> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Swif.ai (UEM)

> Reference for the Tracecat Swif.ai (UEM) integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Delete device extension attributes

Action ID: `tools.swif.delete_device_extension_attributes`

Remove extension attributes by key from one or more devices. Calls DELETE /restful/organization/deviceExtensionAttributes.

Reference: [https://help.swif.ai/en/articles/13172920-public-apis-how-to-edit-device-extension-attributes](https://help.swif.ai/en/articles/13172920-public-apis-how-to-edit-device-extension-attributes)

### Secrets

Required secrets:

* `swif`: required values `SWIF_API_KEY`.

### Input fields

**deviceIds** `array[string]` *required*

Swif device IDs to remove the attributes from.

**keys** `array[string]` *required*

Extension attribute keys to remove.

**base\_url** `string | null`

Swif API base URL. Defaults to [https://api.swifteam.com](https://api.swifteam.com) (global tenants). Use [https://api.eu.swifteam.com](https://api.eu.swifteam.com) for EU tenants.

Default: `null`.

## Get employee

Action ID: `tools.swif.get_employee`

Get an employee by Swif internal employee ID. Calls GET /restful/organization/employees/\{employeeId}.

Reference: [https://help.swif.ai/en/articles/13901608-public-apis-manage-employees](https://help.swif.ai/en/articles/13901608-public-apis-manage-employees)

### Secrets

Required secrets:

* `swif`: required values `SWIF_API_KEY`.

### Input fields

**employeeId** `string` *required*

Swif internal employee ID, as returned by List employees. This is not the HRIS employee number.

**base\_url** `string | null`

Swif API base URL. Defaults to [https://api.swifteam.com](https://api.swifteam.com) (global tenants). Use [https://api.eu.swifteam.com](https://api.eu.swifteam.com) for EU tenants.

Default: `null`.

## Get script report

Action ID: `tools.swif.get_script_report`

Get the full result of a script or osquery command execution on a device, including the command or osquery SQL and the raw response. Calls GET /restful/organization/api/v1/script-reports/\{reportId}.

Reference: [https://help.swif.ai/en/articles/14188336-public-apis-fetch-script-execution-reports](https://help.swif.ai/en/articles/14188336-public-apis-fetch-script-execution-reports)

### Secrets

Required secrets:

* `swif`: required values `SWIF_API_KEY`.

### Input fields

**reportId** `string` *required*

Script report ID (24-character MongoID).

**base\_url** `string | null`

Swif API base URL. Defaults to [https://api.swifteam.com](https://api.swifteam.com) (global tenants). Use [https://api.eu.swifteam.com](https://api.eu.swifteam.com) for EU tenants.

Default: `null`.

## List device applications

Action ID: `tools.swif.list_device_applications`

List applications detected on a managed device, for software inventory, vulnerable or unauthorized software, and shadow IT investigations. Calls GET /restful/organization/devices/\{deviceId}/applications.

Reference: [https://help.swif.ai/en/articles/16290808-public-apis-device-application-retrieval](https://help.swif.ai/en/articles/16290808-public-apis-device-application-retrieval)

### Secrets

Required secrets:

* `swif`: required values `SWIF_API_KEY`.

### Input fields

**deviceId** `string` *required*

Swif device ID.

**base\_url** `string | null`

Swif API base URL. Defaults to [https://api.swifteam.com](https://api.swifteam.com) (global tenants). Use [https://api.eu.swifteam.com](https://api.eu.swifteam.com) for EU tenants.

Default: `null`.

**limit** `integer | null`

Maximum number of application records to return.

Default: `null`.

**offset** `integer | null`

Number of application records to skip.

Default: `null`.

**q** `string | null`

Case-insensitive fuzzy search across application name, bundle name, version, and status.

Default: `null`.

## List device browser extensions

Action ID: `tools.swif.list_device_extensions`

List Chrome, Safari, Firefox, and Edge browser extensions detected on a managed device, for malicious or risky extension investigations. Calls GET /restful/organization/devices/\{deviceId}/extensions.

Reference: [https://help.swif.ai/en/articles/16425729-public-apis-retrieve-extensions-for-a-specific-device](https://help.swif.ai/en/articles/16425729-public-apis-retrieve-extensions-for-a-specific-device)

### Secrets

Required secrets:

* `swif`: required values `SWIF_API_KEY`.

### Input fields

**deviceId** `string` *required*

Swif device ID.

