> ## Documentation Index
> Fetch the complete documentation index at: https://tracecat-codex-docs-secrets-oauth-discoverability.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Sublime

> Reference for the Tracecat Sublime integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Activate rule

Action ID: `tools.sublime.activate_rule`

Activate a Sublime rule.

Reference: [https://docs.sublime.security/reference/activaterule-1](https://docs.sublime.security/reference/activaterule-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime rule ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Add list entry

Action ID: `tools.sublime.add_list_entry`

Add an entry to a Sublime list.

Reference: [https://docs.sublime.security/reference/addlistentry-1](https://docs.sublime.security/reference/addlistentry-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Analyze EML

Action ID: `tools.sublime.analyze_eml`

Analyze an EML message against active detection rules and ML attack score in Sublime.

Reference: [https://docs.sublime.security/reference/analyzemessage](https://docs.sublime.security/reference/analyzemessage)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="eml_base64" type="string" required>
  Base64-encoded EML file.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Analyze EML with the free analyzer

Action ID: `tools.sublime.eml_analyze`

Analyze a raw message with the free, unauthenticated Sublime EML Analyzer API.

Reference: [https://docs.sublime.security/reference/analysis-api-introduction](https://docs.sublime.security/reference/analysis-api-introduction)

### Input fields

<ParamField path="payload" type="object" required>
  API-native analyze request containing raw\_message and optional rules or queries.
</ParamField>

<ParamField path="base_url" type="string">
  Base URL of the Sublime EML Analyzer API.

  Default: `"https://analyzer.sublime.security"`.
</ParamField>

## Analyze message by ID

Action ID: `tools.sublime.analyze_message_by_id`

Analyze an existing Sublime message with API-native rules or queries.

Reference: [https://docs.sublime.security/reference/analyzemessagebyid](https://docs.sublime.security/reference/analyzemessagebyid)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Analyze URL

Action ID: `tools.sublime.analyze_url`

Analyze a URL with ML link analysis in Sublime.

Reference: [https://docs.sublime.security/docs/enrichment-functions#mllink\_analysis](https://docs.sublime.security/docs/enrichment-functions#mllink_analysis)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="url" type="string" required>
  URL to analyze.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Attack score for message

Action ID: `tools.sublime.attack_score_for_message`

Evaluate the attack score of an existing Sublime message.

Reference: [https://docs.sublime.security/reference/attackscoreformessage](https://docs.sublime.security/reference/attackscoreformessage)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Attack score for raw message

Action ID: `tools.sublime.score_eml`

Evaluate the Sublime attack score for a base64-encoded raw EML message.

Reference: [https://docs.sublime.security/reference/attackscoreforrawmessage](https://docs.sublime.security/reference/attackscoreforrawmessage)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="eml_base64" type="string" required>
  Base64-encoded EML file.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## BinExplode file

Action ID: `tools.sublime.binexplode`

Submit a base64-encoded file to Sublime BinExplode and return the task response.

Reference: [https://docs.sublime.security/reference/postscan-1](https://docs.sublime.security/reference/postscan-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="file_contents" type="string" required>
  Base64-encoded raw file contents.
</ParamField>

<ParamField path="file_name" type="string" required>
  Name of the submitted file.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Create email bomb

Action ID: `tools.sublime.create_email_bomb`

Declare a mailbox time range as a Sublime email bomb.

Reference: [https://docs.sublime.security/reference/createemailbomb](https://docs.sublime.security/reference/createemailbomb)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Create list

Action ID: `tools.sublime.create_list`

Create a Sublime list.

Reference: [https://docs.sublime.security/reference/createlist-1](https://docs.sublime.security/reference/createlist-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Create message

Action ID: `tools.sublime.create_message`

Create a Sublime message data model from a raw message.

Reference: [https://docs.sublime.security/reference/createmessage](https://docs.sublime.security/reference/createmessage)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Create rule

Action ID: `tools.sublime.create_rule`

Create a Sublime detection, DLP, or triage rule.

Reference: [https://docs.sublime.security/reference/createrule-1](https://docs.sublime.security/reference/createrule-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Deactivate rule

Action ID: `tools.sublime.deactivate_rule`

Deactivate a Sublime rule.

Reference: [https://docs.sublime.security/reference/deactivaterule-1](https://docs.sublime.security/reference/deactivaterule-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime rule ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Delete list

Action ID: `tools.sublime.delete_list`

Delete a Sublime list.

Reference: [https://docs.sublime.security/reference/deletelist-1](https://docs.sublime.security/reference/deletelist-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Delete list entry

Action ID: `tools.sublime.delete_list_entry`

Delete an entry from a Sublime list.

Reference: [https://docs.sublime.security/reference/deletelistentry-1](https://docs.sublime.security/reference/deletelistentry-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## Delete rule

Action ID: `tools.sublime.delete_rule`

Delete a Sublime rule.

