Count hosts
Action ID:tools.fleetdm.count_hosts
Count hosts matching the given filters without returning host records.
Reference: https://fleetdm.com/docs/rest-api/rest-api#count-hosts
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
The value to get results after. This needs
order_key defined, as that’s the column that would be used.Default: null.Available in Fleet Premium. Filters the hosts by the status of the MDM bootstrap package on the host. Valid options are ‘installed’, ‘pending’, or ‘failed’. Note: If this filter is used in Fleet Premium without a fleet ID filter, the results include only “Unassigned” hosts.Default:
null.A valid label ID. Can only be used in combination with
order_key, order_direction, after, status, query and fleet_id.Default: null.MDM enrollment filter (manual, automatic, enrolled, pending, unenrolled).Default:
null.The ID of the mobile device management (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider and URL).Default:
null.The name of the mobile device management (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider).Default:
null.The ID of the munki issue (a Munki-reported error or warning message) to filter hosts by (that is, filter hosts that are affected by that corresponding error or warning message).Default:
null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.The name of the operating system to filter hosts by.
os_version must also be specified with os_nameDefault: null.Filters the hosts by the status of the operating system settings applied to the hosts. Valid options are ‘verified’, ‘verifying’, ‘pending’, or ‘failed’. Note: If this filter is used in Fleet Premium without a fleet ID filter, the results include only “Unassigned” hosts.Default:
null.Disk encryption status filter (verified, verifying, action_required, enforcing, failed, removing_enforcement).Default:
null.The version of the operating system to filter hosts by.
os_name must also be specified with os_versionDefault: null.Filter by hosts evaluated against this policy ID (pair with policy_response).Default:
null.Create global policy
Action ID:tools.fleetdm.create_global_policy
Create a global compliance policy from an osquery SQL check.
Reference: https://fleetdm.com/docs/rest-api/rest-api#create-policy
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Comma-separated platforms the policy targets (e.g. darwin,windows,linux).Default:
null.Create report
Action ID:tools.fleetdm.create_report
Create a saved report (saved query) in Fleet.
Reference: https://fleetdm.com/docs/rest-api/rest-api#create-report
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Comma-separated platforms the report targets (e.g. darwin,windows,linux).Default:
null.Delete host
Action ID:tools.fleetdm.delete_host
Delete a host from Fleet by its numeric ID.
Reference: https://fleetdm.com/docs/rest-api/rest-api#delete-host
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Get current user
Action ID:tools.fleetdm.get_me
Get the authenticated Fleet user and its roles and accessible fleets.
Reference: https://fleetdm.com/docs/rest-api/rest-api#me
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
If set to true, includes the columns the user hides on the Hosts page (default:
false).Default: null.Get disk encryption summary
Action ID:tools.fleetdm.get_disk_encryption_summary
Get aggregate disk encryption (FileVault and BitLocker) status counts by OS.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-disk-encryption-status
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Get fleet policy
Action ID:tools.fleetdm.get_fleet_policy
Get a fleet-level policy with its passing and failing host counts.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-fleet-level-policy
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Get global policy
Action ID:tools.fleetdm.get_global_policy
Get a single global policy including its pass and fail host counts.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-policy
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Get host
Action ID:tools.fleetdm.get_host
Get full details for a single host by its numeric Fleet ID, including inventoried users and per-host policy responses.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-host
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Get host activities
Action ID:tools.fleetdm.get_host_activities
List the past activity audit trail for a single host.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-past-activity
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
The value to get results after. This needs
order_key defined, as that’s the column that would be used.Default: null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.What to order results by. Allowed fields are
id, created_at, user_id, activity_type, user_name, user_email, and fleet_initiated.Default: null.Get host by identifier
Action ID:tools.fleetdm.get_host_by_identifier
Get full details for a single host by hostname, UUID, or hardware serial, including inventoried users and per-host policy responses.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-host-by-identifier
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Get host configuration profiles
Action ID:tools.fleetdm.get_host_configuration_profiles
Get the OS settings and configuration profiles applied to a host.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-os-settings-configuration-profile
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Get host encryption key
Action ID:tools.fleetdm.get_host_encryption_key
Get a host’s disk encryption recovery key (FileVault or BitLocker).
