Skip to main content

​
Count hosts

Action ID: tools.fleetdm.count_hosts Count hosts matching the given filters without returning host records. Reference: https://fleetdm.com/docs/rest-api/rest-api#count-hosts

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer | null
Scope the count to a fleet (team) ID.Default: null.
​
integer | null
Only count hosts with less than this many GB of disk space.Default: null.
​
string | null
MDM enrollment filter (manual, automatic, enrolled, pending, unenrolled).Default: null.
​
string | null
Disk encryption status filter (verified, verifying, action_required, enforcing, failed, removing_enforcement).Default: null.
​
integer | null
Filter by hosts evaluated against this policy ID (pair with policy_response).Default: null.
​
string | null
Policy compliance filter for policy_id (passing or failing).Default: null.
​
string | null
Search string matched against hostname, IP, serial, and UUID.Default: null.
​
integer | null
Only count hosts that have this software version installed.Default: null.
​
string | null
Host status filter (online, offline, new, mia, missing).Default: null.
​
string | null
Only count hosts affected by this CVE (e.g. CVE-2024-1234).Default: null.

​
Create global policy

Action ID: tools.fleetdm.create_global_policy Create a global compliance policy from an osquery SQL check. Reference: https://fleetdm.com/docs/rest-api/rest-api#create-policy

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
string
required
Name of the policy.
​
string
required
The osquery SQL statement that hosts must satisfy to pass.
​
boolean | null
Mark the policy as critical (Fleet Premium).Default: null.
​
string | null
Human-readable description of the policy.Default: null.
​
string | null
Comma-separated platforms the policy targets (e.g. darwin,windows,linux).Default: null.
​
string | null
Remediation guidance shown for failing hosts.Default: null.

​
Create report

Action ID: tools.fleetdm.create_report Create a saved report (saved query) in Fleet. Reference: https://fleetdm.com/docs/rest-api/rest-api#create-report

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
string
required
Name of the saved report.
​
string
required
The SQL query the report collects data with.
​
string | null
Human-readable description of the report.Default: null.
​
integer | null
Fleet (team) ID to scope the report to.Default: null.
​
integer | null
Schedule interval in seconds (0 or null for an unscheduled report).Default: null.
​
string | null
Comma-separated platforms the report targets (e.g. darwin,windows,linux).Default: null.

​
Delete host

Action ID: tools.fleetdm.delete_host Delete a host from Fleet by its numeric ID. Reference: https://fleetdm.com/docs/rest-api/rest-api#delete-host

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet host ID.

​
Get disk encryption summary

Action ID: tools.fleetdm.get_disk_encryption_summary Get aggregate disk encryption (FileVault and BitLocker) status counts by OS. Reference: https://fleetdm.com/docs/rest-api/rest-api#get-disk-encryption-status

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer | null
Scope the summary to a fleet (team) ID.Default: null.

​
Get global policy

Action ID: tools.fleetdm.get_global_policy Get a single global policy including its pass and fail host counts. Reference: https://fleetdm.com/docs/rest-api/rest-api#get-policy

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet policy ID.

​
Get host

Action ID: tools.fleetdm.get_host Get full details for a single host by its numeric Fleet ID. Reference: https://fleetdm.com/docs/rest-api/rest-api#get-host

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet host ID.
​
boolean | null
If true, omit Fleet-maintained policies from the host’s policy list.Default: null.
​
boolean | null
If true, omit the host’s installed software from the response.Default: null.

​
Get host activities

Action ID: tools.fleetdm.get_host_activities List the past activity audit trail for a single host. Reference: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-past-activity

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet host ID.
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
Activities per page (Fleet caps at 200).Default: 50.

​
Get host by identifier

Action ID: tools.fleetdm.get_host_by_identifier Get full details for a single host by hostname, UUID, serial, or node key. Reference: https://fleetdm.com/docs/rest-api/rest-api#get-host-by-identifier

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
string
required
Host hostname, UUID, hardware serial, osquery host ID, or node key.
​
boolean | null
If true, omit Fleet-maintained policies from the host’s policy list.Default: null.
​
boolean | null
If true, omit the host’s installed software from the response.Default: null.

​
Get host configuration profiles

Action ID: tools.fleetdm.get_host_configuration_profiles Get the OS settings and configuration profiles applied to a host. Reference: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-os-settings-configuration-profile

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet host ID.

​
Get host encryption key

Action ID: tools.fleetdm.get_host_encryption_key Get a host’s disk encryption recovery key (FileVault or BitLocker). Reference: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-disk-encryption-key

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet host ID.

​
Get host MDM

Action ID: tools.fleetdm.get_host_mdm Get the MDM enrollment status and server URL for a host. Reference: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-mobile-device-management-mdm-information

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet host ID.

