[Liongard] Returns the total number of environments visible to the API key. Useful as a cheap health check or to size pagination loops before calling liongard_list_environments.

[Liongard] Create a new environment. Body requires Name, Description, Parent (nullable), ShortName, and Tier (must be 'Core' or 'Essentials'). Returns the created environment with its assigned ID.

[Liongard] Create multiple environments in one call. Body must be a JSON array of environment-create objects (same shape as liongard_create_environment).

[Liongard] WARNING: Permanently delete an environment. Setting relatedEntities=true also deletes child agents, launchpoints, and integration mappings — non-reversible. Use liongard_get_environment_related_entities first to understand the blast radius.

[Liongard] Get a single environment by ID. Returns full environment metadata including parent, short name, tier, creation date, and IDs of associated launchpoints/agents. Use liongard_list_environments to discover IDs.

[Liongard] Fetch all dependent objects for an environment in one call: launchpoints, agents, integration mappings, and child environments. Useful for impact analysis before deletion or drift discovery.

[Liongard] List environments (top-level customer/site containers). Each environment groups inspectors, agents, launchpoints, and asset inventory. Returns paginated array with environment IDs, names, descriptions, and tier (Core or Essentials). Takes the FLAT parameters page/pageSize/columns/orderBy only — this is a GET, not a POST-for-search; a nested / object is NOT accepted (the stackjack_run_* dispatchers reject unknown arguments; a direct call silently ignores them). Liongard offers no server-side name filter on this endpoint: to find an environment by name, page through with orderBy='Name' and match client-side. Use liongard_get_environment for full details and liongard_get_environment_related_entities to fetch dependent objects.

[Liongard] Run dashboard-metric queries against a single environment. Body must contain a queryIdentifiers array of dashboard metric names (e.g. 'm365TotalUsers', 'workstationOsVersionPct', 'winServerEDRSoftware', 'macOSPctEncryptedAtRest'). See Liongard's UI dashboard for the full enum (60+ values). Use this for posture-snapshot reports.

[Liongard] Update a single environment by ID. Body uses the same shape as create (Name/Description/Parent/ShortName/Tier). Use liongard_list_environments to find IDs.

[Liongard] Update multiple environments in one call. Body must be a JSON array of {EnvironmentId, Name, Description, Parent, ShortName, Tier} objects.

[Liongard] Create an environment group. Body requires AutoAddNewEnvironments (bool), Description, Environments (int[]), Name, Users (array of {UserID, GroupID}).

[Liongard] WARNING: Permanently delete one or more environment groups. Liongard quirk: this is a DELETE with a JSON BODY (not a path-based delete). Body shape: {"EnvironmentGroupIDs": [1, 2, 3]}. Environments inside the groups are NOT deleted — only the group association.

[Liongard] List environment groups. Each group bundles environment IDs and user permission assignments. Use to discover group IDs before applying group-level permissions.

[Liongard] Update a single environment group. Body shape matches liongard_create_environment_group. Use liongard_list_environment_groups to find IDs.

[Liongard] WARNING: Permanently delete one or more agents. Liongard quirk: this is a DELETE with a JSON BODY (not path-based). Body shape: {"AgentIDs": [1,2,3]}. Optional disableLaunchpoints flag also disables every launchpoint that pointed at the deleted agents. Use liongard_list_agents first to confirm IDs.

[Liongard] Generate a one-time installer download URL for a new agent in a specific environment. Body requires os ('windows', 'mac', or 'linux') and environmentID. Returns an installer URL or installer artifact metadata.

[Liongard] List agents (Liongard collectors deployed in customer networks). Liongard quirk: this is a POST-for-search endpoint at /view/agents. Body envelope: {Filters, Sorting, Pagination}. Liongard requires empty arrays even when not filtering — this tool sends defaults automatically when bodyJson is null. Optional flags excludeSummary/excludeAgents/excludeManaged trim the response shape.

[Liongard] Get a single identity by UUID. Returns full identity details including type, status, location, manual-curation flag.

[Liongard] Query identities (users, service accounts, admins, guests, etc.) within an environment's asset inventory. POST-for-search: body requires Environment (int, REQUIRED) and Filters/Pagination/Sorting (Liongard requires empty arrays even when unused). Returns identity records with type, status, location, inventory state, and isManual flag.

[Liongard] Bulk-update inventory state, status, and type across many identities. Liongard quirk: this is a POST-for-update (not a PUT), per the bulk-mutate convention. Body: {"Environment": N, "IDs": ["uuid1","uuid2"], "InventoryState": "Archive", "Status": "inactive", "Type": "user"}.