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-disk-encryption-key
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Get host MDM
Action ID:tools.fleetdm.get_host_mdm
Get the MDM enrollment status and server URL for a host.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-mobile-device-management-mdm-information
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Get host report data
Action ID:tools.fleetdm.get_host_report_data
Get a specific report’s saved data for a single host.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-report-data
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Get host summary
Action ID:tools.fleetdm.get_host_summary
Get aggregate host counts grouped by status and platform.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-summary
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Get label
Action ID:tools.fleetdm.get_label
Get the specified label.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-label
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Get labels summary
Action ID:tools.fleetdm.get_labels_summary
Get basic information for global and accessible fleet labels.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-labels-summary
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Available in Fleet Premium. Filters to labels belonging to the specified fleet, plus global labels. Specify
"global" to show only globally-available labels. If omitted, Fleet returns all global labels, plus all labels for fleets to which the requestor has access.Default: null.Get MDM command results
Action ID:tools.fleetdm.get_mdm_command_results
Get the execution results and status for a previously enqueued MDM command.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-mdm-command-results
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
The host’s
hostname, uuid, or hardware_serial. Returns only results for the specified host.Default: null.Get OS settings summary
Action ID:tools.fleetdm.get_os_settings_summary
Get aggregate OS settings status counts (verified, verifying, pending, failed).
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-os-settings-configuration-profiles-status
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Get report
Action ID:tools.fleetdm.get_report
Get a single saved report (saved query) by its ID.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-report
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Get report data
Action ID:tools.fleetdm.get_report_data
Get the most recent saved (scheduled) results for a report.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-report-data
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Filter the report to only include hosts that are associated with the fleet specified.Default:
null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "desc".Default: null.What to order results by. Valid options are
"last_fetched", "host_name", "host_id", or the name of a result column. Result column values are sorted as strings, and the built-in options take precedence over a result column with the same name. Default is "last_fetched".Default: null.Results per page. If omitted, all results are returned and
meta is not included.Default: null.Search query keywords. Matches the host’s display name and any result column value.Default:
null.Get software title
Action ID:tools.fleetdm.get_software_title
Get a single software title with its versions, vulnerabilities, and host counts.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-software
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Get software version
Action ID:tools.fleetdm.get_software_version
Get a software version with its vulnerabilities and host counts.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-software-version
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Available in Fleet Premium. Filters response data to the specified fleet. Use
0 to filter by “Unassigned” hosts.Default: null.Get vulnerability
Action ID:tools.fleetdm.get_vulnerability
Get details for a single CVE including affected software, CVSS, EPSS, and CISA status.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-vulnerability
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
List activities
Action ID:tools.fleetdm.list_activities
List the global audit log of actions performed in Fleet.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-activities
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Indicates the activity type to filter by. See the available types in Fleet’s audit logs documentation.Default:
null.The value to get results after. This needs
order_key defined, as that’s the column that would be used.Default: null.Filters to include only activities that happened before this date. If not specified, set to now.Default:
null.Filters to include only activities that happened after this date. If not specified, set to the earliest possible date.Default:
null.List configuration profiles
Action ID:tools.fleetdm.list_configuration_profiles
List the MDM configuration profiles defined in Fleet.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-configuration-profiles
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
The value to get results after. This needs
order_key defined, as that’s the column that would be used.Default: null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.What to order results by. Can be ordered by
name, created_at, or uploaded_at.Default: null.List fleet policies
Action ID:tools.fleetdm.list_fleet_policies
List the compliance policies scoped to a single fleet (team).
