Skip to main content
You can view all available actions in the /actions page. Actions page

​
Action names

Every Tracecat action has a title, namespace, and name. Actions IDs are defined as <namespace>.<name>. For example, tools.slack.post_message uses the tools.slack namespace and the post_message name.

​
Action types

Tracecat actions are defined in either Python UDFs (user-defined functions) or YAML templates (domain-specific language for actions). See Custom actions for more details.

​
Action toolbar

If you’re building workflows in the UI, you can quickly find actions by namespace using the actions toolbar: Actions toolbar
  • core for built-in utilities such as HTTP requests, Python scripts, email, and gRPC actions
  • ai for non-agent AI actions
  • ai also powers the separate Agent group for actions such as ai.agent and ai.preset_agent
  • core.workflow for workflow actions, plus scatter and gather helpers
  • core.transform for transform actions
  • core.cases for case actions
  • core.table for table actions
  • core.sql and core.duckdb for SQL actions
  • tools.* for installed integrations; this menu also supports search

​
Expressions

Expressions use ${{ ... }}. Use these references inside expressions:
  • TRIGGER.<field>
  • ACTIONS.<ref>.result
  • SECRETS.<name>.<KEY>
  • VARS.<name>.<key>
  • ENV.<field>
  • var.<name>
  • FN.<name>(...)
See Expressions for syntax, operators, and literals. See JSONPath for field access and array access. See Functions for the full function list.

​
Success and error paths

Every action has a success and error path. The success path, which is represented by the green dot, runs when the action succeeds. The error path, which is represented by the red dot, runs when the action fails. Success error paths

​
Control flow

You can configure how an action runs from the “Control flow” tab in the action panel. Action control flow

​
Run if

Use run_if to execute an action only when a condition evaluates to a truthy value. If the condition is falsy, Tracecat skips the action. 
- ref: notify_team
  action: tools.slack.post_message
  run_if: ${{ TRIGGER.severity == "high" }}
  args:
    channel: ${{ SECRETS.slack.SECURITY_CHANNEL }}
    text: "High severity alert: ${{ TRIGGER.alert_id }}"

​
For each

Use for_each to run the same action once per item in a collection. If items contains N values, Tracecat runs the action N times. Inside the action inputs, reference the current item with var.<name>. For example, for_each: ${{ for var.user in TRIGGER.users }} runs the action len(TRIGGER.users) times, and each run reads the current item from var.user. 
- ref: email_user
  action: core.email.send
  for_each: ${{ for var.user in TRIGGER.users }}
  args:
    recipients:
      - ${{ var.user.email }}
    subject: "Tracecat notification"
    body: "Hello ${{ var.user.name }}"

​
Join strategy

join_strategy controls how a downstream action waits on multiple upstream branches. Use all to wait for every branch, or any to continue after the first branch completes.

​
Environment

Use environment to override which secrets or variables environment an action reads from. This is useful to target different secrets or variables for the same pre-built action (e.g. different Slack apps for tools.slack.post_message).

​
Start delay

Use start_delay to wait a fixed number of seconds before an action starts.

​
Timeout

Use timeout to cap how long Tracecat waits for an action attempt to finish. Defaults to 300 seconds.

​
Max attempts

Use max_attempts to control how many times Tracecat retries the action if it fails. Defaults to 1 attempt.