[Liongard] Update a single identity's classification (type, status, location, inventoryState, isManual). Type values: service|user|admin|guest|shared|system|application. Status values: suspended|active|inactive|expired|deactivated|deleted|pending-activation. InventoryState: Inventory|Archive|Discovery.

[Liongard] Get a single device profile by UUID. Returns full device metadata: alias, class, status, category, type, role, location, host info, asset tag, purchase date, warranty/EOL dates, environment.

[Liongard] Query device profiles within an environment's asset inventory. POST-for-search: body requires Environment, Filters, Pagination, Sorting (empty arrays required). Returns devices with class, status, category, type, role, location, and asset metadata.

[Liongard] Update a device's classification or asset metadata. Many enum fields: Class (critical|standar — Liongard spec typo, pass through as 'standar'), Status (active|inactive|idle|standby), Category (compute|network|iot-printer|storage), Type (server|host|desktop|laptop|smartphone|tablet), Role (15 values incl. domain-directory|vm-host|vm-guest|pbx|voip|dns|sql|backup|user-device). See Liongard docs for the full enum tree.

[Liongard] Bulk-update inventory state, status, and type across many device profiles. Liongard quirk: POST-for-update. Body: {"Environment": N, "IDs": ["uuid1","uuid2"], "InventoryState": "Archive", "Status": "inactive", "Type": "server"}.

[Liongard] Evaluate one or more metrics across systems and return the values. WARNING: this endpoint has a STRICTER rate limit (100 req/min vs the platform-wide 2000 req/5min). Batch metric IDs into a single call rather than firing per-metric. Body: {"Metrics": [<int or UUID>], "Filters": [{"Field":"EnvironmentID","Op":"equal_to","Values":[1]}], "Sorting": [], "Pagination": {"Page":1,"PageSize":25}}. Filters/Sorting empty arrays required even when unused.

[Liongard] Evaluate ALL enabled metrics for a list of system IDs. Returns metric values per system. Useful when you want a posture snapshot for specific systems rather than a metric-first view. Body: {"Systems": [N1, N2], "Filters": [], "Sorting": [], "Pagination": }.

[Liongard] Returns the environment IDs where a given metric is currently evaluated. Useful for scoping a follow-up liongard_evaluate_metrics call to only the relevant environments.

[Liongard] List defined metrics. Liongard quirk: this endpoint uses UPPERCASE Page/PageSize query params (most other endpoints use lowercase). Filters/Sorting are passed as repeated form params with JSON-string values, e.g. Filters[]={"FilterBy":"Name","Op":"contains","Value":"Active Directory"}.

[Liongard] List detection events (alert-style records derived from inspector runs). POST-for-search body: {Pagination, Filters, Sorting, StartDate, EndDate}. StartDate/EndDate use ISO 8601 with Z (e.g. '2026-04-01T00:00:00.000Z'); Filters/Sorting may be empty arrays. Filter entries use {"FilterBy","Op","Value"} — NOT the {Field,Op,Values} shape in Liongard's own OAS, which the live validator rejects. FilterBy is one of 'name' | 'change-detection' (Op: contains, does_not_contain, matches_exactly, starts_with, ends_with, is_empty, is_not_empty; Value MUST be a string, even for numbers) or 'date' (Op: between_two_date_times/not_between_two_date_times with From/To, or exactly_on_date_time/from_a_date_time_forward/up_to_certain_date_time with Value). Broad queries can take 30-50s on large instances.

[Liongard] Query timeline entries (inspector runs). Each entry includes Status (queued/running/completed/failed), AdHoc, SystemID, SystemDetailID (presence indicates a dataprint exists), ChangeDetections, ScheduledAt/RunningAt/FinishedAt timestamps, ExitCode, ExitMessage. KNOWN VENDOR LIMITATIONS: Liongard's validator rejects every documented Filters shape on this endpoint (400 'Invalid request body' — do NOT send Filters entries), an empty Sorting array triggers a vendor 500 (StackJack strips empty Filters/Sorting automatically), and the query runs unfiltered — on instances with large timelines it may exceed the 2-minute budget and time out. For filtered change history use liongard_list_detections instead.

[Liongard] Run a JMESPath query against a system's inspection dataprint and return the matched values. JMESPath is a JSON query language (https://jmespath.org). Use liongard_get_inspector_schema_v1 to discover property paths for a given inspector. Body: {"QueryPath": "<jmespath expression>", "Pagination": {"Page":1,"PageSize":25}}.

[Liongard] Register a new webhook. WARNING: Liongard validates the URL is reachable at create time — returns 404 if the destination URL refuses the verification ping. Make sure the receiver is deployed and accepting requests before calling this. Body: {"Description": "...", "Url": "https://...", "Events": ["alert.created"]}. Currently only 'alert.created' is supported.

