> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sublime

> Reference for the Tracecat Sublime integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Activate rule

Action ID: `tools.sublime.activate_rule`

Activate a Sublime rule.

Reference: [https://docs.sublime.security/reference/activaterule-1](https://docs.sublime.security/reference/activaterule-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime rule ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Add list entry

Action ID: `tools.sublime.add_list_entry`

Add an entry to a Sublime list.

Reference: [https://docs.sublime.security/reference/addlistentry-1](https://docs.sublime.security/reference/addlistentry-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="string" type="string" required>
  String list entry
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Analyze EML

Action ID: `tools.sublime.analyze_eml`

Analyze an EML message against active detection rules and ML attack score in Sublime.

Reference: [https://docs.sublime.security/reference/analyzemessage](https://docs.sublime.security/reference/analyzemessage)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="eml_base64" type="string" required>
  Base64-encoded EML file.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Analyze EML with the free analyzer

Action ID: `tools.sublime.eml_analyze`

Analyze a raw message with the free, unauthenticated Sublime EML Analyzer API.

Reference: [https://docs.sublime.security/reference/analysis-api-introduction](https://docs.sublime.security/reference/analysis-api-introduction)

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: raw\_message (required), queries, rules, run\_active\_detection\_rules, run\_all\_detection\_rules, run\_all\_insights.
</ParamField>

<ParamField path="base_url" type="string">
  Base URL of the Sublime EML Analyzer API.

  Default: `"https://analyzer.sublime.security"`.
</ParamField>

## Analyze message by ID

Action ID: `tools.sublime.analyze_message_by_id`

Analyze an existing Sublime message with API-native rules or queries.

Reference: [https://docs.sublime.security/reference/analyzemessagebyid](https://docs.sublime.security/reference/analyzemessagebyid)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: queries, rules, run\_active\_detection\_rules, run\_all\_detection\_rules, run\_all\_insights.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Analyze URL

Action ID: `tools.sublime.analyze_url`

Analyze a URL with ML link analysis in Sublime.

Reference: [https://docs.sublime.security/docs/enrichment-functions#mllink\_analysis](https://docs.sublime.security/docs/enrichment-functions#mllink_analysis)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="url" type="string" required>
  URL to analyze.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Attack score for message

Action ID: `tools.sublime.attack_score_for_message`

Evaluate the attack score of an existing Sublime message.

Reference: [https://docs.sublime.security/reference/attackscoreformessage](https://docs.sublime.security/reference/attackscoreformessage)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Attack score for raw message

Action ID: `tools.sublime.score_eml`

Evaluate the Sublime attack score for a base64-encoded raw EML message.

Reference: [https://docs.sublime.security/reference/attackscoreforrawmessage](https://docs.sublime.security/reference/attackscoreforrawmessage)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="eml_base64" type="string" required>
  Base64-encoded EML file.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## BinExplode file

Action ID: `tools.sublime.binexplode`

Submit a base64-encoded file to Sublime BinExplode and return the task response.

Reference: [https://docs.sublime.security/reference/postscan-1](https://docs.sublime.security/reference/postscan-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="file_contents" type="string" required>
  Base64-encoded raw file contents.
</ParamField>

<ParamField path="file_name" type="string" required>
  Name of the submitted file.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Create email bomb

Action ID: `tools.sublime.create_email_bomb`

Declare a mailbox time range as a Sublime email bomb.

Reference: [https://docs.sublime.security/reference/createemailbomb](https://docs.sublime.security/reference/createemailbomb)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="end_time" type="string" required>
  End of the email bomb time range (must not be in the future)
</ParamField>

<ParamField path="mailbox_id" type="string" required>
  ID of the mailbox to declare the email bomb for
</ParamField>

<ParamField path="start_time" type="string" required>
  Start of the email bomb time range
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Create list

Action ID: `tools.sublime.create_list`

Create a Sublime list.

Reference: [https://docs.sublime.security/reference/createlist-1](https://docs.sublime.security/reference/createlist-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="description" type="string" required>
  Description of list
</ParamField>

<ParamField path="name" type="string" required>
  Unique name used to reference the list in MQL
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Create message

Action ID: `tools.sublime.create_message`

Create a Sublime message data model from a raw message.

Reference: [https://docs.sublime.security/reference/createmessage](https://docs.sublime.security/reference/createmessage)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: raw\_message (required), canonical\_id, external\_created\_at, external\_message\_id, external\_thread\_id, folder, labels, mailbox\_email\_address, message\_type, route\_type.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Create rule

Action ID: `tools.sublime.create_rule`

Create a Sublime detection, DLP, or triage rule.

