get_metric_related_environments |
Free | Read-only | [Liongard] Returns the environment IDs where a given metric is currently evaluated. Useful for scoping a follow-up liongard_evaluate_metrics call to only the relevant environments. |
liongard_list_metrics |
Free | Read-only | [Liongard] List defined metrics. Liongard quirk: this endpoint uses UPPERCASE Page/PageSize query params (most other endpoints use lowercase). Filters/Sorting are passed as repeated form params with JSON-string values, e.g. Filters[]={"FilterBy":"Name","Op":"contains","Value":"Active Directory"}. |
liongard_evaluate_metrics parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"Metrics": [<id-or-uuid>], "Filters": [], "Sorting": [], "Pagination": {"Page":1,"PageSize":25}}. Metrics array can mix integer IDs and UUIDs. | |
includeNonVisible |
boolean | no | null | If true, include disabled (display=off) metrics. Default false. |
liongard_evaluate_metrics_by_system parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"Systems": [int IDs], "Filters": [], "Sorting": [], "Pagination": {"Page":1,"PageSize":25}}. |
liongard_get_metric_related_environments parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
metricId |
integer | yes | Metric ID (integer). |
liongard_list_metrics parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
filters |
array | no | null | Optional repeated filter expressions as JSON strings. Each: {"FilterBy":"Name","Op":"contains","Value":"..."}. |
page |
integer | no | null | Page number (1-based). Default 1. |
pageSize |
integer | no | null | Page size (default 25, max 2000). |
sorting |
array | no | null | Optional repeated sort expressions as JSON strings. Each: {"SortBy":"ID","Direction":"DESC"}. |
Timeline & Detections
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_list_detections |
Free | Read-only | [Liongard] List detection events (alert-style records derived from inspector runs). POST-for-search body: {Pagination, Filters, Sorting, StartDate, EndDate}. StartDate/EndDate use ISO 8601 with Z (e.g. '2026-04-01T00:00:00.000Z'). Filters/Sorting empty arrays required. |
liongard_query_timeline |
Free | Read-only | [Liongard] Query timeline entries (inspector runs). Each entry includes Status (queued/running/completed/failed), AdHoc, SystemID, SystemDetailID (presence indicates a dataprint exists), ChangeDetections, ScheduledAt/RunningAt/FinishedAt timestamps, ExitCode, ExitMessage. POST-for-search body: {Filters, Sorting, Pagination} with empty arrays required. |
liongard_list_detections parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"Pagination": {"Page":1,"PageSize":25}, "Filters": [], "Sorting": [], "StartDate": "2026-04-01T00:00:00.000Z", "EndDate": "2026-05-01T00:00:00.000Z"}. |
liongard_query_timeline parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"Filters": [], "Sorting": [{"Field":"ScheduledAt","Direction":"DESC"}], "Pagination": {"Page":1,"PageSize":25}}. |
Dataprints
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_evaluate_dataprint |
Free | Read-only | [Liongard] Run a JMESPath query against a system's inspection dataprint and return the matched values. JMESPath is a JSON query language (https://jmespath.org). Use liongard_get_inspector_schema_v1 to discover property paths for a given inspector. Body: {"QueryPath": "<jmespath expression>", "Pagination": {"Page":1,"PageSize":25}}. |
liongard_evaluate_dataprint parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"QueryPath": "users[?accountEnabled].userPrincipalName", "Pagination": {"Page":1,"PageSize":25}}. JMESPath: https://jmespath.org/specification.html | |
systemDetailId |
integer | yes | System detail ID (integer). Find via liongard_query_timeline — entries with a SystemDetailID have an evaluable dataprint. |
Webhooks
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_create_webhook |
Pro | Write | [Liongard] Register a new webhook. WARNING: Liongard validates the URL is reachable at create time — returns 404 if the destination URL refuses the verification ping. Make sure the receiver is deployed and accepting requests before calling this. Body: {"Description": "...", "Url": "https://...", "Events": ["alert.created"]}. Currently only 'alert.created' is supported. |
liongard_delete_webhook |
Pro | Destructive | [Liongard] Delete a webhook by UUID. |
liongard_generate_webhook_signing_key |
Pro | Destructive | [Liongard] WARNING: DESTRUCTIVE. Generates a new global signing key used for HMAC-SHA256 signing of ALL webhook payloads. Calling this immediately invalidates HMAC verification for ALL existing webhook receivers — every receiver must be updated with the new key before the next event arrives. Use ONLY when rotating a compromised key. Returns the new signing key in the response (one-time visibility). |
liongard_get_webhook |
Free | Read-only | [Liongard] Get a single webhook by UUID. |
liongard_list_webhooks |
Free | Read-only | [Liongard] List configured webhooks. Each webhook has ID (UUID), URL, Description, Events (array; currently only 'alert.created' is published), Active flag, Health, CreatedOn, CreatedBy. |
liongard_update_webhook |
