Browse a domain to see its available tools and descriptions. All tools are callable at any time — navigation is optional discovery, not a gate.

Check connectivity to SaaS Alerts by fetching the authenticated MSP user. Returns the list of available domains and connection status.

Query security events from SaaS Alerts with optional filters. Returns a paginated list of events matching the specified criteria.

Count security events matching the given filters without fetching full records.

Execute an advanced Elasticsearch query against the SaaS Alerts events index. Accepts a raw Elasticsearch query body for maximum flexibility.

Count events using a raw Elasticsearch query body without fetching full records.

Continue paginating through a previous event query result set using a scroll ID. Call after saas_alerts_events_query_advanced returns a scroll ID.

Get the list of recommended remediation actions for SaaS Alerts event types. Use this to map detected event types to actionable guidance.

List all SaaS Alerts customers for the authenticated partner.

Get a single SaaS Alerts customer by ID.

Create a new SaaS Alerts customer for the authenticated partner.

Update an existing SaaS Alerts customer by ID.

⚠ DESTRUCTIVE — IRREVERSIBLE. Permanently deletes a SaaS Alerts customer and all associated data. This action cannot be undone. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Replace the IP/country whitelist for a customer. This overwrites the existing whitelist. Confirm with the user before invoking.

⚠ HIGH-IMPACT. Replace the account-level whitelist for a customer. This overwrites the existing account whitelist. Confirm with the user before invoking.

Get the MSP user profile associated with the authenticated API key. Also used as a connectivity / credential check.

List all users associated with the authenticated partner account.

List all users belonging to a specific SaaS Alerts customer.

List devices that have been mapped (unified) to SaaS Alerts customer organizations.

List devices that have NOT yet been mapped to a SaaS Alerts organization. Optionally filter by confidence score or whether mapping suggestions are available.

List devices that have been explicitly marked as ignored.

List all device organizations visible to the authenticated partner.

Retrieve billing details for a specific billing date. Use saas_alerts_billing_list_dates first to discover available dates.

List all available billing dates for the authenticated partner. Use the returned dates as input to saas_alerts_billing_get_details.

List all scheduled reports configured for the authenticated partner.

Get a specific scheduled report by its ID.

Create a new scheduled report.

⚠ DESTRUCTIVE — IRREVERSIBLE. Permanently delete a scheduled report. This action cannot be undone. Confirm with the user before invoking.

Get the partner profile associated with the authenticated API key.

⚠ HIGH-IMPACT. Update the partner branding settings (logo, colours, etc.). This overwrites existing branding. Confirm with the user before invoking.