Reference: [https://docs.sublime.security/reference/createrule-1](https://docs.sublime.security/reference/createrule-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: name (required), source (required), action\_ids, active, attack\_types, authors, auto\_review\_auto\_share, auto\_review\_classification, description, detection\_methods, false\_positives, internal\_type, label, maturity, references, run\_triage\_on\_excluded\_messages, severity, tactics\_and\_techniques, tags, triage\_abuse\_reports, triage\_classification\_changes, triage\_dlp\_rule\_matched, triage\_flagged\_messages, type, user\_provided\_tags.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Deactivate rule

Action ID: `tools.sublime.deactivate_rule`

Deactivate a Sublime rule.

Reference: [https://docs.sublime.security/reference/deactivaterule-1](https://docs.sublime.security/reference/deactivaterule-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime rule ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Delete list

Action ID: `tools.sublime.delete_list`

Delete a Sublime list.

Reference: [https://docs.sublime.security/reference/deletelist-1](https://docs.sublime.security/reference/deletelist-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Delete list entry

Action ID: `tools.sublime.delete_list_entry`

Delete an entry from a Sublime list.

Reference: [https://docs.sublime.security/reference/deletelistentry-1](https://docs.sublime.security/reference/deletelistentry-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="string" type="string" required>
  String list entry
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Delete rule

Action ID: `tools.sublime.delete_rule`

Delete a Sublime rule.

Reference: [https://docs.sublime.security/reference/deleterule-1](https://docs.sublime.security/reference/deleterule-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime rule ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Dismiss email bomb

Action ID: `tools.sublime.dismiss_email_bomb`

Dismiss a Sublime email-bomb incident.

Reference: [https://docs.sublime.security/reference/dismissemailbomb](https://docs.sublime.security/reference/dismissemailbomb)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Email bomb ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: review\_comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Dismiss message group

Action ID: `tools.sublime.dismiss_message_canonical_group`

Dismiss a Sublime message group and its future messages.

Reference: [https://docs.sublime.security/reference/dismissmessagecanonicalgroup-1](https://docs.sublime.security/reference/dismissmessagecanonicalgroup-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Message group canonical ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: classification, report\_label, review\_comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Dismiss multiple message groups

Action ID: `tools.sublime.dismiss_multiple_message_groups`

Dismiss multiple Sublime message groups.

Reference: [https://docs.sublime.security/reference/dismissmultiplemessagegroups-1](https://docs.sublime.security/reference/dismissmultiplemessagegroups-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: message\_group\_ids (required), classification, report\_label, review\_comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get BinExplode scan

Action ID: `tools.sublime.get_binexplode_scan`

Retrieve the current status and results of a Sublime BinExplode task.

Reference: [https://docs.sublime.security/reference/getscan-1](https://docs.sublime.security/reference/getscan-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  BinExplode task ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get email bomb

Action ID: `tools.sublime.get_email_bomb`

Retrieve a Sublime email-bomb incident.

Reference: [https://docs.sublime.security/reference/getemailbomb](https://docs.sublime.security/reference/getemailbomb)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Email bomb ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get hunt job

Action ID: `tools.sublime.get_hunt_job`

Retrieve the current state and summary of a Sublime hunt job.

Reference: [https://docs.sublime.security/reference/gethuntjob](https://docs.sublime.security/reference/gethuntjob)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Hunt job ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get hunt job results

Action ID: `tools.sublime.get_hunt_job_results`

Retrieve detailed results for a Sublime hunt job.

Reference: [https://docs.sublime.security/reference/gethuntjobresults](https://docs.sublime.security/reference/gethuntjobresults)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Hunt job ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  The maximum number of results to return.

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  The (zero-based) offset of the first hunt job results to return.

  Default: `null`.
</ParamField>

## Get list

Action ID: `tools.sublime.get_list`

Retrieve a Sublime list.

Reference: [https://docs.sublime.security/reference/getlist-1](https://docs.sublime.security/reference/getlist-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get list entries

Action ID: `tools.sublime.get_list_entries`

Retrieve all entries in a Sublime list.

Reference: [https://docs.sublime.security/reference/getlistentries-1](https://docs.sublime.security/reference/getlistentries-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get list entry

Action ID: `tools.sublime.get_list_entry`

Check for and retrieve an entry in a Sublime list.

Reference: [https://docs.sublime.security/reference/getlistentry-1](https://docs.sublime.security/reference/getlistentry-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="string" type="string" required>
  String list entry
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get lists

Action ID: `tools.sublime.get_lists`

Retrieve Sublime lists using API-native filters.

