List every organization the configured API key can access.

List endpoints with server-side filters (status, online_status, os, reboot_required, …). For counts, use action1_endpoints_summary instead.

Walks every endpoint and returns counts (total, by status/platform/OS/online, reboot_required). ~1 KB output regardless of fleet size.

Fetch the general info block for a single endpoint, plus derived platform and connectivity.online flags.

Case-insensitive substring search restricted to hostname, user, OS and status fields. Walks the endpoint list page by page and matches client-side.

Returns missing-update items for one endpoint. Each item.id can be passed to action1_deploy_update.

Returns vulnerability findings for one endpoint. Returns a clear 403 if the API key lacks the vulnerabilities scope.

List every action template (id, name, description). Use ids with action1_get_action_template.

Fetch full details (parameters, supported platforms) for a single action template by id.

List recent automation instances for the org. For counts use action1_automations_summary instead.

Walks up to max_scan (default 1000) automation instances and returns counts (by_status, success/warning/failure); has_more: true means instances beyond max_scan were not counted. Instance lists carry no actions, so there is no per-template count. ~1 KB output.

Run PowerShell on a Windows endpoint via the run_powershell template. Runs as SYSTEM (no user profile).

Run a Bash script on a macOS endpoint via the run_script template. For OS-aware routing use action1_run_script.

Cross-platform script runner. Routes to PowerShell (Windows) or Bash (macOS); errors on Linux/unknown. For target_type='EndpointGroup' pass os ('windows' or 'macos').

Reboots the host via the reboot action template. Combine with action1_wait_for_automation to track recovery.

Deploy one or more updates (by package id) via the deploy_update template.

Deploy software via the deploy_package template. Use action1_get_action_template for the params schema.

Uninstall software via the uninstall_program template. Use action1_get_action_template for the params schema.

Trigger the run_data_collection template on an endpoint.

Returns the high-level status of one automation instance. For stdout use action1_get_automation_output.

Per-endpoint result rollup for an instance. Use action1_get_automation_output for stdout.

Returns filtered stdout for one endpoint of an automation instance. Strips Action1 status markers.

Block until an automation instance reaches a terminal status (Stopped/Success/Warning/Error) or timeout.

One-shot helper: starts an action (auto-routes by OS for 'script', or runs a template), polls until terminal, returns filtered output.

Create an organization. Creates a new organization. Perm: manage_organizations.

Get the current user settings. Gets settings for the currently authenticated user.

Update the current user settings. Updates settings for the currently authenticated user.

Search. Perm: view_endpoints, view_software_repository, view_reports.

Check endpoint status. Retrieves information if any endpoints were added to an organization.

Get the URL for agent installation. In order to manage an endpoint, the Action1 agent needs to be installed on it first. Perm: manage_endpoints.

Change an endpoint comment or name. Changes the user-defined 'comment', 'name' and custom attributes for the specified endpoint. Perm: manage_endpoint_attributes.

Delete an endpoint. Removes a specified endpoint and attempts to uninstall its agent. Perm: manage_endpoints.

Move the endpoint to another organization. Moves the endpoint to another organization. Perm: manage_endpoints.

Filtered/paginated variant of action1_list_missing_updates (curated). Use for severity/approval_status/sortby filtering. Get missing updates for an endpoint. Obtains a list of missing software updates for a specific endpoint. Perm: view_endpoints.

List endpoint groups. Lists existing endpoint groups. Use filters and narrow down and sort the returned results. Perm: view_endpoints.

Create a new group. Creates a new endpoint group within the specified organization. Perm: manage_endpoints.

Get an endpoint group. Gets a specific endpoint group by its ID. Perm: view_endpoints.

Change group settings. Changes settings for an existing endpoint group in the specified organization. Perm: manage_endpoints.

Delete an endpoint group. Deletes an existing group in the specified organization. Perm: manage_endpoints.

List endpoints from the group. Lists all endpoints included in the specified group. Perm: view_endpoints.

Start a new remote session. Sends a request to the endpoint to start a new remote session. Perm: remote_connect.

Get a remote session. Gets details for an existing remote session specified by ID. Perm: remote_connect.