Reference: [https://docs.sublime.security/reference/deleterule-1](https://docs.sublime.security/reference/deleterule-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime rule ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Dismiss email bomb

Action ID: `tools.sublime.dismiss_email_bomb`

Dismiss a Sublime email-bomb incident.

Reference: [https://docs.sublime.security/reference/dismissemailbomb](https://docs.sublime.security/reference/dismissemailbomb)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Email bomb ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Dismiss message group

Action ID: `tools.sublime.dismiss_message_canonical_group`

Dismiss a Sublime message group and its future messages.

Reference: [https://docs.sublime.security/reference/dismissmessagecanonicalgroup-1](https://docs.sublime.security/reference/dismissmessagecanonicalgroup-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Message group canonical ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Dismiss multiple message groups

Action ID: `tools.sublime.dismiss_multiple_message_groups`

Dismiss multiple Sublime message groups.

Reference: [https://docs.sublime.security/reference/dismissmultiplemessagegroups-1](https://docs.sublime.security/reference/dismissmultiplemessagegroups-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get BinExplode scan

Action ID: `tools.sublime.get_binexplode_scan`

Retrieve the current status and results of a Sublime BinExplode task.

Reference: [https://docs.sublime.security/reference/getscan-1](https://docs.sublime.security/reference/getscan-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  BinExplode task ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get email bomb

Action ID: `tools.sublime.get_email_bomb`

Retrieve a Sublime email-bomb incident.

Reference: [https://docs.sublime.security/reference/getemailbomb](https://docs.sublime.security/reference/getemailbomb)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Email bomb ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get hunt job

Action ID: `tools.sublime.get_hunt_job`

Retrieve the current state and summary of a Sublime hunt job.

Reference: [https://docs.sublime.security/reference/gethuntjob](https://docs.sublime.security/reference/gethuntjob)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Hunt job ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get hunt job results

Action ID: `tools.sublime.get_hunt_job_results`

Retrieve detailed results for a Sublime hunt job.

Reference: [https://docs.sublime.security/reference/gethuntjobresults](https://docs.sublime.security/reference/gethuntjobresults)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Hunt job ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## Get list

Action ID: `tools.sublime.get_list`

Retrieve a Sublime list.

Reference: [https://docs.sublime.security/reference/getlist-1](https://docs.sublime.security/reference/getlist-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get list entries

Action ID: `tools.sublime.get_list_entries`

Retrieve all entries in a Sublime list.

Reference: [https://docs.sublime.security/reference/getlistentries-1](https://docs.sublime.security/reference/getlistentries-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get list entry

Action ID: `tools.sublime.get_list_entry`

Check for and retrieve an entry in a Sublime list.

Reference: [https://docs.sublime.security/reference/getlistentry-1](https://docs.sublime.security/reference/getlistentry-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## Get lists

Action ID: `tools.sublime.get_lists`

Retrieve Sublime lists using API-native filters.

Reference: [https://docs.sublime.security/reference/getlists-1](https://docs.sublime.security/reference/getlists-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## Get message

Action ID: `tools.sublime.get_message`

Retrieve a Sublime message.

Reference: [https://docs.sublime.security/reference/getmessage-1](https://docs.sublime.security/reference/getmessage-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## Get message attachment image

Action ID: `tools.sublime.get_message_attachment_image`

Retrieve rendered images for a PDF attachment by MD5 hash.

Reference: [https://docs.sublime.security/reference/getmessageattachmentimage-1](https://docs.sublime.security/reference/getmessageattachmentimage-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="hash" type="string" required>
  MD5 hash of the attachment.
</ParamField>

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get message data model

Action ID: `tools.sublime.get_message_data_model`

Retrieve the Message Data Model for a Sublime message.

Reference: [https://docs.sublime.security/reference/getmessagedatamodel-1](https://docs.sublime.security/reference/getmessagedatamodel-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## Get message EML

Action ID: `tools.sublime.get_message_eml`

Retrieve the raw EML for a Sublime message.

Reference: [https://docs.sublime.security/reference/getmessageeml](https://docs.sublime.security/reference/getmessageeml)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get message group

Action ID: `tools.sublime.get_message_group`

Retrieve a Sublime message group.

Reference: [https://docs.sublime.security/reference/getmessagegroup](https://docs.sublime.security/reference/getmessagegroup)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Message group canonical ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## Get message group action state

Action ID: `tools.sublime.get_message_canonical_group_action_state`

Retrieve manual action state for a canonical message group.

Reference: [https://docs.sublime.security/reference/getmessagecanonicalgroupactionstate](https://docs.sublime.security/reference/getmessagecanonicalgroupactionstate)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Message group canonical ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## Get message group SIEM summary

Action ID: `tools.sublime.get_message_group_siem_summary`

Retrieve the reduced-field SIEM summary of flagged message groups.