Reference: [https://docs.sublime.security/reference/getlists-1](https://docs.sublime.security/reference/getlists-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="entry_type" type="string" required>
  List type to filter by. One of 'string', 'user\_group', 'provider\_org\_unit'.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="id" type="string | null">
  Optional ID (exact match) to filter by

  Default: `null`.
</ParamField>

<ParamField path="name" type="string | null">
  Optional name (exact match) to filter by

  Default: `null`.
</ParamField>

## Get message

Action ID: `tools.sublime.get_message`

Retrieve a Sublime message.

Reference: [https://docs.sublime.security/reference/getmessage-1](https://docs.sublime.security/reference/getmessage-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="recompute_mdm_from_raw" type="boolean | null">
  When true, recompute the MDM from the raw EML. For internal use only!

  Default: `null`.
</ParamField>

<ParamField path="remove_large_text_fields" type="boolean | null">
  When true, any text field over 1MB will be cleared before returning

  Default: `null`.
</ParamField>

## Get message attachment image

Action ID: `tools.sublime.get_message_attachment_image`

Retrieve rendered images for a PDF attachment by MD5 hash.

Reference: [https://docs.sublime.security/reference/getmessageattachmentimage-1](https://docs.sublime.security/reference/getmessageattachmentimage-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="hash" type="string" required>
  MD5 hash of the attachment.
</ParamField>

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get message data model

Action ID: `tools.sublime.get_message_data_model`

Retrieve the Message Data Model for a Sublime message.

Reference: [https://docs.sublime.security/reference/getmessagedatamodel-1](https://docs.sublime.security/reference/getmessagedatamodel-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="recompute_mdm_from_raw" type="boolean | null">
  When true, recompute the MDM from the raw EML. For internal use only!

  Default: `null`.
</ParamField>

<ParamField path="remove_large_text_fields" type="boolean | null">
  When true, any text field over 1MB will be cleared before returning

  Default: `null`.
</ParamField>

## Get message EML

Action ID: `tools.sublime.get_message_eml`

Retrieve the raw EML for a Sublime message.

Reference: [https://docs.sublime.security/reference/getmessageeml](https://docs.sublime.security/reference/getmessageeml)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get message group

Action ID: `tools.sublime.get_message_group`

Retrieve a Sublime message group.

Reference: [https://docs.sublime.security/reference/getmessagegroup](https://docs.sublime.security/reference/getmessagegroup)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Message group canonical ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="sort_previews_message_id__is" type="array[string] | null">
  Sort previews with these message IDs at the top

  Default: `null`.
</ParamField>

## Get message group action state

Action ID: `tools.sublime.get_message_canonical_group_action_state`

Retrieve manual action state for a canonical message group.

Reference: [https://docs.sublime.security/reference/getmessagecanonicalgroupactionstate](https://docs.sublime.security/reference/getmessagecanonicalgroupactionstate)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Message group canonical ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="created_at__gte" type="string | null">
  Only return action states created after this time

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  The maximum number of action states to return. If the value exceeds the maximum, then the maximum value will be used.

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  The (zero-based) offset of the action states to return

  Default: `null`.
</ParamField>

## Get message group SIEM summary

Action ID: `tools.sublime.get_message_group_siem_summary`

Retrieve the reduced-field SIEM summary of flagged message groups.

Reference: [https://docs.sublime.security/reference/getmessagegroupsiemsummary](https://docs.sublime.security/reference/getmessagegroupsiemsummary)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="cursor" type="string | null">
  Opaque pagination cursor returned in the previous response's cursor field.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  The maximum number of message groups to return.

  Default: `null`.
</ParamField>

<ParamField path="timestamp__gte" type="string | null">
  Inclusive lower bound on the sort timestamp (newest\_created\_at for type=flagged, first\_reported\_as\_phish\_at for type=reported).

  Default: `null`.
</ParamField>

<ParamField path="timestamp__lt" type="string | null">
  Exclusive upper bound on the sort timestamp (newest\_created\_at for type=flagged, first\_reported\_as\_phish\_at for type=reported).

  Default: `null`.
</ParamField>

<ParamField path="type" type="string | null">
  Which timestamp the endpoint sorts/filters on: 'flagged' uses newest\_created\_at, 'reported' uses first\_reported\_as\_phish\_at. Possible values: flagged, reported.

  Default: `null`.
</ParamField>

## Get message image

Action ID: `tools.sublime.get_message_image`

Retrieve rendered images for a Sublime message.

Reference: [https://docs.sublime.security/reference/getmessageimage-1](https://docs.sublime.security/reference/getmessageimage-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="recompute_mdm_from_raw" type="boolean | null">
  When true, recompute the MDM from the raw EML. For internal use only!

  Default: `null`.
</ParamField>

<ParamField path="remove_large_text_fields" type="boolean | null">
  When true, any text field over 1MB will be cleared before returning

  Default: `null`.
</ParamField>

## Get message image link

Action ID: `tools.sublime.get_message_image_link`

Retrieve a temporary link to a rendered Sublime message image.

