Conversation
Add support for DELETE /workflows/entities/definitions/v1 which accepts a list of workflow definition IDs and deletes those definitions along with all their associated versions. - Added endpoint definition to _endpoint/_workflows.py - Added delete_definitions() method to Workflows service class - Added WorkflowDefinitionsDelete operation ID alias for backwards compatibility
alhumaw
approved these changes
Jun 10, 2026
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
FalconPy v1.6.3
This update implements new operations and service collections. Multiple bug fixes are also included.
Unit test coverage
Bandit analysis
[main] INFO profile include tests: None [main] INFO profile exclude tests: None [main] INFO cli include tests: None [main] INFO cli exclude tests: None [main] INFO running on Python 3.14.4 Working... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:01 Run started:2026-05-11 23:01:27.661734+00:00 Test results: No issues identified. Code scanned: Total lines of code: 131340 Total lines skipped (#nosec): 0 Run metrics: Total issues (by severity): Undefined: 0 Low: 0 Medium: 0 High: 0 Total issues (by confidence): Undefined: 0 Low: 0 Medium: 0 High: 0 Files skipped (0):Added features and functionality
Added: New Access Scopes service collection with two operations.
_endpoint/__init__.py_endpoint/_access_scopes.py_payload/__init__.py_payload/_access_scopes.py__init__.pyaccess_scopes.pytests/test_access_scopes.pyAdded: New Api Clients service collection with seven operations.
_endpoint/__init__.py_endpoint/_api_clients.py_payload/__init__.py_payload/_api_clients.py__init__.pyapi_clients.pytests/test_api_clients.pyAdded: Added nine new operations to the Cloud Azure Registration service collection.
_endpoint/_cloud_azure_registration.pycloud_azure_registration.pytests/test_cloud_azure_registration.pyRemoved: Removed
download_azure_scriptoperation from the Cloud Azure Registration service collection._endpoint/_cloud_azure_registration.py_endpoint/deprecated/_cloud_azure_registration.py_endpoint/deprecated/_mapping.pycloud_azure_registration.pyAdded: Added
CloneComplianceFrameworkoperation to the Cloud Policies service collection._endpoint/_cloud_policies.pycloud_policies.pytests/test_cloud_policies.pyUpdated: Added
adversary,groups,groups.business_impact,groups.business_unit,groups.environment, andthreat_actorsas allowed filter fields in the Cloud Security service collection._endpoint/_cloud_security.pycloud_security.pyAdded: Added
cloud_security_assets_entities_postoperation to the Cloud Security Assets service collection._endpoint/_cloud_security_assets.pycloud_security_assets.pytests/test_cloud_security_assets.pyUpdated: Added
resource_gcrn,resource_parent,tags_string,azure.resource_group, andinsights.*as allowed filter fields in the Cloud Security Assets service collection._endpoint/_cloud_security_assets.pycloud_security_assets.pyUpdated: Added
tenant_idas an allowed sort and filter field in the Cloud Security Detections service collection._endpoint/_cloud_security_detections.pycloud_security_detections.pyAdded: New Cloud Security Registration Combined service collection with one operation.
_endpoint/__init__.py_endpoint/_cloud_security_registration_combined.py_payload/__init__.py_payload/_cloud_security_registration_combined.py__init__.pycloud_security_registration_combined.pytests/test_cloud_security_registration_combined.pyAdded: New Cloud Security Risks service collection with one operation.
_endpoint/__init__.py_endpoint/_cloud_security_risks.py_payload/__init__.py_payload/_cloud_security_risks.py__init__.pycloud_security_risks.pytests/test_cloud_security_risks.pyUpdated: Added
architectureas an allowed filter field in multiple operations within the Container Images service collection._endpoint/_container_images.pycontainer_images.pyRemoved: Removed
AggregateFCIncidentsoperation from the Falcon Complete Dashboard service collection._endpoint/_falcon_complete_dashboard.py_endpoint/deprecated/_falcon_complete_dashboard.py_endpoint/deprecated/_mapping.pyfalcon_complete_dashboard.pyRemoved: Removed
QueryIncidentIdsByFilteroperation from the Falcon Complete Dashboard service collection._endpoint/_falcon_complete_dashboard.py_endpoint/deprecated/_falcon_complete_dashboard.py_endpoint/deprecated/_mapping.pyfalcon_complete_dashboard.pyUpdated: Added
architectureparameter to GetImageAssessmentImages and GetImageAssessmentImagesByDigest operations in the Falcon Container service collection._endpoint/_falcon_container.pyfalcon_container.pyAdded: New Federated Connections service collection with three operations.
_endpoint/__init__.py_endpoint/_federated_connections.py_payload/__init__.py_payload/_federated_connections.py__init__.pyfederated_connections.pytests/test_federated_connections.pyRemoved: Removed
CreateFileV1operation from the Foundry Logscale service collection._endpoint/_foundry_logscale.py_endpoint/deprecated/_foundry_logscale.py_endpoint/deprecated/_mapping.pyfoundry_logscale.pyRemoved: Removed
UpdateFileV1operation from the Foundry Logscale service collection._endpoint/_foundry_logscale.py_endpoint/deprecated/_foundry_logscale.py_endpoint/deprecated/_mapping.pyfoundry_logscale.pyAdded: New Foundry Lookup Files service collection with two operations.
