Skip to main content

​
Delete device extension attributes

Action ID: tools.swif.delete_device_extension_attributes Remove extension attributes by key from one or more devices. Calls DELETE /restful/organization/deviceExtensionAttributes. Reference: https://help.swif.ai/en/articles/13172920-public-apis-how-to-edit-device-extension-attributes

​
Secrets

Required secrets:
  • swif: required values SWIF_API_KEY.

​
Input fields

​
array[string]
required
Swif device IDs to remove the attributes from.
​
array[string]
required
Extension attribute keys to remove.
​
string | null
Swif API base URL. Defaults to https://api.swifteam.com (global tenants). Use https://api.eu.swifteam.com for EU tenants.Default: null.

​
Get employee

Action ID: tools.swif.get_employee Get an employee by Swif internal employee ID. Calls GET /restful/organization/employees/{employeeId}. Reference: https://help.swif.ai/en/articles/13901608-public-apis-manage-employees

​
Secrets

Required secrets:
  • swif: required values SWIF_API_KEY.

​
Input fields

​
string
required
Swif internal employee ID, as returned by List employees. This is not the HRIS employee number.
​
string | null
Swif API base URL. Defaults to https://api.swifteam.com (global tenants). Use https://api.eu.swifteam.com for EU tenants.Default: null.

​
Get script report

Action ID: tools.swif.get_script_report Get the full result of a script or osquery command execution on a device, including the command or osquery SQL and the raw response. Calls GET /restful/organization/api/v1/script-reports/{reportId}. Reference: https://help.swif.ai/en/articles/14188336-public-apis-fetch-script-execution-reports

​
Secrets

Required secrets:
  • swif: required values SWIF_API_KEY.

​
Input fields

​
string
required
Script report ID (24-character MongoID).
​
string | null
Swif API base URL. Defaults to https://api.swifteam.com (global tenants). Use https://api.eu.swifteam.com for EU tenants.Default: null.

​
List device applications

Action ID: tools.swif.list_device_applications List applications detected on a managed device, for software inventory, vulnerable or unauthorized software, and shadow IT investigations. Calls GET /restful/organization/devices/{deviceId}/applications. Reference: https://help.swif.ai/en/articles/16290808-public-apis-device-application-retrieval

​
Secrets

Required secrets:
  • swif: required values SWIF_API_KEY.

​
Input fields

​
string
required
Swif device ID.
​
string | null
Swif API base URL. Defaults to https://api.swifteam.com (global tenants). Use https://api.eu.swifteam.com for EU tenants.Default: null.
​
integer | null
Maximum number of application records to return.Default: null.
​
integer | null
Number of application records to skip.Default: null.
​
string | null
Case-insensitive fuzzy search across application name, bundle name, version, and status.Default: null.

​
List device browser extensions

Action ID: tools.swif.list_device_extensions List Chrome, Safari, Firefox, and Edge browser extensions detected on a managed device, for malicious or risky extension investigations. Calls GET /restful/organization/devices/{deviceId}/extensions. Reference: https://help.swif.ai/en/articles/16425729-public-apis-retrieve-extensions-for-a-specific-device

​
Secrets

Required secrets:
  • swif: required values SWIF_API_KEY.

​
Input fields

​
string
required
Swif device ID.
​
string | null
Swif API base URL. Defaults to https://api.swifteam.com (global tenants). Use https://api.eu.swifteam.com for EU tenants.Default: null.

​
List device extension attributes

Action ID: tools.swif.list_device_extension_attributes Retrieve custom extension attributes (device metadata such as tags or risk labels) for a device. Calls GET /restful/organization/deviceExtensionAttributes. Reference: https://help.swif.ai/en/articles/13172920-public-apis-how-to-edit-device-extension-attributes

​
Secrets

Required secrets:
  • swif: required values SWIF_API_KEY.

​
Input fields

​
string
required
Swif device ID to retrieve extension attributes for.
​
string | null
Swif API base URL. Defaults to https://api.swifteam.com (global tenants). Use https://api.eu.swifteam.com for EU tenants.Default: null.
​
integer | null
Maximum number of records to return.Default: null.
​
integer | null
Number of records to skip.Default: null.

​
List devices

Action ID: tools.swif.list_devices List managed devices with inventory and security evidence, including Swif’s compliance verdict (isCompliant, nonComplianceReasons, failingComplianceChecks), osquery device information, hardware, network, owner, and policy state. Calls GET /restful/organization/devices. Reference: https://help.swif.ai/en/articles/9341271-public-apis-device-and-evidence-retrieval

​
Secrets

Required secrets:
  • swif: required values SWIF_API_KEY.

​
Input fields

​
string | null
Swif API base URL. Defaults to https://api.swifteam.com (global tenants). Use https://api.eu.swifteam.com for EU tenants.Default: null.
​
integer | null
Maximum number of records to return. Swif defaults to 10.Default: null.
​
integer | null
Number of records to skip. Swif defaults to 0.Default: null.
​
string | null
Search query, for example a device serial number.Default: null.
​
string | null
Only return devices in this team (24-character hexadecimal team ID). Use List teams to look up team IDs.Default: null.