Reference: [https://docs.sublime.security/reference/getmessageimagelink-1](https://docs.sublime.security/reference/getmessageimagelink-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="link_duration_seconds" type="integer | null">
  Period link should be valid for. Default is 15 minutes, max 7 days.

  Default: `null`.
</ParamField>

<ParamField path="platform_link" type="boolean | null">
  When true, link will always be presigned against Sublime. When false, the link may be to S3 directly.

  Default: `null`.
</ParamField>

<ParamField path="recompute_mdm_from_raw" type="boolean | null">
  When true, recompute the MDM from the raw EML. For internal use only!

  Default: `null`.
</ParamField>

<ParamField path="remove_large_text_fields" type="boolean | null">
  When true, any text field over 1MB will be cleared before returning

  Default: `null`.
</ParamField>

## Get rule

Action ID: `tools.sublime.get_rule`

Retrieve a Sublime rule.

Reference: [https://docs.sublime.security/reference/getrule-1](https://docs.sublime.security/reference/getrule-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime rule ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get rule history

Action ID: `tools.sublime.get_rule_history`

Retrieve history for a Sublime rule.

Reference: [https://docs.sublime.security/reference/getrulehistory](https://docs.sublime.security/reference/getrulehistory)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime rule ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="classification_created_at_gte" type="string | null">
  Filter by classifications made after this datetime. Results are limited to the most recent 180 days.

  Default: `null`.
</ParamField>

<ParamField path="classification_created_at_lte" type="string | null">
  Filter by classifications made before this datetime. Results are limited to the most recent 180 days.

  Default: `null`.
</ParamField>

<ParamField path="use_rule_last_updated_as_created_at" type="boolean | null">
  Filter by classifications made since the rule has been updated. Results are limited to the most recent 180 days.

  Default: `null`.
</ParamField>

## Get task

Action ID: `tools.sublime.get_task`

Retrieve the current status of a Sublime task.

Reference: [https://docs.sublime.security/reference/gettask-1](https://docs.sublime.security/reference/gettask-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime task ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Graymail multiple message groups

Action ID: `tools.sublime.graymail_multiple_message_groups`

Move multiple Sublime message groups to Graymail.

Reference: [https://docs.sublime.security/reference/graymailmultiplemessagegroups](https://docs.sublime.security/reference/graymailmultiplemessagegroups)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: message\_group\_ids (required), classification, report\_label, review\_comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## List email bombs

Action ID: `tools.sublime.list_email_bombs`

List Sublime email-bomb incidents using API-native filters.

Reference: [https://docs.sublime.security/reference/listemailbombs](https://docs.sublime.security/reference/listemailbombs)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="active" type="boolean | null">
  Filter by active status. true = only active, false = only inactive, null = all

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="dismissed" type="boolean | null">
  Filter by dismissed status. true = only dismissed, false = only not dismissed, null = all

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  The maximum number of email bombs to return

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  The (zero-based) offset of the email bombs to return

  Default: `null`.
</ParamField>

## List mailboxes

Action ID: `tools.sublime.list_mailboxes`

List Sublime mailboxes using API-native filters.

Reference: [https://docs.sublime.security/reference/listmailboxes](https://docs.sublime.security/reference/listmailboxes)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="active" type="boolean | null">
  Filter for effectively active mailboxes (marked active with a live subscription)

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="email_addresses" type="string | null">
  Email addresses of the mailboxes to return (comma-delimited)

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  The maximum number of entries to return. If the value exceeds the maximum, then the maximum value will be used

  Default: `null`.
</ParamField>

<ParamField path="mailbox_types" type="string | null">
  Comma-delimited list of mailbox types to filter by

  Default: `null`.
</ParamField>

<ParamField path="marked_active" type="boolean | null">
  Filter for mailboxes marked active

  Default: `null`.
</ParamField>

<ParamField path="message_source_id" type="string | null">
  ID of the message source the mailboxes belong to

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  The (zero-based) offset of the first mailbox to return

  Default: `null`.
</ParamField>

<ParamField path="search" type="string | null">
  Search across mailbox names and email addresses

  Default: `null`.
</ParamField>

<ParamField path="sub_error_types" type="string | null">
  Comma-delimited list of subscription error types to filter by

  Default: `null`.
</ParamField>

## List message groups

Action ID: `tools.sublime.list_message_groups`

List Sublime message groups using API-native filters.