**base\_url** `string | null`

Swif API base URL. Defaults to [https://api.swifteam.com](https://api.swifteam.com) (global tenants). Use [https://api.eu.swifteam.com](https://api.eu.swifteam.com) for EU tenants.

Default: `null`.

## List device extension attributes

Action ID: `tools.swif.list_device_extension_attributes`

Retrieve custom extension attributes (device metadata such as tags or risk labels) for a device. Calls GET /restful/organization/deviceExtensionAttributes.

Reference: [https://help.swif.ai/en/articles/13172920-public-apis-how-to-edit-device-extension-attributes](https://help.swif.ai/en/articles/13172920-public-apis-how-to-edit-device-extension-attributes)

### Secrets

Required secrets:

* `swif`: required values `SWIF_API_KEY`.

### Input fields

**ids** `string` *required*

Swif device ID to retrieve extension attributes for.

**base\_url** `string | null`

Swif API base URL. Defaults to [https://api.swifteam.com](https://api.swifteam.com) (global tenants). Use [https://api.eu.swifteam.com](https://api.eu.swifteam.com) for EU tenants.

Default: `null`.

**limit** `integer | null`

Maximum number of records to return.

Default: `null`.

**offset** `integer | null`

Number of records to skip.

Default: `null`.

## List devices

Action ID: `tools.swif.list_devices`

List managed devices with inventory and security evidence, including Swif's compliance verdict (isCompliant, nonComplianceReasons, failingComplianceChecks), osquery device information, hardware, network, owner, and policy state. Calls GET /restful/organization/devices.

Reference: [https://help.swif.ai/en/articles/9341271-public-apis-device-and-evidence-retrieval](https://help.swif.ai/en/articles/9341271-public-apis-device-and-evidence-retrieval)

### Secrets

Required secrets:

* `swif`: required values `SWIF_API_KEY`.

### Input fields

**base\_url** `string | null`

Swif API base URL. Defaults to [https://api.swifteam.com](https://api.swifteam.com) (global tenants). Use [https://api.eu.swifteam.com](https://api.eu.swifteam.com) for EU tenants.

Default: `null`.

**limit** `integer | null`

Maximum number of records to return. Swif defaults to 10.

Default: `null`.

**offset** `integer | null`

Number of records to skip. Swif defaults to 0.

Default: `null`.

**q** `string | null`

Search query, for example a device serial number.

Default: `null`.

**teamId** `string | null`

Only return devices in this team (24-character hexadecimal team ID). Use List teams to look up team IDs.

Default: `null`.

## List employees

Action ID: `tools.swif.list_employees`

List employees (device owners) in the organization, optionally filtered by primary team. Calls GET /restful/organization/employees.

Reference: [https://help.swif.ai/en/articles/9341271-public-apis-device-and-evidence-retrieval](https://help.swif.ai/en/articles/9341271-public-apis-device-and-evidence-retrieval)

### Secrets

Required secrets:

* `swif`: required values `SWIF_API_KEY`.

### Input fields

**base\_url** `string | null`

Swif API base URL. Defaults to [https://api.swifteam.com](https://api.swifteam.com) (global tenants). Use [https://api.eu.swifteam.com](https://api.eu.swifteam.com) for EU tenants.

Default: `null`.

**limit** `integer | null`

Maximum number of records to return. Swif defaults to 10.

Default: `null`.

**offset** `integer | null`

Number of records to skip. Swif defaults to 0.

Default: `null`.

**q** `string | null`

Search query to filter employees.

Default: `null`.

**teamId** `string | null`

Only return employees whose primary team is this team (24-character hexadecimal team ID).

Default: `null`.

## List script reports

Action ID: `tools.swif.list_script_reports`

Search and filter stored results of scripts and osquery commands run on managed devices, for threat hunting and fleet-wide evidence collection. Each report contains the command or osquery SQL, the raw response, device, owner, team, status, and timestamps. Reports are retained for up to 90 days. Calls GET /restful/organization/api/v1/script-reports.

Reference: [https://help.swif.ai/en/articles/14188336-public-apis-fetch-script-execution-reports](https://help.swif.ai/en/articles/14188336-public-apis-fetch-script-execution-reports)

### Secrets

Required secrets:

* `swif`: required values `SWIF_API_KEY`.

### Input fields

**base\_url** `string | null`

Swif API base URL. Defaults to [https://api.swifteam.com](https://api.swifteam.com) (global tenants). Use [https://api.eu.swifteam.com](https://api.eu.swifteam.com) for EU tenants.

Default: `null`.

**collectedAtFrom** `string | null`

ISO 8601 lower bound on collectedAt. Use the last collectedAt seen to poll for new reports.

