List all workflows in the current workspace

Create a new workflow

Get details of a specific workflow by ID

Update an existing workflow

Deploy (commit) a workflow to make it active

Export a workflow as YAML definition

Delete a workflow permanently

Validate a workflow WITHOUT deploying it. Checks actions, inputs, expressions, graph connectivity, and trigger connections. Returns errors and warnings.

Validate a workflow and automatically fix common issues: orphan nodes (position + connect), disconnected trigger (connect to first action), unclosed expressions (close }}). Returns a report of fixes applied.

Execute a workflow by ID with optional input payload

List workflow executions, optionally filtered by workflow ID

Get details of a specific workflow execution

Execute a workflow in DRAFT mode (uses uncommitted version, useful for testing before deploy)

Cancel a running workflow execution

Get compact execution details (lighter response with action-level status, inputs, results, errors)

List all cases in the current workspace

Create a new case

Update an existing case

Add a comment to a case

Get details of a specific case by ID

Delete a case permanently

List all comments on a case

List all tasks attached to a case

Create a task on a case (checklist item / investigative step)

Update a case task (status, title, assignee, etc.)

Delete a task from a case

List all custom case field definitions (workspace-scoped schema for case extras)

Define a new custom case field (appears on every case). Common types: text, number, boolean, date, long_text, url, select.

Update a custom case field definition

Delete a custom case field definition (IRREVERSIBLE — drops the field from all cases)

List all actions for a given workflow

Create a new action in a workflow

Get details of a specific action by ID

Update an existing action (title, description, inputs, control_flow). Note: inputs must be a YAML string, not a JSON object.

Delete an action from a workflow

Search for secrets by name or type

Create a new secret

Get a secret by name (returns metadata, not decrypted values)

Update an existing secret's keys, description, or environment

Delete a secret permanently

List all tables in the current workspace

Create a new table

Get details of a specific table by ID (includes columns)

Update a table's name or description

Delete a table

Create a new column in a table

Delete a column from a table

List rows in a table with optional pagination

Get a specific row by ID from a table

Insert a new row into a table. Data keys must match existing column names.

Update an existing row in a table

Delete a row from a table

Insert multiple rows into a table at once. Each row is a flat object with keys matching column names.

Get webhook details for a workflow (URL, status, methods)

Update webhook settings for a workflow (status, methods, entrypoint, CIDR allowlist)

Generate or rotate a webhook API key for a workflow

List all schedules in the current workspace

Create a new schedule for a workflow (cron or interval)

Get details of a specific schedule

Update a schedule (cron, interval, status, inputs)

Delete a schedule

Check if the Tracecat API is running and healthy

Get the workflow graph (nodes, edges, positions, version). Use this to inspect the visual layout and connections between actions.

Add connections (edges) between actions in a workflow graph. source_type is 'trigger' for the trigger node or 'udf' for actions. source_handle can be 'success', 'error', or null (default).

Remove connections (edges) between actions in a workflow graph.

Reposition action nodes in the workflow graph. Recommended layout: trigger at (500,0), first action at y>=300, 160px vertical spacing, 320px horizontal spacing for parallel nodes.

Reposition the trigger node in the workflow graph. Default recommended position is (500, 0).

Get inline documentation about Tracecat concepts. Topics: action_types, expressions, functions, control_flow, common_mistakes.

Get documentation of ALL Tracecat MCP tools grouped by category. Use this to discover available tools and learn how to use them. Optionally filter by category.

List available SOAR workflow templates. Returns template ID, title, description, category, and action count for each template.

Get the full YAML template for a SOAR workflow pattern. Use tracecat_list_templates to see available template IDs.

List all workflow folders in the current workspace

Create a new workflow folder

Rename a workflow folder

Delete a workflow folder

Move a workflow into a folder (or to root with '/')

Get the current workspace ID and base UI URL (useful for building workflow links)

List all workspaces accessible to the current user

Create a new workspace

Update a workspace (rename)

Delete a workspace (IRREVERSIBLE — deletes all workflows, cases, and data inside)

List non-sensitive workspace variables (names + environments). For secret values use secrets tools instead.

Search variables by names, ids, or environment — returns full variable objects with values

Get a variable by name (returns full object including values)

Create a non-sensitive variable (base URLs, project IDs, tenant defaults). For secrets use tracecat_create_secret.

Update a variable's values, description, or environment

Delete a variable permanently

List all configured OAuth integrations for the current user

Get integration details (provider config, connection status, grant type) for a specific provider

Test a client_credentials integration's connection without consuming tokens. For authorization_code integrations this may not apply.

Revoke an integration's OAuth tokens while preserving its configuration (reconnectable via UI)

Remove an integration entirely (configuration + tokens). Use disconnect if you only want to revoke tokens.

List all available OAuth providers (both built-in and custom) that can be used to create integrations

Get provider metadata — scopes, auth endpoints, schema — for building integration configuration