Reference: [https://docs.sublime.security/reference/listmessagegroups-1](https://docs.sublime.security/reference/listmessagegroups-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="attachment_name__is" type="array[string] | null">
  Filters result to only message groups with the provided attachment name

  Default: `null`.
</ParamField>

<ParamField path="attachment_sha256__is" type="array[string] | null">
  Filters result to only message groups with the provided attachment SHA256

  Default: `null`.
</ParamField>

<ParamField path="attack_score_verdict__is" type="array[string] | null">
  Filters result to only message groups with the provided attack score verdict. Possible values: unknown, likely\_benign, suspicious, malicious, graymail, spam.

  Default: `null`.
</ParamField>

<ParamField path="attack_surface_reduction__filter" type="boolean | null">
  Filters result to only message groups that have flagged (ONLY) rules with the 'Attack surface reduction' tag

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="canonical_id__is" type="array[string] | null">
  Filters result to only message groups with the provided canonical ID

  Default: `null`.
</ParamField>

<ParamField path="created_at__gte" type="string | null">
  Inclusive start datetime filter, in UTC using the ISO 8601 format (e.g., '2021-03-14T15:09:26Z'). Only message groups that contain a message processed at or after this time will be returned.

  Default: `null`.
</ParamField>

<ParamField path="created_at__lt" type="string | null">
  Exclusive end datetime filter, in UTC using the ISO 8601 format (e.g., '2021-05-04T15:09:26Z'). Only message groups that contain a message processed before this time will be returned. Paired with created\_at\_\_gte this selects groups that were active at any point in the window, including groups that are still receiving messages after it. Note that this bounds a group's oldest message while created\_at\_\_gte bounds its newest, so the two cannot be served by a single index and the request may time out on high volume organizations or wide date ranges. If you only need groups whose newest message falls inside the window, prefer last\_created\_at\_\_lt, which bounds the same field as created\_at\_\_gte.

  Default: `null`.
</ParamField>

<ParamField path="first_message_reported_at__gte" type="string | null">
  Filters result to only message groups with a message first reported at or after the provided time. Datetime must be in UTC using the ISO 8601 format (e.g., '2021-03-14T15:09:26Z').

  Default: `null`.
</ParamField>

<ParamField path="flagged" type="boolean | null">
  Filters result to only message groups with at least one flagged message

  Default: `null`.
</ParamField>

<ParamField path="flagged_rule_id__is" type="array[string] | null">
  Filters result to only message groups with the provided flagged rule ID

  Default: `null`.
</ParamField>

<ParamField path="flagged_rule_severity__is" type="array[string] | null">
  Filters result to only message groups with the provided flagged rule severity. Possible values: informational, low, medium, high, critical.

  Default: `null`.
</ParamField>

<ParamField path="historically_flagged_rule_id__is" type="array[string] | null">
  Filters result to only message groups with the provided historically flagged rule ID

  Default: `null`.
</ParamField>

<ParamField path="historically_flagged_rule_severity__is" type="array[string] | null">
  Filters result to only message groups with the provided historically flagged rule severity. Possible values: informational, low, medium, high, critical.

  Default: `null`.
</ParamField>

<ParamField path="last_created_at__gte" type="string | null">
  Inclusive start datetime filter, in UTC using the ISO 8601 format (e.g., '2021-03-14T15:09:26Z'). Only message groups whose newest message was processed at or after this time will be returned. Equivalent to created\_at\_\_gte.

  Default: `null`.
</ParamField>

<ParamField path="last_created_at__lt" type="string | null">
  Exclusive end datetime filter, in UTC using the ISO 8601 format (e.g., '2021-05-04T15:09:26Z'). Only message groups whose newest message was processed before this time will be returned. Unlike created\_at\_\_lt, groups that are still receiving messages after this time are excluded. Prefer this over created\_at\_\_lt for historical lookbacks, since it bounds the same field as created\_at\_\_gte and both can then be served by a single index. High volume organizations may still need to request narrow time windows to avoid a timeout.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  The maximum number of message groups to return. If the value exceeds the maximum, then the maximum value will be used.

  Default: `null`.
</ParamField>

<ParamField path="mailbox_email__is" type="array[string] | null">
  Filters result to only message groups with the provided mailbox email

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  The (zero-based) offset of the message groups to return

  Default: `null`.
</ParamField>

<ParamField path="recipient_email__is" type="array[string] | null">
  Filters result to only message groups with the provided recipient email

  Default: `null`.
</ParamField>

<ParamField path="reported_as_phish_by__is" type="array[string] | null">
  Filters result to only message groups with the provided reporter

  Default: `null`.
</ParamField>

<ParamField path="reviewed" type="boolean | null">
  Filters result to only message groups which have or have not been reviewed

  Default: `null`.
</ParamField>

<ParamField path="sender_display_name__is" type="array[string] | null">
  Filters result to only message groups with the provided sender display name

  Default: `null`.
</ParamField>

<ParamField path="sender_domain__is" type="array[string] | null">
  Filters result to only message groups with the provided sender domain

  Default: `null`.
</ParamField>

<ParamField path="sender_email__is" type="array[string] | null">
  Filters result to only message groups with the provided sender email

  Default: `null`.
</ParamField>

<ParamField path="spam__is" type="array[string] | null">
  Filters result to only message groups with the provided spam status. Possible values: spam, not\_spam, mixed.