Default: `null`.

**collectedAtTo** `string | null`

ISO 8601 upper bound on collectedAt.

Default: `null`.

**command** `string | null`

Case-insensitive partial match on the raw command, script, or osquery SQL text.

Default: `null`.

**commandId** `string | null`

Case-insensitive partial match on command execution ID.

Default: `null`.

**commandName** `string | null`

Case-insensitive partial match on command display name.

Default: `null`.

**commandTemplateId** `string | null`

Case-insensitive partial match on command template ID, for example an osquery command template.

Default: `null`.

**commandType** `string | null`

Case-insensitive partial match on command type, for example SCRIPT.

Default: `null`.

**completedAtFrom** `string | null`

ISO 8601 lower bound on completedAt.

Default: `null`.

**completedAtTo** `string | null`

ISO 8601 upper bound on completedAt.

Default: `null`.

**deviceId** `string | null`

Exact match on Swif device ID (24-character MongoID).

Default: `null`.

**deviceName** `string | null`

Case-insensitive partial match on device name.

Default: `null`.

**limit** `integer | null`

Page size. Values of 0 or less default to 20; the maximum is 200.

Default: `null`.

**mdmDeviceId** `string | null`

Case-insensitive partial match on MDM device ID.

Default: `null`.

**offset** `integer | null`

Number of records to skip. Negative values are treated as 0.

Default: `null`.

**ownerEmail** `string | null`

Case-insensitive partial match on device owner email.

Default: `null`.

**ownerId** `string | null`

Exact match on device owner ID (24-character MongoID).

Default: `null`.

**ownerName** `string | null`

Case-insensitive partial match on device owner name.

Default: `null`.

**response** `string | null`

Case-insensitive partial match on the raw command output, for example an indicator such as a file hash, process name, or extension ID.

Default: `null`.

**search** `string | null`

Case-insensitive keyword search across team name, device, owner, serial number, command ID, template, name, type, command text, and response.

Default: `null`.

**serialNumber** `string | null`

Case-insensitive partial match on device serial number.

Default: `null`.

**startedAtFrom** `string | null`

ISO 8601 lower bound on startedAt.

Default: `null`.

**startedAtTo** `string | null`

ISO 8601 upper bound on startedAt.

Default: `null`.

**status** `integer | null`

Exact match on the integer execution status code.

Default: `null`.

**teamId** `string | null`

Exact match on team ID (24-character MongoID).

Default: `null`.

## List teams

Action ID: `tools.swif.list_teams`

List the organization's active teams, sorted by name. Use team IDs to scope device, employee, and script report queries. Calls GET /restful/organization/teams.

Reference: [https://help.swif.ai/en/articles/9341271-public-apis-device-and-evidence-retrieval](https://help.swif.ai/en/articles/9341271-public-apis-device-and-evidence-retrieval)

### Secrets

Required secrets:

* `swif`: required values `SWIF_API_KEY`.

### Input fields

**base\_url** `string | null`

Swif API base URL. Defaults to [https://api.swifteam.com](https://api.swifteam.com) (global tenants). Use [https://api.eu.swifteam.com](https://api.eu.swifteam.com) for EU tenants.

Default: `null`.

## Set device extension attributes

Action ID: `tools.swif.set_device_extension_attributes`

Set, update, or clear custom extension attributes on one or more devices, for example to tag a compromised device so a smart device group applies a response policy. A non-empty value sets or updates the attribute; an empty string or null value deletes it. Calls POST /restful/organization/deviceExtensionAttributes.

Reference: [https://help.swif.ai/en/articles/13172920-public-apis-how-to-edit-device-extension-attributes](https://help.swif.ai/en/articles/13172920-public-apis-how-to-edit-device-extension-attributes)

### Secrets

Required secrets:

* `swif`: required values `SWIF_API_KEY`.

### Input fields

**items** `array[object]` *required*

Devices and attributes to set. Each item has a deviceId and an attributes list of objects with key and value, for example \[\{"deviceId": "\<device\_id>", "attributes": \[\{"key": "risk", "value": "high"}]}]. Keys must match an extension attribute definition in Swif.

**base\_url** `string | null`

Swif API base URL. Defaults to [https://api.swifteam.com](https://api.swifteam.com) (global tenants). Use [https://api.eu.swifteam.com](https://api.eu.swifteam.com) for EU tenants.

Default: `null`.

**ids** `string | null`

Swif device ID query parameter, as shown in Swif's request examples.

Default: `null`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.