List every RoboShadow organisation visible to this connector's refresh token, with each organisation's ID, name, and the caller's permission level. Start here to discover the organisationId every other tool needs.

List the users belonging to a RoboShadow organisation, with each user's display name, email, and permission level. PII-bearing - admin-gated.

Get a paged multi-factor-authentication report for a Microsoft-identity-linked organisation: each user's registered MFA methods, MFA status, and whether they hold the Global Administrator role. Results page in blocks of 5000 users - pass skipPages to page through until hasMoreData is false. PII-bearing identity data - admin-gated.

List the status of every external vulnerability scan (VScanner) for an organisation, with per-IP and per-domain scan status. Filter by isScheduled or status.

Get a detailed summary of one external vulnerability scan: scan details, IP vulnerability totals, and web vulnerability findings.

Get a per-target breakdown of one external vulnerability scan: CVE counts by severity, open-port counts, and component scan statuses for each scanned IP.

List applications grouped across the organisation (by application identity, not per-install), each with install/device counts, distinct version counts, and a best-matching WinGet package if one exists.

Get detailed information for one application group by its hashed group ID.

List applications installed on one device, with vendor, version, and last-seen time.

List every device in a RoboShadow organisation, with hardware/OS identity, network address, health scores, and pending-update/CVE counts. PII-bearing (IP/MAC address, logged-on user, serial number) - admin-gated.

Get detailed information about a single device. PII-bearing - admin-gated.

List Windows user profiles present on one device, including profile SID and disk path. PII-bearing - admin-gated.

List local/Active-Directory user accounts on one device, including email address, employee ID, and admin flag. PII-bearing - admin-gated.

Get antivirus/endpoint-protection state for one device: engine name, real-time/tamper-protection status, and any active threats.

List antivirus/firewall/protection status for every device in the organisation.

List ransomware-protection status for every device in the organisation.

Get an organisation-wide antivirus summary: active-threat count, devices missing antivirus/on-access/real-time protection, third-party vs. Windows Defender coverage, and open-firewall count.

List detected antivirus threats across the organisation, with severity and detection/remediation timing.

List Windows Defender configuration status (real-time protection, tamper protection, service state) for every device.

List Windows firewall status (enabled/disabled per profile: domain, private, public) for every device in the organisation.

List disks (drive letter, size, free space, used %) on one device.

List network shares exposed on one disk of one device. Includes share path and access details.

List disk usage across the organisation, grouped by disk (percentage used, encryption status, share count).

List disk information grouped by device (total disk/share counts, whether any drive is unencrypted).

Get an organisation-wide disk-usage summary: low-disk-space devices, unencrypted laptops/servers/workstations, shared-folder and USB-disk counts.

List hardware inventory grouped by device: processor, memory, serial number, system manufacturer/model, and end-of-life OS flag.

Get an organisation-wide hardware summary: total machines, servers, workstations, and machines running an end-of-life OS.

List Windows services on one device, including start mode, running state, and whether the service has an unquoted-path vulnerability.

List missing Windows updates for one device, with category, KB/package ID, and reboot requirement.

List a paginated missing-updates report grouped by device across the organisation, filterable by update category, workstation/server, and reboot-required status.

Get organisation-wide update summary statistics (devices needing critical/security/driver/rollup updates, reboot-pending count) plus the top devices requiring attention.

Get the vulnerability summary for one device: per-application CVE lists (with CVSS scores and available WinGet upgrades) and an overall severity rollup.

List applications with known vulnerabilities across the organisation, with per-severity CVE counts and available upgrades.

List CPE (Common Platform Enumeration) vulnerability findings across the organisation.

List CVEs affecting the organisation, each with CVSS/EPSS score, known-exploited-in-the-wild flag, and affected-OS/app/device counts.

List available fixes/patches for one CVE.

List devices with known vulnerabilities, each with per-severity CVE counts and an overall CVSS score.

Get an organisation-wide vulnerability summary: devices by severity, top-5 most critical apps/CVEs/devices, and the single most critical server/workstation.

List detailed vulnerability-remediation attempts across the organisation: action taken, category, target device, and success/failure outcome.

List the CVEs addressed by one remediation attempt.