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-fleet-level-policies
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
The value to get results after. This needs
order_key defined, as that’s the column that would be used.Default: null.Filters by automation type. Supported values are “software”, “scripts”, “calendar”, “conditional_access”, and “other”.Default:
null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.What to order results by. Allowed fields are
id, name, team_id, created_at, updated_at, failing_host_count, and passing_host_count.Default: null.Filters policies by targeted platform. Accepts
"darwin", "windows", "linux", or "chrome". Policies that target all platforms (empty platform field) are always included.Default: null.List fleets
Action ID:tools.fleetdm.list_fleets
List fleets (teams) used to scope hosts, policies, and queries.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-fleets
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
The value to get results after. This needs
order_key defined, as that’s the column that would be used.Default: null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.List global policies
Action ID:tools.fleetdm.list_global_policies
List global compliance policies with their passing and failing host counts.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-policies
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
The value to get results after. This needs
order_key defined, as that’s the column that would be used.Default: null.Filters policies by targeted platform. Accepts
"darwin", "windows", "linux", or "chrome". Policies that target all platforms (empty platform field) are always included.Default: null.List host reports
Action ID:tools.fleetdm.list_host_reports
List the saved reports for a host, including when results were last fetched.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-hosts-reports
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.What to order results by. Valid options are
"name" and "last_fetched". Default is "name".Default: null.List host software
Action ID:tools.fleetdm.list_host_software
List the software installed on a host along with detected vulnerabilities.
Reference: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-software
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
If true, only include AI tools. Requires Fleet Premium and server support for AI tools inventory; unavailable in Fleet 4.93.0. Older servers can ignore this filter.Default:
null.If
true or 1, only list software that is available for install (added by the user). Default is false.Default: null.Filter extensions by their browser or IDE. Requires source and server support for software type filters; unavailable in Fleet 4.93.0. Older servers can ignore this filter.Default:
null.If
true, filters to only include software at the top level of the /Applications folder. This parameter applies only to macOS hosts, and is ignored for hosts on other platforms. Default is false.Default: null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.Filter by the osquery software source (for example, apps, npm_packages, chrome_extensions, ai_clis, mcp_servers, or ai_skills). Requires server support for software type filters; unavailable in Fleet 4.93.0. Older servers can ignore this filter.Default:
null.List hosts
Action ID:tools.fleetdm.list_hosts
List and search hosts enrolled in Fleet with server-side filters.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-hosts
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
A comma-delimited list of fields to include in each host’s
additional object. This query is populated by the additional_queries in the features section of the configuration YAML.Default: null.The value to get results after. This needs
order_key defined, as that’s the column that would be used. Note: Use page instead of afterDefault: null.Available in Fleet Premium. Filters the hosts by the status of the MDM bootstrap package on the host. Valid options are ‘installed’, ‘pending’, or ‘failed’.Default:
null.Filter hosts that are talking to this Fleet server for MDM features. In rare cases, hosts can be enrolled to one Fleet server but talk to a different Fleet server for MDM features. In this case, the value would be
false. Always false for Linux hosts.Default: null.Filters the hosts by DEP profile assignment status. Valid options are ‘SUCCESS’, ‘FAILED’, ‘THROTTLED’ or ‘NOT_ACCESSIBLE’. Only Apple hosts which are, or were assigned to Fleet in ABM will be returned.Default:
null.If
true, the response will only include Apple MDM hosts with DEP profile assignment errors(mdm.dep_profile_error: true).Default: null.If
true, hosts will return failing policies as 0 regardless of whether there are any that failed for the host. This is meant to be used when increased performance is needed in exchange for the extra information.Default: null.If
true, the response will include lock and wipe status (mdm.device_status) and mdm.pending_action information for each host.Default: null.MDM enrollment filter (manual, automatic, enrolled, pending, unenrolled).Default:
null.The ID of the mobile device management (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider and URL).Default:
null.The name of the mobile device management (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider).Default:
null.The ID of the munki issue (a Munki-reported error or warning message) to filter hosts by (that is, filter hosts that are affected by that corresponding error or warning message).Default:
