# Dnsfilter DNSFilter provides cloud-based DNS security and content filtering solutions to protect networks from online threats and manage internet usage. - **Category:** security & identity tools - **Auth:** API_KEY - **Composio Managed App Available?** N/A - **Tools:** 171 - **Triggers:** 0 - **Slug:** `DNSFILTER` - **Version:** 20260312_00 ## Tools ### Add Allowed Application **Slug:** `DNSFILTER_ADD_ALLOWED_APPLICATION` Adds a single application to the allow list of a policy in DNSFilter. Use this action when you need to permit a specific application through the filtering policy. The application will be added to the policy's allow_applications list and will be allowed regardless of other blocking rules. This is useful for whitelisting specific applications that need to function while maintaining strict filtering policies for other traffic. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | Policy ID to add the allowed application to. Use LIST_POLICIES action to retrieve valid policy IDs. | | `name` | string | Yes | Application name to add to the allow list. This should be a valid application identifier recognized by DNSFilter (e.g., '1password', 'dropbox', 'slack'). | | `include_relationships` | boolean | No | Include relationships in the response (organization, etc.). Defaults to true. Set to false for a lighter response payload. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Add Allowlist Domains to Policies **Slug:** `DNSFILTER_ADD_ALLOWLIST_DOMAINS_TO_POLICIES` Tool to bulk add one or more domains to one or more policies' allow lists. Use when you need to permit specific domains across multiple policies efficiently, bypassing filtering rules for trusted sites. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `notes` | object | No | Optional dictionary mapping domain names to explanatory notes. Keys are domain names and values are note strings describing why the domain was added. | | `domains` | array | Yes | List of domain names to add to the allow list. These domains will bypass filtering rules and be permitted for the specified policies. | | `policy_ids` | array | Yes | List of policy IDs to which the domains should be added. Use LIST_POLICIES action to retrieve valid policy IDs. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Add Blacklist Category To Policy **Slug:** `DNSFILTER_ADD_BLACKLIST_CATEGORY_TO_POLICY` Tool to add a single category to a policy's blocklist. Use when you need to block a specific content category for a DNS filtering policy. The category will be added to the existing blacklist categories without affecting other policy settings. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique ID of the policy to update. Use LIST_POLICIES or GET_POLICIES actions to retrieve valid policy IDs. | | `category_id` | integer | Yes | The ID of the category to add to the blocklist. Use LIST_CATEGORIES or LIST_ALL_CATEGORIES actions to retrieve valid category IDs. | | `include_relationships` | boolean | No | Include relationships in the response (organization, etc.). Defaults to true. Set to false for a lighter response payload. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Add Blacklist Domain To Policy **Slug:** `DNSFILTER_ADD_BLACKLIST_DOMAIN_TO_POLICY` Tool to add a single domain to a policy's blocklist. Use when you need to block a specific domain under a DNS filtering policy. The domain will be added to the policy's blacklist and blocked from access for users under that policy. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique ID of the policy to add the domain to. Use LIST_POLICIES action to retrieve valid policy IDs. | | `note` | string | Yes | A note or comment explaining why this domain is being blocked. Useful for documentation and auditing purposes. | | `domain` | string | Yes | The domain name to add to the blocklist. Should be a fully qualified domain name (FQDN) without protocol prefix (e.g., 'malicious-domain.com', not 'https://malicious-domain.com'). | | `include_relationships` | boolean | No | Include relationships in the response (organization, etc.). Defaults to true. Set to false for a lighter response payload. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Add Blocked Application **Slug:** `DNSFILTER_ADD_BLOCKED_APPLICATION` Adds a single application to the block list of a policy in DNSFilter. Use this action when you need to block a specific application through the filtering policy. The application will be added to the policy's block_applications list and will be blocked regardless of other allow rules. This is useful for blocking specific applications that should not be accessible while maintaining other filtering policies. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | Policy ID to add the blocked application to. Use LIST_POLICIES action to retrieve valid policy IDs. | | `name` | string | Yes | Application name to add to the block list. This should be a valid application identifier recognized by DNSFilter (e.g., '101domains', 'tiktok', 'snapchat'). | | `include_relationships` | boolean | No | Include relationships in the response (organization, etc.). Defaults to true. Set to false for a lighter response payload. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Add Blocklist Domains To Policies **Slug:** `DNSFILTER_ADD_BLOCKLIST_DOMAINS_TO_POLICIES` Tool to add one or more domains to the blocklist of multiple policies at once. Use when you need to block specific domains across multiple filtering policies efficiently. The operation applies all specified domains to all specified policies in a single API call. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `notes` | object | No | Optional key-value pairs mapping domain names to notes/comments. Keys should match domains from the 'domains' field. Useful for documenting why specific domains are blocked. | | `domains` | array | Yes | List of domain names to add to the blocklist. Each domain should be a fully qualified domain name (FQDN) without protocol prefix (e.g., 'malicious-domain.com', not 'https://malicious-domain.com'). | | `policy_ids` | array | Yes | List of policy IDs to add the domains to. Each policy will have all specified domains added to its blocklist. Use LIST_POLICIES action to retrieve valid policy IDs. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Add Whitelist Domain **Slug:** `DNSFILTER_ADD_WHITELIST_DOMAIN` Tool to add a single domain to a policy's allowlist. Use when you need to permit a specific domain for a policy, bypassing filtering rules for that trusted site. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | Policy ID to which the domain should be added. Use LIST_POLICIES action to retrieve valid policy IDs. | | `note` | string | Yes | Explanatory note describing why this domain was added to the allowlist. Helps document the reason for allowlisting this domain. | | `domain` | string | Yes | Domain name to add to the allowlist. This domain will bypass filtering rules and be permitted for the specified policy. Domain should be in standard format without protocol (e.g., 'example.com'). | | `include_relationships` | boolean | No | Include relationships in the response. Defaults to true. Set to false for a lighter response payload. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Cancel Organization **Slug:** `DNSFILTER_CANCEL_ORGANIZATION` Sets an organization as 'Canceled' in DNSFilter by its unique ID. Use this action when you need to cancel an organization's service. The organization will be marked as canceled but may not be immediately deleted depending on billing cycles. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique ID of the organization to cancel. Use the List Organizations action to find valid organization IDs. This sets the organization status to 'Canceled'. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Check User Agent Bulk Updates Has Mixed **Slug:** `DNSFILTER_CHECK_USER_AGENT_BULK_UPDATES_HAS_MIXED` Check if user agent attributes are mixed in a bulk selection. Use this to determine whether block pages, policies, sites, or tags differ across the selected user agents before performing bulk updates. This helps identify configuration inconsistencies and plan bulk update operations. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `ids` | array | No | List of user agent IDs to check for mixed attributes. If empty, the check applies to all agents matching the filter parameters. | | `tags` | array | No | Filter user agents by tags. Agents matching any of the specified tags will be included. | | `type` | string ("proxy" | "agents") | No | User agent type filter. Defaults to non-proxy/non-relay user agents if not specified. | | `state` | string ("online" | "offline") | No | Filter user agents by their online/offline state. | | `search` | string | No | Search user agents by keywords (space-delimited). Searches across hostname and friendly name fields. | | `status` | string | No | Filter user agents by status. Valid values: active, disabled, uninstalled. | | `agent_state` | string ("protected" | "unprotected" | "bypassed" | "uninstalled") | No | Filter user agents by their protection state: protected, unprotected, bypassed, or uninstalled. | | `name_search` | string | No | Search term to filter clients by hostname or friendly_name fields. Case-insensitive partial matching. | | `network_ids` | array | No | List of network IDs to filter user agents. If not specified, defaults to all networks. | | `organization_ids` | array | No | List of organization IDs to filter user agents. Defaults to user organization ID if not specified. | | `traffic_received_last_15_mins` | boolean | No | Filter to include only agents that have received traffic in the last 15 minutes. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create API Keys **Slug:** `DNSFILTER_CREATE_API_KEYS` Creates a new API key in DNSFilter for authentication and API access. This action generates a new API key that can be used to authenticate API requests to DNSFilter. The API key is returned only once upon creation and should be stored securely. You can optionally set an expiration date to enforce key rotation policies. Use cases include: - Creating keys for automated integrations - Generating keys for third-party service access - Setting up keys with specific expiration policies IMPORTANT: The API key value is only returned in the creation response. Store it securely as it cannot be retrieved later. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `name` | string | Yes | A descriptive name for the API key to help identify its purpose or usage (e.g., 'Production API Key', 'Integration with Service X'). This helps with organization and management of multiple API keys. | | `expiry` | string | Yes | Expiration date and time for the API key in ISO 8601 format (e.g., '2026-12-31T23:59:59.000Z'). The expiry date must be in the future and cannot be more than 1 year from the current date. Use this to enforce key rotation policies. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create CyberSight CSV Export **Slug:** `DNSFILTER_CREATE_CYBER_SIGHT_CSV_EXPORT` Creates a CyberSight CSV export record to track export of CyberSight report information. This action initiates an export of CyberSight activity logs to CSV format. The export is processed asynchronously - the response includes a UUID to track the export status. Once processing is complete, the response will contain a presigned S3 URL to download the CSV file. Common use cases: - Exporting activity logs for compliance reporting - Downloading filtered CyberSight data for analysis - Creating scheduled reports of network activity The export can be filtered by organization, time range, activity type, and various other criteria. Required fields are report_type, start_at, and end_at. The export URL will be available once processing is complete (usually within a few minutes depending on data volume). #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `end_at` | string | Yes | End date/time for the report query in ISO8601 format (e.g., '2026-02-13T23:59:59Z'). This defines the end of the time range for the exported data. | | `search` | string | No | Search term for filtering results. General search across CyberSight data. | | `app_name` | string | No | Filter by application name using regex pattern. Use this to export activities from applications matching the pattern. | | `msp_uuid` | string | No | MSP UUID to filter by in UUIDv7 format. Limits the export to data from a specific Managed Service Provider. | | `start_at` | string | Yes | Start date/time for the report query in ISO8601 format (e.g., '2026-02-06T00:00:00Z'). This defines the beginning of the time range for the exported data. | | `web_host` | string | No | Filter by web host using regex pattern. Use this to export web activities from specific hosts. | | `ip_search` | string | No | IP address to search for. Use this to export activities from a specific IP address. | | `org_uuids` | array | No | Organization UUIDs to filter by in UUIDv7 format. Limits the export to data from specified organizations only. | | `report_type` | string ("activity_logs") | Yes | Type of CyberSight Report to export. Currently only 'activity_logs' is supported. | | `category_ids` | array | No | Category IDs to filter by. Limits the export to activities in specific categories. | | `web_full_url` | string | No | Filter by web full URL using regex pattern. Use this to export web activities matching specific URL patterns. | | `weekdays_only` | boolean | No | Only include weekdays in results (Monday-Friday). Defaults to false if not specified. | | `app_window_title` | string | No | Filter by application window title using regex pattern. Use this to export activities from applications with specific window titles. | | `included_columns` | array | No | Specific columns to include in the exported CSV report. If not specified, all available columns will be included. | | `user_agent_uuids` | array | No | User agent UUIDs to filter by in UUIDv7 format. Limits the export to activities from specific user agents. | | `activity_type_ids` | array | No | Activity type IDs to filter by. Use this to export only specific types of activity logs. | | `excluded_org_uuids` | array | No | Organization UUIDs to exclude from results in UUIDv7 format. Use this to filter out specific organizations from the export. | | `app_executable_path` | string | No | Filter by application executable path using regex pattern. Use this to export activities from applications at specific paths. | | `agent_local_user_uuids` | array | No | Agent local user UUIDs to filter by in UUIDv7 format. Limits the export to activities from specific agent users. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create IP Address **Slug:** `DNSFILTER_CREATE_IP_ADDRESS` Creates a new IP address entry in DNSFilter for network filtering and policy enforcement. This action registers an IPv4 or IPv6 address with a specific network in DNSFilter, allowing that IP to be subject to the network's filtering policies. Common use cases include: - Adding gateway or router IP addresses - Registering office or branch location IPs - Including failover or WAN link IPs Prerequisites: - Must have a valid network_id (use LIST_NETWORKS to retrieve available networks) - The IP address must be a valid IPv4 or IPv6 format - User must have authorization to create IP addresses in the target network Returns the created IP address details including its unique ID and UUID for future reference. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `address` | string | Yes | The IPv4 or IPv6 address to register. Must be a valid IP address format (e.g., '192.0.2.1' for IPv4 or '2001:db8::1' for IPv6). This IP will be associated with the specified network for filtering purposes. | | `network_id` | integer | Yes | The unique identifier of the network where this IP address should be registered. Use the LIST_NETWORKS action to retrieve valid network IDs from your DNSFilter account. | | `description` | string | No | Optional human-readable label or note to identify this IP address (e.g., purpose, location, or device name). Helps with organization and management of multiple IPs. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create MAC Address **Slug:** `DNSFILTER_CREATE_MAC_ADDRESS` Creates a new MAC address entry in DNSFilter with the specified data. This action registers a MAC address with a specific organization in DNSFilter, allowing that MAC address to be subject to custom filtering policies and block pages. Common use cases include: - Adding device MAC addresses for network access control - Assigning custom policies to specific devices - Managing device-level filtering in BYOD environments Prerequisites: - Must have a valid organization_id (use LIST_ORGANIZATIONS to retrieve available organizations) - The MAC address should be in valid format with colons (e.g., '00:11:22:33:44:55') - User must have authorization to create MAC addresses in the target organization Returns the created MAC address details including its unique ID for future reference. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mac_address` | object | Yes | MAC address creation request parameters containing the organization ID and optional MAC address details. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Networks **Slug:** `DNSFILTER_CREATE_NETWORKS` Creates a new network with the specified configuration in DNSFilter. Networks represent locations or groups of devices that will be protected by DNSFilter's DNS filtering policies. Use this action to set up filtering for office locations, remote workers, or any group of devices that need DNS security. Required fields are network name and organization_id. Optional settings include custom block pages, IP addresses, local domain handling, and policy assignments. The action returns the complete network details including its unique ID and UUID for future operations. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `network` | object | Yes | Network data with required and optional attributes for network creation. At minimum, you must provide a name and organization_id. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Bulk Create Networks **Slug:** `DNSFILTER_CREATE_NETWORKS_BULK` Bulk create multiple networks in DNSFilter with a single API call. Use when you need to create multiple networks at once for efficiency. Each network requires at minimum a name; optional fields like physical address, coordinates, description, and policy assignment can be included for better organization. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `networks` | array | Yes | Array of network objects to create. Each network must have at minimum a 'name' field. All networks will be created in a single bulk operation. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Organization User **Slug:** `DNSFILTER_CREATE_ORGANIZATION_USER` Adds a new or existing user with the specified email to an organization in DNSFilter. This action creates a user association with a specific organization, assigning them a role (administrator or read_only). If the user email already exists in DNSFilter, it adds that existing user to the organization. If the email is new, it creates a new user account. Common use cases: - Adding administrators to manage organization settings - Granting read-only access to stakeholders or auditors - Managing multi-organization access with permission lists Prerequisites: - Must have a valid organization_id (use LIST_ORGANIZATIONS to retrieve) - User must have administrator permissions in the organization - Email must be valid and unique within the organization Returns the created user details including their ID, role, and contact information. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user` | object | Yes | User creation request parameters containing the email, name, role, and optional permissions. | | `organization_id` | integer | Yes | The ID of the organization to add the user to. Use the LIST_ORGANIZATIONS action to retrieve valid organization IDs from your DNSFilter account. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Policies **Slug:** `DNSFILTER_CREATE_POLICIES` Creates a new DNS filtering policy with the specified configuration in DNSFilter. Policies define filtering rules including blocked/allowed categories, domain lists, safe search enforcement, and application controls. Use this action to create filtering policies that can be applied to networks, IP addresses, or MAC addresses for content filtering and security enforcement. Required fields are policy name and organization_id. Optional settings include category blocking, domain allow/block lists, safe search enforcement for multiple search engines, application controls, and YouTube restrictions. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `policy` | object | Yes | Policy creation request parameters containing the policy name, organization ID, and optional filtering settings. | | `append_domains` | boolean | No | Option to append allowlist/blocklist domains to the existing ones rather than replacing them. Default: false. Use true when adding to existing domain lists. | | `include_relationships` | boolean | No | Include relationships in the response (organization, etc.). Defaults to true. Set to false for a lighter response payload. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Scheduled Policy **Slug:** `DNSFILTER_CREATE_SCHEDULED_POLICY` Creates a new scheduled (time-based) policy in DNSFilter. Scheduled policies allow different filtering policies to be applied during different times of the week based on a weekly schedule divided into 15-minute intervals. Use this action to implement time-based filtering rules such as stricter policies during school/work hours and relaxed policies during evenings or weekends. The policy_ids array must contain exactly 672 integers representing each 15-minute block of the week starting from Monday 12:01am. Each policy ID can be reused for multiple time blocks to create consistent filtering periods. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `name` | string | Yes | Human-readable name for the scheduled policy. Use a descriptive name that helps identify the policy's purpose or schedule (e.g., 'School Hours Policy', 'Weekend Filtering'). | | `timezone` | string | Yes | The timezone string in IANA timezone database format (e.g., 'America/New_York', 'Europe/London', 'Asia/Tokyo') for localizing the scheduled policy. This determines when each 15-minute block applies based on local time. | | `policy_ids` | array | Yes | Array of exactly 672 policy IDs representing 15-minute time blocks for the entire week, starting Monday morning 12:01am. Each element corresponds to a 15-minute interval (4 blocks per hour × 24 hours × 7 days = 672 blocks). Use policy IDs from LIST_POLICIES action. The same policy ID can be repeated for multiple time blocks. | | `organization_id` | integer | Yes | The unique identifier of the organization where this scheduled policy should be created. Use LIST_ORGANIZATIONS action to retrieve valid organization IDs. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Scheduled Report Previews **Slug:** `DNSFILTER_CREATE_SCHEDULED_REPORT_PREVIEWS` Creates a scheduled report preview for an organization, triggering background generation of the report. This action initiates the generation of a preview for scheduled reports in DNSFilter. The preview includes filtered content statistics and threat summaries based on the organization's DNS filtering activity. Use this when you need to generate a sample report to review filtering effectiveness or prepare regular scheduled reports. The report generation happens asynchronously in the background after creation. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `scheduled_report_preview` | object | Yes | Scheduled report preview configuration containing organization ID and report display options. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create Scheduled Report **Slug:** `DNSFILTER_CREATE_SCHEDULED_REPORTS` Creates a scheduled report in DNSFilter to automate regular delivery of network activity and security summaries. Use this to set up periodic reports that track web traffic, threats, and content filtering patterns for your organization. Required fields are organization_id and frequency. Optional settings include threat summaries, content category breakdowns, delivery schedules, and recipient lists. The scheduled report will be generated and sent automatically according to the specified frequency. Use this when you need regular visibility into network filtering activity without manual report generation. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `scheduled_report` | object | Yes | Configuration details for the scheduled report including frequency, content options, and recipients. At minimum, you must provide organization_id and frequency. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create User Agent Bulk Deletes **Slug:** `DNSFILTER_CREATE_USER_AGENT_BULK_DELETES` Create a user agent bulk delete operation in DNSFilter. Use when you need to delete multiple user agents at once based on explicit IDs or filter criteria. This action allows you to either: 1. Delete specific agents by providing their IDs in the 'ids' parameter 2. Delete agents matching filter criteria (agent_state, network_ids, tags, etc.) 3. Combine filters with exclude_ids to protect specific agents from bulk deletion The 'queue_uninstall' parameter determines deletion behavior: - True: Hard delete with agent uninstallation - False: Soft delete (agent deactivation) Common use cases: - Remove all unprotected agents from a specific network - Delete agents that haven't received traffic recently - Clean up agents with a specific version or status - Bulk remove agents by tags or organization #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `ids` | array | No | List of user agent IDs to delete. When provided, this overrides any lookups based on filter parameters. If empty or not provided, agents will be selected based on the filter parameters below. | | `tags` | array | No | Filter user agents by tags. Agents matching any of the specified tags will be included. | | `type` | string ("proxy" | "agents") | No | User agent type filter. Defaults to non-proxy/non-relay user agents if not specified. | | `state` | string ("online" | "offline") | No | Filter user agents by their online/offline state. | | `search` | string | No | Search user agents by keywords (space-delimited). Searches across hostname and friendly name fields. | | `status` | string | No | Filter user agents by status: active, disabled, or uninstalled. | | `policy_id` | integer | No | Filter user agents by their assigned policy ID. | | `agent_state` | string ("protected" | "unprotected" | "bypassed" | "uninstalled") | No | Filter user agents by their protection state: protected, unprotected, bypassed, or uninstalled. | | `exclude_ids` | array | No | List of user agent IDs to exclude from deletion when using filter parameters. This allows you to apply broad filters while protecting specific agents from deletion. | | `name_search` | string | No | Search term to filter clients by hostname or friendly_name fields. Case-insensitive partial matching. | | `network_ids` | array | No | List of network IDs to filter user agents. If not specified, defaults to all networks. | | `agent_version` | string | No | Filter user agents by specific agent version string. | | `block_page_id` | integer | No | Filter user agents by the ID of their assigned block page. | | `organization_id` | integer | No | Organization ID to filter user agents. Required when using filter parameters without explicit IDs. | | `policy_schedule` | string | No | Filter user agents by policy or schedule name. | | `queue_uninstall` | boolean | No | If true, the operation will uninstall the agents (hard delete). If false, performs a soft delete. Determines whether agents are marked for uninstallation or just deactivated. | | `organization_ids` | array | No | List of organization IDs to filter user agents across multiple organizations. | | `scheduled_policy_id` | integer | No | Filter user agents by their assigned scheduled policy ID. | | `traffic_received_last_15_mins` | boolean | No | Filter to include only agents that have received traffic in the last 15 minutes. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Create User Agent Cleanup **Slug:** `DNSFILTER_CREATE_USER_AGENT_CLEANUP` Creates a user agent cleanup to track bulk deletion of inactive user agents in DNSFilter. This action initiates a cleanup process that identifies and deletes user agents that have been inactive for a specified number of days across one or more organizations. The cleanup helps maintain an accurate inventory by removing stale agent entries that are no longer in use. Use cases: - Removing outdated agents from decommissioned devices - Cleaning up test agents after evaluation periods - Maintaining accurate license counts by removing inactive agents Returns details about the cleanup operation including which agents will be deleted and the status of the cleanup process. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `inactive_for` | integer | Yes | Number of days an agent must be inactive to be included in the cleanup. For example, setting this to 30 will target agents that have not been active for 30 or more days. | | `organization_ids` | array | Yes | List of organization IDs to perform cleanup on. Use LIST_ORGANIZATIONS action to retrieve valid organization IDs. The cleanup will identify and delete inactive user agents across the specified organizations. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete API Key **Slug:** `DNSFILTER_DELETE_API_KEY` Tool to remove an API key by its ID. Use when you need to revoke or delete an existing API key from the DNSFilter system. Returns success on 204 No Content. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique ID of the API key to delete. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete IP Address **Slug:** `DNSFILTER_DELETE_IP_ADDRESS` Removes an IP address from DNSFilter by its unique ID. Use this action when you need to unregister an IP address from a network, such as when decommissioning equipment or removing access. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique identifier of the IP address to delete. Use LIST_IP_ADDRESSES or GET_IP_ADDRESS actions to retrieve valid IP address IDs. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete MAC Address **Slug:** `DNSFILTER_DELETE_MAC_ADDRESS` Deletes a MAC address entry from DNSFilter by its ID. Use this action when you need to remove a MAC address from your network filtering configuration. You must provide the numeric ID of the MAC address to delete. The action returns the deleted resource information in JSON:API format, including the ID, type, and UUID of the removed MAC address. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mac_address_id` | integer | Yes | The unique ID of the MAC address to delete. Use the List All MAC Addresses or List MAC Addresses action to find valid MAC address IDs. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Networks (Bulk) **Slug:** `DNSFILTER_DELETE_NETWORKS_BULK` Bulk destroy multiple networks in DNSFilter. Use when you need to delete multiple networks at once or all networks in an organization. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `ids` | string | Yes | Comma-delimited list of network IDs to delete (e.g., '10626258,10626259') or the keyword 'all' to delete all networks. When using 'all', the organization_id parameter is required. | | `organization_id` | integer | No | Organization ID. This parameter is required when ids is set to 'all' to specify which organization's networks should be deleted. Not needed when specific network IDs are provided. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Policies **Slug:** `DNSFILTER_DELETE_POLICIES` Deletes a DNS filtering policy from DNSFilter by its unique ID. Use this action when you need to remove a policy that is no longer needed. Note that the API performs a soft deletion, setting a deleted_at timestamp on the policy record. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique ID of the policy to delete. Use the List Policies action to find valid policy IDs. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Scheduled Policies **Slug:** `DNSFILTER_DELETE_SCHEDULED_POLICIES` Removes a scheduled policy from the DNSFilter database by its unique ID. Use this action when you need to delete a scheduled policy that is no longer needed or was created in error. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique ID of the scheduled policy to delete. Use the List Scheduled Policies action to find valid scheduled policy IDs. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Delete Scheduled Report **Slug:** `DNSFILTER_DELETE_SCHEDULED_REPORT` Tool to delete a scheduled report by its ID. Use when you need to remove a scheduled report from the DNSFilter system. Returns the deleted report data. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique ID of the scheduled report to delete. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get API Key **Slug:** `DNSFILTER_GET_API_KEYS` Tool to retrieve detailed information about a specific API key by its ID. Use when you need to display or verify the details of an existing API key. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique identifier of the API key to retrieve. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Application Category **Slug:** `DNSFILTER_GET_APPLICATION_CATEGORY` Retrieves detailed information about a specific DNSFilter application category by its ID. Application categories group applications for filtering policies (e.g., Business, VPN And Proxy, GenAI & ML). Use LIST_APPLICATION_CATEGORIES to discover available category IDs first. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `application_category_id` | string | Yes | The unique identifier of the application category to retrieve. Use LIST_APPLICATION_CATEGORIES to get valid IDs. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Billing Address **Slug:** `DNSFILTER_GET_BILLING_ADDRESS` Retrieves the billing address for a specific DNSFilter organization. Use when you need to access or verify billing contact information, shipping addresses, or organization location details for invoicing purposes. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `organization_id` | integer | Yes | The unique identifier of the organization to retrieve billing address for. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Billing Information **Slug:** `DNSFILTER_GET_BILLING_INFORMATION` Retrieves billing records for a specific DNSFilter organization. Returns a list of billing records including amounts, payment status, and billing periods. Returns an empty list if no billing records exist for the organization. Use this when you need to access billing history, verify payment status, or generate billing reports. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `organization_id` | string | Yes | Unique identifier of the organization. Can be either the numeric ID or UUID format. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Category **Slug:** `DNSFILTER_GET_CATEGORY` Tool to get basic information of a specific category. Use when you need to retrieve details for a category by its ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | Unique identifier of the category to retrieve | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get IP Address **Slug:** `DNSFILTER_GET_IP_ADDRESS` Retrieves detailed information for a specific IP address record by its ID. Use this action when you need to fetch complete metadata, network relationships, and attributes for a particular IP address that you've already identified (e.g., from the List IP Addresses action). The response includes the IP address in both short and full notation, along with associated network and organization IDs. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `ip_address_id` | string | Yes | The unique ID of the IP address record to retrieve (e.g., from the List IP Addresses action). | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get MAC Address **Slug:** `DNSFILTER_GET_MAC_ADDRESS` Retrieves detailed information for a specific MAC address record by its ID. Use this action when you need to fetch complete metadata and attributes for a particular MAC address that you've already identified (e.g., from the List MAC Addresses action). The response includes the MAC address value, name/label, organization and location associations, and timestamps in JSON:API format. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `mac_address_id` | integer | Yes | The unique ID of the MAC address record to retrieve (e.g., from the List MAC Addresses action). | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Organization Usage Metrics **Slug:** `DNSFILTER_GET_METRICS_ORGANIZATION_USAGE` Retrieves usage metrics for a DNSFilter organization over a specified date range. Returns DNS query counts, user statistics, and billing information. The maximum allowed date range is 365 days. Use this when you need to analyze organization activity, generate usage reports, or monitor DNS request volumes. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | Yes | End date for the usage metrics in ISO 8601 format (YYYY-MM-DD). The maximum date range is 365 days. | | `from` | string | Yes | Start date for the usage metrics in ISO 8601 format (YYYY-MM-DD). The maximum date range is 365 days. | | `organization_id` | integer | Yes | Unique identifier of the organization. Obtain this from the List Organizations action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Organization Usage Detailed Metrics **Slug:** `DNSFILTER_GET_METRICS_ORGANIZATION_USAGE_DETAILED` Retrieves detailed usage metrics for a specific DNSFilter organization. Use this when you need comprehensive usage statistics including user counts, WiFi networks, roaming clients, and DNS request volumes for a given time period. This endpoint fetches user_count and wifi_count directly from the database and includes roaming client counts. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | Organization ID to retrieve usage metrics for. | | `to_date` | string | No | End date for the usage period in ISO8601 format (e.g., "2023-12-31"). If not provided, defaults to the current date. | | `from_date` | string | No | Start date for the usage period in ISO8601 format (e.g., "2023-12-01"). If not provided, defaults to the beginning of the current billing period. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get My IP Address **Slug:** `DNSFILTER_GET_MY_IP_ADDRESS` Tool to retrieve the requester's IP address as reported by DNSFilter API. Use when you need to determine the public IP address from which API requests are being made. #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Networks Bulk Create Status **Slug:** `DNSFILTER_GET_NETWORKS_BULK_CREATE` Tool to check the status of a bulk network creation job. Use when you need to monitor the progress or completion of a bulk network creation operation, or to retrieve the results (successful, failed, and skipped counts) of a completed bulk job. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | Yes | The unique ID of the bulk create job to check status on. This ID is returned when you initiate a bulk network creation operation. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Networks Bulk Destroy Status **Slug:** `DNSFILTER_GET_NETWORKS_BULK_DESTROY` Check the status of a bulk network destroy operation. Use this action after initiating a bulk destroy to monitor progress and see which networks were successfully destroyed, failed, or skipped. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | Yes | The ID of the bulk destroy job to check status on (UUID format). This ID is returned when initiating a bulk destroy operation. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Networks Bulk Update Status **Slug:** `DNSFILTER_GET_NETWORKS_BULK_UPDATE_STATUS` Check the status of a bulk network update job. Use this action to monitor the progress and results of a bulk update operation after initiating it. The response indicates completion status, success/failure counts, and IDs of affected networks. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | Yes | The ID of the bulk update job to check status on. This ID is returned when you create a bulk update job. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Networks CSV Export **Slug:** `DNSFILTER_GET_NETWORKS_CSV_EXPORT` Retrieves a networks CSV export by its ID. Use this action when you need to check the status of a CSV export or get the download URL for the exported data. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | Yes | The unique ID of the network CSV export to retrieve. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Notes **Slug:** `DNSFILTER_GET_NOTES` Tool to retrieve notes associated with a specific resource (policy, MSP, or organization) and domain. Use when you need to fetch allow/block notes for a particular domain within a given resource context. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique identifier of the resource (policy ID, MSP ID, or organization ID). | | `domain` | string | Yes | The domain name to retrieve notes for (e.g., 'example.com', 'google.com'). | | `resource` | string ("policies" | "msps" | "organizations") | Yes | The resource type to retrieve notes for. Valid values: policies, msps, or organizations. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Organization **Slug:** `DNSFILTER_GET_ORGANIZATION` Tool to get basic information of a specific organization by ID. Use when you need to retrieve detailed organization configuration, billing details, feature flags, and network relationships for a particular organization. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | Organization ID to retrieve | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Organization User **Slug:** `DNSFILTER_GET_ORGANIZATIONS_USERS` Tool to retrieve user details and permissions for a specific organization. Use when you need to fetch information about a particular user within an organization, including their role, contact details, and permission settings. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The ID of the user to return | | `organization_id` | integer | Yes | The ID of the organization to search | | `include_auth_providers` | boolean | No | Return user's authentication providers if true (default: false) | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Policy **Slug:** `DNSFILTER_GET_POLICIES` Tool to get basic information of the specified policy. Use when you need to retrieve details for a specific policy by its ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique ID of the policy to retrieve. | | `include_relationships` | boolean | No | Include relationships in the response. Defaults to true. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Policy Permissive Mode **Slug:** `DNSFILTER_GET_POLICIES_PERMISSIVE_MODE` Tool to retrieve the permissive mode setting for a specific policy. Use when you need to check if a policy has permissive mode enabled or disabled. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique ID of the policy to retrieve permissive mode for. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Policy IP **Slug:** `DNSFILTER_GET_POLICY_IP` Retrieves basic information for a specific Policy IP by its ID. Use this action when you need to fetch DNS server IP addresses (primary and secondary) associated with a particular policy. The response includes the Policy IP's UUID and the DNS server addresses that can be used for DNS filtering. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique ID of the Policy IP to retrieve. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get Scheduled Report Preview **Slug:** `DNSFILTER_GET_SCHEDULED_REPORT_PREVIEWS` Tool to retrieve a specific scheduled report preview by its ID. Use when you need to view the preview data for a scheduled report before it's sent. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique identifier of the scheduled report preview to retrieve. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get User **Slug:** `DNSFILTER_GET_USER` Tool to get basic information of a specified user by ID. Use when you need to retrieve user details such as email, name, role, and verification status. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | string | Yes | The unique identifier of the user to retrieve. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get User Agent Cleanup **Slug:** `DNSFILTER_GET_USER_AGENT_CLEANUP` Tool to get the specific user agent cleanup by ID. Use when you need to retrieve the status and details of a user agent cleanup process, including which agents are marked for deletion and whether the cleanup has completed. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | Id of user agent cleanup | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get User Agent CSV Export **Slug:** `DNSFILTER_GET_USER_AGENT_CSV_EXPORTS` Tool to retrieve a specific user agent CSV export by its ID. Use when you need to check the status of a CSV export and obtain the download URL once ready. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | ID of the user agent CSV export to retrieve | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Get User Agents Uninstall PIN **Slug:** `DNSFILTER_GET_USER_AGENTS_UNINSTALL_PIN` Tool to get the uninstall PIN for an organization's user agents. Use when you need to retrieve the PIN required to uninstall user agents protected by PIN authentication. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `organization_id` | integer | Yes | Organization ID to get the uninstall PIN for | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List All Agent Local Users **Slug:** `DNSFILTER_LIST_ALL_AGENT_LOCAL_USERS` Get all agent local users associated with a user organization. Returns basic information about agent local users including their IDs, types, and relationships. Use filters to narrow results by collection membership, name, or organization. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `name` | string | No | Filter by name. If friendly_name not found, will search by user_name | | `sort` | string | No | Sort options, valid attributes: name | | `page_size` | integer | No | Number of items per page. Maps to page[size] in the API | | `page_number` | integer | No | Page number for pagination. Maps to page[number] in the API | | `in_a_collection` | boolean | No | Filter by agent local users in a collection | | `organization_ids` | array | No | Organization IDs to filter by, defaults to user organization ID | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List All Block Pages **Slug:** `DNSFILTER_LIST_ALL_BLOCK_PAGES` Retrieves all block pages associated with the current user. Block pages are custom HTML pages displayed when users attempt to access blocked websites. Use this when you need a complete list of all configured block pages without pagination. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `organization_id` | integer | No | Filter block pages by organization ID | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List All IP Addresses **Slug:** `DNSFILTER_LIST_ALL_IP_ADDRESSES` Retrieves all IP addresses across all networks in your organization. This tool automatically handles pagination to fetch complete results. Use this when you need a comprehensive list of all IP address entries without filtering. #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List API Keys **Slug:** `DNSFILTER_LIST_API_KEYS` Retrieves the list of API keys associated with the authenticated user. Use this to view all API keys, check their expiration status, or filter by specific criteria such as name or organization. Supports filtering by expiration, ID, name, organization, and last four characters of the token. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | No | Filter by API key ID. Returns only the API key with this specific ID. | | `name` | string | No | Filter by API key name. Returns keys matching this name. | | `expired` | boolean | No | Filter by expiration status. Set to true to return only expired keys, false for non-expired keys. If not specified, returns all keys. | | `last_four` | string | No | Filter by last four characters of the API key token. Useful for identifying a specific key. | | `organization_id` | integer | No | Filter by organization ID. Returns API keys associated with this organization. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Application Categories **Slug:** `DNSFILTER_LIST_APPLICATION_CATEGORIES` Retrieves all available application categories from DNSFilter. Application categories group SaaS applications and services (e.g., Business, Messaging, File Sharing, VPN And Proxy) and are used to apply filtering policies. Returns a list of categories with their IDs, names, UUIDs, and descriptions. Use this to discover available categories before configuring policies or filtering rules. #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List All Applications **Slug:** `DNSFILTER_LIST_APPLICATIONS_ALL` Tool to list all applications basic information including deleted ones. Use when you need a comprehensive list of all application entries without filtering out deleted applications. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `page_size` | integer | No | Number of records per page to return. If not specified, the API determines the default page size. | | `page_number` | integer | No | Page number to retrieve (1-indexed). If not specified, returns the first page. | | `category_ids` | array | No | Category IDs to filter applications by. If not specified, returns applications from all categories. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Billing **Slug:** `DNSFILTER_LIST_BILLING` Retrieve payment method information from Stripe for a DNSFilter organization. Returns details about the registered payment method including card information, billing address, and expiration dates. Returns empty response if no payment method is configured. Use this when you need to verify payment method setup or check billing details. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `organization_id` | integer | Yes | User organization ID. Obtain this from the List Organizations action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List All Categories (Including Internal) **Slug:** `DNSFILTER_LIST_CATEGORIES_ALL` Tool to list all categories including internal categories from DNSFilter. Returns comprehensive category information with pagination support. Use when you need the complete set of categories including system/internal categories. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `page` | object | No | Pagination parameters for listing categories. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Current User **Slug:** `DNSFILTER_LIST_CURRENT_USER` Tool to fetch information about the currently authenticated user. Use when you need to retrieve the profile details of the user associated with the current API credentials, including their name, email, and contact information. #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List CyberSight Activity Types **Slug:** `DNSFILTER_LIST_DICTIONARY_CYBER_SIGHT_ACTIVITY_TYPES` Tool to retrieve all available CyberSight activity types. Use when you need the complete dictionary of activity types for CyberSight reports. #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Domains Bulk Lookup **Slug:** `DNSFILTER_LIST_DOMAINS_BULK_LOOKUP` Retrieves domain information and category classifications for multiple FQDNs in a single request. Use this action to perform bulk lookups of domain categories and classifications. This is useful when you need to check the category status of multiple domains at once, rather than making individual requests for each domain. The response includes category information and other domain attributes for each requested FQDN. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `fqdns` | string | Yes | Comma-separated list of fully qualified domain names (FQDNs) to lookup. Each FQDN should be a valid domain name format (e.g., 'google.com,facebook.com,amazon.com'). | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Domains User Lookup **Slug:** `DNSFILTER_LIST_DOMAINS_USER_LOOKUP` Tool to look up all domains associated with a particular FQDN. Returns domain information including category classification, identifiers, and related metadata. Use when you need to retrieve domain details or check the categorization status of a specific fully qualified domain name. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `fqdn` | string | Yes | Fully Qualified Domain Name (FQDN) to lookup, e.g., 'google.com' or 'example.org' | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Enterprise Connections **Slug:** `DNSFILTER_LIST_ENTERPRISE_CONNECTIONS` List all enterprise connections for a DNSFilter organization. Use this to retrieve information about external identity provider integrations and enterprise authentication connections configured for the specified organization. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `organization_id` | integer | Yes | Organization ID to retrieve enterprise connections for | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Invoices **Slug:** `DNSFILTER_LIST_INVOICES` Retrieves billing invoices for a DNSFilter organization with pagination and sorting support. Returns invoice details including amounts, statuses, creation dates, and due dates. Use this when you need to view billing history, check payment status, or retrieve invoice information for accounting purposes. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `page` | integer | No | Page number for pagination. Must be >= 1. | | `sort` | string | No | Field to sort by (e.g., 'created_at', 'amount', 'status'). If not specified, API uses its default sorting. | | `per_page` | integer | No | Number of results per page. Must be >=1. | | `direction` | string ("asc" | "desc") | No | Sort direction: 'asc' (ascending/oldest first) or 'desc' (descending/newest first). If not specified, API uses its default. | | `organization_id` | string | Yes | The unique identifier of the DNSFilter organization. Obtain this from the List Organizations action. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List All IP Addresses (All Endpoint) **Slug:** `DNSFILTER_LIST_IP_ADDRESSES_ALL` Tool to retrieve all user-associated IP addresses with basic information. Use when you need to get the complete list of IP addresses using the dedicated /all endpoint with optional pagination. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `page_size` | integer | No | Number of items per page (default: 1500, max: 1500). Maps to page[size] in the API. | | `page_number` | integer | No | Page number for pagination (default: 1). Maps to page[number] in the API. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List MAC Addresses **Slug:** `DNSFILTER_LIST_MAC_ADDRESSES` Tool to list MAC addresses associated with an organization. Use when you need to retrieve basic MAC address information, optionally filtered by organization or paginated. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `page_size` | integer | No | Number of items per page | | `page_number` | integer | No | Page number for pagination (1-based) | | `organization_id` | string | No | Filter MAC addresses by organization ID | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List All Networks **Slug:** `DNSFILTER_LIST_NETWORKS_ALL` Tool to retrieve ALL networks associated with the user with basic information. Use when you need a comprehensive list of all networks with optional filtering by protection status or search terms. Supports pagination and various options to control the level of detail returned. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `search` | string | No | Search for the given value among the network name, hostname, ip address, etc. | | `page_size` | integer | No | Number of results per page | | `protected` | boolean | No | Filter networks with assigned policy | | `basic_info` | boolean | No | Return most basic Network Info only. Defaults to False | | `page_number` | integer | No | Page number for pagination | | `unprotected` | boolean | No | Filter networks without assigned policy | | `count_network_ips` | boolean | No | Return count of IP Addresses. Defaults to False | | `force_truncate_ips` | boolean | No | Return Network info without IP Addresses. Defaults to False | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Networks Geo **Slug:** `DNSFILTER_LIST_NETWORKS_GEO` Tool to retrieve networks with geographical information only. Use when you need location data (latitude, longitude, physical address) for networks in your DNSFilter organization. This action returns a simplified view focused on network location data without full configuration details. #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List All MSP Networks **Slug:** `DNSFILTER_LIST_NETWORKS_MSP_ALL` Tool to retrieve ALL networks associated with the MSP user with basic information. Use when you need a comprehensive list of all MSP-managed networks for a specific organization ID. Supports pagination and various options to control IP address details. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `page_size` | integer | No | Number of results per page | | `protected` | boolean | No | Filter networks with assigned policy | | `page_number` | integer | No | Page number for pagination | | `unprotected` | boolean | No | Filter networks without assigned policy | | `organization_id` | integer | Yes | Organization ID to retrieve networks for | | `count_network_ips` | boolean | No | Return count of IP Addresses. Defaults to False | | `force_truncate_ips` | boolean | No | Return Network info without IP Addresses. Defaults to False | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Network Subnets **Slug:** `DNSFILTER_LIST_NETWORK_SUBNETS` Tool to retrieve subnets associated with a specific network. Use when you need to get subnet information for a particular network ID. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `page` | integer | No | Page number for pagination (default: 1). Maps to page[number] in the API. | | `page_size` | integer | No | Number of items per page. Maps to page[size] in the API. | | `network_id` | integer | Yes | Network ID to retrieve subnets for | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List All Organizations **Slug:** `DNSFILTER_LIST_ORGANIZATIONS_ALL` Tool to get all organizations with optional filtering by type, MSP relationships, or name. Use when you need to retrieve organizations with specific criteria or pagination. Supports filtering by organization type (normal, msp, sub_organization), MSP ownership, and name patterns. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `name` | string | No | Filter organizations by name using case-insensitive pattern matching | | `page` | object | No | Pagination parameters for the request. | | `type` | string ("normal" | "msp" | "sub_organization") | No | Organization type values. | | `basic_info` | boolean | No | Return only basic organization information (true) or full details (false). Defaults to false. | | `owned_msp_id` | integer | No | Filter to return only parent organizations whose MSP ID matches this value | | `managed_by_msp_id` | integer | No | Filter to return only MSP sub-organizations whose MSP ID matches this value | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Organizations Settings **Slug:** `DNSFILTER_LIST_ORGANIZATIONS_SETTINGS` Tool to get basic information and settings of the specified organization. Use when you need to retrieve organization configuration, settings, or details. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `name` | string | No | Filter organizations by name. Partial matches may be supported. | | `msp_id` | integer | No | MSP ID to set scope for the request. Filter organizations by MSP. | | `organization_id` | integer | No | Organization ID to set scope for the request. Filter to a specific organization. | | `organization_ids` | string | No | Multiple organization IDs to set scope. Comma-separated list of organization IDs. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Organization Users **Slug:** `DNSFILTER_LIST_ORGANIZATIONS_USERS` Tool to get the users for a specified organization. Use when you need to retrieve a list of all users associated with an organization, including their roles, permissions, and authentication details. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `organization_id` | integer | Yes | The ID of the organization to search | | `include_auth_providers` | boolean | No | Return user's authentication providers if true (default: false) | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Policies **Slug:** `DNSFILTER_LIST_POLICIES` Tool to retrieve basic information about user-associated policies. Use when you need to list all available policies for filtering configuration or policy management tasks. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `organization_id` | integer | No | Filter policies by organization ID | | `include_global_policies` | boolean | No | Include global policies in the listing | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List All Policies **Slug:** `DNSFILTER_LIST_POLICIES_ALL` Tool to retrieve ALL user-associated policies with basic information. Use when you need a comprehensive list of all policies associated with the user account, with optional filtering by organization or inclusion of global policies. Supports pagination for large datasets. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `page_size` | integer | No | Number of results per page | | `page_number` | integer | No | Page number for pagination | | `organization_id` | integer | No | Organization ID to filter policies by organization | | `include_global_policies` | boolean | No | Include global policies in the listing | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Policies for Application **Slug:** `DNSFILTER_LIST_POLICIES_APPLICATION` Tool to retrieve policies information for a specific application. Use when you need to see which policies allow or block a particular application, along with application and organization details. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `name` | string | No | Name or partial name of a policy to query | | `policy_ids` | array | No | List of specific policy IDs to retrieve | | `application_id` | integer | Yes | Application ID to retrieve policies for | | `organization_id` | integer | Yes | Organization ID | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Policy IPs **Slug:** `DNSFILTER_LIST_POLICY_IPS` List policy IPs in your DNSFilter organization. Retrieves basic information about user-associated policy IPs including their DNS server addresses (primary and secondary). Use when you need to view all available policy IP configurations for DNS filtering. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `page` | integer | No | Page number for pagination (default: 1). Maps to page[number] in the API. | | `page_size` | integer | No | Number of items per page (default: 1500, max: 1500). Maps to page[size] in the API. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List QP Methods **Slug:** `DNSFILTER_LIST_QP_METHODS` Tool to list all QP (Query Protection) methods available in DNSFilter. Use when you need to retrieve the dictionary of query protection methods. #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List All Scheduled Policies **Slug:** `DNSFILTER_LIST_SCHEDULED_POLICIES_ALL` Tool to retrieve ALL scheduled policies associated with the current user. Use when you need a comprehensive list of all time-based policies with pagination support. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `page_size` | integer | No | Number of results per page | | `page_number` | integer | No | Page number for pagination | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports QPS **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_QPS` Get queries per second (QPS) metrics for DNS traffic over a specified time period. Returns time-series data showing DNS query volume aggregated by configurable time buckets (1 minute, 15 minutes, or 1 day). Use this to analyze traffic patterns, identify peak usage times, and monitor DNS query volumes. Supports extensive filtering by networks, organizations, agents, applications, IP addresses, and traffic type (allowed/blocked/threats). #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `msp_id` | integer | No | MSP ID to filter by. Only applicable for MSP accounts. | | `source` | string | No | Comma separated list of desired traffic sources to include in the report. Options: all, networks, agents, proxies. Defaults to all if not specified. | | `nat_ips` | string | No | Comma separated list of NAT IPs to filter by. Valid values are integers from 101 to 106. Defaults to all if not specified. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "1min" | "15min" | "1day") | No | Bucket size options for report aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_networks` | boolean | No | Group report results by network ID. When true, results are broken down by individual networks. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports QPS Active Agents **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_QPS_ACTIVE_AGENTS` Get queries per second (QPS) statistics for roaming clients over a time period. Returns the total number of DNS queries per second for active agents (roaming clients) with optional filtering by agent, organization, application, network, and other criteria. The maximum time range is 20 minutes. Use this action to monitor real-time DNS query loads and analyze traffic patterns for roaming clients. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not provided or format is not recognized. Maximum time range is 20 minutes. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not provided or format is not recognized. Maximum time range is 20 minutes. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to retrieve. | | `source` | string ("all" | "agents" | "proxies") | No | Traffic source types for filtering. | | `nat_ips` | string | No | Comma separated list of NAT IPs to filter by (valid integer list from 101 to 106). If not specified, returns data for all NAT IPs. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, returns data for all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, returns data for all agents. | | `private_ip` | string | No | Filter by specific private LAN IP address. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, returns data for all agent types. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, returns data for all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, returns data for all MAC addresses. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use together with private_ip_from to specify an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, returns data for all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, returns data for all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use together with private_ip_to to specify an IP range. | | `security_report` | boolean | No | Filter by security threats. Set to true for threats only, false for non-threats only, or omit for both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. Defaults to user's organization ID if not specified. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports QPS Active Collections **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_QPS_ACTIVE_COLLECTIONS` Tool to retrieve queries per second (QPS) metrics for active collections over a specified time period. Returns the total number of DNS queries per second grouped by collections. The maximum time range is 20 minutes. Use this to monitor query volume and traffic patterns across different collections in your DNSFilter organization. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not provided or if format is not recognized. Maximum time range is 20 minutes. | | `from` | string | No | Report UTC lower limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not provided or if format is not recognized. Maximum time range is 20 minutes. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report filtering. | | `source` | string ("all" | "agents" | "proxies") | No | Source of traffic for the report. | | `nat_ips` | string | No | Comma separated list of NAT IPs. Defaults to all NAT IPs if not specified. Valid integer list from 101 to 106. | | `user_ids` | string | No | Comma separated list of local user IDs. Defaults to all users if not specified. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs. Defaults to all agents if not specified. | | `private_ip` | string | No | Private LAN IP address to filter by. | | `agent_types` | string | No | Comma separated list of user agent types. Defaults to all types if not specified. | | `network_ids` | string | No | Comma separated list of network IDs. Defaults to all networks if not specified. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values. Defaults to all MAC addresses if not specified. | | `private_ip_to` | string | No | Private LAN IP range upper limit. | | `collection_ids` | string | No | Comma separated list of collection IDs. Defaults to all collections if not specified. | | `application_ids` | string | No | Comma separated list of application IDs. Defaults to all applications if not specified. | | `private_ip_from` | string | No | Private LAN IP range lower limit. | | `security_report` | boolean | No | Filter by threats: true for threats only, false for non-threats only. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs. Defaults to user organization ID if not specified. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports QPS Active Organizations **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_QPS_ACTIVE_ORGANIZATIONS` Retrieves the total number of queries per second (QPS) over a time period for active organizations. Use this action to analyze DNS query traffic patterns and volume for organizations. The maximum time range is 20 minutes between the from and to parameters. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not provided or format is not recognized. Maximum time range is 20 minutes. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not provided or format is not recognized. Maximum time range is 20 minutes. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report. | | `msp_id` | integer | No | MSP (Managed Service Provider) ID to filter by. | | `source` | string ("all" | "agents" | "proxies") | No | Traffic source types for filtering. | | `nat_ips` | string | No | Comma separated list of NAT IPs. Valid integer list from 101 to 106. Defaults to all if not provided. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. Defaults to all if not provided. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. Defaults to all if not provided. | | `private_ip` | string | No | Private LAN IP address to filter by. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. Defaults to all if not provided. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. Defaults to all if not provided. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values. Defaults to all if not provided. | | `private_ip_to` | string | No | Private LAN IP range upper limit for filtering. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. Defaults to all if not provided. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. Defaults to all if not provided. | | `private_ip_from` | string | No | Private LAN IP range lower limit for filtering. | | `security_report` | boolean | No | Filter for threats report. Set to true for threats only, false for non-threats only, or omit for both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. Defaults to user organization ID if not provided. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports QPS Active Users **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_QPS_ACTIVE_USERS` Get the total number of queries per second (QPS) in a time period (maximum 20 minutes) for active users. Use this to monitor traffic patterns and identify high-activity users. Supports filtering by user agents, networks, organizations, IP addresses, and traffic types (allowed/blocked/threats). #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime or if format is not recognized | | `from` | string | No | Report UTC lower limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime minus 1 day or if format is not recognized | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report. | | `source` | string ("all" | "agents" | "proxies") | No | Traffic source types. | | `nat_ips` | string | No | Comma separated list of NAT IPs, defaults to all (valid integer list from 101 to 106) | | `user_ids` | string | No | Comma separated list of local user IDs, defaults to all | | `agent_ids` | string | No | Comma separated list of user agent UUIDs, defaults to all | | `private_ip` | string | No | Private LAN IP | | `agent_types` | string | No | Comma separated list of user agent types, defaults to all | | `network_ids` | string | No | Comma separated list of networks IDs, defaults to all | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values, defaults to all | | `private_ip_to` | string | No | Private LAN IP range, upper limit | | `collection_ids` | string | No | Comma separated list of collection IDs, defaults to all | | `application_ids` | string | No | Comma separated list of application IDs, defaults to all | | `private_ip_from` | string | No | Private LAN IP range, lower limit | | `security_report` | boolean | No | Threats report true/false, *both* (threats and non-threats) if it is empty or not sent | | `organization_ids` | string | No | Comma separated list of organization IDs, defaults to user organization ID | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Query Logs **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_QUERY_LOGS` Get query raw logs from DNSFilter traffic reports in a specified period of time. Use this to retrieve detailed DNS query logs with extensive filtering options including time range, domains, networks, user agents, IP addresses, and query results (allowed/blocked). Supports pagination for large result sets. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime or if format is not recognized | | `fqdn` | string | No | Search for FQDNs that contains this value | | `from` | string | No | Report UTC lower limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ, defaults to current UTC datetime minus 1 day or if format is not recognized | | `page` | integer | No | Page number for pagination (defaults to 1) | | `domain` | string | No | Only search for domains that starts with this value | | `result` | string ("all" | "allowed" | "blocked") | No | Filter for the type of query results to retrieve. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Filter for traffic source types. | | `nat_ips` | string | No | Comma separated list of NAT IPs, defaults to all (valid integer list from 101 to 106) | | `user_id` | integer | No | User local ID to filter by | | `agent_id` | string | No | User agent UUID to filter by | | `user_ids` | string | No | Comma separated list of User local IDs | | `agent_ids` | string | No | Comma separated list of User agent UUIDs | | `page_size` | integer | No | Number of items per page (defaults to 10, maximum 100) | | `network_id` | integer | No | Network ID to filter by | | `private_ip` | string | No | Private LAN IP to filter by | | `network_ids` | string | No | Comma separated list of networks IDs | | `category_ids` | string | No | Comma separated list of category IDs, defaults to all | | `collection_id` | integer | No | Collection ID to filter by | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values, defaults to all | | `private_ip_to` | string | No | Private LAN IP range, upper limit | | `question_type` | string | No | Question Type of queries, defaults to all | | `collection_ids` | string | No | Comma separated list of Collection IDs | | `application_ids` | string | No | Comma separated list of application IDs, defaults to all | | `organization_id` | integer | No | Organization ID, defaults to user organization ID | | `private_ip_from` | string | No | Private LAN IP range, lower limit | | `security_report` | boolean | No | Threats report true/false, *both* (threats and non-threats) if it is empty or not sent | | `application_category_ids` | string | No | Comma separated list of application category IDs, defaults to all | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Top Agents **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOP_AGENTS` Get the top user agents by DNS traffic volume in a specified time period. Returns ranked list of agents with associated traffic metrics. Use this to identify most active agents, analyze agent-level usage patterns, and monitor individual device or user traffic. Supports filtering by agent attributes, networks, organizations, IP addresses, and traffic type. Results are paginated for large datasets. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `name` | string | No | Only user agents whose name contains this value will be included in the results. Case-insensitive substring match. | | `page` | integer | No | Page number for pagination (defaults to 1). | | `size` | integer | No | Number of records per page (defaults to 10, maximum 100). | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `msp_id` | integer | No | MSP ID to filter by. Only applicable for MSP accounts. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `nat_ips` | string | No | Comma separated list of NAT IPs to filter by. Valid values are integers from 101 to 106. Defaults to all if not specified. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Top Application Categories **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOP_APPLICATION_CATEGORIES` Get the top application categories domains in a period of time. Returns a paginated list of application categories ranked by DNS query volume, with support for filtering by networks, organizations, agents, time range, and traffic type. Use this to analyze which application categories (e.g., social media, streaming, productivity) are most frequently accessed in your network. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `name` | string | No | Filter to only include applications whose name contains this value. | | `page` | object | No | Pagination information for the request. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `msp_id` | integer | No | MSP ID to filter by. Only applicable for MSP accounts. | | `source` | string | No | Comma separated list of desired traffic sources to include in the report. Options: all, networks, agents, proxies. Defaults to all if not specified. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | string ("all" | "true" | "false") | No | Security report filter options. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Top Categories **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOP_CATEGORIES` Get the top domain categories accessed during a specified time period. Returns category-level statistics showing which website categories (e.g., Social Networking, News, Streaming) are most frequently accessed. Use this to understand browsing patterns, identify potential policy needs, and analyze category-level traffic trends across your organization. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `name` | string | No | Filter to include only categories whose name contains this value (case-insensitive substring match). | | `page` | integer | No | Page number to retrieve (defaults to 1 if not specified). | | `size` | integer | No | Number of records per page to return (defaults to 10, maximum 100). | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `msp_id` | integer | No | MSP ID to filter by. Only applicable for MSP accounts. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | string ("all" | "true" | "false") | No | Security report filter options. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Top Collections **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOP_COLLECTIONS` Tool to retrieve the top collections by traffic volume over a specified time period. Returns collection-level metrics showing which collections have the most DNS query activity. Use this to identify the most active collections in your DNSFilter organization and analyze traffic distribution across collections. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not provided or if format is not recognized. | | `from` | string | No | Report UTC lower limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not provided or if format is not recognized. | | `name` | string | No | Only local users whose name contains this value will be included in the report. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report filtering. | | `msp_id` | integer | No | MSP ID for filtering. Only applicable for MSP accounts. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Source of traffic for the report. | | `nat_ips` | string | No | Comma separated list of NAT IPs. Defaults to all NAT IPs if not specified. Valid integer list from 101 to 106. | | `user_ids` | string | No | Comma separated list of local user IDs. Defaults to all users if not specified. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs. Defaults to all agents if not specified. | | `page_size` | integer | No | Number of items per page for pagination. Defaults to 10 if not specified, maximum is 100. Maps to page[size] in the API. | | `private_ip` | string | No | Private LAN IP address to filter by. | | `agent_types` | string | No | Comma separated list of user agent types. Defaults to all types if not specified. | | `network_ids` | string | No | Comma separated list of network IDs. Defaults to all networks if not specified. | | `page_number` | integer | No | Page number for pagination. Defaults to 1 if not specified. Maps to page[number] in the API. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values. Defaults to all MAC addresses if not specified. | | `private_ip_to` | string | No | Private LAN IP range upper limit. | | `collection_ids` | string | No | Comma separated list of collection IDs. Defaults to all collections if not specified. | | `application_ids` | string | No | Comma separated list of application IDs. Defaults to all applications if not specified. | | `private_ip_from` | string | No | Private LAN IP range lower limit. | | `security_report` | boolean | No | Filter by threats: true for threats only, false for non-threats only. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs. Defaults to user organization ID if not specified. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Top Domains **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOP_DOMAINS` Get the top requested domains over a specified time period. Returns a list of the most frequently queried domains with request counts, helping identify popular sites, potential issues, or security concerns. Use this to analyze domain access patterns, monitor bandwidth usage, and detect anomalous traffic. Supports extensive filtering by networks, organizations, agents, applications, IP addresses, and traffic type (allowed/blocked/threats). Results are paginated and can be filtered by domain prefix or FQDN substring. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `fqdn` | string | No | Search for fully qualified domain names (FQDNs) that contain this value. Used for substring matching within domains. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `page` | integer | No | Page number for pagination. Defaults to 1 if not specified. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to retrieve. | | `domain` | string | No | Only search for domains that start with this value. Used for domain prefix filtering. | | `msp_id` | integer | No | MSP ID to filter by. Only applicable for MSP accounts. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source types for filtering. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `page_size` | integer | No | Number of items per page. Defaults to 10 if not specified. Maximum value is 100. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `category_ids` | string | No | Comma separated list of category IDs to filter by. If not specified, defaults to all categories. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | string ("all" | "true" | "false") | No | Security report filter options. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Top Networks **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOP_NETWORKS` Get the top networks ranked by DNS traffic volume over a specified time period. Returns network traffic metrics showing which networks generated the most DNS queries. Use this to identify high-traffic networks, monitor network activity levels, and analyze traffic distribution across your organization. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `name` | string | No | Only networks whose name contains this value will be included in the results. | | `page` | object | No | Pagination information for page parameter. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `nat_ips` | string | No | Comma separated list of NAT IPs to filter by. Valid values are integers from 101 to 106. Defaults to all if not specified. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Top Organizations **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOP_ORGANIZATIONS` Gets the top organizations by DNS traffic volume over a specified time period. Use this action to identify which organizations are generating the most DNS queries. Supports pagination and extensive filtering by time range, networks, agents, applications, IP addresses, and traffic type. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not provided or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not provided or format is not recognized. | | `name` | string | No | Filter for organizations whose name contains this value (and are included in the organization_ids list). | | `page` | integer | No | Page number for pagination. Defaults to 1 if not provided. | | `size` | integer | No | Number of results per page. Defaults to 10, maximum 100. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source types for filtering. | | `nat_ips` | string | No | Comma separated list of NAT IPs. Valid integer list from 101 to 106. Defaults to all if not provided. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. Defaults to all if not provided. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. Defaults to all if not provided. | | `private_ip` | string | No | Private LAN IP address to filter by. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. Defaults to all if not provided. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. Defaults to all if not provided. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values. Defaults to all if not provided. | | `private_ip_to` | string | No | Private LAN IP range upper limit for filtering. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. Defaults to all if not provided. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. Defaults to all if not provided. | | `private_ip_from` | string | No | Private LAN IP range lower limit for filtering. | | `security_report` | boolean | No | Filter for threats report. Set to true for threats only, false for non-threats only, or omit for both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. Defaults to user organization ID if not provided. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Top Organizations by Requests **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOP_ORGANIZATIONS_REQUESTS` Get the top organizations ranked by total number of DNS requests over a specified time period. Returns organizations with the highest request volumes, useful for identifying most active organizations and analyzing usage patterns. Results are paginated with configurable page size (max 100 per page). #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not provided or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not provided or format is not recognized. | | `page` | integer | No | Page number for pagination. Defaults to 1 if not provided. | | `size` | integer | No | Number of results per page. Defaults to 10 if not provided. Maximum is 100. | | `msp_id` | integer | No | MSP ID to filter by. Only applicable for MSP accounts. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for traffic report time aggregation. | | `organization_id` | integer | No | Organization ID to filter by. Defaults to user's organization ID if not provided. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Top Users **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOP_USERS` Get the top users by DNS query volume over a specified time period. Returns user activity metrics showing which users generated the most DNS traffic, with support for pagination and extensive filtering. Use this to identify high-volume users, analyze user behavior patterns, and monitor individual user activity across networks and organizations. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `name` | string | No | Filter to only include local users whose name contains this value. Case-insensitive partial match. | | `page` | object | No | Pagination parameters for traffic reports. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `msp_id` | integer | No | MSP ID to filter by. Only applicable for MSP accounts. | | `source` | string | No | Comma separated list of desired traffic sources to include in the report. Options: all, networks, agents, proxies. Defaults to all if not specified. | | `nat_ips` | string | No | Comma separated list of NAT IPs to filter by. Valid values are integers from 101 to 106. Defaults to all if not specified. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Applications Stats **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_APPLICATIONS_STATS` Get statistics of number of requests by application in a time period. Returns aggregated data showing how many requests were made to each application, useful for understanding traffic patterns and application usage across your DNSFilter deployment. Use when you need to analyze application-level traffic patterns or generate usage reports. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit. Format: YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. If not specified or format is not recognized, defaults to current UTC datetime. | | `from` | string | No | Report UTC lower limit. Format: YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. If not specified or format is not recognized, defaults to current UTC datetime minus 1 day. | | `name` | string | No | Filter to only include applications whose display name contains this value (case-insensitive substring match). | | `type` | string ("all" | "allowed" | "blocked") | No | Report type options. | | `msp_id` | integer | No | MSP (Managed Service Provider) ID to filter results by specific MSP. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source types. | | `nat_ips` | string | No | Comma separated list of NAT IPs. Valid values are integers from 101 to 106. If not specified, defaults to all NAT IPs. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs. If not specified, defaults to all agents. | | `private_ip` | string | No | Filter by a specific private LAN IP address. | | `agent_types` | string | No | Comma separated list of user agent types. If not specified, defaults to all agent types. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values. If not specified, defaults to all MAC addresses. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. Set to true for threats only, false for non-threats only, or leave empty/null for both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs. If not specified, defaults to the user's organization ID. | | `application_category_ids` | string | No | Comma separated list of application category IDs to filter by. If not specified, defaults to all categories. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Applications Agents Stats **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_APPS_AGENTS_STATS` Get statistics of number of requests for roaming clients by application in a period of time. Returns aggregated request counts grouped by application for active agents (roaming clients) with optional filtering by agent, organization, application, network, and other criteria. Use this action to analyze which applications are generating the most DNS traffic from roaming clients. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not provided or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not provided or format is not recognized. | | `name` | string | No | Filter to only include user agents whose name contains this value. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to retrieve. | | `source` | string | No | Comma separated list of desired traffic sources to filter by. Options are 'all', 'networks', 'agents', or 'proxies'. Defaults to all if not specified. | | `nat_ips` | string | No | Comma separated list of NAT IPs to filter by. Valid integer list from 101 to 106. Defaults to all NAT IPs if not specified. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. Defaults to all users if not specified. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. Defaults to all agents if not specified. | | `private_ip` | string | No | Filter by specific private LAN IP address. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. Defaults to all agent types if not specified. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. Defaults to all networks if not specified. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. Defaults to all MAC addresses if not specified. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use together with private_ip_from to specify an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. Defaults to all collections if not specified. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. Defaults to all applications if not specified. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use together with private_ip_to to specify an IP range. | | `security_report` | boolean | No | Filter by security threats. Set to true for threats only, false for non-threats only, or omit for both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. Defaults to user's organization ID if not specified. | | `application_category_ids` | string | No | Comma separated list of application category IDs to filter by. Defaults to all categories if not specified. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Applications Collections Stats **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_APPS_COLLECTIONS_STATS` Get statistics of number of requests for collections by application over a specified time period. Returns aggregated data showing how many DNS requests were made for each application within different collections. Use this to analyze application usage patterns across collections and understand which applications are generating the most traffic. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `name` | string | No | Only local users whose name contains this value will be included in the report. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `nat_ips` | string | No | Comma separated list of NAT IPs to filter by. Valid values are integers from 101 to 106. Defaults to all if not specified. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `application_category_ids` | string | No | Comma separated list of application category IDs to filter by. If not specified, defaults to all application categories. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Applications Networks Stats **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_APPS_NETWORKS_STATS` Get statistics showing the number of requests for sites by application across networks over a specified time period. Use this to analyze application usage patterns and DNS query volumes per application across your network infrastructure. Supports extensive filtering by networks, organizations, agents, applications, application categories, IP addresses, and traffic type (allowed/blocked/threats). #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `name` | string | No | Filter to include only networks whose name contains this value. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `nat_ips` | string | No | Comma separated list of NAT IPs to filter by. Valid values are integers from 101 to 106. Defaults to all if not specified. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. Defaults to all if not specified. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. Defaults to all if not specified. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. Defaults to all if not specified. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. Defaults to all if not specified. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. Defaults to all if not specified. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. Defaults to all if not specified. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. Defaults to all if not specified. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. Defaults to user organization ID if not specified. | | `application_category_ids` | string | No | Comma separated list of application category IDs to filter by. Defaults to all if not specified. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Applications Organizations **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_APPS_ORGANIZATIONS` Tool to get statistics of number of requests for organizations by application in a period of time. Use when you need to analyze application usage patterns across different organizations within a specified time range. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not provided or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not provided or format is not recognized. | | `name` | string | No | Only organizations whose name contains this value will be included in the report. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report. | | `msp_id` | integer | No | MSP (Managed Service Provider) ID to filter by. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source types for filtering. | | `nat_ips` | string | No | Comma separated list of NAT IPs. Valid integer list from 101 to 106. Defaults to all if not provided. | | `user_ids` | string | No | Comma separated list of local user IDs. Defaults to all if not provided. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs. Defaults to all if not provided. | | `private_ip` | string | No | Private LAN IP address to filter by. | | `agent_types` | string | No | Comma separated list of user agent types. Defaults to all if not provided. | | `network_ids` | string | No | Comma separated list of network IDs. Defaults to all if not provided. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values. Defaults to all if not provided. | | `private_ip_to` | string | No | Private LAN IP range upper limit for filtering. | | `collection_ids` | string | No | Comma separated list of collection IDs. Defaults to all if not provided. | | `application_ids` | string | No | Comma separated list of application IDs. Defaults to all if not provided. | | `private_ip_from` | string | No | Private LAN IP range lower limit for filtering. | | `security_report` | boolean | No | Filter for threats report. Set to true for threats only, false for non-threats only, or omit for both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. Defaults to user organization ID if not provided. | | `application_category_ids` | string | No | Comma separated list of application category IDs. Defaults to all if not provided. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Applications Users Stats **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_APPS_USERS_STATS` Get statistics of the number of requests for users by application within a specified time period. Returns detailed application usage data broken down by user, showing which users are accessing which applications and how frequently. Use this to understand application usage patterns across users, identify heavy application users, and analyze user-level application access trends. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `name` | string | No | Filter to include only local users whose name contains this value (case-insensitive substring match). | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `nat_ips` | string | No | Comma separated list of NAT IPs to filter by. Valid integer list from 101 to 106. If not specified, defaults to all. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not provided or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `application_category_ids` | string | No | Comma separated list of application category IDs to filter by. If not specified, defaults to all application categories. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Categories **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_CATEGORIES` Get the total number of requests by category for sites in a period of time. Returns aggregated statistics showing how many DNS requests were made to each website category during the specified time range. Use this to understand category-level traffic patterns and analyze DNS request volumes across different website categories. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `msp_id` | integer | No | MSP ID to filter by. Only applicable for MSP accounts. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for report aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_networks` | boolean | No | Group report results by network ID. When true, results are broken down by individual networks. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Categories for Agents **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_CATEGORIES_AGENTS` Get the total number of requests by category for roaming clients (user agents) during a specified time period. Use this to analyze category-level traffic patterns for roaming/mobile users, understand which website categories roaming users access most, and track security threats by category across your roaming user base. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for time-based aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats, omit or null for both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_agents` | boolean | No | Group report result by agent ID. If true, results are grouped by individual agents. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Categories Collections **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_CATEGORIES_COLLECTIONS` Get the total number of DNS requests by category for collections over a specified time period. Returns aggregated statistics showing request counts grouped by website categories across collections. Use this to analyze category-level traffic patterns for collection-based deployments and identify browsing trends. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for grouping results. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or None, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_collections` | boolean | No | Group report result by collection ID. Set to True to see results broken down by individual collections. Defaults to False if not specified. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Total Categories by Organizations **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_CATEGORIES_ORGS` Get the total number of DNS requests by category for organizations over a specified time period. Returns aggregated statistics showing how many requests were made to each category (e.g., Social Networking, News, Streaming) across one or more organizations. Use this to analyze category-level traffic distribution, understand which content types are most accessed, and track trends across organizational boundaries. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for report aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_organizations` | boolean | No | Group report results by organization ID. When true, results are broken down by individual organizations. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports by Category for Users **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_CATEGORIES_USERS` Gets the total number of DNS requests by category for users in a specified time period. Returns aggregated traffic data showing which content categories were accessed and by which users. Use this to analyze user browsing patterns, identify high-traffic categories, or generate security reports for a given time range. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of report to generate. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source types for filtering. | | `user_ids` | string | No | Comma separated list of local user IDs. Defaults to all users if not specified. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs. Defaults to all agents if not specified. | | `private_ip` | string | No | Private LAN IP address to filter by. | | `agent_types` | string | No | Comma separated list of user agent types. Defaults to all types if not specified. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size for grouping traffic data. | | `network_ids` | string | No | Comma separated list of network IDs. Defaults to all networks if not specified. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values. Defaults to all if not specified. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define a range. | | `collection_ids` | string | No | Comma separated list of collection IDs. Defaults to all collections if not specified. | | `application_ids` | string | No | Comma separated list of application IDs. Defaults to all applications if not specified. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define a range. | | `security_report` | boolean | No | Filter by threats: true for threats only, false for non-threats only, omit for both. | | `organization_ids` | string | No | Comma separated list of organization IDs. Defaults to user organization ID if not specified. | | `show_individual_users` | boolean | No | Group report result by user ID. Defaults to false if not specified. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Category Stats **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_CATEGORY_STATS` Tool to get the total number of stats for a category in a period of time. Use when you need to analyze category-level request statistics including allowed, blocked, and threat requests within a specified time range. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not provided or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not provided or format is not recognized. | | `msp_id` | integer | No | MSP (Managed Service Provider) ID to filter by. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `category_ids` | string | No | Comma separated list of category IDs to filter by. If not specified, defaults to all categories. | | `organization_id` | integer | No | Organization ID to filter by. If not specified, defaults to user organization ID. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Client Stats **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_CLIENT_STATS` Gets the organization network, users and client stats from traffic reports. Returns total and active counts for sites, users, roaming clients, and relays. Use this when you need to understand the deployment scale and active usage of DNSFilter protection across an organization. Note: The time period between 'from' and 'to' parameters must not exceed 20 minutes. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not provided or format is not recognized. Note: The time period between 'from' and 'to' must not exceed 20 minutes. | | `from` | string | No | Report UTC lower limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not provided or format is not recognized. Note: The time period between 'from' and 'to' must not exceed 20 minutes. | | `msp_id` | integer | No | MSP (Managed Service Provider) ID to filter statistics by. If not specified, statistics for all MSPs will be included. | | `network_ids` | string | No | Comma-separated list of network IDs to filter statistics by. Defaults to all networks if not specified. | | `organization_id` | integer | No | Organization ID to filter statistics by. Defaults to the authenticated user's organization ID if not specified. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Collections **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_COLLECTIONS` Get the total number of DNS requests by collection for sites over a specified time period. Returns aggregated data showing how many requests were made for each collection, optionally grouped by network. Use this to analyze DNS query volume across collections and understand which collections are receiving the most traffic. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for traffic report aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_networks` | boolean | No | Group report results by network ID. When true, includes network_ids and network_names in the response. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Collections Agents **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_COLLECTIONS_AGENTS` Get the total number of requests by collection for roaming clients over a specified time period. Returns aggregated request counts grouped by collection with support for extensive filtering by agents, organizations, networks, applications, IP addresses, and traffic type. Use this action to analyze DNS traffic patterns for roaming clients across different collections. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not provided or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not provided or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to retrieve. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source types for filtering. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. Defaults to all users if not specified. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. Defaults to all agents if not specified. | | `private_ip` | string | No | Filter by specific private LAN IP address. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. Defaults to all agent types if not specified. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for traffic report time aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. Defaults to all networks if not specified. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. Defaults to all MAC addresses if not specified. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use together with private_ip_from to specify an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. Defaults to all collections if not specified. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. Defaults to all applications if not specified. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use together with private_ip_to to specify an IP range. | | `security_report` | boolean | No | Filter by security threats. Set to true for threats only, false for non-threats only, or omit for both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. Defaults to user's organization ID if not specified. | | `show_individual_agents` | boolean | No | Group report results by agent ID. When true, results are broken down by individual roaming client agents. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Collections Organizations **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_COLLECTIONS_ORGS` Get the total number of DNS requests by collection for organizations over a specified time period. Returns aggregated data showing how many DNS requests were made for each collection within different organizations. Use this to analyze collection usage patterns across organizations and understand which collections are generating the most traffic. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for traffic report time aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_organizations` | boolean | No | Group report result by organization ID. If True, results are grouped by organization. Defaults to False. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Collections Users **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_COLLECTIONS_USERS` Get the total number of DNS requests by collection for users over a specified time period. Returns aggregated request counts grouped by collections and users, with support for time bucketing and extensive filtering. Use this to analyze collection-level traffic patterns per user, identify high-volume collections for specific users, and generate detailed usage reports across organizations. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `source` | string | No | Comma separated list of desired traffic sources to include in the report. Options: all, networks, agents, proxies. Defaults to all if not specified. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for traffic reports. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_users` | boolean | No | Group report result by user ID. If True, breaks down results by individual users. Defaults to False. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Deployments **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_DEPLOYMENTS` Gets the organization deployments information including collections, relays, sync tools, user agents, and users. Use this to retrieve deployment metrics and statistics for an organization or filtered by MSP/networks. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `msp_id` | integer | No | MSP ID to filter deployments by. Only include if you need to filter by a specific MSP. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. Defaults to all networks if not specified. | | `organization_id` | integer | No | Organization ID to filter by. Defaults to the authenticated user's organization ID if not specified. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Domain Requests **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_DOMAIN_REQUESTS` Get the total number of requests for a domain over a specified time period. Returns aggregate request counts for domains, helping analyze domain access patterns and traffic volumes. Supports filtering by domain prefix, networks, organizations, and MSP accounts. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `domain` | string | No | Only search for domains that start with this value. Used for domain prefix filtering. | | `msp_id` | integer | No | MSP ID to filter by. Only applicable for MSP accounts. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `organization_id` | integer | No | Organization ID to filter by. Defaults to user's organization ID if not specified. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Domains **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_DOMAINS` Get the total number of requests by domain for sites in a period of time. Returns aggregated statistics showing how many DNS requests were made to each domain during the specified time range. Use this to understand domain-level traffic patterns and analyze DNS request volumes across different domains. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `domain` | string | No | Only search for domains that start with this value. Used for domain prefix filtering. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for report aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `category_ids` | string | No | Comma separated list of category IDs to filter by. If not specified, defaults to all categories. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_networks` | boolean | No | Group report results by network ID. When true, results are broken down by individual networks. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Domains Collections **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_DOMAINS_COLLECTIONS` Tool to retrieve the total number of DNS requests by domain for collections within a specified time period. Use when you need to analyze which domains are being accessed most frequently, track collection-level traffic patterns, or generate domain usage reports. Supports extensive filtering by agents, networks, organizations, collections, time ranges, and traffic types (allowed/blocked). Results can be grouped by individual collections or aggregated across all collections. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is invalid. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is invalid. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of report filter. | | `domain` | string | No | Filter to only search for domains that start with this value. Partial domain matching from the beginning. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options. | | `user_ids` | string | No | Comma separated list of user IDs to filter by. Defaults to all users if not specified. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. Defaults to all agents if not specified. | | `private_ip` | string | No | Filter by a specific private LAN IP address. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. Defaults to all types if not specified. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for traffic reports. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. Defaults to all networks if not specified. | | `category_ids` | string | No | Comma separated list of category IDs to filter by. Defaults to all categories if not specified. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values. Defaults to all if not specified. | | `private_ip_to` | string | No | Private LAN IP range filter, upper limit. Use with private_ip_from to define a range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. Defaults to all collections if not specified. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. Defaults to all applications if not specified. | | `private_ip_from` | string | No | Private LAN IP range filter, lower limit. Use with private_ip_to to define a range. | | `security_report` | boolean | No | Filter by threat status: true for threats only, false for non-threats only, or omit for both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. Defaults to the authenticated user's organization ID if not specified. | | `show_individual_collections` | boolean | No | When true, groups report results by collection ID. When false or omitted, returns aggregated results across all collections. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Total Domains by Organizations **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_DOMAINS_ORGANIZATIONS` Get the total number of DNS requests by domain for organizations over a specified time period. Returns aggregated statistics showing how many requests were made to each domain across one or more organizations. Use this to analyze domain-level traffic distribution, understand which domains are most accessed, and track trends across organizational boundaries. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `domain` | string | No | Only search for domains that start with this value. Used for domain prefix filtering. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for report aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `category_ids` | string | No | Comma separated list of category IDs to filter by. If not specified, defaults to all categories. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_organizations` | boolean | No | Group report results by organization ID. When true, results are broken down by individual organizations. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Domain Stats **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_DOMAIN_STATS` Tool to get the total number of stats for a domain in a period of time. Use when you need to analyze domain-level request statistics including allowed, blocked, and threat requests within a specified time range. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not provided or format is not recognized. | | `fqdn` | string | No | Only search for FQDNs that contains this value | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not provided or format is not recognized. | | `domain` | string | No | Only search for domains that starts with this value | | `msp_id` | integer | No | MSP (Managed Service Provider) ID to filter by. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `organization_id` | integer | No | Organization ID to filter by. If not specified, defaults to user organization ID. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Domains Users **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_DOMAINS_USERS` Gets the total number of DNS requests by domain for users in a period of time. Use this when you need to analyze domain traffic patterns across users or generate traffic reports. At least one query parameter must be provided for the endpoint to work successfully. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `show_individual_users` | boolean | No | Group report result by user id. Defaults to false. NOTE: While marked as optional, at least one query parameter must be provided for the endpoint to work successfully. This parameter is recommended as a minimal requirement. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Total Organizations Requests **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_ORGANIZATIONS_REQUESTS` Get the total number of DNS requests for organizations in a specified time period. Returns time-series data showing request volumes aggregated by configurable time buckets. Use this to analyze overall traffic patterns and monitor DNS query volumes across organizations. Supports extensive filtering by agents, applications, categories, networks, domains, and traffic type. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `fqdn` | string | No | Search for FQDNs (fully qualified domain names) that contain this value. Used for substring-based domain filtering. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `name` | string | No | Only include applications whose display name contains this value. Used for filtering by application name. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `domain` | string | No | Only search for domains that start with this value. Used for prefix-based domain filtering. | | `msp_id` | integer | No | MSP ID to filter by. Only applicable for MSP accounts. | | `user_ids` | string | No | Comma separated list of user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for report aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `category_ids` | string | No | Comma separated list of category IDs to filter by. If not specified, defaults to all categories. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `organization_id` | integer | No | Organization ID to filter by. Defaults to user's organization ID if not provided. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to user's organization ID. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Organizations Stats **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_ORGANIZATIONS_STATS` Retrieves aggregated DNS traffic statistics across organizations for a specified time period. Returns total request counts (allowed, blocked, threats) and the organizations included in the report. Use this to monitor overall traffic patterns, identify security threats, and analyze DNS filtering effectiveness across your DNSFilter deployment. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified. | | `name` | string | No | Filter to only include applications whose display name contains this value (case-insensitive substring match). | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `msp_id` | integer | No | MSP (Managed Service Provider) ID to filter statistics for a specific MSP. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, includes all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, includes all agents. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, includes all agent types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size for aggregating traffic statistics. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, includes all collections. | | `organization_id` | integer | No | Organization ID to filter statistics. Defaults to the authenticated user's organization ID if not specified. | | `security_report` | boolean | No | Filter by threat status: true for threats only, false for non-threats only, or omit for both threats and non-threats. | | `application_category_ids` | string | No | Comma separated list of application category IDs to filter by. If not specified, includes all categories. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Requests **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_REQUESTS` Get the total number of DNS requests over a specified time period. Returns time-series data showing DNS request volumes aggregated by configurable time buckets (15 minutes or 1 day). Use this to analyze traffic patterns, identify peak usage times, and monitor DNS request volumes broken down by allowed, blocked, and total counts. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `msp_id` | integer | No | MSP ID to filter by. Only applicable for MSP accounts. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `nat_ips` | string | No | Comma separated list of NAT IPs to filter by. Valid values are integers from 101 to 106. Defaults to all if not specified. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for report aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_networks` | boolean | No | Group report results by network ID. When true, results are broken down by individual networks. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Requests for Agents **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_REQUESTS_AGENTS` Get the total number of requests for roaming clients (user agents) during a specified time period. Use this to analyze overall traffic volume from roaming/mobile users, track request patterns over time, and monitor total DNS query activity across your roaming user base. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `msp_id` | integer | No | MSP (Managed Service Provider) ID to filter by. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `nat_ips` | string | No | Comma separated list of NAT IPs to filter by. Valid integer list from 101 to 106. Defaults to all if not specified. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for time-based aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats, omit or null for both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_agents` | boolean | No | Group report result by agent ID. If true, results are grouped by individual agents. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Requests Collections **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_REQUESTS_COLLECTIONS` Get the total number of requests for collections over a specified time period. Returns time-series data showing collection request volumes aggregated by configurable time buckets. Use this to analyze collection-specific traffic patterns and identify which collections are being used most frequently. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `source` | string | No | Comma separated list of desired traffic sources to include in the report. Options: all, networks, agents, proxies. Defaults to all if not specified. | | `nat_ips` | string | No | Comma separated list of NAT IPs to filter by. Valid values are integers from 101 to 106. Defaults to all if not specified. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for report aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_collections` | boolean | No | Group report results by collection ID. When true, results are broken down by individual collections. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Requests Geo **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_REQUESTS_GEO` Gets the total number of DNS requests by geographic location for organizations in a specified time period. Used for generating heatmap visualizations on the overview dashboard. Returns network IDs, organization IDs, and request counts grouped by geographic location. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not provided or if format is not recognized. | | `from` | string | No | Report UTC lower limit, format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not provided or if format is not recognized. | | `limit` | integer | Yes | Limit the size of the response. This is a required parameter that determines how many geographic locations are returned. | | `msp_id` | integer | No | MSP ID to filter results by managed service provider | | `organization_ids` | string | No | Comma separated list of organization IDs. Defaults to user organization ID if not provided. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Total Requests Organizations **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_REQUESTS_ORGANIZATIONS` Get the total number of DNS requests for organizations in a specified time period. Returns time-series data showing request volumes aggregated by configurable time buckets (15 minutes or 1 day). Use this to analyze traffic patterns by organization, identify peak usage times, and monitor DNS request volumes broken down by allowed, blocked, and total counts. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `msp_id` | integer | No | MSP ID to filter by. Only applicable for MSP accounts. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `nat_ips` | string | No | Comma separated list of NAT IPs to filter by. Valid values are integers from 101 to 106. Defaults to all if not specified. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for report aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `security_report` | boolean | No | Filter by threat status. True returns only threats, False returns only non-threats. If not specified or empty, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_organizations` | boolean | No | Group report results by organization ID. When true, results are broken down by individual organizations. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Requests Users **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_REQUESTS_USERS` Gets the total number of requests for users in a period of time. Use this to analyze DNS traffic patterns, monitor user activity, and generate reports on request volume. Supports extensive filtering by time range, user agents, networks, applications, and more. Results can be aggregated by different time buckets (15min or 1day) and optionally grouped by individual users. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Report type options for filtering traffic. | | `msp_id` | integer | No | MSP (Managed Service Provider) ID for filtering. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering reports. | | `nat_ips` | string | No | Comma separated list of NAT IPs. Valid integer list from 101 to 106. Defaults to all if not specified. | | `user_ids` | string | No | Comma separated list of local user IDs. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs. If not specified, defaults to all user agents. | | `private_ip` | string | No | Private LAN IP address for filtering. | | `agent_types` | string | No | Comma separated list of user agent types. If not specified, defaults to all agent types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for traffic report aggregation. | | `network_ids` | string | No | Comma separated list of network IDs. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values. If not specified, defaults to all MAC addresses. | | `private_ip_to` | string | No | Private LAN IP range upper limit for filtering. | | `collection_ids` | string | No | Comma separated list of collection IDs. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit for filtering. | | `security_report` | boolean | No | Filter by threats. True for threats only, false for non-threats only. If not specified or null, returns both threats and non-threats. | | `organization_ids` | string | No | Comma separated list of organization IDs. If not specified, defaults to user's organization ID. | | `show_individual_users` | boolean | No | Group report result by user ID. Set to true to see individual user breakdown, false for aggregated data. Defaults to false if not specified. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Roaming Clients **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_ROAMING_CLIENTS` Gets the roaming clients information for the specified organization. Use this to retrieve roaming client statistics and deployment information across organizations. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `msp_id` | integer | No | MSP ID to filter by. Only applicable for MSP accounts. | | `organization_id` | integer | No | Organization ID to filter by. Defaults to the authenticated user's organization ID if not specified. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Threats **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_THREATS` Get the total number of threats detected over a specified time period. Returns time-series data showing threat volumes aggregated by configurable time buckets (15 minutes or 1 day). Use this to monitor security threats, analyze threat patterns over time, and identify when threat activity is highest across networks and organizations. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `source` | string | No | Comma separated list of desired traffic sources to include in the report. Options: all, networks, agents, proxies. Defaults to all if not specified. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for report aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_networks` | boolean | No | Group report results by network ID. When true, results are broken down by individual networks. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Threats Agents **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_THREATS_AGENTS` Get the total number of threats for roaming clients in a period of time. Returns time-series data showing threat counts aggregated by configurable time buckets for agents (roaming clients). Use this to analyze security threat patterns and monitor blocked malicious domains or categories detected for roaming clients. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for report aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_agents` | boolean | No | Group report results by agent ID. When true, results are broken down by individual agents. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Total Threats by Collections **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_THREATS_COLLECTIONS` Tool to retrieve the total number of threats for collections over a specified time period. Use when you need to analyze threat patterns, generate security reports, or monitor DNS-based threats blocked by DNSFilter across different collections. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source filter options. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. Defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. Defaults to all agents. | | `private_ip` | string | No | Filter by a specific private LAN IP address. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. Defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for grouping traffic report data. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. Defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values. Defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define a range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. Defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. Defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define a range. | | `organization_ids` | string | No | Comma separated list of organization IDs. Defaults to user's organization ID. | | `show_individual_collections` | boolean | No | Whether to group report result by collection ID. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Total Threats by Organizations **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_THREATS_ORGANIZATIONS` Get the total number of threats detected for organizations over a specified time period. Returns aggregated threat statistics showing how many malicious or dangerous DNS requests were identified across one or more organizations. Use this to monitor security posture, identify at-risk organizations, and track threat trends over time. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for report aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_organizations` | boolean | No | Group report results by organization ID. When true, results are broken down by individual organizations. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List Traffic Reports Total Threats Users **Slug:** `DNSFILTER_LIST_TRAFFIC_REPORTS_TOTAL_THREATS_USERS` Get the total number of threats for users in a period of time. Returns aggregated statistics showing security threats detected across users during the specified time range. Use this to monitor user-level threat activity and identify users encountering security issues. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `to` | string | No | Report UTC upper limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime if not specified or format is not recognized. Note: While marked as optional, this parameter should be provided for successful API responses. | | `from` | string | No | Report UTC lower limit in format YYYY-MM-DDThh:mm:ss or YYYY-MM-DDThh:mm:ssZ. Defaults to current UTC datetime minus 1 day if not specified or format is not recognized. Note: While marked as optional, this parameter should be provided for successful API responses. | | `type` | string ("all" | "allowed" | "blocked") | No | Type of traffic report to generate. | | `source` | string ("all" | "networks" | "agents" | "proxies") | No | Traffic source options for filtering. | | `user_ids` | string | No | Comma separated list of local user IDs to filter by. If not specified, defaults to all users. | | `agent_ids` | string | No | Comma separated list of user agent UUIDs to filter by. If not specified, defaults to all agents. | | `private_ip` | string | No | Private LAN IP address to filter by. Filters traffic from a specific private IP. | | `agent_types` | string | No | Comma separated list of user agent types to filter by. If not specified, defaults to all types. | | `bucket_size` | string ("auto" | "15min" | "1day") | No | Bucket size options for report aggregation. | | `network_ids` | string | No | Comma separated list of network IDs to filter by. If not specified, defaults to all networks. | | `mac_addresses` | string | No | Comma separated list of MAC addresses (without colons) or filter values to filter by. If not specified, defaults to all. | | `private_ip_to` | string | No | Private LAN IP range upper limit. Use with private_ip_from to define an IP range. | | `collection_ids` | string | No | Comma separated list of collection IDs to filter by. If not specified, defaults to all collections. | | `application_ids` | string | No | Comma separated list of application IDs to filter by. If not specified, defaults to all applications. | | `private_ip_from` | string | No | Private LAN IP range lower limit. Use with private_ip_to to define an IP range. | | `organization_ids` | string | No | Comma separated list of organization IDs to filter by. If not specified, defaults to the user's organization ID. | | `show_individual_users` | boolean | No | Group report results by user ID. When true, results are broken down by individual users. Defaults to false. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List User Agent Bulk Deletes Counts **Slug:** `DNSFILTER_LIST_USER_AGENT_BULK_DELETES_COUNTS` Tool to get user agent bulk delete counts by filtering criteria. Use when you need to determine how many user agents can be deleted or uninstalled and deleted based on various filters like agent state, network, tags, or online/offline status. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `tags` | array | No | User agent list by tags | | `type` | string ("proxy" | "agents") | No | Enumeration of possible user agent types. | | `state` | string ("online" | "offline") | No | Enumeration of possible online/offline states. | | `search` | string | No | User agent list by keyword(s) (space delimited), this could be: hostname, friendly name | | `status` | string | No | Filter by user agent status, valid attributes: active, disabled, uninstalled | | `agent_state` | string ("protected" | "unprotected" | "bypassed" | "uninstalled") | No | Enumeration of possible agent states. | | `name_search` | string | No | A search term to search client name fields (i.e. hostname and friendly_name) | | `network_ids` | array | No | Network IDs to filter by, defaults to all networks if not specified | | `organization_id` | integer | No | Organization ID to filter by | | `traffic_received_last_15_mins` | boolean | No | Filter by agents that have received traffic in last 15 minutes | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List User Agent Bulk Updates Counts **Slug:** `DNSFILTER_LIST_USER_AGENT_BULK_UPDATES_COUNTS` Tool to get user agent bulk delete counts by filters. Use when you need to determine how many user agents match certain criteria and whether they support remote uninstall. Returns counts of agents that can be deleted vs agents that can be both uninstalled and deleted. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `tags` | array | No | User agent list by tags | | `type` | string ("proxy" | "agents") | No | Enumeration of user agent types. | | `state` | string ("online" | "offline") | No | Enumeration of online/offline states for filtering. | | `search` | string | No | User agent list by keyword(s) (space delimited), this could be: hostname, friendly name | | `status` | string | No | Filter by user agent status, valid attributes: active, disabled, uninstalled | | `policy_id` | integer | No | Filter user agents by policy ID | | `agent_state` | string ("protected" | "unprotected" | "bypassed" | "uninstalled") | No | Enumeration of possible agent states for filtering. | | `name_search` | string | No | A search term to search client name fields (i.e. hostname and friendly_name) | | `network_ids` | array | No | Network IDs to filter by, defaults to all networks | | `block_page_id` | integer | No | Filter user agents by block page ID | | `organization_id` | integer | No | Organization ID to filter by | | `release_channels` | array | No | Filter user agents by release channel. Valid values: stable, beta, preview | | `scheduled_policy_id` | integer | No | Filter user agents by scheduled policy ID | | `traffic_received_last_15_mins` | boolean | No | Filter by agents that have received traffic in last 15 minutes | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List User Agent Releases **Slug:** `DNSFILTER_LIST_USER_AGENT_RELEASES` Gets a list of latest user agent releases for each unique combination of agent_type, architecture, release_channels, and white label. Use this to discover available agent versions for deployment across different platforms and release channels. #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List User Agent Releases Relay **Slug:** `DNSFILTER_LIST_USER_AGENT_RELEASES_RELAY` Tool to get a list of latest relay releases for each unique combination of architecture, release channels, and white label. Use when you need to retrieve available relay agent versions for deployment or updates. #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List All User Agents **Slug:** `DNSFILTER_LIST_USER_AGENTS_ALL` Tool to retrieve ALL user agents with basic information. Use when you need a comprehensive list of all user agents, optionally filtered by network, organization, state, status, or tags. Supports pagination and sorting. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `sort` | string | No | Sort options, valid attributes: hostname, friendly_name, agent_version, last_sync. Prefix with '-' for descending order. | | `tags` | array | No | User agent list by tags | | `type` | string ("proxy" | "agents") | No | User agent type enumeration. | | `state` | string ("online" | "offline") | No | User agent state enumeration. | | `search` | string | No | User agent list by keyword(s) (space delimited), this could be: status, hostname, friendly name, current logged in user | | `status` | string | No | Filter by user agent status, valid attributes: active, disabled, uninstalled, uninstall_queued, uninstalling | | `page_size` | integer | No | Number of items per page. Maps to page[size] in the API. | | `network_ids` | array | No | Networks IDs, defaults to all | | `page_number` | integer | No | Page number for pagination (1-based). Maps to page[number] in the API. | | `organization_ids` | array | No | Organization IDs, defaults to user organization ID | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List User Agents Counts **Slug:** `DNSFILTER_LIST_USER_AGENTS_COUNTS` Tool to get counts of user agents for each status. Use when you need to retrieve statistics about user agents grouped by their protection status (protected, unprotected, bypassed, etc.). Supports filtering by organization, network, tags, and various other criteria. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `tags` | array | No | User agent list by tags | | `type` | string ("proxy" | "agents") | No | User agent type. | | `state` | string ("online" | "offline") | No | User agent online/offline state. | | `msp_id` | integer | No | MSP ID, set scope to all sub-orgs | | `search` | string | No | User agent list by keyword(s) (space delimited), this could be: tags, status, hostname, friendly name, current logged in user | | `status` | string | No | Filter by user agent status, valid attributes: active, disabled, uninstalled | | `name_search` | string | No | A search term to search client name fields (i.e. hostname and friendly_name) | | `network_ids` | array | No | Networks IDs, defaults to all | | `new_agent_states` | boolean | No | Get counts for new agent states: Protected, Unprotected, Offline | | `organization_ids` | array | No | Organization IDs, defaults to user organization ID | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List User Agents CSV **Slug:** `DNSFILTER_LIST_USER_AGENTS_CSV` Tool to export user agents as CSV data for a specific organization. Use when you need to retrieve a CSV-formatted list of user agents, optionally including suborg data. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `timezone` | string | No | Timezone string for localizing the filename (e.g., 'America/New_York'). Defaults to 'UTC' | | `include_suborgs` | boolean | No | Include suborgs when organization_id is MSP owner org (defaults to false) | | `organization_id` | integer | Yes | Organization ID to retrieve user agents for | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List User Agent Tags **Slug:** `DNSFILTER_LIST_USER_AGENTS_TAGS` Retrieves all tags used by user agents on a network or organization. Tags help categorize and organize user agents for easier management and policy application. Use when you need to view available tags for filtering or grouping user agents. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `msp_id` | integer | No | MSP ID to set scope to all sub-organizations. Use this to retrieve tags across managed service provider sub-organizations. | | `network_ids` | array | No | List of network IDs to filter tags by. Defaults to all networks if not specified. Use to scope tags to specific networks. | | `organization_ids` | array | No | List of organization IDs to filter tags by. Defaults to the user's organization ID if not specified. | | `include_used_only` | boolean | No | Filters out tags that aren't currently used on any user agents. Set to true to only return tags actively in use. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### List All Users **Slug:** `DNSFILTER_LIST_USERS_ALL` Tool to get all users basic information with optional pagination. Use when you need to retrieve a list of users in the organization with their profile details including name, email, and contact information. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `page` | object | No | Pagination parameters for the request. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Lookup Network By IP **Slug:** `DNSFILTER_LOOKUP_NETWORK_BY_IP` Tool to get basic network information based on an IP address lookup. Use when you need to identify which network an IP belongs to and retrieve its block page configuration settings. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `requesting_ip_address` | string | Yes | IP address to lookup. Use this to find which network a specific IP belongs to and retrieve its basic configuration. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove Allowed Application **Slug:** `DNSFILTER_REMOVE_ALLOWED_APPLICATION` Removes a single application from the allow list of a policy in DNSFilter. Use this action when you need to revoke access for a specific application that was previously allowed. The application will be removed from the policy's allow_applications list and will no longer bypass filtering rules. This is useful for tightening security policies or removing applications that are no longer needed while maintaining the rest of the filtering configuration. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | Policy ID to remove the allowed application from. Use LIST_POLICIES action to retrieve valid policy IDs. | | `name` | string | Yes | Application name to remove from the allow list. This should be a valid application identifier currently in the policy's allow list (e.g., '101domains', 'dropbox', 'slack'). | | `include_relationships` | boolean | No | Include relationships in the response (organization, etc.). Defaults to true. Set to false for a lighter response payload. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove Allowlist Domains from Policies **Slug:** `DNSFILTER_REMOVE_ALLOWLIST_DOMAINS_FROM_POLICIES` Tool to remove one or more domains from one or more policies' allow lists. Use when you need to bulk remove previously allowed domains from multiple policies at once, useful for security updates or policy cleanup. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `notes` | object | No | Optional domain/note key-value pairs to associate notes with specific domains being removed. | | `domains` | array | Yes | List of domain names to remove from the allow list. Domains should be in standard format without protocol (e.g., 'example.com'). | | `policy_ids` | array | Yes | List of policy IDs to remove the domains from. Use LIST_POLICIES action to retrieve valid policy IDs. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove Blacklist Category **Slug:** `DNSFILTER_REMOVE_BLACKLIST_CATEGORY` Tool to remove a single category from a policy's blocklist. Use when you need to unblock a specific content category that was previously restricted in a DNS filtering policy. The category will be removed from the policy's blacklist_categories array, allowing domains in that category to be accessed. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique ID of the policy to modify. Use LIST_POLICIES action to retrieve valid policy IDs. | | `category_id` | integer | Yes | The category ID to remove from the blocklist. Use LIST_CATEGORIES or LIST_ALL_CATEGORIES actions to retrieve valid category IDs. | | `include_relationships` | boolean | No | Include relationships in the response (organization, etc.). Defaults to true. Set to false for a lighter response payload. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove Blacklist Domain From Policy **Slug:** `DNSFILTER_REMOVE_BLACKLIST_DOMAIN_FROM_POLICY` Tool to remove a single domain from a policy's blocklist. Use when you need to unblock a specific domain that was previously blocked by a policy, such as when correcting false positives or updating filtering rules. The domain will be removed from the specified policy's blacklist_domains list. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique identifier of the policy to remove the domain from. Use LIST_POLICIES action to retrieve valid policy IDs. | | `note` | string | Yes | Note or comment explaining why this domain is being removed from the blocklist. Useful for audit trails and documentation. | | `domain` | string | Yes | The domain name to remove from the blocklist. Should be a valid domain name without protocol prefix (e.g., 'example.com', not 'https://example.com'). | | `include_relationships` | boolean | No | Include relationships in the response (organization, etc.). Defaults to true. Set to false for a lighter response payload. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove Blocked Application **Slug:** `DNSFILTER_REMOVE_BLOCKED_APPLICATION` Removes a single application from the block list of a policy in DNSFilter. Use this action when you need to unblock a specific application that was previously blocked by the filtering policy. The application will be removed from the policy's block_applications list and will no longer be blocked by this policy. This is useful for allowing previously blocked applications while maintaining other filtering rules. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | Policy ID to remove the blocked application from. Use LIST_POLICIES action to retrieve valid policy IDs. | | `name` | string | Yes | Application name to remove from the block list. This should be a valid application identifier that exists in the policy's blocked applications list (e.g., '101domains', 'facebook', 'twitter'). | | `include_relationships` | boolean | No | Include relationships in the response (organization, etc.). Defaults to true. Set to false for a lighter response payload. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove Blocklist Domains **Slug:** `DNSFILTER_REMOVE_BLOCKLIST_DOMAINS` Tool to remove one or more domains from one or more policy block lists in bulk. Use when you need to unblock domains across multiple policies simultaneously, such as when removing false positives or updating block list policies. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `notes` | object | No | Optional key-value pairs mapping domain names to notes. Use this to document the reason for removal or provide context for each domain. | | `domains` | array | Yes | List of domain names to remove from the block lists. Each domain should be a valid domain name (e.g., 'example.com', 'malicious-site.net'). These domains will be removed from all specified policies. | | `policy_ids` | array | Yes | List of policy IDs to remove the domains from. Use LIST_POLICIES to retrieve valid policy IDs. The domains will be removed from the block lists of all specified policies. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Remove Whitelist Domain from Policy **Slug:** `DNSFILTER_REMOVE_WHITELIST_DOMAIN_FROM_POLICY` Tool to remove a single domain from a policy's whitelist/allowlist. Use when you need to revoke access for a previously allowed domain, useful for security updates or policy cleanup. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | Policy ID from which to remove the domain. Use LIST_POLICIES action to retrieve valid policy IDs. | | `note` | string | Yes | Explanatory note describing why the domain is being removed from the allowlist. | | `domain` | string | Yes | Domain name to remove from the whitelist/allowlist. Should be in standard format without protocol (e.g., 'example.com'). | | `include_relationships` | boolean | No | Include relationships in the response (organization, etc.). Defaults to true. Set to false for a lighter response payload. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Resend User Invite **Slug:** `DNSFILTER_RESEND_USER_INVITE` Tool to resend an invitation email to a user in a DNSFilter organization. Use when a user hasn't received their original invitation or needs a new invitation link. The invitation will be sent to the user's registered email address. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique ID of the user to resend the invitation to | | `organization_id` | integer | Yes | The unique ID of the organization that the user belongs to | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Suggest Domain Threat **Slug:** `DNSFILTER_SUGGEST_DOMAIN_THREAT` Submit a domain threat report to DNSFilter for review and potential threat categorization. Use this action when you have identified a suspicious or malicious domain that should be reported to DNSFilter. The submission will be reviewed by DNSFilter's security team and may result in the domain being categorized as a threat, which will improve protection for all DNSFilter users. This is typically used for reporting newly discovered phishing sites, malware distribution domains, spam sources, or other malicious domains that are not yet properly categorized. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `fqdn` | string | Yes | Fully qualified domain name (FQDN) to report as a potential threat. Must be a valid domain name format (e.g., 'malicious-site.example.com'). | | `notes` | string | Yes | Detailed explanation describing why this domain is considered a threat. Include specific observations such as phishing attempts, malware distribution, spam campaigns, or other malicious activity. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Billing Address **Slug:** `DNSFILTER_UPDATE_BILLING_ADDRESS` Updates the billing address for a DNSFilter organization. Use this when you need to modify billing contact information, shipping addresses, or invoice recipient details for an organization. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `billing_address` | object | Yes | Billing address details to update. All fields are optional; only provided fields will be updated. | | `organization_id` | integer | Yes | Unique numeric identifier of the organization whose billing address is being updated | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Current User **Slug:** `DNSFILTER_UPDATE_CURRENT_USER` Updates profile attributes for the currently authenticated DNSFilter user. Use this action to modify the user's first name, last name, or phone number. At least one field must be provided in the update request. Common use cases include updating contact information or correcting profile details. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `user` | object | Yes | User attributes to update. At least one field (first_name, last_name, or phone) should be provided. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Enterprise Connection **Slug:** `DNSFILTER_UPDATE_ENTERPRISE_CONNECTION` Updates an existing enterprise connection for SSO authentication in DNSFilter. Use this action to modify enterprise connection settings such as display name, identity provider configuration, authorized domains, role mappings, and OAuth credentials. Commonly used for updating OIDC, Okta, Azure AD, or Google Workspace SSO integrations. Note: To set a custom login URL, update the organization's 'unique_id' attribute using the PATCH /v1/organizations endpoint. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique identifier of the enterprise connection to update. | | `idp` | string ("openid" | "okta" | "azure" | "google") | No | Identity provider types for enterprise connections. | | `options` | object | No | Options for the enterprise connection, dependent on the IDP strategy. | | `role_map` | array | No | List of mappings from identity provider groups to DNSFilter roles. Allows fine-grained role assignment based on IDP group membership. | | `display_name` | string | No | The UI-visible name of the enterprise connection. Helps users identify the connection in the dashboard. | | `role_default` | string ("administrator" | "read_only" | "owner" | "technical" | "accountant" | "policies_only" | "super_administrator") | No | Default role options for enterprise connection users. | | `organization_id` | integer | No | The ID of the organization that owns this enterprise connection. | | `authorized_domains` | array | No | List of email domains that are authorized to connect via this enterprise connection. Users with these email domains can authenticate. | | `default_organization_id` | integer | No | The ID of the default organization to assign users upon authentication through this connection. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update IP Address **Slug:** `DNSFILTER_UPDATE_IP_ADDRESS` Updates an existing IP address record in DNSFilter with new data. This action modifies an IP address entry by its ID, allowing you to change the IP address itself, reassign it to a different network or organization, or update its dynamic hostname. Common use cases include: - Updating an IP address when your gateway IP changes - Moving an IP address to a different network - Setting or updating the dynamic hostname for better identification Prerequisites: - Must have a valid IP address ID (use GET_IP_ADDRESS or LIST_IP_ADDRESSES to retrieve IDs) - Must provide all required fields (address, organization_id, network_id) even if only changing one - User must have authorization to update IP addresses in the target network #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique identifier of the IP address record to update. Use GET_IP_ADDRESS or LIST_IP_ADDRESSES to retrieve valid IDs. | | `ip_address` | object | Yes | The IP address data to update. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update MAC Address **Slug:** `DNSFILTER_UPDATE_MAC_ADDRESSES` Updates an existing MAC address entry in DNSFilter with new configuration. This action allows you to modify MAC address settings including the physical address itself, organization assignment, filtering policies, block pages, and custom filter values. Common use cases include: - Correcting a MAC address that was entered incorrectly - Reassigning a MAC address to a different organization - Applying custom filtering policies to specific devices - Setting custom block pages for certain MAC addresses Prerequisites: - Must have a valid MAC address ID (use LIST_MAC_ADDRESSES or LIST_ALL_MAC_ADDRESSES to retrieve) - Must provide organization_id in the update payload - User must have authorization to update MAC addresses Notes: - If both policy_id and scheduled_policy_id are provided, scheduled_policy_id takes precedence - The filter_value defaults to the MAC address without colons if not specified - Returns HTTP 422 if the update cannot be processed with the specified data #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique identifier of the MAC address entry to update. Use LIST_MAC_ADDRESSES or LIST_ALL_MAC_ADDRESSES to retrieve valid MAC address IDs. | | `mac_address` | object | Yes | MAC address update parameters including organization_id (required) and optional fields for address, policies, and block pages. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Bulk Update Networks **Slug:** `DNSFILTER_UPDATE_NETWORKS_BULK` Tool to bulk update multiple networks with specified configuration changes. Use when you need to apply the same settings (policy, block page, VPN status) to multiple networks simultaneously instead of updating them one by one. This action creates an asynchronous bulk update job that processes multiple networks. Common use cases include: - Applying a new policy to multiple branch office networks - Enabling/disabling legacy VPN across multiple locations - Standardizing block page settings for multiple networks - Updating scheduled policies for multiple sites The operation returns a job ID immediately and processes updates in the background. For updating all networks in an organization, use ids='all' and provide organization_id. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `ids` | string | Yes | Comma-delimited network IDs to update (e.g., '10626258,9219250'), or the keyword 'all' to update all networks in an organization. Use LIST_NETWORKS action to retrieve valid network IDs. | | `policy_id` | integer | No | Policy ID to assign to the specified networks. Use to update the filtering policy for multiple networks at once. | | `block_page_id` | integer | No | Block Page ID to assign to the networks. Use to customize the block page displayed when filtering blocks a request. | | `organization_id` | integer | No | Organization ID. Required when ids is 'all', specifying which organization's networks to update. Optional when specific network IDs are provided. | | `scheduled_policy_id` | integer | No | Scheduled Policy ID to assign to the networks. Use to set or update time-based policy schedules across multiple networks. | | `is_legacy_vpn_active` | boolean | No | Whether to enable or disable legacy VPN for the specified networks. Set to true to activate, false to deactivate. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Organizations **Slug:** `DNSFILTER_UPDATE_ORGANIZATIONS` Updates an existing organization with the specified data in DNSFilter. Use this action to modify organization information such as name, billing contacts, address, licensing, MSP management settings, or custom login configurations. Common use cases include updating billing information, changing the organization name, adjusting license quantities, or configuring enterprise SSO settings. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique identifier of the organization to update. Use LIST_ORGANIZATIONS action to retrieve valid organization IDs. | | `organization` | object | Yes | The organization data to update. At minimum, you must provide the organization name. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Organization User **Slug:** `DNSFILTER_UPDATE_ORGANIZATIONS_USERS` Updates a user or permissions within an organization in DNSFilter. Use this action to modify user details such as email, name, phone, role, or organization permissions. Common use cases include updating contact information, changing user roles between administrator and read-only, or modifying organization access permissions. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The OrganizationUser ID to update. This is the unique identifier of the user within the organization. | | `user` | object | Yes | User update parameters including email, name, phone, role, and permission settings. At least one field should be provided. | | `organization_id` | integer | Yes | The ID of the organization where the user belongs. Use LIST_ORGANIZATIONS to retrieve valid organization IDs. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Policies **Slug:** `DNSFILTER_UPDATE_POLICIES` Updates an existing DNS filtering policy with the specified configuration in DNSFilter. Use this action to modify filtering rules including blocked/allowed categories, domain lists, safe search enforcement, and application controls for an existing policy. Only include fields you want to update - all fields are optional except the policy ID. Common use cases include enabling/disabling safe search, updating domain allow/block lists, modifying category blocking rules, and changing application controls. Use the append_domains parameter to add to existing domain lists rather than replacing them. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique identifier of the policy to update. Use LIST_POLICIES or GET_POLICY to retrieve valid policy IDs. | | `policy` | object | Yes | Policy update request parameters containing the fields to modify. Only include fields you want to update. | | `append_domains` | boolean | No | Option to append allowlist/blocklist domains to the existing ones rather than replacing them. Default: false. Use true when adding to existing domain lists. | | `include_relationships` | boolean | No | Include relationships in the response (organization, etc.). Defaults to true. Set to false for a lighter response payload. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Policies Application **Slug:** `DNSFILTER_UPDATE_POLICIES_APPLICATION` Updates a policy with the specified application data, configuring which policies allow or block access to an application. This action assigns allow and block policy rules to a specific application, controlling which users (based on their assigned policies) can access the application. Common use cases include: - Setting up application-level filtering rules for specific user groups - Blocking access to certain applications for specific policies - Allowing access to applications only for designated policies Prerequisites: - Must have a valid organization_id - Must have a valid application_id (use LIST_APPLICATIONS to retrieve available applications) - Must provide both allow_policies and block_policies lists (can be empty arrays) - User must have authorization to update policies in the target organization #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `allow_policies` | array | Yes | List of Policy IDs that should allow access to this application. Users under these policies will be granted access. | | `application_id` | integer | Yes | The unique identifier of the application to be configured with policy rules. | | `block_policies` | array | Yes | List of Policy IDs that should block access to this application. Users under these policies will be denied access. | | `organization_id` | integer | Yes | The unique identifier of the organization. This determines which organization's policies will be updated. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Policy Permissive Mode **Slug:** `DNSFILTER_UPDATE_POLICIES_PERMISSIVE_MODE` Tool to update the permissive mode setting for a specific policy. Use when you need to enable or disable permissive mode for a DNS filtering policy. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique ID of the policy to update permissive mode for. | | `permissive_mode` | boolean | Yes | The new permissive mode value for the policy. Set to true to enable permissive mode, false to disable it. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Scheduled Policies **Slug:** `DNSFILTER_UPDATE_SCHEDULED_POLICIES` Updates an existing scheduled policy in DNSFilter with the specified data. Use this action to modify time-based policy configurations that control filtering rules based on schedules throughout the week. Only include fields you want to update - all fields except the ID are optional. Scheduled policies allow you to apply different filtering policies at different times. Common use cases include stricter filtering during work hours, relaxed filtering during breaks, or different policies for weekdays vs weekends. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique identifier of the scheduled policy to update. Use LIST_SCHEDULED_POLICIES action to retrieve valid scheduled policy IDs. | | `name` | string | No | Human-readable name for the scheduled policy. Use a descriptive name that helps identify the policy's purpose or schedule. | | `timezone` | string | No | The timezone string for localizing the policy schedule (e.g., 'America/New_York', 'UTC', 'Europe/London'). This determines how the time blocks in policy_ids are interpreted. | | `policy_ids` | array | No | Array of 672 policy IDs representing 15-minute time blocks starting Monday morning 12:01am. Each index corresponds to a 15-minute block throughout the week, allowing you to assign different policies for different time periods. | | `organization_id` | integer | No | The unique identifier of the organization that owns the scheduled policy. This must match the organization that owns the policy. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update Scheduled Reports **Slug:** `DNSFILTER_UPDATE_SCHEDULED_REPORTS` Updates an existing scheduled report configuration in DNSFilter. Use this action to modify report frequency, delivery schedule, content options, or recipient settings. Common use cases include changing the day of the week for report delivery, adjusting which content categories are included, or enabling/disabling threat summaries. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique identifier of the scheduled report to update. Use LIST_SCHEDULED_REPORTS action to retrieve valid scheduled report IDs. | | `scheduled_report` | object | Yes | The scheduled report data to update. You can modify any combination of frequency, day of week, content settings, and recipient options. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Update User Agent Cleanups **Slug:** `DNSFILTER_UPDATE_USER_AGENT_CLEANUPS` Updates a user agent cleanup operation in DNSFilter. Use this to modify the inactivity threshold or start/restart a cleanup job. This action allows you to: 1. Change the 'inactive_for' threshold to adjust which agents are included in the cleanup (automatically restarts the job) 2. Start the cleanup process by setting 'start' to true (only works if 'inactive_for' is not provided) Common use cases: - Adjust the inactivity threshold from 30 to 45 days to be more conservative about deletions - Start a previously configured cleanup job that hasn't been started yet - Restart a cleanup job with a new threshold to recalculate which agents should be deleted Note: When 'inactive_for' is provided, it takes precedence and restarts the job, making 'start' parameter ineffective. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `id` | integer | Yes | The unique identifier of the user agent cleanup operation to update. This ID is returned when creating a cleanup or can be retrieved from listing operations. | | `start` | boolean | No | Start the cleanup process. Note: This will do nothing if 'inactive_for' is also included in the request, as updating inactive_for automatically restarts the job. | | `inactive_for` | integer | No | The number of inactive days for user agents to be included in cleanup. Setting this value restarts the job to find agents to delete based on the new inactivity threshold. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not | ### Validate Auth0 JWT **Slug:** `DNSFILTER_VALIDATE_AUTH0_JWT` Tool to validate a JWT with Auth0. Use when you need to confirm token validity before making DNSFilter API calls. #### Input Parameters | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `jwt` | string | Yes | Auth0 JSON Web Token (JWT) string to validate. | #### Output | Parameter | Type | Required | Description | |-----------|------|----------|-------------| | `data` | string | Yes | Data from the action execution | | `error` | string | No | Error if any occurred during the execution of the action | | `successful` | boolean | Yes | Whether or not the action execution was successful or not |