Microsoft Graph SDK

Reference for the Tracecat Microsoft Graph SDK integration: registered actions, required secrets, expected inputs, and example workflow usage.

Call continuation method

Action ID: tools.microsoft_graph_sdk.call_continuation_method

Follow one validated Graph next or delta link.

Reference: https://learn.microsoft.com/en-us/graph/paging

Secrets

Optional secrets:

• microsoft_graph_oauth: OAuth token MICROSOFT_GRAPH_SERVICE_TOKEN.
• microsoft_graph_oauth: OAuth token MICROSOFT_GRAPH_USER_TOKEN.
• microsoft_graph_security_oauth: OAuth token MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.
• microsoft_graph_security_oauth: OAuth token MICROSOFT_GRAPH_SECURITY_USER_TOKEN.
• microsoft_outlook_oauth: OAuth token MICROSOFT_OUTLOOK_SERVICE_TOKEN.
• microsoft_outlook_oauth: OAuth token MICROSOFT_OUTLOOK_USER_TOKEN.

Input fields

continuation_url · string · required

Complete @odata.nextLink or @odata.deltaLink returned by Microsoft Graph. The URL must remain on the selected national-cloud v1.0 root.

auth_mode · MicrosoftGraphAuthMode

Credential type to use from the selected OAuth provider. application uses its service token, delegated uses its user token, and auto tries the service chain before the user chain. Product providers fall back to the matching generic Microsoft Graph token.

Default: "application".

base_url · string | null

Microsoft Graph v1.0 API root. Defaults to https://graph.microsoft.com/v1.0. Also accepts https://graph.microsoft.us/v1.0, https://dod-graph.microsoft.us/v1.0 and https://microsoftgraph.chinacloudapi.cn/v1.0.

Default: null.

headers · map[string, string | null] | null

Additional request headers. null values are dropped. Authorization and Host are owned by the SDK and are rejected (case-insensitive).

Default: null.

oauth_provider · MicrosoftGraphOAuthProvider

OAuth provider to use. Product providers prefer their own token and fall back to the matching generic Microsoft Graph token. Security and Outlook credentials are never used as fallbacks for each other.

Default: "microsoft_graph".

Call method

Action ID: tools.microsoft_graph_sdk.call_method

Send one Microsoft Graph v1.0 request and return its untouched JSON body.

Reference: https://learn.microsoft.com/en-us/graph/use-the-api

Secrets

Optional secrets:

• microsoft_graph_oauth: OAuth token MICROSOFT_GRAPH_SERVICE_TOKEN.
• microsoft_graph_oauth: OAuth token MICROSOFT_GRAPH_USER_TOKEN.
• microsoft_graph_security_oauth: OAuth token MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.
• microsoft_graph_security_oauth: OAuth token MICROSOFT_GRAPH_SECURITY_USER_TOKEN.
• microsoft_outlook_oauth: OAuth token MICROSOFT_OUTLOOK_SERVICE_TOKEN.
• microsoft_outlook_oauth: OAuth token MICROSOFT_OUTLOOK_USER_TOKEN.

Input fields

method · string · required

HTTP method. One of GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS.

path · string · required

Resource path relative to the Microsoft Graph v1.0 root, e.g. /security/alerts_v2. Absolute URLs, dot-segments and encoded separators are rejected.

auth_mode · MicrosoftGraphAuthMode

Credential type to use from the selected OAuth provider. application uses its service token, delegated uses its user token, and auto tries the service chain before the user chain. Product providers fall back to the matching generic Microsoft Graph token.

Default: "application".

base_url · string | null

Microsoft Graph v1.0 API root. Defaults to https://graph.microsoft.com/v1.0. Also accepts https://graph.microsoft.us/v1.0, https://dod-graph.microsoft.us/v1.0 and https://microsoftgraph.chinacloudapi.cn/v1.0.

Default: null.

headers · map[string, string | null] | null

Additional request headers. null values are dropped. Authorization and Host are owned by the SDK and are rejected (case-insensitive).

Default: null.

oauth_provider · MicrosoftGraphOAuthProvider

OAuth provider to use. Product providers prefer their own token and fall back to the matching generic Microsoft Graph token. Security and Outlook credentials are never used as fallbacks for each other.

Default: "microsoft_graph".

omit_none_payload_fields · boolean

Drop top-level payload fields whose value is null instead of sending JSON null. Nested null values are always preserved.

Default: false.

params · object | null

Query parameters, e.g. {"$top": 50}. Only None values are dropped: false, 0 and "" are sent. Booleans are serialized as OData true/false and lists as repeated keys.

Default: null.

payload · object | null

JSON request body. Explicit null values are sent as JSON null unless omit_none_payload_fields is enabled.

Default: null.

Call paginated method

Action ID: tools.microsoft_graph_sdk.call_paginated_method

Fetch every page of a Microsoft Graph collection, bounded by limit.

Reference: https://learn.microsoft.com/en-us/graph/paging

Secrets

Optional secrets:

• microsoft_graph_oauth: OAuth token MICROSOFT_GRAPH_SERVICE_TOKEN.
• microsoft_graph_oauth: OAuth token MICROSOFT_GRAPH_USER_TOKEN.
• microsoft_graph_security_oauth: OAuth token MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN.
• microsoft_graph_security_oauth: OAuth token MICROSOFT_GRAPH_SECURITY_USER_TOKEN.
• microsoft_outlook_oauth: OAuth token MICROSOFT_OUTLOOK_SERVICE_TOKEN.
• microsoft_outlook_oauth: OAuth token MICROSOFT_OUTLOOK_USER_TOKEN.

Input fields

path · string · required

Resource path relative to the Microsoft Graph v1.0 root, e.g. /security/alerts_v2. Absolute URLs, dot-segments and encoded separators are rejected.

auth_mode · MicrosoftGraphAuthMode

Credential type to use from the selected OAuth provider. application uses its service token, delegated uses its user token, and auto tries the service chain before the user chain. Product providers fall back to the matching generic Microsoft Graph token.

Default: "application".

base_url · string | null

Microsoft Graph v1.0 API root. Defaults to https://graph.microsoft.com/v1.0. Also accepts https://graph.microsoft.us/v1.0, https://dod-graph.microsoft.us/v1.0 and https://microsoftgraph.chinacloudapi.cn/v1.0.

Default: null.

headers · map[string, string | null] | null

Additional request headers. null values are dropped. Authorization and Host are owned by the SDK and are rejected (case-insensitive).

Default: null.

limit · integer | null

Maximum number of items to return across all pages. Paging stops as soon as the bound is reached. Set to null to follow every @odata.nextLink.

Default: 1000.

oauth_provider · MicrosoftGraphOAuthProvider

OAuth provider to use. Product providers prefer their own token and fall back to the matching generic Microsoft Graph token. Security and Outlook credentials are never used as fallbacks for each other.

Default: "microsoft_graph".

params · object | null

Query parameters, e.g. {"$top": 50}. Only None values are dropped: false, 0 and "" are sent. Booleans are serialized as OData true/false and lists as repeated keys.

Default: null.