Switch a current monitor. Changes the 'current_monitor' parameter for a specific remote session. Perm: remote_connect.

Get Agent Deployment settings. Obtains the current Agent Deployment settings in a specified organization. Perm: manage_endpoints.

Update Agent Deployment settings. Updates the Agent Deployment configuration for a specific organization. Perm: manage_endpoints.

List Deployers. Lists all Action1 Deployer services in the specified organization. Perm: manage_endpoints.

Get Deployer installation URL. Obtains an URL to download the Deployer installation file. Perm: manage_endpoints.

Get a specific Deployer. Obtains the current information about the specified Action1 Deployer service. Perm: manage_endpoints.

Delete Deployer. Perm: manage_endpoints.

List data sources. Gets a list of existing data sources. To filter out built-in data sources, set the 'builtin'. Perm: manage_data_sources, manage_reports.

Create a data source. Creates a new custom data source. At this time, all data sources are enterprise-wide. Perm: manage_data_sources.

Get a specific data source. Gets details about a specific data source. Perm: manage_data_sources, manage_reports.

Update a custom data source. Updates a custom data source specified by its ID. Perm: manage_data_sources.

Delete a custom data source. Deletes an existing custom data source. Note that you cannot remove built-in data sources. Perm: manage_data_sources.

List scripts. Gets a list of existing scripts from the Script Library. Perm: use_scripts.

Create a custom script. Creates a new custom script and adds it to the Script Library. Perm: manage_scripts.

Get a specific script. Gets details for a script specified by its ID. Perm: use_scripts.

Update a custom script. Updates details for an existing custom script specified by its ID. Perm: manage_scripts.

Delete a custom script. Deletes an existing custom script specified by its ID. Perm: manage_scripts.

List setting templates. Gets a list of existing setting templates.

Get a setting template. Gets details about a setting template specified by its ID.

List settings. Lists all existing settings. At this time, all settings are enterprise-wide. Perm: manage_advanced_settings.

Create a new setting. Creates a new setting. At this time, all setting templates are enterprise-wide. Perm: manage_advanced_settings.

Get setting configuration. Gets details about the setting configuration. Perm: manage_advanced_settings.

Update a setting. Updates an existing setting specified by its ID. Perm: manage_advanced_settings.

Delete a setting. Deletes an existing setting specified by its ID. Perm: manage_advanced_settings.

List reports. Gets a list of existing reports. At this time all reports are enterprise-wide.

List reports and categories. Gets a list of reports and categories. At this time all reports are enterprise-wide.

Create a custom report. Creates a custom report in the predefined Custom report category. Perm: manage_reports.

Update a custom report. Updates a custom report. You cannot changes a custom report's category. Perm: manage_reports.

Delete a custom report. Deletes a custom report specified by its ID. Perm: manage_reports.

Get report rows. Gets data organized by report rows. Use parameters to filter out returned results. Perm: view_reports.

Get report errors. Returns report errors for the specified report. Perm: view_reports.

Export a report. Exports data from the report. Use parameters to filter out exported data. Perm: view_reports.

Re-querying a report. This API method initiates an asynchronous update ("requery") of the report's underlying data source. Perm: view_reports.

Drill down to details. Expands report details to provide more information. Perm: view_reports.

Export report details. Exports reports data. Use parameters to filter out exported data. Perm: view_reports.

List Software Repository packages. Gets a list of Software Repository packages for the entire enterprise. Perm: view_software_repository.

Create new Software Repository package. Create a new custom Software Repository package object (with no versions) and set its initial basic. Perm: manage_software_repository.

Get Software Repository package settings. Gets details for a Software Repository package specified by its ID. Perm: view_software_repository.

Update Software Repository package settings. Perm: manage_software_repository.

Delete custom Software Repository package. Deletes a custom Software Repository package specified by its ID. Perm: manage_software_repository.

Clone Software Repository package. Creates a full copy of an existing Software Repository package under a new package ID. Perm: manage_software_repository.

Create new version in Software Repository package. Adds a new version to the specified Software Repository package. Perm: manage_software_repository.

Get version in Software Repository package. Gets details about a package version specified by its ID. Perm: view_software_repository.

Modify version in Software Repository package.