[Liongard] WARNING: DESTRUCTIVE. Generates a new global signing key used for HMAC-SHA256 signing of ALL webhook payloads. Calling this immediately invalidates HMAC verification for ALL existing webhook receivers — every receiver must be updated with the new key before the next event arrives. Use ONLY when rotating a compromised key. Returns the new signing key in the response (one-time visibility).

[Liongard] List configured webhooks. Each webhook has ID (UUID), URL, Description, Events (array; currently only 'alert.created' is published), Active flag, Health, CreatedOn, CreatedBy.

[Liongard] Update a single webhook. Adds Active toggle vs. create. Body: {"Description": "...", "Url": "https://...", "Events": ["alert.created"], "Active": true}.

[Liongard v1] Returns the JSON schema for an inspector's dataprint output, including all property paths (JMESPath-compatible). Pair with liongard_evaluate_dataprint (v2) to query specific values from a system's inspection.

[Liongard v1] Get a single inspector's metadata: name, version, description, inspection schedule, configuration schema. Use liongard_list_inspectors_v1 to discover IDs.

[Liongard v1] List all inspectors available in this tenant. Each inspector is a data source definition (e.g. 'Microsoft 365 Inspector'). Use to discover available data sources before chaining to liongard_get_inspector_schema_v1 for property paths usable in dataprint queries.

[Liongard v1] Get the most recent inspection details (dataprint snapshot) for a system. Returns the full inspector output. For targeted queries against this output, use liongard_evaluate_dataprint (v2) with the SystemDetailID.

[Liongard v1] List inspector instances (systems). v1 filter quirk: each filter is a JSON object inside a bracket-array query param, e.g. conditions[]={"path":"Name","op":"equals","value":"Contoso"}. Allowed path names are endpoint-specific and not published by Liongard — an unsupported path returns 400 'must be equal to constant'; known-good ops include equals, is, contains.

[Liongard v1] Create a new launchpoint. Body shape: schedule, system, agent, configuration. Consult Liongard's v1 API explorer for the exact schema (varies by inspector type).

[Liongard v1] Delete a launchpoint. Stops scheduled inspections; the underlying system is not deleted.

[Liongard v1] List launchpoints (scheduled inspection triggers). Returns Schedule, NextScheduledFor, AssociatedSystem, AssociatedAgent, and configuration.

[Liongard v1] Trigger a manual ad-hoc run of a launchpoint's inspection. ASYNC — returns immediately; the actual inspection runs in the background. Poll liongard_query_timeline (v2) to see the resulting timeline entry transition through running → completed/failed.

[Liongard v1] Create a Liongard user. Body shape includes Email, Name, Role assignments. Consult Liongard's v1 API explorer for exact schema (varies by tenant tier).

[Liongard v1] WARNING: Permanently delete a user. Removes all role assignments and revokes any API keys owned by that user.

[Liongard v1] List Liongard tenant users with their role assignments and account status. Useful for permission audits.

[Liongard v1] List service providers (top-level MSP entities). Most tenants have a single SP; multi-SP setups use this for tenant discovery.

[Liongard v1] Download a generated report binary and return a short-lived SAS URL pointing to the blob-stored copy. The connector enforces a 100 MB size cap. Confirm the report status is 'complete' (via liongard_get_report_v1) before calling — otherwise this returns 404 or partial content.

[Liongard v1] Trigger report generation. ASYNC — returns a job/report ID immediately. Poll liongard_get_report_v1 until status transitions from 'pending'/'running' to 'complete', then call liongard_download_report_v1 to fetch the binary. Body shape varies by report type — consult Liongard's v1 API explorer.

[Liongard v1] Mark an alert as acknowledged. Idempotent — safe to call repeatedly. Useful for clearing resolved findings from the active alert queue.

[Liongard v1] List alerts (notifications from inspector runs). Returns severity, status (acknowledged/unacknowledged), source system, and alert text.

[Liongard v1] Create a new tag. Body: {"Name": "...", "Description": "...", "Color": "#hex"} or similar. Consult Liongard's v1 API explorer for exact schema.

[Liongard v1] Delete a tag. Removes the tag from all entities it was applied to.

[Liongard v1] Create a note attached to an entity. Body requires entity_type ('Environment'|'System'|'Launchpoint') and entity_id, plus the note text. Consult Liongard's v1 API explorer for exact schema.

[Liongard v1] List notes. Filter by entity_type / entity_id via the conditions param to scope to a specific environment or system.

[Liongard v1] List all roles defined in this tenant. Use to enumerate role names + permission sets when auditing user assignments.

[Liongard v1] List audit log entries with optional date-range filter. Returns who-did-what records (user, action, target, timestamp) for compliance and security review.