Pro | Write | [Liongard] Update a single webhook. Adds Active toggle vs. create. Body: {"Description": "...", "Url": "https://...", "Events": ["alert.created"], "Active": true}. |
liongard_create_webhook parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"Description": "...", "Url": "https://...", "Events": ["alert.created"]}. |
liongard_delete_webhook parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
webhookId |
string | yes | Webhook UUID. |
liongard_get_webhook parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
webhookId |
string | yes | Webhook UUID. |
liongard_update_webhook parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body: {"Description": "...", "Url": "...", "Events": [...], "Active": true|false}. | |
webhookId |
string | yes | Webhook UUID. |
Inspectors (v1)
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_get_inspector_schema_v1 |
Free | Read-only | [Liongard v1] Returns the JSON schema for an inspector's dataprint output, including all property paths (JMESPath-compatible). Pair with liongard_evaluate_dataprint (v2) to query specific values from a system's inspection. |
liongard_get_inspector_v1 |
Free | Read-only | [Liongard v1] Get a single inspector's metadata: name, version, description, inspection schedule, configuration schema. Use liongard_list_inspectors_v1 to discover IDs. |
liongard_list_inspectors_v1 |
Free | Read-only | [Liongard v1] List all inspectors available in this tenant. Each inspector is a data source definition (e.g. 'Microsoft 365 Inspector'). Use to discover available data sources before chaining to liongard_get_inspector_schema_v1 for property paths usable in dataprint queries. |
liongard_get_inspector_schema_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
inspectorId |
integer | yes | Inspector ID (integer). |
liongard_get_inspector_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
inspectorId |
integer | yes | Inspector ID (integer). |
liongard_list_inspectors_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fields |
string | no | null | Optional CSV of fields to limit response shape (e.g. 'ID,Name,Version'). |
Systems (v1)
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_get_system_details_v1 |
Free | Read-only | [Liongard v1] Get the most recent inspection details (dataprint snapshot) for a system. Returns the full inspector output. For targeted queries against this output, use liongard_evaluate_dataprint (v2) with the SystemDetailID. |
liongard_get_system_v1 |
Free | Read-only | [Liongard v1] Get a single system (inspector instance) with its current configuration and binding to an environment. |
liongard_list_systems_v1 |
Free | Read-only | [Liongard v1] List inspector instances (systems). v1 quirk: filters use exploded conditions[] query params with path/operator/value triples (e.g. conditions[0][path]=Environment.ID&conditions[0][op]=eq&conditions[0][value]=42). |
liongard_search_systems_v1 |
Free | Read-only | [Liongard v1] POST-for-search across systems by inspector property values. Body shape varies — consult Liongard's v1 API explorer for exact filter schema. Useful for finding systems with specific configuration drift signals. |
liongard_get_system_details_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
systemId |
integer | yes | System ID (integer). |
liongard_get_system_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
systemId |
integer | yes | System ID (integer). |
liongard_list_systems_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
conditions |
string | no | null | Optional pre-formatted Liongard v1 conditions query suffix. Example: 'conditions[0][path]=Environment.ID&conditions[0][op]=eq&conditions[0][value]=42'. Pass it raw (no leading '?'); StackJack appends it to the URL verbatim. URL-encode individual VALUES yourself if they contain reserved characters. |
fields |
string | no | null | Optional CSV of fields to limit response shape. |
liongard_search_systems_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body — see Liongard v1 docs for exact search filter schema. |
Launchpoints (v1)
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_create_launchpoint_v1 |
Pro | Write | [Liongard v1] Create a new launchpoint. Body shape: schedule, system, agent, configuration. Consult Liongard's v1 API explorer for the exact schema (varies by inspector type). |
liongard_delete_launchpoint_v1 |
Pro | Destructive | [Liongard v1] Delete a launchpoint. Stops scheduled inspections; the underlying system is not deleted. |
liongard_get_launchpoint_v1 |
Free | Read-only | [Liongard v1] Get a single launchpoint by ID with full configuration. |
liongard_list_launchpoints_v1 |
Free | Read-only | [Liongard v1] List launchpoints (scheduled inspection triggers). Returns Schedule, NextScheduledFor, AssociatedSystem, AssociatedAgent, and configuration. |
liongard_run_launchpoint_v1 |
Pro | Write | [Liongard v1] Trigger a manual ad-hoc run of a launchpoint's inspection. ASYNC — returns immediately; the actual inspection runs in the background. Poll liongard_query_timeline (v2) to see the resulting timeline entry transition through running → completed/failed. |
liongard_update_launchpoint_v1 |