Delete version from Software Repository package. Deletes the specified version of the specified custom Software Repository package. Perm: manage_software_repository.

Delete additional action from version of Software Repository package. Perm: manage_software_repository.

Check for Software Repository package matching conflicts before creating a new package version. Perm: view_software_repository.

Check for package matching conflicts when editing and existing package version. Perm: view_software_repository.

Not supported by this server (see error text). Initialize package file upload. Initializes package file upload. The client starts by sending the initial upload request. Perm: manage_software_repository.

Not supported by this server (see error text). Upload package file chunks. Uploads package file chunks. Perm: manage_software_repository.

List missing updates. Gets a list of all missing updates. Use parameters to filter out updates in the returned results. Perm: approve_updates, view_dashboards, manage_automations.

List updates for a package. Gets a list of updates available for a package specified by its ID. Perm: approve_updates, view_dashboards, manage_automations.

List endpoints missing a specific update. Gets a list of endpoints that are missing updates for a specific package and its version,. Perm: approve_updates, view_dashboards, manage_automations.

Manage updates approvals. Manages approval status for multiple packages in bulk. Perm: approve_updates.

Get installed apps. Gets a list of installed apps. Use parameters to filter out apps in the returned results. Perm: view_installed_software.

Re-querying installed apps. This API method initiates an asynchronous update ("requery") of the installed software inventory. Perm: view_installed_software.

Get apps report errors. Returns apps report errors. Use parameters to filter out returned results. Perm: view_installed_software.

Get installed apps on a specific endpoint. Gets a list of installed apps on an endpoint specified by its ID. Perm: view_installed_software, view_endpoints.

Re-querying installed apps on a specific endpoint. Perm: view_installed_software, view_endpoints.

List automation schedules. Lists existing scheduled automations. Use parameters to filter out automations in the returned. Perm: view_automations.

Create a automation schedule. Schedules a new automation. The automation will be executed against a specified list of endpoints. Perm: manage_automations.

Get a specific automation schedule. Gets a scheduled automation specified by its ID. Perm: view_automations.

Update a automation schedule. Perm: manage_automations.

Delete a automation schedule. Deletes a scheduled automation specified by its ID. Perm: manage_automations.

Get the deployment statuses of a automation. Gets the deployment statuses of a automation specified by its ID. Perm: view_automations.

Delete an action from a automation. Deletes a specified action from a scheduled automation. Perm: manage_automations.

List automation instances. Gets a list of running and completed automations for the specified organization. Perm: view_automations.

Apply a automation. Immediately runs an instance of the automation on the specified endpoints in the specified. Perm: run_automations.

Get a specific instance. Gets details about a automation instance specified by its ID. Perm: view_automations.

List results. Gets a list of endpoints where the automation instance is being applied or has been executed. Perm: view_automations.

Raw automation-script output struct. For filtered stdout (status markers stripped) prefer action1_get_automation_output (curated). Get details of a specific endpoint. Gets details about the automation instance applied to an endpoint specified by its ID. Perm: view_automations.

Stop a automation. Stops applying a automation instance and aborts actions running on a remote endpoint. Perm: manage_automations.

Get diagnostic logs. Gets diagnostic logs. Use parameters to pre-filter returned results. Perm: manage_endpoints.

Get enterprise license information. Gets details about the enterprise license. Perm: manage_enterprise.

Request a free trial or its extension. Perm: manage_enterprise.

Request a quote. Sends a quote request to the Action1 Sales department. Perm: manage_enterprise.

Get usage statistics for an enterprise. Gets details about license usage for the entire enterprise. Perm: manage_enterprise.

Get usage statistics for organizations. Gets details about license usage with statistics for each organization individually. Perm: manage_organizations.

Get usage statistics for a specific organization. Gets details about license usage for an organization specified by its ID. Perm: manage_organizations.

List roles. Gets a list of available roles. Perm: manage_roles.

Create a role. Creates a new role. Perm: manage_roles.

Get a specific role. Gets details about a role specified by its ID. Perm: manage_roles.

Update a specific role. Updates a role specified by its ID. Perm: manage_roles.

Delete a specific role. Deletes a role specified by its ID. Perm: manage_roles.

Clone a role. Creates a copy of an existing role. Perm: manage_roles.

