> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Graph SDK

> Reference for the Tracecat Microsoft Graph SDK integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Call continuation method

Action ID: `tools.microsoft_graph_sdk.call_continuation_method`

Follow one validated Graph next or delta link.

Reference: [https://learn.microsoft.com/en-us/graph/paging](https://learn.microsoft.com/en-us/graph/paging)

### Secrets

Optional secrets:

* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_outlook_oauth`: OAuth token `MICROSOFT_OUTLOOK_SERVICE_TOKEN`.
* `microsoft_outlook_oauth`: OAuth token `MICROSOFT_OUTLOOK_USER_TOKEN`.

### Input fields

<ParamField path="continuation_url" type="string" required>
  Complete `@odata.nextLink` or `@odata.deltaLink` returned by Microsoft Graph. The URL must remain on the selected national-cloud v1.0 root.
</ParamField>

<ParamField path="auth_mode" type="MicrosoftGraphAuthMode">
  Credential type to use from the selected OAuth provider. `application` uses its service token, `delegated` uses its user token, and `auto` tries the service chain before the user chain. Product providers fall back to the matching generic Microsoft Graph token.

  Default: `"application"`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. Defaults to `https://graph.microsoft.com/v1.0`. Also accepts `https://graph.microsoft.us/v1.0`, `https://dod-graph.microsoft.us/v1.0` and `https://microsoftgraph.chinacloudapi.cn/v1.0`.

  Default: `null`.
</ParamField>

<ParamField path="headers" type="map[string, string | null] | null">
  Additional request headers. `null` values are dropped. `Authorization` and `Host` are owned by the SDK and are rejected (case-insensitive).

  Default: `null`.
</ParamField>

<ParamField path="oauth_provider" type="MicrosoftGraphOAuthProvider">
  OAuth provider to use. Product providers prefer their own token and fall back to the matching generic Microsoft Graph token. Security and Outlook credentials are never used as fallbacks for each other.

  Default: `"microsoft_graph"`.
</ParamField>

## Call method

Action ID: `tools.microsoft_graph_sdk.call_method`

Send one Microsoft Graph v1.0 request and return its untouched JSON body.

Reference: [https://learn.microsoft.com/en-us/graph/use-the-api](https://learn.microsoft.com/en-us/graph/use-the-api)

### Secrets

Optional secrets:

* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_outlook_oauth`: OAuth token `MICROSOFT_OUTLOOK_SERVICE_TOKEN`.
* `microsoft_outlook_oauth`: OAuth token `MICROSOFT_OUTLOOK_USER_TOKEN`.

### Input fields

<ParamField path="method" type="string" required>
  HTTP method. One of GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS.
</ParamField>

<ParamField path="path" type="string" required>
  Resource path relative to the Microsoft Graph v1.0 root, e.g. `/security/alerts_v2`. Absolute URLs, dot-segments and encoded separators are rejected.
</ParamField>

<ParamField path="auth_mode" type="MicrosoftGraphAuthMode">
  Credential type to use from the selected OAuth provider. `application` uses its service token, `delegated` uses its user token, and `auto` tries the service chain before the user chain. Product providers fall back to the matching generic Microsoft Graph token.

  Default: `"application"`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. Defaults to `https://graph.microsoft.com/v1.0`. Also accepts `https://graph.microsoft.us/v1.0`, `https://dod-graph.microsoft.us/v1.0` and `https://microsoftgraph.chinacloudapi.cn/v1.0`.

  Default: `null`.
</ParamField>

<ParamField path="headers" type="map[string, string | null] | null">
  Additional request headers. `null` values are dropped. `Authorization` and `Host` are owned by the SDK and are rejected (case-insensitive).

  Default: `null`.
</ParamField>

<ParamField path="oauth_provider" type="MicrosoftGraphOAuthProvider">
  OAuth provider to use. Product providers prefer their own token and fall back to the matching generic Microsoft Graph token. Security and Outlook credentials are never used as fallbacks for each other.

  Default: `"microsoft_graph"`.
</ParamField>

<ParamField path="omit_none_payload_fields" type="boolean">
  Drop top-level payload fields whose value is `null` instead of sending JSON `null`. Nested `null` values are always preserved.

  Default: `false`.
</ParamField>

<ParamField path="params" type="object | null">
  Query parameters, e.g. `&#123;"$top": 50&#125;`. Only `None` values are dropped: `false`, `0` and `""` are sent. Booleans are serialized as OData `true`/`false` and lists as repeated keys.

  Default: `null`.
</ParamField>

<ParamField path="payload" type="object | null">
  JSON request body. Explicit `null` values are sent as JSON `null` unless `omit_none_payload_fields` is enabled.

  Default: `null`.
</ParamField>

## Call paginated method

Action ID: `tools.microsoft_graph_sdk.call_paginated_method`

Fetch every page of a Microsoft Graph collection, bounded by `limit`.

Reference: [https://learn.microsoft.com/en-us/graph/paging](https://learn.microsoft.com/en-us/graph/paging)

### Secrets

Optional secrets:

* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_SERVICE_TOKEN`.
* `microsoft_graph_oauth`: OAuth token `MICROSOFT_GRAPH_USER_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_SERVICE_TOKEN`.
* `microsoft_graph_security_oauth`: OAuth token `MICROSOFT_GRAPH_SECURITY_USER_TOKEN`.
* `microsoft_outlook_oauth`: OAuth token `MICROSOFT_OUTLOOK_SERVICE_TOKEN`.
* `microsoft_outlook_oauth`: OAuth token `MICROSOFT_OUTLOOK_USER_TOKEN`.

### Input fields

<ParamField path="path" type="string" required>
  Resource path relative to the Microsoft Graph v1.0 root, e.g. `/security/alerts_v2`. Absolute URLs, dot-segments and encoded separators are rejected.
</ParamField>

<ParamField path="auth_mode" type="MicrosoftGraphAuthMode">
  Credential type to use from the selected OAuth provider. `application` uses its service token, `delegated` uses its user token, and `auto` tries the service chain before the user chain. Product providers fall back to the matching generic Microsoft Graph token.

  Default: `"application"`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Microsoft Graph v1.0 API root. Defaults to `https://graph.microsoft.com/v1.0`. Also accepts `https://graph.microsoft.us/v1.0`, `https://dod-graph.microsoft.us/v1.0` and `https://microsoftgraph.chinacloudapi.cn/v1.0`.

  Default: `null`.
</ParamField>

<ParamField path="headers" type="map[string, string | null] | null">
  Additional request headers. `null` values are dropped. `Authorization` and `Host` are owned by the SDK and are rejected (case-insensitive).

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of items to return across all pages. Paging stops as soon as the bound is reached. Set to `null` to follow every `@odata.nextLink`.

  Default: `1000`.
</ParamField>

<ParamField path="oauth_provider" type="MicrosoftGraphOAuthProvider">
  OAuth provider to use. Product providers prefer their own token and fall back to the matching generic Microsoft Graph token. Security and Outlook credentials are never used as fallbacks for each other.

  Default: `"microsoft_graph"`.
</ParamField>

<ParamField path="params" type="object | null">
  Query parameters, e.g. `&#123;"$top": 50&#125;`. Only `None` values are dropped: `false`, `0` and `""` are sent. Booleans are serialized as OData `true`/`false` and lists as repeated keys.

  Default: `null`.
</ParamField>