null.Filters the hosts by the status of the operating system settings applied to the hosts. Valid options are ‘verified’, ‘verifying’, ‘pending’, or ‘failed’. Note: If this filter is used in Fleet Premium without a fleet ID filter, the results include only “Unassigned” hosts.Default:
null.Disk encryption status filter (verified, verifying, action_required, enforcing, failed, removing_enforcement).Default:
null.Filter by hosts evaluated against this policy ID (pair with policy_response).Default:
null.If
true, the response will include end user data for each host, including identity provider (IdP) details and other emails.Default: null.Requires
profile_uuid. Valid options are ‘verified’, ‘verifying’, ‘pending’, or ‘failed’.Default: null.The status of the software install to filter hosts by. One of:
pending_install, failed_install, installed, pending_uninstall, failed_uninstall, pending, or failed. Mutually exclusive with software_version_id, and must be supplied if software_title_id is set.Default: null.List hosts by vulnerability
Action ID:tools.fleetdm.list_hosts_by_vulnerability
List the hosts affected by a specific CVE.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-hosts
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Available in Fleet Premium. Filters the hosts to only include hosts with less GB of disk space available than this value. Must be a number between 1-100.Default:
null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.The name of the operating system to filter hosts by.
os_version must also be specified with os_name. See note below for filtering Windows hosts.Default: null.The version of the operating system to filter hosts by.
os_name must also be specified with os_version. See note below for filtering Windows hosts.Default: null.If
true, the response will include policy data for each host, including Fleet-maintained policies.Default: null.Search query keywords. Searchable fields include
hostname, hardware_serial, uuid, ipv4, and end user email addresses.Default: null.List hosts in label
Action ID:tools.fleetdm.list_label_hosts
List the hosts that are members of a given label.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-labels-hosts
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
The value to get results after. This needs
order_key defined, as that’s the column that would be used.Default: null.Available in Fleet Premium. Filters the hosts by the status of the MDM bootstrap package on the host. Valid options are ‘installed’, ‘pending’, or ‘failed’. Note: If this filter is used in Fleet Premium without a fleet ID filter, the results include only “Unassigned” hosts.Default:
null.If “true”, hosts will return failing policies as 0 regardless of whether there are any that failed for the host. This is meant to be used when increased performance is needed in exchange for the extra information.Default:
null.Available in Fleet Premium. Filters the hosts to only include hosts in the specified fleet.Default:
null.Available in Fleet Premium. Filters the hosts to only include hosts with less GB of disk space available than this value. Must be a number between 1-100.Default:
null.The mobile device management (MDM) enrollment status to filter hosts by. Valid options are ‘manual’, ‘manual-personal’, ‘automatic’, ‘enrolled’, ‘pending’, or ‘unenrolled’. ‘pending’ only includes Apple (macOS, iOS, iPadOS) hosts in Apple Business (AB) that are not yet enrolled to Fleet.Default:
null.The ID of the mobile device management (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider and URL).Default:
null.The name of the mobile device management (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider).Default:
null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.Filters the hosts by the status of the operating system settings applied to the hosts. Valid options are ‘verified’, ‘verifying’, ‘pending’, or ‘failed’. Note: If this filter is used in Fleet Premium without a fleet ID filter, the results include only “Unassigned” hosts.Default:
null.Filters the hosts by disk encryption status. Valid options are ‘verified’, ‘verifying’, ‘action_required’, ‘enforcing’, ‘failed’, or ‘removing_enforcement’. Note: If this filter is used in Fleet Premium without a fleet ID filter, the results include only “Unassigned” hosts.Default:
null.List labels
Action ID:tools.fleetdm.list_labels
List all labels defined in Fleet, including built-in platform labels.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-labels
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
The value to get results after. This needs
order_key defined, as that’s the column that would be used.Default: null.Available in Fleet Premium. Filters to labels belonging to the specified fleet, plus global labels. Specify
"global" to show only globally-available labels. If omitted, Fleet returns all global labels, plus all labels for fleets to which the requestor has access.Default: null.Whether or not to calculate host counts for each label. Default is
true. See “additional notes” for more information.Default: null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.List MDM commands
Action ID:tools.fleetdm.list_mdm_commands
List MDM commands issued to a host, optionally filtered by request type and status.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-mdm-commands
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Host hostname, UUID, or hardware serial to scope commands to (required by Fleet; omitting it is deprecated and removed in Fleet 5).