List users in a specific role. Gets a list of users in a role specified by its ID. Perm: view_users, assign_roles, manage_roles.

Assign user to a specific role. Assigns user to a role specified by its ID. Perm: assign_roles.

Unassign user from a specific role. Unassigns user from a role specified by its ID. Perm: assign_roles.

List permission templates. Gets a list of available permission templates.

Get enterprise settings. Gets settings for an enterprise. You can query data for your enterprise only.

Update enterprise settings. Updates settings for a current enterprise. Perm: manage_enterprise.

Close the entire enterprise associated with Action1 account. The request is available only for a free Action1 account. Perm: manage_enterprise.

Revoke account closure. The Action1 enterprise will be immediately reactivated and all your data will be retained. Perm: manage_enterprise.

Update organization settings. Updates settings for an organization specified by its ID. Perm: manage_organizations.

Delete an organization. Removes an organization from the enterprise. Perm: manage_organizations.

List report subscriptions. Gets a list of report subscriptions.

Create a new report subscription. Creates a new report subscription. Perm: view_reports.

Update the report subscription. Updates the report subscription. Perm: view_reports.

Delete the report subscription. Removes the report subscription.

List users. Gets a list of users within the current Action1 enterprise. Perm: view_users.

Create new user. Creates a new user. To create an SSO user, please first review the following documentation: -. Perm: manage_users.

Get user. Gets an existing user. Perm: view_users.

Update user. Updates an existing user. Perm: manage_users.

Delete user. Deletes an existing user. Perm: manage_users.

List the roles assigned to a user. Retrieves all roles assigned to a user specified by ID. Perm: manage_users.

Org-wide CVE rollup with 13 server-side filters. For per-endpoint vulnerabilities use action1_list_vulnerabilities (curated). List of all vulnerable software within the organization. Perm: view_vulnerabilities.

Lists endpoints in an organization affected by a specific vulnerability. Perm: view_vulnerabilities.

Detailed information on a specific vulnerability within an organization, including CVE details like attack vector. Perm: view_vulnerabilities.

Detailed information on a specific vulnerability in general (not for an organization), including CVE details like attack vector. Perm: view_vulnerabilities.

Lists past remediation actions for a specific vulnerability. Perm: view_vulnerabilities.

Documents applied compensating controls for a specific vulnerability. Perm: manage_vulnerabilities.

Updates record of compensating controls when remediation changes. Perm: manage_vulnerabilities.

Deletes remediation record of compensating controls. Perm: manage_vulnerabilities.

Get audit records of user actions. 'The Audit Trail contains event records associated with user actions, such as logins, remote. Perm: view_audit.

Export of audit trail data. Exports audit data. Use parameters to filter out exported data. Perm: view_audit.

Get an audit record by its ID. Get a specific audit record by its ID. Perm: view_audit.

Look up an endpoint group by name or UUID using exact-id/exact-name/starts-with/contains.

Fetch installed-software inventory for one endpoint, with optional name substring filter.

List recurring automations with optional client-side filters (status, template_id, group id substring).

Search /audit/events with an optional time window (sent to Action1 as timefrom/timeto) and case-insensitive substring filters on user, event and object.

Resolve a report by name or UUID, then return JSON rows or a CSV export blob.

Read-only correlation of vulnerabilities and the updates that fix them. Does NOT execute; pass the result to action1_deploy_update.

Add a single endpoint to an endpoint group. POSTs the spec array body [{method:POST,data:{endpoint_id,type}}] to /endpoints/groups/{org}/{group}/contents. Re-adding an existing member is a no-op.

Remove a single endpoint from an endpoint group. POSTs the spec array body [{method:DELETE,endpoint_id}] to /endpoints/groups/{org}/{group}/contents (there is no DELETE verb or /contents/{id} sub-path).

Generic passthrough to any Action1 API path. Bypasses per-tool schemas; use only when no dedicated tool exists. GET/HEAD run free; POST/PUT/PATCH/DELETE require the destructive guard (ACTION1_ALLOW_DESTRUCTIVE + confirm:YES + dry_run-default-true) and, as account operations, ACTION1_ALLOW_ACCOUNT_OPS.