  Default: `null`.
</ParamField>

<ParamField path="subject__is" type="array[string] | null">
  Filters result to only message groups with the provided subject

  Default: `null`.
</ParamField>

<ParamField path="user_reported" type="boolean | null">
  Filters result to only message groups with at least one reported message

  Default: `null`.
</ParamField>

<ParamField path="vendor_id__is" type="array[string] | null">
  Filters result to only message groups with the provided vendor

  Default: `null`.
</ParamField>

## List rule history

Action ID: `tools.sublime.list_rule_history`

List history across Sublime rules using API-native filters.

Reference: [https://docs.sublime.security/reference/listrulehistory](https://docs.sublime.security/reference/listrulehistory)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="classification_created_at_gte" type="string" required>
  Filter by classifications made after this datetime. Results are limited to the most recent 180 days.
</ParamField>

<ParamField path="classification_created_at_lte" type="string" required>
  Filter by classifications made before this datetime. Results are limited to the most recent 180 days.
</ParamField>

<ParamField path="active" type="boolean | null">
  Restrict to rules that are active

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="count" type="integer | null">
  Number of results to return

  Default: `null`.
</ParamField>

<ParamField path="in_feed" type="boolean | null">
  Restrict to rules that are in a feed

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  Offset from the first result

  Default: `null`.
</ParamField>

<ParamField path="type" type="array[string] | null">
  Restrict to rules that have one of the given types. One of 'detection', 'triage', 'dlp'.

  Default: `null`.
</ParamField>

## List rules

Action ID: `tools.sublime.list_rules`

List Sublime rules using API-native filters.

Reference: [https://docs.sublime.security/reference/listrules-1](https://docs.sublime.security/reference/listrules-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="in_feed" type="boolean | null">
  Restrict to rules that are explicitly in or not in a feed

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  The maximum number of entries to return. Maximum value is 500.

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  The (zero-based) offset of the first rule to return

  Default: `null`.
</ParamField>

<ParamField path="search" type="string | null">
  Search for matching case-insensitive substring across rule name, description, and MQL source

  Default: `null`.
</ParamField>

## List user reports

Action ID: `tools.sublime.list_user_reports`

List Sublime user-reported messages using API-native filters.

Reference: [https://docs.sublime.security/reference/listuserreports](https://docs.sublime.security/reference/listuserreports)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  The maximum number of message groups to return. If the value exceeds the maximum, then the maximum value will be used.

  Default: `null`.
</ParamField>

<ParamField path="reported_at_gte" type="string | null">
  Inclusive start datetime filter for time of report, in UTC using the ISO 8601 format (e.g., '2021-03-14T15:09:26Z'). Only reports at or after this time will be returned.

  Default: `null`.
</ParamField>

<ParamField path="reported_at_lt" type="string | null">
  Exclusive end datetime filter for time of report, in UTC using the ISO 8601 format (e.g., '2021-03-14T15:09:26Z'). Only reports before this time will be returned.

  Default: `null`.
</ParamField>

## Patch list

Action ID: `tools.sublime.patch_list`

Update a Sublime list with an API-native patch body.

Reference: [https://docs.sublime.security/reference/patchlist-1](https://docs.sublime.security/reference/patchlist-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="description" type="string" required>
  Description of list
</ParamField>

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Perform message actions

Action ID: `tools.sublime.action_message`

Perform API-native actions on an individual Sublime message.

Reference: [https://docs.sublime.security/reference/actionmessage](https://docs.sublime.security/reference/actionmessage)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: action, custom\_action\_ids, share\_with\_sublime.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Quarantine message group

Action ID: `tools.sublime.quarantine_message_canonical_group`

Quarantine a Sublime message group and its future messages.

Reference: [https://docs.sublime.security/reference/quarantinemessagecanonicalgroup-1](https://docs.sublime.security/reference/quarantinemessagecanonicalgroup-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Message group canonical ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: classification, report\_label, review\_comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Quarantine multiple message groups

Action ID: `tools.sublime.quarantine_multiple_message_groups`

Quarantine multiple Sublime message groups.

Reference: [https://docs.sublime.security/reference/quarantinemultiplemessagegroups-1](https://docs.sublime.security/reference/quarantinemultiplemessagegroups-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: message\_group\_ids (required), classification, report\_label, review\_comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Render attachment image

Action ID: `tools.sublime.get_message_attachment_image_raw`

Render images from a base64-encoded raw attachment.

