Universal Action
If it has an API, ManySignal can act on it
Universal Action lets you define any HTTP-based API call as a governed action module. Authentication, request templating, success validation, and rollback payload are all expressed in a single YAML file — no code, no plugin development.
Universal Action manifest — YAML
One file to define, authenticate, execute, and roll back
Define the request template with context bundle interpolation, map the success condition, and optionally declare a rollback action. The platform handles retries, rate limits, and audit logging.
action:
name: okta-suspend-user
display_name: "Suspend Okta User"
category: identity
reversible: true
auth:
type: api_key
header: Authorization
value: "SSWS {{secret.okta_api_key}}"
request:
method: POST
url: "https://{{config.okta_domain}}/api/v1/users/{{context.entity.okta_id}}/lifecycle/suspend"
headers:
Content-Type: application/json
body: {}
success:
status_codes: [200]
extract:
user_status: "$.status"
rollback:
request:
method: POST
url: "https://{{config.okta_domain}}/api/v1/users/{{context.entity.okta_id}}/lifecycle/unsuspend"
body: {}
rate_limit:
requests_per_minute: 60
retry_on: [429, 503]
max_retries: 3Governed by the same autonomy framework as built-in actions
Once defined, a Universal Action module is indistinguishable from a built-in action. It runs at the configured autonomy level, stores rollback state if declared reversible, and is subject to guardrail rules — blast-radius limits, entity protection lists, and dry-run preview all apply.
Secrets referenced in the manifest are resolved from the platform secret store at execution time, not stored in the manifest itself. Rotation of an API key updates all manifests that reference the secret without manifest edits.
What Universal Action covers
REST and webhook targets
Any endpoint that accepts HTTP requests. JSON, form-encoded, and XML request bodies are supported. Response parsing uses JSONPath or regex extraction.
GraphQL mutations
Wrap a GraphQL mutation as an action. The manifest includes the query string and variable mapping from the context bundle.
Context bundle interpolation
Reference any field from the alert context — entity ID, finding severity, IP address — directly in the URL, headers, or request body template.
Secret management
API keys, OAuth tokens, and bearer tokens are stored in the platform secret store with encryption at rest. Manifests reference secrets by name, never by value.
Rate limit handling
Declare rate limits in the manifest. The platform queues and retries requests automatically, with configurable backoff. No silent drops.
Action as evidence source
A Universal Action can be used as an evidence source in an agent question set — call VirusTotal, receive a structured response, use it to answer a threat intel question.
Universal Action — FAQ
Does Universal Action support OAuth 2.0 authentication?
Yes. The auth block supports API key, bearer token, Basic auth, and OAuth 2.0 client credentials and authorization code flows. Token refresh is handled automatically using the configured refresh token or client credentials.
Can I test a Universal Action before deploying it to production?
Yes. The action sandbox lets you supply a test context bundle and execute the action against a staging endpoint, with the full request and response visible. Dry-run mode is also available for production testing without committing the action.
What if the target API doesn't support rollback natively?
Rollback is optional. If the action is not reversible by nature (e.g., sending an alert notification), leave the rollback block empty. The action is marked non-reversible in the UI and cannot be rolled back from the case timeline.
Are Universal Actions shared across the team?
Yes. Actions are tenant-level objects. Any workflow or agent question set can reference a Universal Action by name. MSSP tenants can publish shared actions to child tenants.
How do Universal Actions interact with the autonomy ladder?
Every Universal Action is assigned an action class (identity, network, endpoint, notification, cloud) when defined. The autonomy ladder then applies the tier configured for that class — recommend-only, approve-gated, or autonomous. Blast-radius limits and dry-run previews apply to Universal Actions identically to built-in action modules.
How many Universal Actions can a tenant define?
There is no hard limit on action definitions. Performance considerations apply when action execution queues are large; high-frequency automation is best handled via the native integration modules rather than general REST calls where possible.
Can Universal Actions call internal APIs behind a corporate firewall?
Yes. In self-hosted deployments, the response automation service originates API calls from within your network, reaching internal endpoints directly. In cloud-hosted deployments, outbound calls to internal APIs require either a public endpoint, VPC peering, or PrivateLink configuration.
What is the timeout and retry policy for Universal Action execution?
Default timeout is 30 seconds per action attempt with 3 retries using exponential backoff. Timeouts and retry counts are configurable per action definition. Failed actions after exhausting retries create a manual task for the analyst rather than failing silently.
Is there a community library of Universal Action templates?
Yes. A curated library of Universal Action templates is available in the platform under Actions > Templates. Templates exist for common integration patterns — Webhook notification, REST CRUD, GraphQL query, and vendor-specific API patterns — and can be forked and customised in the YAML editor.
Connect the tools you already have
200+ shipped action modules plus Universal Action for everything else. If it has an API, it works.