Create a workspace admin role for testing.

Make a DELETE request.

Ensure tarball is extracted to a target directory. Uses per-cache-key locking to prevent duplicate downloads from concurrent async ta

Extract the first payload from a workflow history event.

Retrieve custom field values for a case.

Get a lookup table by name. Args: table_name: The name of the table to get Returns: The requested Table

List all events for a case.

List rows in tests using cursor semantics.

Create a test manifest with given action names.

Validate environment variable key is safe for protobuf config. Args: key: Environment variable name to validate. Raises: San

Generate SSE frames required to close active parts.

Create a TaskResult from a raw result value. Wraps the result in InlineObject for uniform envelope. Use this for creating TaskResult

Normalize a domain for display and stable lookup. Rules: - Trim surrounding whitespace - Drop any trailing dot - Lowercase - Norm

Double-quote a SQL identifier for safe use in DDL statements. Prevents syntax errors when identifier names collide with SQL reserved keywords

Check if the current user has permission to execute a specific action. This function checks the context scopes against the required action scope.

Run an AI agent. Either config or preset_slug must be provided. Args: user_prompt: The prompt for the agent.

Process jsonpaths in strings, sequences, and mappings.

Compute cache key from tarball URI.

Convert string value to appropriate Python type based on column type.

Create a new case field column and update the schema. Extends the parent to persist the optional ``kind`` metadata (e.g. LONG_TEXT, U

Return all validation errors.

Get the setting keys as a set.

Print a success message.

Search the LDAP directory. Args: search_base: The base of the search request. search_filter: The filter of the search

Sync a repository and create a versioned snapshot. Args: db_repo: The database repository to sync. target_version: Op

Get headers for Chronicle API requests.

Clamp a requested MCP list limit to a safe range.

Serialize a paginated response to a JSON-safe dict.

Validate cache key is a safe hex string. Args: cache_key: Cache key to validate (expected to be SHA256 hex). Raises: Sandbox

Build a DSLInput from a Workflow.

Create a single approval record.

Create a new attachment for a case with security validations. Args: case: The case to attach the file to params: The

Create a new comment on a case.

Create a new case duration definition.

Create a custom role for the organization.

Execute a parameterized SQL query on an external database.

Get a comment by ID. Args: case: The case to get the comment for comment_id: The ID of the comment to get Re

Get a folder by ID. Args: folder_id: The ID of the folder Returns: The folder or None if not found

List cases with default filtering and sorting options.

Validate an OAuth endpoint URL for security. Args: url: The endpoint URL to validate base_domain: Optional base domain to validat

Validate that a scope string follows the allowed format. Rules: - Lowercase alphanumeric characters - Allowed special characters: : _ . -

Set the session in the context.

Reset the Redis client and pool so the next attempt reinitializes them.

Decode a cursor to timestamp and ID.

Evaluate a jsonpath expression on the target object (operand).

Get the current organization settings. Returns: Settings: The current organization settings configuration

Get a configured S3 client for either AWS S3. Yields: Configured aioboto3 S3 client

Paginate through a HTTP response. Returns a list of items when `items_jsonpath` is provided (flattened across pages), respecting the `limit`

Recursively convert a JSON schema to a Pydantic model. This function will recursively convert a JSON schema to a Pydantic model. It will also

Build a CaseCreate payload while keeping type checkers happy.

Retrieve StoredObjects and replace with raw values in context copy. With uniform envelope design, TaskResult.result is ALWAYS a StoredObject.

Convert MCP tool name to readable action name for display. MCP tool naming convention: mcp__{server_name}__{tool_name} Handles Tracecat regi

Store data, potentially externalizing if over threshold. Args: key: Storage key (e.g., "results/wf-123/action-1/uuid.json")

Return tool arguments without Tracecat-internal proxy metadata. Args: args: Tool arguments that may include Tracecat proxy metadata.

Queue the next tasks that are ready to run.

Add a tag association to a workflow.

Convert a non-negative integer to a base62 string. Args: num: Non-negative integer to encode Returns: Base62 encoded string

Emit an end-of-turn marker.

Extract secrets from templated objects using AST parsing.

Get action from index with manifest from the version. Searches both org-scoped and platform registries using a single UNION ALL query.

Get an agent preset by ID with proper error handling.

Create a signed executor JWT scoped to a specific workflow execution.

Dependency to parse webhook payload based on Content-Type header. Args: request: FastAPI request object content_type: Conten

Set a secret by name. Sets the secret in the registry-owned context.

Update a case.

Update an MCP integration.

Upload a file attachment to a case.