_endpoint/__init__.py_endpoint/_foundry_lookup_files.py_payload/__init__.py_payload/_foundry_lookup_files.py__init__.pyfoundry_lookup_files.pytests/test_foundry_lookup_files.pyUpdated: Updated Host Migration endpoint definitions and docstrings.
_endpoint/_host_migration.pyhost_migration.pyUpdated: Expanded available sort and filter fields in the Hosts service collection to include
device_policies.*fields,agent_load_flags,agent_version,criticality,deployment_type,detection_suppression_status, and many more._endpoint/_hosts.pyhosts.pyAdded: Added three new operations to the Intel service collection.
_endpoint/_intel.pyintel.pytests/test_intel.pyAdded: New Knowledge Base Audit Events service collection with four operations.
_endpoint/__init__.py_endpoint/_knowledge_base_audit_events.py_payload/__init__.py_payload/_knowledge_base_audit_events.py__init__.pyknowledge_base_audit_events.pytests/test_knowledge_base_audit_events.pyAdded: New Knowledge Base Files service collection with six operations.
_endpoint/__init__.py_endpoint/_knowledge_base_files.py_payload/__init__.py_payload/_knowledge_base_files.py__init__.pyknowledge_base_files.pytests/test_knowledge_base_files.pyAdded: New Knowledge Bases service collection with five operations.
_endpoint/__init__.py_endpoint/_knowledge_bases.py_payload/__init__.py_payload/_knowledge_bases.py__init__.pyknowledge_bases.pytests/test_knowledge_bases.pyAdded: Added eight new operations to the Ngsiem service collection.
_endpoint/_ngsiem.pyngsiem.pytests/test_ngsiem.pyUpdated: Added
schema_validation_enabledparameter to the CreateConnectorConfig operation in the Ngsiem service collection._endpoint/_ngsiem.pyngsiem.pyUpdated: Added
targeted_platformsandchannel_file_statusas allowed filter fields in the query_scheduled_scans operation within the Ods service collection._endpoint/_ods.pyods.pyAdded: New Profile Groups service collection with nine operations.
_endpoint/__init__.py_endpoint/_profile_groups.py_payload/__init__.py_payload/_profile_groups.py__init__.pyprofile_groups.pytests/test_profile_groups.pyRemoved: Removed
combinedQueryInstalledPatchesoperation from the Spotlight Vulnerabilities service collection._endpoint/_spotlight_vulnerabilities.py_endpoint/deprecated/_spotlight_vulnerabilities.py_endpoint/deprecated/_mapping.pyspotlight_vulnerabilities.pyUpdated: Added new AI-related edge types (
ai_agent_used_by,connected_mcp,invokes_model,loaded_skill,mcp_tool_call,runs_session,session_process,session_run_by,spawns_agent,tool_spawned_process,used_tool,uses_ai_agent) and vertex types (ai_agent,ai_model,ai_session,ai_skill,ai_tool,mcp_server) to the Threatgraph service collection._endpoint/_threatgraph.pythreatgraph.pyAdded: Added
WorkflowDefinitionsDeleteoperation to the Workflows service collection._endpoint/_workflows.pyworkflows.pytests/test_workflows.pyIssues resolved
Fixed: Fixed bug in ITAutomation causing
cancel_executionto wraptask_execution_idin a list when the API expects a string. Passingtask_execution_idas a keyword argument now correctly produces a flat body payload. Closes [ BUG ]cancel_executionin ITAutomation wrapstask_execution_idin a list causing 400 invalid post body #1465.it_automation.pyFixed: Fixed missing comma in
_payload/_generic.pycausing implicit string concatenation betweenextended_boundsandfilters_spec, breaking both kwargs for all aggregate operations. Closes [ BUG ] Missing comma in _payload/_generic.py causes implicit string concatenation breaking aggregate kwargs #1460._payload/_generic.pyFixed: Fixed missing comma in
_payload/_aspm.pycausing implicit string concatenation betweentypeandusername, breaking both kwargs for ASPM relay node retrieval operations. Closes [ BUG ] Missing comma in_payload/_aspm.pycauses implicit string concatenation breaking relay node kwargs #1461._payload/_aspm.pyFixed: Fixed missing comma in
_payload/_foundry.pycausing implicit string concatenation betweenversionandwith_in, breaking both kwargs for Foundry LogScale saved search execute operations. Closes [ BUG ] Missing comma in_payload/_foundry.pycauses implicit string concatenation breaking saved search kwargs #1462._payload/_foundry.pyFixed: Fixed missing comma in
_payload/_cspm_registration.pycausing implicit string concatenation betweenproject_idandservice_account_conditions, breaking both kwargs for GCP CSPM service account validation. Closes [ BUG ] Missing comma in_payload/_cspm_registration.pycauses implicit string concatenation breaking GCP validation kwargs #1463._payload/_cspm_registration.pyFixed: Fixed typo
dashbaord_urlin_payload/_aspm.pycausingdashboard_urlkwargs to be silently ignored for ASPM node creation operations._payload/_aspm.pyFixed: Fixed missing
customkeyword argument in thecreate_data_connectionmethod of the NGSIEM service collection. Thecustomfield (a free-form string map used for connector-specific configuration such asPluginConfigID) was omitted from the payload builder, causing it to be silently dropped and the API to return HTTP 400 with "required custom property missing". Passingcustom={"PluginConfigID": "<value>"}as a keyword argument now works correctly. Closes [ BUG ] create_data_connection does not expose custom keyword #1468._payload/_ngsiem.pyngsiem.py