Pro | Write | [Liongard v1] Update launchpoint schedule or configuration. |
liongard_create_launchpoint_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body — see Liongard v1 docs for the exact schema. |
liongard_delete_launchpoint_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
launchpointId |
integer | yes | Launchpoint ID (integer). |
liongard_get_launchpoint_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
launchpointId |
integer | yes | Launchpoint ID (integer). |
liongard_list_launchpoints_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
conditions |
string | no | null | Optional pre-formatted Liongard v1 conditions query suffix (e.g. 'conditions[0][path]=AssociatedAgent.ID&conditions[0][op]=eq&conditions[0][value]=42'). Pass raw — StackJack appends verbatim without URL-escaping the bracket syntax. |
fields |
string | no | null | Optional CSV of fields to limit response shape. |
liongard_run_launchpoint_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
launchpointId |
integer | yes | Launchpoint ID (integer). |
liongard_update_launchpoint_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body with fields to update. | |
launchpointId |
integer | yes | Launchpoint ID (integer). |
Users (v1)
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_create_user_v1 |
Pro | Write | [Liongard v1] Create a Liongard user. Body shape includes Email, Name, Role assignments. Consult Liongard's v1 API explorer for exact schema (varies by tenant tier). |
liongard_delete_user_v1 |
Pro | Destructive | [Liongard v1] WARNING: Permanently delete a user. Removes all role assignments and revokes any API keys owned by that user. |
liongard_get_user_v1 |
Free | Read-only | [Liongard v1] Get a single user by ID with full role and group memberships. |
liongard_list_users_v1 |
Free | Read-only | [Liongard v1] List Liongard tenant users with their role assignments and account status. Useful for permission audits. |
liongard_update_user_v1 |
Pro | Write | [Liongard v1] Update user details or role assignments. |
liongard_create_user_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body — see Liongard v1 docs. |
liongard_delete_user_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
userId |
integer | yes | User ID (integer). |
liongard_get_user_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
userId |
integer | yes | User ID (integer). |
liongard_list_users_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fields |
string | no | null | Optional CSV of fields to limit response shape. |
liongard_update_user_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body with fields to update. | |
userId |
integer | yes | User ID (integer). |
Service Providers (v1)
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_get_service_provider_v1 |
Free | Read-only | [Liongard v1] Get a single service provider's metadata. |
liongard_list_service_providers_v1 |
Free | Read-only | [Liongard v1] List service providers (top-level MSP entities). Most tenants have a single SP; multi-SP setups use this for tenant discovery. |
liongard_get_service_provider_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
serviceProviderId |
integer | yes | Service Provider ID (integer). |
Reports (v1)
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_download_report_v1 |
Free | Read-only | [Liongard v1] Download a generated report binary and return a short-lived SAS URL pointing to the blob-stored copy. The connector enforces a 100 MB size cap. Confirm the report status is 'complete' (via liongard_get_report_v1) before calling — otherwise this returns 404 or partial content. |
liongard_generate_report_v1 |
Pro | Write | [Liongard v1] Trigger report generation. ASYNC — returns a job/report ID immediately. Poll liongard_get_report_v1 until status transitions from 'pending'/'running' to 'complete', then call liongard_download_report_v1 to fetch the binary. Body shape varies by report type — consult Liongard's v1 API explorer. |
liongard_get_report_v1 |
Free | Read-only | [Liongard v1] Get a single report's metadata: status (pending/running/complete/failed), generated_at, expires_at, source data. |
liongard_list_reports_v1 |
Free | Read-only | [Liongard v1] List Liongard reports (audit outputs, configuration snapshots, etc.) with their generation status. |
liongard_download_report_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
reportId |
integer | yes | Report ID (integer). | |
sasTtlMinutes |
integer | no | 60 | How long the SAS URL should remain valid, in minutes. Default 60. |
liongard_generate_report_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body — see Liongard v1 docs for the exact report-type schema. |
liongard_get_report_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
reportId |
integer | yes | Report ID (integer). |
liongard_list_reports_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fields |
string | no | null | Optional CSV of fields to limit response shape. |
Alerts (v1)
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_acknowledge_alert_v1 |
Pro | Write | [Liongard v1] Mark an alert as acknowledged. Idempotent — safe to call repeatedly. Useful for clearing resolved findings from the active alert queue. |