Reference: [https://docs.sublime.security/reference/getmessageattachmentimageraw-1](https://docs.sublime.security/reference/getmessageattachmentimageraw-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: raw (required), file\_type.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Restore message

Action ID: `tools.sublime.restore_message`

Restore a previously remediated Sublime message.

Reference: [https://docs.sublime.security/reference/restoremessage-1](https://docs.sublime.security/reference/restoremessage-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Restore message group

Action ID: `tools.sublime.restore_message_canonical_group`

Restore a Sublime message group and disable future remediation.

Reference: [https://docs.sublime.security/reference/restoremessagecanonicalgroup-1](https://docs.sublime.security/reference/restoremessagecanonicalgroup-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Message group canonical ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: classification, report\_label, review\_comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Restore multiple message groups

Action ID: `tools.sublime.restore_multiple_message_groups`

Restore multiple Sublime message groups.

Reference: [https://docs.sublime.security/reference/restoremultiplemessagegroups-1](https://docs.sublime.security/reference/restoremultiplemessagegroups-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: message\_group\_ids (required), classification, report\_label, review\_comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Retrieve ASA report

Action ID: `tools.sublime.retrieve_asa_report`

Retrieve the Autonomous Security Analyst report for a message.

Reference: [https://docs.sublime.security/reference/retrieveasareport](https://docs.sublime.security/reference/retrieveasareport)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Retrieve ASA verdict

Action ID: `tools.sublime.retrieve_asa_verdict`

Retrieve the Autonomous Security Analyst verdict for a message.

Reference: [https://docs.sublime.security/reference/retrieveasaverdict](https://docs.sublime.security/reference/retrieveasaverdict)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Review message groups

Action ID: `tools.sublime.review_message_groups`

Review, classify, and take actions on Sublime message groups.

Reference: [https://docs.sublime.security/reference/reviewmessagegroups](https://docs.sublime.security/reference/reviewmessagegroups)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: classification (required), message\_group\_ids (required), action, custom\_action\_ids, generate\_asa\_lesson, review\_comment, share\_with\_sublime.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Scan file with BinExplode

Action ID: `tools.sublime.scan_file`

Scan a file with BinExplode and return the completed scan results.

Reference: [https://docs.sublime.security/reference/postscan-1](https://docs.sublime.security/reference/postscan-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="file_base64" type="string" required>
  Base64-encoded file.
</ParamField>

<ParamField path="file_name" type="string" required>
  Name of the file.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Search message groups

Action ID: `tools.sublime.search_message_groups`

Search Sublime message groups using API-native query parameters.

Reference: [https://docs.sublime.security/reference/searchmessagegroups-1](https://docs.sublime.security/reference/searchmessagegroups-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="any" type="string | null">
  Searches every field (performs a case insensitive, OR search in all fields). Not compatible with other search fields.

  Default: `null`.
</ParamField>

<ParamField path="attachment_md5" type="string | null">
  Search for messages containing an attachment MD5 match

  Default: `null`.
</ParamField>

<ParamField path="attachment_sha1" type="string | null">
  Search for messages containing an attachment SHA1 match

  Default: `null`.
</ParamField>

<ParamField path="attachment_sha256" type="string | null">
  Search for messages containing an attachment SHA256 match

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="created_at_gte" type="string | null">
  Inclusive start datetime filter for search, in UTC using the ISO 8601 format (e.g., '2021-03-14T15:09:26Z'). Only message groups with a message processed at or after this time will be returned.

  Default: `null`.
</ParamField>

<ParamField path="created_at_lt" type="string | null">
  Exclusive end datetime filter for search, in UTC using the ISO 8601 format (e.g., '2021-05-04T15:09:26Z'). Only message groups with a message processed before this time will be returned.

  Default: `null`.
</ParamField>

<ParamField path="file_name" type="string | null">
  Search in attachment filenames (case insensitive wildcard match)

  Default: `null`.
</ParamField>

<ParamField path="first_reported_as_phish_at_gte" type="string | null">
  Inclusive start datetime filter for search, in UTC using the ISO 8601 format (e.g., '2021-03-14T15:09:26Z'). Only message groups reported at or after this time will be returned.

  Default: `null`.
</ParamField>

<ParamField path="first_reported_as_phish_at_lt" type="string | null">
  Exclusive end datetime filter for search, in UTC using the ISO 8601 format (e.g., '2021-05-04T15:09:26Z'). Only message groups reported before this time will be returned.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  The maximum number of message groups to return. If the value exceeds the maximum, then the maximum value will be used.

