ThreatLocker Scheduled Actions
scheduled_actionsList and manage scheduled ThreatLocker agent version updates. Filter by organization or computer group, get details, schedule batched rollouts, or abort pending actions.
Instructions
Query ThreatLocker scheduled agent actions.
Scheduled actions are pending operations on ThreatLocker agents, primarily version updates. Updates are batched and scheduled within maintenance windows to avoid disruption.
Common workflows:
List all scheduled actions: action=list
Search with filters: action=search, organizationIds=["..."], computerGroupIds=["..."]
Get scheduled action details: action=get, scheduledActionId="..."
Get available targets for scheduling: action=get_applies_to
Scheduled action types: Version Update (scheduledType=1).
Pitfalls:
isAscending is inverted by the API: true (or omitted) sorts descending (high to low); set false for ascending.
search (GetByParameters) is keyed by scheduledId — pass it to filter to a specific scheduled action's computers; use list for the top-level set.
Permissions: Edit Computers, Edit Computer Groups, View Computers. Pagination: search action is paginated (use fetchAllPages=true to auto-fetch all pages). Key response fields: scheduledAgentActionId, scheduledType, scheduledDateTime, computerName, computerGroupName, status.
Related tools: computers (see current versions), computer_groups (target groups for updates), organizations (filter by org)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | list=all scheduled actions, search=filtered search, get=single action details, get_applies_to=available scheduling targets, schedule=schedule a batched agent version update, abort=cancel a scheduled action (abortAll=true for the whole action, or appliesTo=[computers] for specific ones) | |
| osType | No | Filter get_applies_to targets by OS: 1=Windows, 2=Mac, 3=Linux, 7=Red Hat Enterprise Linux 6 | |
| orderBy | No | Field to sort by | |
| abortAll | No | abort: cancel the entire scheduled action across all targets. When true, appliesTo is ignored; when false/omitted, supply appliesTo. | |
| pageSize | No | Results per page (default: 25, max: 500) | |
| appliesTo | No | Targets for schedule (each {appliesToId, appliesToTypeId}); for abort, the computers to cancel (each {appliesToId}). Resolve ids via get_applies_to. | |
| startDate | No | When the rollout starts (ISO 8601). Defaults to now. | |
| pageNumber | No | Page number (default: 1) | |
| searchText | No | Free-text filter for search (e.g. computer name). | |
| batchAmount | No | Computers updated per batch (REQUIRED for schedule). Omitting it would update the whole fleet at once. | |
| isAscending | No | Sort order. Note: the API inverts this — true (or omitted) returns results in descending order (high to low); set false for ascending. Default: true. | |
| scheduledId | No | Filter search to the computers within a specific scheduled action (GUID). Find via list first. | |
| fetchAllPages | No | Fetch all pages automatically (max 10 pages). Default: false (single page). | |
| scheduledType | No | Scheduled type: 1=Version Update (the only supported type). Default: 1. | |
| windowEndTime | No | Daily window end, 24h "HH:MM". | |
| includeChildren | No | Include child organizations (list and get_applies_to actions) | |
| organizationIds | No | Filter by organization GUIDs. Find via organizations first. | |
| response_format | No | Output format: markdown (default, human-readable) or json (structured) | markdown |
| targetVersionId | No | ThreatLocker version GUID to roll out (schedule action). Get it from the versions tool value field. | |
| windowStartTime | No | Daily window start, 24h "HH:MM". | |
| computerGroupIds | No | Filter by computer group GUIDs. Find via computer_groups first. | |
| scheduledActionId | No | Scheduled action GUID (required for get). Find via list or search first. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | Response data — shape varies by action | |
| error | No | ||
| success | Yes | ||
| pagination | No |