liongard_get_alert_v1 |
Free | Read-only | [Liongard v1] Get a single alert by ID with full context. |
liongard_list_alerts_v1 |
Free | Read-only | [Liongard v1] List alerts (notifications from inspector runs). Returns severity, status (acknowledged/unacknowledged), source system, and alert text. |
liongard_acknowledge_alert_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
alertId |
integer | yes | Alert ID (integer). |
liongard_get_alert_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
alertId |
integer | yes | Alert ID (integer). |
liongard_list_alerts_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
conditions |
string | no | null | Optional pre-formatted Liongard v1 conditions query suffix (e.g. 'conditions[0][path]=Acknowledged&conditions[0][op]=eq&conditions[0][value]=false'). Pass raw — StackJack appends verbatim without URL-escaping the bracket syntax. |
fields |
string | no | null | Optional CSV of fields to limit response shape. |
Tags (v1)
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_create_tag_v1 |
Pro | Write | [Liongard v1] Create a new tag. Body: {"Name": "...", "Description": "...", "Color": "#hex"} or similar. Consult Liongard's v1 API explorer for exact schema. |
liongard_delete_tag_v1 |
Pro | Destructive | [Liongard v1] Delete a tag. Removes the tag from all entities it was applied to. |
liongard_get_tag_v1 |
Free | Read-only | [Liongard v1] Get a single tag by ID. |
liongard_list_tags_v1 |
Free | Read-only | [Liongard v1] List all tags defined in this tenant. |
liongard_update_tag_v1 |
Pro | Write | [Liongard v1] Update tag metadata. |
liongard_create_tag_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body — see Liongard v1 docs. |
liongard_delete_tag_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tagId |
integer | yes | Tag ID (integer). |
liongard_get_tag_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
tagId |
integer | yes | Tag ID (integer). |
liongard_list_tags_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
fields |
string | no | null | Optional CSV of fields to limit response shape. |
liongard_update_tag_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body with fields to update. | |
tagId |
integer | yes | Tag ID (integer). |
Notes (v1)
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_create_note_v1 |
Pro | Write | [Liongard v1] Create a note attached to an entity. Body requires entity_type ('Environment'|'System'|'Launchpoint') and entity_id, plus the note text. Consult Liongard's v1 API explorer for exact schema. |
liongard_delete_note_v1 |
Pro | Destructive | [Liongard v1] Delete a note. |
liongard_get_note_v1 |
Free | Read-only | [Liongard v1] Get a single note by ID. |
liongard_list_notes_v1 |
Free | Read-only | [Liongard v1] List notes. Filter by entity_type / entity_id via the conditions param to scope to a specific environment or system. |
liongard_update_note_v1 |
Pro | Write | [Liongard v1] Update note text or metadata. |
liongard_create_note_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body — see Liongard v1 docs. |
liongard_delete_note_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
noteId |
integer | yes | Note ID (integer). |
liongard_get_note_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
noteId |
integer | yes | Note ID (integer). |
liongard_list_notes_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
conditions |
string | no | null | Optional pre-formatted Liongard v1 conditions query suffix (e.g. 'conditions[0][path]=EntityType&conditions[0][op]=eq&conditions[0][value]=Environment'). Pass raw — StackJack appends verbatim without URL-escaping the bracket syntax. |
fields |
string | no | null | Optional CSV of fields to limit response shape. |
liongard_update_note_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
bodyJson |
string | yes | JSON body with fields to update. | |
noteId |
integer | yes | Note ID (integer). |
Roles (v1)
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_get_role_v1 |
Free | Read-only | [Liongard v1] Get a single role by ID with its full permission set. |
liongard_list_roles_v1 |
Free | Read-only | [Liongard v1] List all roles defined in this tenant. Use to enumerate role names + permission sets when auditing user assignments. |
liongard_get_role_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
roleId |
integer | yes | Role ID (integer). |
Audit Log (v1)
| Tool | Plan | Access | Description |
|---|---|---|---|
liongard_list_audit_log_v1 |
Free | Read-only | [Liongard v1] List audit log entries with optional date-range filter. Returns who-did-what records (user, action, target, timestamp) for compliance and security review. |
liongard_list_audit_log_v1 parameters
| Param | Type | Required | Default | Description |
|---|---|---|---|---|
endDate |
string | no | null | Optional ISO 8601 end date (e.g. '2026-05-01T00:00:00Z'). |
page |
integer | no | null | Page number (1-based). Default 1. |
pageSize |
integer | no | null | Page size (default 25, max 2000). |
startDate |
string | no | null | Optional ISO 8601 start date (e.g. '2026-04-01T00:00:00Z'). |