Show which Action1 identity these API credentials map to, and their permissions.

Use this first when a call fails with 403 — it tells you whether the API credential simply lacks access to the organization you asked about.

Returns: The /Me object: account identity and granted API permissions.

List the organizations (tenants) these credentials can see.

Most other tools need an org_id from here.

Get one organization's details.

List managed endpoints (machines with the Action1 agent installed).

Get full detail for one managed endpoint.

List discovered but unmanaged devices — seen on the network, no agent installed.

Useful for finding coverage gaps: machines that exist but are not being patched.

List endpoint groups, which are what policies and automations target.

List the endpoints in one group.

List updates missing across the organization's endpoints.

List installed software, tenant-wide or for one endpoint.

List app packages available in the Action1 software repository.

These are what a deployment could install — this tool does not deploy anything.

List CVEs detected across the organization's endpoints.

Get details for one CVE as Action1 sees it in this organization.

List the endpoints affected by one CVE.

List remediations already configured for one CVE.

Read-only: this shows what remediation exists, it does not create or run one.

List policy instances (deployments and remediations configured in the tenant).

Show per-endpoint results for one policy — what succeeded, failed or is pending.

List automations (scheduled policies) configured in the organization.

List scripts available in the tenant.

Useful for auditing what automation could run. This tool cannot execute them.

List the report definitions available in the tenant.

Pair with action1_get_report_data to read one.

Read the rows of one report.

Returns Action1's last computed data. This tool does not trigger a requery, so figures can lag the console.