​
List employees

Action ID: tools.swif.list_employees List employees (device owners) in the organization, optionally filtered by primary team. Calls GET /restful/organization/employees. Reference: https://help.swif.ai/en/articles/9341271-public-apis-device-and-evidence-retrieval

​
Secrets

Required secrets:
  • swif: required values SWIF_API_KEY.

​
Input fields

​
string | null
Swif API base URL. Defaults to https://api.swifteam.com (global tenants). Use https://api.eu.swifteam.com for EU tenants.Default: null.
​
integer | null
Maximum number of records to return. Swif defaults to 10.Default: null.
​
integer | null
Number of records to skip. Swif defaults to 0.Default: null.
​
string | null
Search query to filter employees.Default: null.
​
string | null
Only return employees whose primary team is this team (24-character hexadecimal team ID).Default: null.

​
List script reports

Action ID: tools.swif.list_script_reports Search and filter stored results of scripts and osquery commands run on managed devices, for threat hunting and fleet-wide evidence collection. Each report contains the command or osquery SQL, the raw response, device, owner, team, status, and timestamps. Reports are retained for up to 90 days. Calls GET /restful/organization/api/v1/script-reports. Reference: https://help.swif.ai/en/articles/14188336-public-apis-fetch-script-execution-reports

​
Secrets

Required secrets:
  • swif: required values SWIF_API_KEY.

​
Input fields

​
string | null
Swif API base URL. Defaults to https://api.swifteam.com (global tenants). Use https://api.eu.swifteam.com for EU tenants.Default: null.
​
string | null
ISO 8601 lower bound on collectedAt. Use the last collectedAt seen to poll for new reports.Default: null.
​
string | null
ISO 8601 upper bound on collectedAt.Default: null.
​
string | null
Case-insensitive partial match on the raw command, script, or osquery SQL text.Default: null.
​
string | null
Case-insensitive partial match on command execution ID.Default: null.
​
string | null
Case-insensitive partial match on command display name.Default: null.
​
string | null
Case-insensitive partial match on command template ID, for example an osquery command template.Default: null.
​
string | null
Case-insensitive partial match on command type, for example SCRIPT.Default: null.
​
string | null
ISO 8601 lower bound on completedAt.Default: null.
​
string | null
ISO 8601 upper bound on completedAt.Default: null.
​
string | null
Exact match on Swif device ID (24-character MongoID).Default: null.
​
string | null
Case-insensitive partial match on device name.Default: null.
​
integer | null
Page size. Values of 0 or less default to 20; the maximum is 200.Default: null.
​
string | null
Case-insensitive partial match on MDM device ID.Default: null.
​
integer | null
Number of records to skip. Negative values are treated as 0.Default: null.
​
string | null
Case-insensitive partial match on device owner email.Default: null.
​
string | null
Exact match on device owner ID (24-character MongoID).Default: null.
​
string | null
Case-insensitive partial match on device owner name.Default: null.
​
string | null
Case-insensitive partial match on the raw command output, for example an indicator such as a file hash, process name, or extension ID.Default: null.
​
string | null
Case-insensitive keyword search across team name, device, owner, serial number, command ID, template, name, type, command text, and response.Default: null.
​
string | null
Case-insensitive partial match on device serial number.Default: null.
​
string | null
ISO 8601 lower bound on startedAt.Default: null.
​
string | null
ISO 8601 upper bound on startedAt.Default: null.
​
integer | null
Exact match on the integer execution status code.Default: null.
​
string | null
Exact match on team ID (24-character MongoID).Default: null.

​
List teams

Action ID: tools.swif.list_teams List the organization’s active teams, sorted by name. Use team IDs to scope device, employee, and script report queries. Calls GET /restful/organization/teams. Reference: https://help.swif.ai/en/articles/9341271-public-apis-device-and-evidence-retrieval

​
Secrets

Required secrets:
  • swif: required values SWIF_API_KEY.

​
Input fields

​
string | null
Swif API base URL. Defaults to https://api.swifteam.com (global tenants). Use https://api.eu.swifteam.com for EU tenants.Default: null.

​
Set device extension attributes

Action ID: tools.swif.set_device_extension_attributes Set, update, or clear custom extension attributes on one or more devices, for example to tag a compromised device so a smart device group applies a response policy. A non-empty value sets or updates the attribute; an empty string or null value deletes it. Calls POST /restful/organization/deviceExtensionAttributes. Reference: https://help.swif.ai/en/articles/13172920-public-apis-how-to-edit-device-extension-attributes

​
Secrets

Required secrets:
  • swif: required values SWIF_API_KEY.

​
Input fields

​
array[object]
required
Devices and attributes to set. Each item has a deviceId and an attributes list of objects with key and value, for example [{“deviceId”: “<device_id>”, “attributes”: [{“key”: “risk”, “value”: “high”}]}]. Keys must match an extension attribute definition in Swif.
​
string | null
Swif API base URL. Defaults to https://api.swifteam.com (global tenants). Use https://api.eu.swifteam.com for EU tenants.Default: null.
​
string | null
Swif device ID query parameter, as shown in Swif’s request examples.Default: null.