Commands

tracee apps

Run any action of a connected app, or call its API.

search

Find actions in connected apps. Matching actions with their slug, risk (read, write, destructive) and required inputs.

tracee apps search --query <query> [--apps <apps>] [--limit <limit>]

--querystringrequired
The query
up to 300 characters
--appsstring[]
Limit search to these toolkit slugs Repeat the flag or separate values with commas.
--limitinteger
The limit.
1–25

Example

tracee apps search --query "send a slack message" --limit 5

Calls GET /api/v1/apps/actions

schema

An app action's inputs.

tracee apps schema <slug>

<slug>argumentrequired
The slug. From GET /api/v1/apps/actions query=<what you want to do>
up to 200 characters

Example

tracee apps schema SLACK_SEND_MESSAGE

Calls GET /api/v1/apps/actions/{slug}

run

Run an app action. read actions run straight away; write and destructive ones become an approval request and run as soon as a person approves.

tracee apps run <slug> [--args <args>] [--connection-id <connection_id>] [--note <note>]

<slug>argumentrequired
The slug. From GET /api/v1/apps/actions query=<what you want to do>
up to 200 characters

--argsobject
The args JSON text or @file.json.
any keys
--connection-idstring
Which connection, if the app has several. From GET /api/v1/connections (connectedApps[].connection_id).
--notestring
Context for the approver
up to 500 characters

--data <json|@file|-> sends the whole body instead of flags.

Example

tracee apps run SLACK_SEND_MESSAGE \
  --args '{"channel":"#launches","text":"The dashboard post is live"}' \
  --note "Tell the team"

Calls POST /api/v1/apps/actions/{slug}/run

request

Call a connected app's own API. Signed with the workspace's connection, for anything no action covers. GET runs straight away; anything else becomes an approval request.

tracee apps request <app> --endpoint <endpoint> [--method <method>] [--params <params>] [--body <body>] [--connection-id <connection_id>] [--note <note>]

<app>argumentrequired
The toolkit slug, e.g. hubspot. From GET /api/v1/connections (connectedApps[].app)
up to 60 characters

--endpointstringrequired
A path relative to the app's API, or a full URL on its domain
up to 1,000 characters
--methodstring
Default GET
Available options:GETPOSTPUTPATCHDELETE
--paramsobject
Query string parameters JSON text or @file.json.
any keys
--bodyany
The JSON body JSON text or @file.json.
--connection-idstring
Which connection, if the app has several. From GET /api/v1/connections (connectedApps[].connection_id).
--notestring
Context for the approver
up to 500 characters

--data <json|@file|-> sends the whole body instead of flags.

Example

tracee apps request hubspot \
  --method GET \
  --endpoint /crm/v3/objects/contacts

Calls POST /api/v1/apps/{app}/request