Insert a new row into the table. Args: params: The row data to insert Returns: A mapping containing the inse

List comments grouped by top-level thread.

List all organizations.

Lookup a value in a table with automatic retry on database errors.

Render a provider messages request into an OpenAI chat payload.

Promote a specific version to current. Guardrails: - Version must exist and belong to this repository - Version must have a v

Build the prompt for the tool call agent.

Rank items using an LLM based on natural language criteria. Args: items: List of items to rank (each with 'id' and 'text').

Read a framed message from the socket. Args: reader: The asyncio stream reader. expected_type: If provided, validates the message

Resolve a preset version from logical preset identity and optional pin.

Resolve a Git reference to its SHA. Args: repo_url: Git repository URL. ref: Git reference to resolve. If None, resolves HEAD.

Restore a previously truncated tool name.

Retrieve data from a StoredObject. Args: stored: StoredObject with either inline data or an ObjectRef Returns:

Retrieve a StoredObject using the backend encoded in its reference.

Revoke a pending invitation. Args: invitation_id: The invitation UUID. Returns: OrganizationInvitation: The

Main monitoring loop.

Seed system scopes into the database. Uses PostgreSQL upsert (INSERT ... ON CONFLICT DO NOTHING) for idempotency. System scopes have organiza

Set a value only if the key does not exist (SET NX).

Convert a value to a JSONable Python object. Drop nulls and use fallback for unknown values.

Update a custom field column and update the schema if needed.

Validate the DSL expressions at commit time.

Validate that approval responses cover all expected tool calls.

Verify executor JWT and return the token payload. Returns the ExecutorTokenPayload containing workspace_id, user_id, service_id, wf_id, and w

Yield an agent preset configuration with provider credentials loaded. Args: preset_id: Agent preset ID to load slug:

Build the Redis key used for action permit tracking for an org.

Reject operations on internal/system-managed column names.

Construct the execution context for an action with resolved dependencies.

Normalize credential inputs to trimmed strings or None.

Helper to create DSL bypassing validation during construction.

Emit stream.done() exactly once. This helper ensures the stream end marker is emitted exactly once, even if multiple code paths could

Classify the stored GitHub App secret without failing on corruption.

Get access token from Tracecat's OAuth system.

Check if message has a tool return.

List rows in tests using cursor semantics with deterministic ordering.

Create a test manifest with the given actions.

Build a minimal MiddlewareContext for tool-call middleware tests.

Parse an s3://bucket/key URI into (bucket, key).

PreToolUse hook invoked by Claude SDK before each tool use. The proxy MCP server only exposes pre-filtered allowed actions. Tools are

Ensure an organization exists.

Set ctx_logical_time for deterministic FN.now() in template evaluations.

Start a batch of identical workflows using the same role and DSL. Returns: A list of workflow handles, one per started workflow, so calle

Temporarily add paths to sys.path for module imports. This is used by TestBackend to make custom registry modules available during in-process

Column list for API-facing queries, excluding internal columns.

Write a synthetic JSON error response back to the sandbox client.

Acquire the migration lock for PostgreSQL connections. Returns True if a lock was acquired and should be released by caller.

Factory to create workers configured for agent workflows.

Build list-row trigger summary fields from denormalized query columns.

Build a workspace-scoped External ID for AWS AssumeRole.

Check if an organization has an entitlement, raising if not. Args: org_id: The organization ID to check entitlement:

Convert supported inputs into a date.

Create a service using the process Redis client and configured permit TTL.

Create a RegistryVersion with manifest for the given actions. Returns a RegistryLock that can be used in RunActionInput.

Create a RegistryVersion with manifest for the given actions.

Create a new case tag in the current workspace.

Soft delete an attachment. Implements soft deletion where the file is removed from blob storage but the database record is preserved

Delete a custom field and remove it from the schema.

Delete an MCP integration.

Delete a task. Args: task_id: The ID of the task to delete Raises: TracecatNotFoundError: If the task is not

Delete a workflow and clean up associated resources. This method ensures that Temporal schedules are properly deleted before the data

Build the Redis key for an organization's effective limits cache.

Encrypt a client credential using the service's encryption key.

The components of a workflow execution ID.

Get all tier-related activities for worker registration.

Get the bucket key for the request. Args: request: The FastAPI request Returns: A string key for th

Data converter using Pydantic JSON conversion with optional compression.

Get decrypted access and refresh tokens for an integration.

Get the default (first) organization ID. This is used by auth modules that need to read platform-level settings before user authentication pr

Compute the scopes a user has from group memberships. This method: 1. Finds all groups the user belongs to 2. Gets all role a