Reference: [https://docs.sublime.security/reference/getmessagegroupsiemsummary](https://docs.sublime.security/reference/getmessagegroupsiemsummary)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## Get message image

Action ID: `tools.sublime.get_message_image`

Retrieve rendered images for a Sublime message.

Reference: [https://docs.sublime.security/reference/getmessageimage-1](https://docs.sublime.security/reference/getmessageimage-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## Get message image link

Action ID: `tools.sublime.get_message_image_link`

Retrieve a temporary link to a rendered Sublime message image.

Reference: [https://docs.sublime.security/reference/getmessageimagelink-1](https://docs.sublime.security/reference/getmessageimagelink-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## Get rule

Action ID: `tools.sublime.get_rule`

Retrieve a Sublime rule.

Reference: [https://docs.sublime.security/reference/getrule-1](https://docs.sublime.security/reference/getrule-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime rule ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Get rule history

Action ID: `tools.sublime.get_rule_history`

Retrieve history for a Sublime rule.

Reference: [https://docs.sublime.security/reference/getrulehistory](https://docs.sublime.security/reference/getrulehistory)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime rule ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## Get task

Action ID: `tools.sublime.get_task`

Retrieve the current status of a Sublime task.

Reference: [https://docs.sublime.security/reference/gettask-1](https://docs.sublime.security/reference/gettask-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime task ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Graymail multiple message groups

Action ID: `tools.sublime.graymail_multiple_message_groups`

Move multiple Sublime message groups to Graymail.

Reference: [https://docs.sublime.security/reference/graymailmultiplemessagegroups](https://docs.sublime.security/reference/graymailmultiplemessagegroups)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## List email bombs

Action ID: `tools.sublime.list_email_bombs`

List Sublime email-bomb incidents using API-native filters.

Reference: [https://docs.sublime.security/reference/listemailbombs](https://docs.sublime.security/reference/listemailbombs)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## List mailboxes

Action ID: `tools.sublime.list_mailboxes`

List Sublime mailboxes using API-native filters.

Reference: [https://docs.sublime.security/reference/listmailboxes](https://docs.sublime.security/reference/listmailboxes)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## List message groups

Action ID: `tools.sublime.list_message_groups`

List Sublime message groups using API-native filters.

Reference: [https://docs.sublime.security/reference/listmessagegroups-1](https://docs.sublime.security/reference/listmessagegroups-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## List rule history

Action ID: `tools.sublime.list_rule_history`

List history across Sublime rules using API-native filters.

Reference: [https://docs.sublime.security/reference/listrulehistory](https://docs.sublime.security/reference/listrulehistory)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## List rules

Action ID: `tools.sublime.list_rules`

List Sublime rules using API-native filters.

Reference: [https://docs.sublime.security/reference/listrules-1](https://docs.sublime.security/reference/listrules-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## List user reports

Action ID: `tools.sublime.list_user_reports`

List Sublime user-reported messages using API-native filters.

Reference: [https://docs.sublime.security/reference/listuserreports](https://docs.sublime.security/reference/listuserreports)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## Patch list

Action ID: `tools.sublime.patch_list`

Update a Sublime list with an API-native patch body.

Reference: [https://docs.sublime.security/reference/patchlist-1](https://docs.sublime.security/reference/patchlist-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Perform message actions

Action ID: `tools.sublime.action_message`

Perform API-native actions on an individual Sublime message.

Reference: [https://docs.sublime.security/reference/actionmessage](https://docs.sublime.security/reference/actionmessage)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Quarantine message group

Action ID: `tools.sublime.quarantine_message_canonical_group`

Quarantine a Sublime message group and its future messages.

Reference: [https://docs.sublime.security/reference/quarantinemessagecanonicalgroup-1](https://docs.sublime.security/reference/quarantinemessagecanonicalgroup-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Message group canonical ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Quarantine multiple message groups

Action ID: `tools.sublime.quarantine_multiple_message_groups`

Quarantine multiple Sublime message groups.

Reference: [https://docs.sublime.security/reference/quarantinemultiplemessagegroups-1](https://docs.sublime.security/reference/quarantinemultiplemessagegroups-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Render attachment image

Action ID: `tools.sublime.get_message_attachment_image_raw`

Render images from a base64-encoded raw attachment.

Reference: [https://docs.sublime.security/reference/getmessageattachmentimageraw-1](https://docs.sublime.security/reference/getmessageattachmentimageraw-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Restore message

Action ID: `tools.sublime.restore_message`

Restore a previously remediated Sublime message.