The value to get results after. This needs
order_key defined, as that’s the column that would be used.Default: null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.What to order results by. Allowed values:
host_uuid, command_uuid, status, updated_at, request_type, hostname. Default is updated_at.Default: null.List OS versions
Action ID:tools.fleetdm.list_os_versions
List operating system versions across hosts with detected vulnerabilities.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-operating-systems
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Limits the number of
vulnerabilities returned per OS version. (If omitted, returns all vulnerabilities.)Default: null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.What to order results by. Allowed fields are:
hosts_count. Default is hosts_count (descending).Default: null.The name of the operating system to filter hosts by.
os_version must also be specified with os_nameDefault: null.The version of the operating system to filter hosts by.
os_name must also be specified with os_versionDefault: null.List policy hosts
Action ID:tools.fleetdm.list_policy_hosts
List the hosts that pass or fail a given policy.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-hosts
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Available in Fleet Premium. Filters the hosts to only include hosts with less GB of disk space available than this value. Must be a number between 1-100.Default:
null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.The name of the operating system to filter hosts by.
os_version must also be specified with os_name. See note below for filtering Windows hosts.Default: null.The version of the operating system to filter hosts by.
os_name must also be specified with os_version. See note below for filtering Windows hosts.Default: null.If
true, the response will include policy data for each host, including Fleet-maintained policies.Default: null.Search query keywords. Searchable fields include
hostname, hardware_serial, uuid, ipv4, and end user email addresses.Default: null.Indicates the status of the hosts to return. Can either be ‘new’, ‘online’, ‘offline’, ‘mia’, ‘missing’ or ‘enrolled’. ‘enrolled’ returns every host except those pending MDM enrollment.Default:
null.List reports
Action ID:tools.fleetdm.list_reports
List the saved reports (saved queries) defined in Fleet.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-reports
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
The value to get results after. This needs
order_key defined, as that’s the column that would be used.Default: null.Available in Fleet Premium. If
true, will include global reports in addition to fleet-level reports when filtering by fleet_id. (If no fleet_id is provided, this parameter is ignored.)Default: null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.List software titles
Action ID:tools.fleetdm.list_software_titles
List software titles across the fleet with host counts and detected vulnerabilities.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-software
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
If true, only include AI tools. Requires Fleet Premium and server support for AI tools inventory; unavailable in Fleet 4.93.0. Older servers can ignore this filter.Default:
null.If
true or 1, only list software that is available for install (added by the user). Default is false.Default: null.Filter extensions by their browser or IDE. Requires source and server support for software type filters; unavailable in Fleet 4.93.0. Older servers can ignore this filter.Default:
null.Filters to only include custom software packages (uploaded installers) with the specified SHA-256 hash.
fleet_id must be specified to filter by hash. This allows checking if a specific package already exists before uploading.Default: null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.What to order results by. Allowed fields are
name and hosts_count. Default is hosts_count (descending).Default: null.Filters to only include custom software packages (uploaded installers) with the specified package filename.