​
Get host summary

Action ID: tools.fleetdm.get_host_summary Get aggregate host counts grouped by status and platform. Reference: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-summary

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer | null
Scope the summary to a fleet (team) ID.Default: null.
​
integer | null
Count hosts with less than this many GB of disk space.Default: null.
​
string | null
Platform filter (darwin, windows, linux, chrome, ios, ipados).Default: null.

​
Get MDM command results

Action ID: tools.fleetdm.get_mdm_command_results Get the execution results and status for a previously enqueued MDM command. Reference: https://fleetdm.com/docs/rest-api/rest-api#get-mdm-command-results

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
string
required
UUID of the MDM command returned when it was enqueued.

​
Get OS settings summary

Action ID: tools.fleetdm.get_os_settings_summary Get aggregate OS settings status counts (verified, verifying, pending, failed). Reference: https://fleetdm.com/docs/rest-api/rest-api#get-os-settings-configuration-profiles-status

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer | null
Scope the summary to a fleet (team) ID.Default: null.

​
Get report

Action ID: tools.fleetdm.get_report Get a single saved report (saved query) by its ID. Reference: https://fleetdm.com/docs/rest-api/rest-api#get-report

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet report ID.

​
Get report data

Action ID: tools.fleetdm.get_report_data Get the most recent saved (scheduled) results for a report. Reference: https://fleetdm.com/docs/rest-api/rest-api#get-report-data

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet report ID.

​
Get software title

Action ID: tools.fleetdm.get_software_title Get a single software title with its versions, vulnerabilities, and host counts. Reference: https://fleetdm.com/docs/rest-api/rest-api#get-software

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet software title ID.
​
integer | null
Scope host counts to a fleet (team) ID.Default: null.

​
Get vulnerability

Action ID: tools.fleetdm.get_vulnerability Get details for a single CVE including affected software, CVSS, EPSS, and CISA status. Reference: https://fleetdm.com/docs/rest-api/rest-api#get-vulnerability

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
string
required
CVE identifier (e.g. CVE-2024-1234).
​
integer | null
Scope affected hosts and software to a fleet (team) ID.Default: null.

​
List activities

Action ID: tools.fleetdm.list_activities List the global audit log of actions performed in Fleet. Reference: https://fleetdm.com/docs/rest-api/rest-api#list-activities

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
string | null
Sort direction (asc or desc).Default: null.
​
string | null
Field to order by (e.g. created_at).Default: null.
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
Activities per page.Default: 50.
​
string | null
Search string matched against actor name and email.Default: null.

​
List configuration profiles

Action ID: tools.fleetdm.list_configuration_profiles List the MDM configuration profiles defined in Fleet. Reference: https://fleetdm.com/docs/rest-api/rest-api#list-configuration-profiles

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer | null
Scope profiles to a fleet (team) ID.Default: null.
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
Profiles per page (Fleet caps at 200).Default: 50.

​
List fleet policies

Action ID: tools.fleetdm.list_fleet_policies List the compliance policies scoped to a single fleet (team). Reference: https://fleetdm.com/docs/rest-api/rest-api#list-fleet-level-policies

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet (team) ID.
​
boolean | null
Include global policies inherited by the fleet.Default: null.

​
List fleets

Action ID: tools.fleetdm.list_fleets List fleets (teams) used to scope hosts, policies, and queries. Reference: https://fleetdm.com/docs/rest-api/rest-api#list-fleets

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
Fleets per page (Fleet caps at 200).Default: 50.
​
string | null
Search string matched against fleet name.Default: null.

​
List global policies

Action ID: tools.fleetdm.list_global_policies List global compliance policies with their passing and failing host counts. Reference: https://fleetdm.com/docs/rest-api/rest-api#list-policies

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
string | null
Sort direction (asc or desc); requires order_key.Default: null.
​
string | null
Field to order policies by (e.g. name, failing_host_count).Default: null.
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
Policies per page (Fleet caps at 200).Default: 50.

​
List host software

Action ID: tools.fleetdm.list_host_software List the software installed on a host along with detected vulnerabilities. Reference: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-software

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet host ID.
​
boolean | null
Only include software with a CISA known-exploited vulnerability.Default: null.
​
number | null
Only include software with a vulnerability at or below this CVSS score.Default: null.
​
number | null
Only include software with a vulnerability at or above this CVSS score.Default: null.
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
Software entries per page (Fleet caps at 200).Default: 50.
​
string | null
Search string matched against software name.Default: null.
​
boolean | null
Only include software with known vulnerabilities.Default: null.