Reference: [https://docs.sublime.security/reference/restoremessage-1](https://docs.sublime.security/reference/restoremessage-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Restore message group

Action ID: `tools.sublime.restore_message_canonical_group`

Restore a Sublime message group and disable future remediation.

Reference: [https://docs.sublime.security/reference/restoremessagecanonicalgroup-1](https://docs.sublime.security/reference/restoremessagecanonicalgroup-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Message group canonical ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Restore multiple message groups

Action ID: `tools.sublime.restore_multiple_message_groups`

Restore multiple Sublime message groups.

Reference: [https://docs.sublime.security/reference/restoremultiplemessagegroups-1](https://docs.sublime.security/reference/restoremultiplemessagegroups-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Retrieve ASA report

Action ID: `tools.sublime.retrieve_asa_report`

Retrieve the Autonomous Security Analyst report for a message.

Reference: [https://docs.sublime.security/reference/retrieveasareport](https://docs.sublime.security/reference/retrieveasareport)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Retrieve ASA verdict

Action ID: `tools.sublime.retrieve_asa_verdict`

Retrieve the Autonomous Security Analyst verdict for a message.

Reference: [https://docs.sublime.security/reference/retrieveasaverdict](https://docs.sublime.security/reference/retrieveasaverdict)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Review message groups

Action ID: `tools.sublime.review_message_groups`

Review, classify, and take actions on Sublime message groups.

Reference: [https://docs.sublime.security/reference/reviewmessagegroups](https://docs.sublime.security/reference/reviewmessagegroups)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Scan file with BinExplode

Action ID: `tools.sublime.scan_file`

Scan a file with BinExplode and return the completed scan results.

Reference: [https://docs.sublime.security/reference/postscan-1](https://docs.sublime.security/reference/postscan-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="file_base64" type="string" required>
  Base64-encoded file.
</ParamField>

<ParamField path="file_name" type="string" required>
  Name of the file.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Search message groups

Action ID: `tools.sublime.search_message_groups`

Search Sublime message groups using API-native query parameters.

Reference: [https://docs.sublime.security/reference/searchmessagegroups-1](https://docs.sublime.security/reference/searchmessagegroups-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

<ParamField path="params" type="object | null">
  API-native query parameters.

  Default: `null`.
</ParamField>

## Set list entries

Action ID: `tools.sublime.set_list_entries`

Replace all entries in a Sublime list.

Reference: [https://docs.sublime.security/reference/setlistentries-1](https://docs.sublime.security/reference/setlistentries-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  List ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Set message access justification

Action ID: `tools.sublime.set_message_access_justification`

Set the message-content access justification for the API user.

Reference: [https://docs.sublime.security/reference/setmessageaccessjustification-1](https://docs.sublime.security/reference/setmessageaccessjustification-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Share message group with Sublime

Action ID: `tools.sublime.share_with_sublime_public`

Share a message group with the Sublime team.

Reference: [https://docs.sublime.security/reference/sharewithsublimepublic-1](https://docs.sublime.security/reference/sharewithsublimepublic-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Message group canonical ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Start hunt job

Action ID: `tools.sublime.start_hunt_job`

Start an asynchronous Sublime hunt job.

Reference: [https://docs.sublime.security/reference/starthuntjob](https://docs.sublime.security/reference/starthuntjob)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Trash message

Action ID: `tools.sublime.trash_message`

Trash an individual Sublime message.

Reference: [https://docs.sublime.security/reference/trashmessage-1](https://docs.sublime.security/reference/trashmessage-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime message ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Trash message group

Action ID: `tools.sublime.trash_message_canonical_group`

Trash a Sublime message group and its future messages.

Reference: [https://docs.sublime.security/reference/trashmessagecanonicalgroup-1](https://docs.sublime.security/reference/trashmessagecanonicalgroup-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Message group canonical ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Trash multiple message groups

Action ID: `tools.sublime.trash_multiple_message_groups`

Trash multiple Sublime message groups.

Reference: [https://docs.sublime.security/reference/trashmultiplemessagegroups-1](https://docs.sublime.security/reference/trashmultiplemessagegroups-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Update rule

Action ID: `tools.sublime.update_rule`

Replace a Sublime rule definition.

Reference: [https://docs.sublime.security/reference/updaterule-1](https://docs.sublime.security/reference/updaterule-1)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="id" type="string" required>
  Sublime rule ID.
</ParamField>

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>

## Validate rule

Action ID: `tools.sublime.validate_rule`

Validate an API-native Sublime rule definition.

Reference: [https://docs.sublime.security/reference/validaterule](https://docs.sublime.security/reference/validaterule)

### Secrets

Required secrets:

* `sublime`: required values `SUBLIME_API_KEY`.

### Input fields

<ParamField path="payload" type="object" required>
  API-native JSON request body.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Sublime API.

  Default: `null`.
</ParamField>