Create a new agent session. Args: args: Session creation parameters. channel_context: Trusted external channel metada

Create a new workspace.

Decrypt a client credential using the service's encryption key.

Delete a folder. Args: folder_id: ID of the folder to delete recursive: If True, also delete subfolders and contained

Delete the current organization and all associated resources.

Delete a preset.

Delete a registry repository.

Delete a registry version. Note: This also deletes all associated RegistryIndex entries due to CASCADE delete.

Disconnect a user's integration for a specific provider.

Check if a value exists in a table column.

Extract unique IPv4 addresses from a string.

Extract unique IPv6 addresses from a string. Includes defanged variants as an option.

Extract URLs from text, optionally including defanged ones.

Flattens an ExceptionGroup or single exception into a list of exceptions. Args: eg: Either an ExceptionGroup containing exceptions of typ

Create an error info from an exception.

Decode payloads without surfacing raw payload data in errors.

Best-effort title generation via direct PydanticAI call.

Get description for authorization code flow for a Microsoft service.

Batch fetch actions from index + manifest. Searches both org-scoped and platform registries for actions. Args: action_na

Get an async SQLAlchemy database session with RLS context. Behavior depends on TRACECAT__RLS_MODE: - off: bypass context by default - sha

Get attachment metadata without downloading the content.

Generate a presigned URL for downloading an attachment. Args: case: The case the attachment belongs to attachment_id:

Helper method to easily get an attribute value

Get the OAuth authorization URL. Returns: Tuple of (authorization_url, code_verifier) code_verifier is None if PKCE i

Get description for client credentials flow for a Microsoft service.

Get a comment by ID scoped to a specific case.

Get the organization's default AI model.

Retrieve a single case duration definition.

Resolve effective limits via cache first, then DB fallback.

Retrieve GitHub App credentials from organization secret. Returns: GitHub App credentials Raises: GitHubAppE

Get an invitation by its unique token. This method does not require scope checks as it is used during the public invitation acceptanc

Get the most recent version before the current one. Useful for quick rollback UX - returns the version to rollback to.

Get a platform registry by origin.

Get a role by ID with its scopes.

Get a row by ID.

Retrieve a schedule by its ID. Parameters ---------- schedule_id : AnyScheduleID The ID of the schedule

Cached version of get_setting function. Cache is keyed by (key, organization_id) to prevent cross-tenant data leakage. Uses context role and

Get a case tag by ID scoped to the current workspace.

Get a case tag by either UUID or slug; gracefully handle free-form names.

Extract normalized caller identity from the current access token.

Backward-compatible wrapper for SQL literal rendering.

Check if a user has all required scopes. Args: user_scopes: The set of scopes granted to the user required_scopes: The scopes req

Heartbeat a workflow permit.

Check if a feature flag is enabled.

True when ciphertext is not empty.

List full action details from registry index for a specific repository. Queries both org-scoped and platform registry tables using UNION ALL.

List all attachments for a case. Args: case: The case to list attachments for Returns: List of case attachme

List cases with a simplified default search query.

List invitations for a workspace. Args: workspace_id: The workspace to list invitations for. status: Optional filter

Retrieve a list of all members in the organization. This method queries the database to obtain all user records associated w

List all lookup tables for a workspace. Args: workspace_id: The ID of the workspace to list tables for Returns:

Load the registry from the origin and return the commit sha. If we pass a local directory, load the files directly.

Logout from Tracecat.

Normalize CSV headers for robust matching across parsers.