Core actions

Core actions are the building blocks of Tracecat workflows and action templates. All core actions are under the core namespace. They are distinct from pre-built integrations in the tools namespace, which are pre-configured for specific 3rd-party tools.

There are five sub-namespaces under core:

• core
• core.transform
• core.workflow
• core.require
• core.script

core actions are the most commonly used actions in Tracecat. They include:

​

Reshape

Reshape is a simple action that takes a single input value (e.g. a string, number, or object), evaluates any expressions and functions, and returns the result.

The following examples show common use-cases and inputs for the Reshape action.

# Get one value from a previous action
value: ${{ ACTIONS.get_user.result.data.user.name }}

# Get multiple values from a previous action
value:
  name: ${{ ACTIONS.get_user.result.data.user.name }}
  email: ${{ ACTIONS.get_user.result.data.user.email }}

# Get data from the trigger
value: ${{ TRIGGER.data.user }}

​

HTTP Request

Perform an HTTP request to a given URL.

Parameters

• url (HttpUrl, required): The destination of the HTTP request.
• method (Literal[“GET”, “POST”, “PUT”, “PATCH”, “DELETE”], required): HTTP request method.
• headers (dict[str, str], optional): HTTP request headers.
• params (dict[str, Any], optional): URL query parameters.
• payload (dict[str, Any] | list[Any], optional): JSON serializable data in request body (POST, PUT, and PATCH).
• form_data (dict[str, Any], optional): Form encoded data in request body (POST, PUT, and PATCH).
• files (dict[str, str | FileUploadData], optional): Files to upload using multipart/form-data.
  • The dictionary key is the form field name for the file (e.g., "file", "attachment1").
  • The value can be:
    1. A simple base64 encoded string representing the file content. In this case, the form_field_name will also be used as the filename in the Content-Disposition header.
    2. A dictionary (FileUploadData) with the following keys:

• • filename (str): The actual filename to be sent in the Content-Disposition header (e.g., "mydocument.pdf"). If not provided or empty, the form_field_name will be used.

• content_base64 (str, required): The base64 encoded string of the file content.
• content_type (str, optional): The MIME type of the file (e.g., "application/pdf", "image/png"). If not provided, httpx will attempt to guess it.
• auth (dict[str, str], optional): Basic auth credentials with username and password keys.
• timeout (float, optional, default: 10.0): Timeout in seconds.
• follow_redirects (bool, optional, default: False): Follow HTTP redirects.
• max_redirects (int, optional, default: 20): Maximum number of redirects.
• verify_ssl (bool, optional, default: True): Verify SSL certificates.

File Upload Examples (files parameter):

1. Simple Base64 Upload (filename defaults to form field name):

   Copy

   Ask AI

   actions:
     - name: Upload Text File
       provider: core
       action: http_request
       params:
         url: https://httpbin.org/post
         method: POST
         files: {"my_text_file.txt": "{{ FN.to_base64(\"Hello, this is the file content!\") }}"}
   

2. Upload with Custom Filename and Content Type (using FileUploadData dict):

   Copy

   Ask AI

   actions:
     - name: Upload PDF Document
       provider: core
       action: http_request
       params:
         url: https://httpbin.org/post
         method: POST
         files: {
           "document_field":
             filename: "Annual Report.pdf"
             content_base64: "{{ FN.to_base64(ACTIONS.file_content.result.data) }}"
             content_type: "application/pdf"
         }
   

3. Multiple File Uploads (mixed simple and detailed):

   Copy

   Ask AI

   actions:
     - name: Upload Multiple Attachments
       provider: core
       action: http_request
       params:
         url: https://httpbin.org/post
         method: POST
         form_data: # Can be combined with files
           user_id: "user123"
         files: {
           "main_image.png": "{{ FN.to_base64(ACTIONS.file_content.result.data) }}"
           "additional_notes": # Detailed
             filename: "notes.txt"
             content_base64: "{{ FN.to_base64(\"Some notes here.\") }}"
             content_type: "text/plain"
         }
   

Returns

HTTPResponse (dict):

• status_code (int)
• headers (dict)
• data (str | dict | list | None)

​

HTTP Polling

Perform an HTTP request to a given URL with polling.

Parameters

• Accepts all parameters from core.http_request except for the files parameter. core.http_poll does not support file uploads.
• poll_retry_codes (int | list[int], optional): Status codes on which the action will retry. If not specified, poll_condition must be provided.
• poll_interval (float, optional): Interval in seconds between polling attempts. If not specified, defaults to polling with exponential wait.
• poll_max_attempts (int, optional, default: 10): Maximum number of polling attempts. If set to 0, the action will poll indefinitely (until timeout).
• poll_condition (str, optional): User defined condition that determines whether to retry. The condition is a Python lambda function string. If not specified, poll_retry_codes must be provided.

Returns

HTTPResponse (dict) - same as core.http_request.

​

Tutorial: URLScan

URLScan uses a two-step process to get a threat intelligence report on a URL:

1. Call the /scan endpoint to submit the URL for scanning.
2. Poll the /result endpoint repeatedly until the status code changes from 404 to 200.
3. Uses a reshape to extract the maliciousness score and categories from the response body.

url: https://urlscan.io/api/v1/scan/
method: POST
headers:
  API-key: ${{ SECRETS.urlscan.URLSCAN_API_KEY }}
payload:
  url: https://crowdstrikebluescreen.com
  visibility: private

url: https://urlscan.io/api/v1/result/${{ ACTIONS.scan_url.result.data.uuid }}
method: GET
poll_retry_codes: [404]
headers:
  API-key: ${{ SECRETS.urlscan.URLSCAN_API_KEY }}

value:
  verdict: ${{ ACTIONS.lookup_url.result.data.verdicts.urlscan.malicious }}
  score: ${{ ACTIONS.lookup_url.result.data.verdicts.urlscan.score }}