fleet_id must be specified to filter by package name. This allows checking if a specific package already exists before uploading.Default: null.Available in Fleet Premium. If
true or 1, only lists packages available for install (without app store apps).Default: null.Filter by the osquery software source (for example, apps, npm_packages, chrome_extensions, ai_clis, mcp_servers, or ai_skills). Requires server support for software type filters; unavailable in Fleet 4.93.0. Older servers can ignore this filter.Default:
null.List software versions
Action ID:tools.fleetdm.list_software_versions
List software versions across the fleet with their associated CVEs.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-software-versions
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
The value to get results after. This needs
order_key defined, as that’s the column that would be used.Default: null.If true, only include AI tools. Requires Fleet Premium and server support for AI tools inventory; unavailable in Fleet 4.93.0. Older servers can ignore this filter.Default:
null.Filter extensions by their browser or IDE. Requires source and server support for software type filters; unavailable in Fleet 4.93.0. Older servers can ignore this filter.Default:
null.Requires
order_key. The direction of the order given the order key. Options include "asc" and "desc". Default is "asc".Default: null.What to order results by. Allowed fields are
name, hosts_count, cve_published, cvss_score, epss_probability and cisa_known_exploit. Default is hosts_count (descending).Default: null.Filter by the osquery software source (for example, apps, npm_packages, chrome_extensions, ai_clis, mcp_servers, or ai_skills). Requires server support for software type filters; unavailable in Fleet 4.93.0. Older servers can ignore this filter.Default:
null.Available in Fleet Premium. If
true only vulnerability name is included in response. If false (or omitted), adds vulnerability description, CVSS score, and other details available in Fleet Premium. See note above on performance.Default: null.List vulnerabilities
Action ID:tools.fleetdm.list_vulnerabilities
List CVEs affecting software and operating systems across the fleet.
Reference: https://fleetdm.com/docs/rest-api/rest-api#list-vulnerabilities
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
The value to get results after. This needs
order_key defined, as that’s the column that would be used.Default: null.Only include CVEs with a CISA known-exploited vulnerability (Fleet Premium).Default:
null.Field to order by (cve, cvss_score, epss_probability, cve_published, host_count).Default:
null.Live query host
Action ID:tools.fleetdm.live_query_host
Run an ad-hoc osquery SQL statement live against a single host.
Reference: https://fleetdm.com/docs/rest-api/rest-api#run-live-report-on-host-ad-hoc
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Lock host
Action ID:tools.fleetdm.lock_host
Lock a host via MDM so it cannot be used until unlocked.
Reference: https://fleetdm.com/docs/rest-api/rest-api#lock-host
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Refetch host
Action ID:tools.fleetdm.refetch_host
Flag a host to refresh its details and policy results on next check-in.
Reference: https://fleetdm.com/docs/rest-api/rest-api#refetch-host
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Run live report
Action ID:tools.fleetdm.run_live_report
Run a saved report live against target hosts and return results synchronously.
Reference: https://fleetdm.com/docs/rest-api/rest-api#run-live-report
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Run MDM command
Action ID:tools.fleetdm.run_mdm_command
Enqueue a raw Apple or Windows MDM command to run on hosts at next check-in.
Reference: https://fleetdm.com/docs/rest-api/rest-api#run-mdm-command
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Turn off MDM
Action ID:tools.fleetdm.turn_off_mdm
Turn off MDM for a host, unenrolling it from Fleet MDM management.
Reference: https://fleetdm.com/docs/rest-api/rest-api#turn-off-hosts-mdm
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Unlock host
Action ID:tools.fleetdm.unlock_host
Unlock a previously locked host, or retrieve its macOS unlock PIN.
Reference: https://fleetdm.com/docs/rest-api/rest-api#unlock-host
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).
Wipe host
Action ID:tools.fleetdm.wipe_host
Remotely wipe a host via MDM, erasing its data.
Reference: https://fleetdm.com/docs/rest-api/rest-api#wipe-host
Secrets
Required secrets:fleetdm: required valuesFLEETDM_API_TOKEN.
Input fields
Fleet server base URL (e.g. https://fleet.example.com).