​
List hosts

Action ID: tools.fleetdm.list_hosts List and search hosts enrolled in Fleet with server-side filters. Reference: https://fleetdm.com/docs/rest-api/rest-api#list-hosts

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer | null
Scope results to a fleet (team) ID.Default: null.
​
integer | null
Only include hosts with less than this many GB of disk space.Default: null.
​
string | null
MDM enrollment filter (manual, automatic, enrolled, pending, unenrolled).Default: null.
​
string | null
Sort direction (asc or desc); requires order_key.Default: null.
​
string | null
Column to sort hosts by.Default: null.
​
string | null
Operating system name filter (must be paired with os_version).Default: null.
​
string | null
Disk encryption status filter (verified, verifying, action_required, enforcing, failed, removing_enforcement).Default: null.
​
string | null
Operating system version filter (must be paired with os_name).Default: null.
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
Hosts per page (Fleet caps at 200).Default: 50.
​
integer | null
Filter by hosts evaluated against this policy ID (pair with policy_response).Default: null.
​
string | null
Policy compliance filter for policy_id (passing or failing).Default: null.
​
boolean | null
Include each host’s policy compliance in the response.Default: null.
​
boolean | null
Include each host’s installed software in the response.Default: null.
​
string | null
Search string matched against hostname, IP, serial, and UUID.Default: null.
​
integer | null
Only include hosts that have this software version installed.Default: null.
​
string | null
Host status filter (online, offline, new, mia, missing).Default: null.
​
string | null
Only include hosts affected by this CVE (e.g. CVE-2024-1234).Default: null.

​
List hosts by vulnerability

Action ID: tools.fleetdm.list_hosts_by_vulnerability List the hosts affected by a specific CVE. Reference: https://fleetdm.com/docs/rest-api/rest-api#list-hosts

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
string
required
CVE identifier to filter affected hosts by (e.g. CVE-2024-1234).
​
integer | null
Scope results to a fleet (team) ID.Default: null.
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
Hosts per page (Fleet caps at 200).Default: 50.
​
string | null
Host status filter (online, offline, new, mia, missing).Default: null.

​
List hosts in label

Action ID: tools.fleetdm.list_label_hosts List the hosts that are members of a given label. Reference: https://fleetdm.com/docs/rest-api/rest-api#list-labels-hosts

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet label ID.
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
Hosts per page (Fleet caps at 200).Default: 50.
​
string | null
Search string matched against hostname, IP, serial, and UUID.Default: null.
​
string | null
Host status filter (online, offline, new, mia, missing).Default: null.

​
List labels

Action ID: tools.fleetdm.list_labels List all labels defined in Fleet, including built-in platform labels. Reference: https://fleetdm.com/docs/rest-api/rest-api#list-labels

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
string | null
Field to order labels by (e.g. name, created_at).Default: null.

​
List MDM commands

Action ID: tools.fleetdm.list_mdm_commands List MDM commands issued to a host, optionally filtered by request type and status. Reference: https://fleetdm.com/docs/rest-api/rest-api#list-mdm-commands

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
string
required
Host hostname, UUID, or hardware serial to scope commands to (required by Fleet; omitting it is deprecated and removed in Fleet 5).
​
string | null
Filter by command status (ran, pending, failed).Default: null.
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
Commands per page (Fleet caps at 200).Default: 50.
​
string | null
Filter by MDM command request type (e.g. DeviceLock, EraseDevice).Default: null.

​
List OS versions

Action ID: tools.fleetdm.list_os_versions List operating system versions across hosts with detected vulnerabilities. Reference: https://fleetdm.com/docs/rest-api/rest-api#list-operating-systems

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer | null
Scope results to a fleet (team) ID.Default: null.
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
OS versions per page (Fleet caps at 200).Default: 50.
​
string | null
Platform filter (darwin, windows, linux, chrome).Default: null.

​
List policy hosts

Action ID: tools.fleetdm.list_policy_hosts List the hosts that pass or fail a given policy. Reference: https://fleetdm.com/docs/rest-api/rest-api#list-hosts

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet policy ID.
​
integer | null
Scope results to a fleet (team) ID.Default: null.
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
Hosts per page (Fleet caps at 200).Default: 50.
​
string
Compliance filter (passing or failing).Default: "failing".

​
List reports

Action ID: tools.fleetdm.list_reports List the saved reports (saved queries) defined in Fleet. Reference: https://fleetdm.com/docs/rest-api/rest-api#list-reports

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer | null
Scope reports to a fleet (team) ID.Default: null.
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
Reports per page (Fleet caps at 200).Default: 50.
​
string | null
Platform filter (macos, windows, linux, chrome).Default: null.
​
string | null
Search string matched against report name.Default: null.