  Default: `null`.
</ParamField>

<ParamField path="mailbox" type="string | null">
  Search for a mailbox by email address (case insensitive, wildcard match)

  Default: `null`.
</ParamField>

<ParamField path="message_id" type="string | null">
  Search in the Message-ID header (case insensitive exact match; wildcards are not supported)

  Default: `null`.
</ParamField>

<ParamField path="offset" type="integer | null">
  The (zero-based) offset of the message groups to return

  Default: `null`.
</ParamField>

<ParamField path="sender" type="string | null">
  Search in the From field (case insensitive wildcard match)

  Default: `null`.
</ParamField>

<ParamField path="states" type="array[string] | null">
  Search for messages in any of the given states

  Default: `null`.
</ParamField>

<ParamField path="subject" type="string | null">
  Search in the message subject (case insensitive wildcard match)

  Default: `null`.
</ParamField>

<ParamField path="to" type="string | null">
  Search in the To, CC, and Bcc fields (case insensitive wildcard match). If possible, use 'mailbox' and 'type' instead for better performance

  Default: `null`.
</ParamField>

<ParamField path="type" type="array[string] | null">
  Search for messages by type. Multiple values are OR'd together.

  Default: `null`.
</ParamField>

## Set list entries

Action ID: `tools.sublime.set_list_entries`

Replace all entries in a Sublime list.

Reference: [https://docs.sublime.security/reference/setlistentries-1](https://docs.sublime.security/reference/setlistentries-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="entries" type="array[string]" required>
  List entries
</ParamField>

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Set message access justification

Action ID: `tools.sublime.set_message_access_justification`

Set the message-content access justification for the API user.

Reference: [https://docs.sublime.security/reference/setmessageaccessjustification-1](https://docs.sublime.security/reference/setmessageaccessjustification-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: justification.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Share message group with Sublime

Action ID: `tools.sublime.share_with_sublime_public`

Share a message group with the Sublime team.

Reference: [https://docs.sublime.security/reference/sharewithsublimepublic-1](https://docs.sublime.security/reference/sharewithsublimepublic-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Message group canonical ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: destination, report\_label, review\_comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Start hunt job

Action ID: `tools.sublime.start_hunt_job`

Start an asynchronous Sublime hunt job.

Reference: [https://docs.sublime.security/reference/starthuntjob](https://docs.sublime.security/reference/starthuntjob)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: range\_end\_time (required), range\_start\_time (required), source (required), name, private, triage\_email\_bomb, triage\_flagged, triage\_reported.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Trash message

Action ID: `tools.sublime.trash_message`

Trash an individual Sublime message.

Reference: [https://docs.sublime.security/reference/trashmessage-1](https://docs.sublime.security/reference/trashmessage-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Trash message group

Action ID: `tools.sublime.trash_message_canonical_group`

Trash a Sublime message group and its future messages.

Reference: [https://docs.sublime.security/reference/trashmessagecanonicalgroup-1](https://docs.sublime.security/reference/trashmessagecanonicalgroup-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Message group canonical ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: classification, report\_label, review\_comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Trash multiple message groups

Action ID: `tools.sublime.trash_multiple_message_groups`

Trash multiple Sublime message groups.

Reference: [https://docs.sublime.security/reference/trashmultiplemessagegroups-1](https://docs.sublime.security/reference/trashmultiplemessagegroups-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: message\_group\_ids (required), classification, report\_label, review\_comment.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Update rule

Action ID: `tools.sublime.update_rule`

Replace a Sublime rule definition.

Reference: [https://docs.sublime.security/reference/updaterule-1](https://docs.sublime.security/reference/updaterule-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime rule ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: name (required), source (required), action\_ids, attack\_types, authors, auto\_review\_auto\_share, auto\_review\_classification, description, detection\_methods, false\_positives, internal\_type, label, maturity, references, run\_triage\_on\_excluded\_messages, severity, tactics\_and\_techniques, tags, triage\_abuse\_reports, triage\_classification\_changes, triage\_dlp\_rule\_matched, triage\_flagged\_messages, user\_provided\_tags.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Validate rule

Action ID: `tools.sublime.validate_rule`

Validate an API-native Sublime rule definition.

Reference: [https://docs.sublime.security/reference/validaterule](https://docs.sublime.security/reference/validaterule)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native request body. Documented fields: name (required), source (required), action\_ids, active, attack\_types, authors, auto\_review\_auto\_share, auto\_review\_classification, description, detection\_methods, false\_positives, internal\_type, label, maturity, references, run\_triage\_on\_excluded\_messages, severity, tactics\_and\_techniques, tags, triage\_abuse\_reports, triage\_classification\_changes, triage\_dlp\_rule\_matched, triage\_flagged\_messages, type, user\_provided\_tags.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>