​
List software titles

Action ID: tools.fleetdm.list_software_titles List software titles across the fleet with host counts and detected vulnerabilities. Reference: https://fleetdm.com/docs/rest-api/rest-api#list-software

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
boolean | null
Only include software with a CISA known-exploited vulnerability.Default: null.
​
integer | null
Scope results to a fleet (team) ID.Default: null.
​
number | null
Only include software with a vulnerability at or below this CVSS score.Default: null.
​
number | null
Only include software with a vulnerability at or above this CVSS score.Default: null.
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
Software titles per page (Fleet caps at 200).Default: 50.
​
string | null
Platform filter (darwin, windows, linux, chrome).Default: null.
​
string | null
Search string matched against software title and CVE.Default: null.
​
boolean | null
Only include software with known vulnerabilities.Default: null.

​
List software versions

Action ID: tools.fleetdm.list_software_versions List software versions across the fleet with their associated CVEs. Reference: https://fleetdm.com/docs/rest-api/rest-api#list-software-versions

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
boolean | null
Only include versions with a CISA known-exploited vulnerability.Default: null.
​
integer | null
Scope results to a fleet (team) ID.Default: null.
​
number | null
Only include versions with a vulnerability at or below this CVSS score.Default: null.
​
number | null
Only include versions with a vulnerability at or above this CVSS score.Default: null.
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
Software versions per page (Fleet caps at 200).Default: 50.
​
string | null
Search string matched against software name and CVE.Default: null.
​
boolean | null
Only include versions with known vulnerabilities.Default: null.

​
List vulnerabilities

Action ID: tools.fleetdm.list_vulnerabilities List CVEs affecting software and operating systems across the fleet. Reference: https://fleetdm.com/docs/rest-api/rest-api#list-vulnerabilities

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
boolean | null
Only include CVEs with a CISA known-exploited vulnerability (Fleet Premium).Default: null.
​
integer | null
Scope results to a fleet (team) ID.Default: null.
​
string | null
Sort direction (asc or desc).Default: null.
​
string | null
Field to order by (cve, cvss_score, epss_probability, cve_published, host_count).Default: null.
​
integer
Page number to retrieve (0-indexed).Default: 0.
​
integer
Vulnerabilities per page (Fleet caps at 200).Default: 50.
​
string | null
Search string matched against CVE identifiers.Default: null.

​
Live query host

Action ID: tools.fleetdm.live_query_host Run an ad-hoc osquery SQL statement live against a single host. Reference: https://fleetdm.com/docs/rest-api/rest-api#run-live-report-on-host-ad-hoc

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet host ID to run the query against.
​
string
required
The ad-hoc osquery SQL statement to run.

​
Lock host

Action ID: tools.fleetdm.lock_host Lock a host via MDM so it cannot be used until unlocked. Reference: https://fleetdm.com/docs/rest-api/rest-api#lock-host

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet host ID.
​
boolean | null
For macOS, return the six-digit unlock PIN in the response.Default: null.

​
Refetch host

Action ID: tools.fleetdm.refetch_host Flag a host to refresh its details and policy results on next check-in. Reference: https://fleetdm.com/docs/rest-api/rest-api#refetch-host

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet host ID.

​
Run live report

Action ID: tools.fleetdm.run_live_report Run a saved report live against target hosts and return results synchronously. Reference: https://fleetdm.com/docs/rest-api/rest-api#run-live-report

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
array[integer]
required
Numeric IDs of the hosts to run the report against.
​
integer
required
Numeric Fleet report ID to run.

​
Run MDM command

Action ID: tools.fleetdm.run_mdm_command Enqueue a raw Apple or Windows MDM command to run on hosts at next check-in. Reference: https://fleetdm.com/docs/rest-api/rest-api#run-mdm-command

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
string
required
Base64-encoded MDM command payload (Apple plist XML or Windows SyncML).
​
array[string]
required
UUIDs of the hosts to send the command to.

​
Turn off MDM

Action ID: tools.fleetdm.turn_off_mdm Turn off MDM for a host, unenrolling it from Fleet MDM management. Reference: https://fleetdm.com/docs/rest-api/rest-api#turn-off-hosts-mdm

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet host ID.

​
Unlock host

Action ID: tools.fleetdm.unlock_host Unlock a previously locked host, or retrieve its macOS unlock PIN. Reference: https://fleetdm.com/docs/rest-api/rest-api#unlock-host

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet host ID.

​
Wipe host

Action ID: tools.fleetdm.wipe_host Remotely wipe a host via MDM, erasing its data. Reference: https://fleetdm.com/docs/rest-api/rest-api#wipe-host

​
Secrets

Required secrets:
  • fleetdm: required values FLEETDM_API_TOKEN.

​
Input fields

​
string
required
Fleet server base URL (e.g. https://fleet.example.com).
​
integer
required
Numeric Fleet host ID.
​
string | null
For Windows, the wipe type (doWipe or doWipeProtected).Default: null.