Altr MCP Server

Create an access management policy for an OLTP datasource. Each rule in the list must contain: - type: "read" - actors: list of dicts with 'type' ("idp_user"|"idp_group"), 'condition' ("equals"), and 'identifiers' (list of str). - objects: list of dicts with 'type' ("column") and 'identifiers' (list of dicts with database/schema/table/column keys, each having 'name' (str) and 'wildcard' (bool)). Args: policy_name: Name for the policy (1-255 chars). description: Description of the policy (1-255 chars). repo_name: Repository/connection name. database_type: Database type c…

Run an on-demand classification scan on an OLTP database (Oracle, MSSQL, MySQL, PostgreSQL) via a sidecar classification agent. Use this for OLTP/sidecar repos. `create_job` is Snowflake-only — it requires a numeric `database_id`, which OLTP repos do not have. This triggers an immediate one-off run and does NOT create a scheduled task. Runs asynchronously — poll with `get_jobs`, then fetch results with `get_job_findings` or `get_classification_report`. Args: agent_id: CLASSIFIER agent UUID (from `list_sc_agents` with agent_type="CLASSIFIER"). repo_name: Target sidecar reposi…

Create an empty masking policy for a specific tag. Creates a masking policy that controls how data tagged with the specified tag is masked. Until you add rules with `add_rules`, all users will see NULL for tagged columns. Each tag can only have one policy — check `get_policies` first to avoid conflicts. After creating a policy, use `add_rules` to define masking behavior. PLATFORM DIFFERENCES — TAG HANDLING: Snowflake and Databricks tags are FUNDAMENTALLY DIFFERENT in ALTR: - A Snowflake tag is a connected ALTR object — it has been registered with `connect_tag`, owns a `tag_group_id`, a…

Add a comment to a report instance. Args: definition_id: ID of the report definition. instance_id: ID of the report instance. text: Comment text to add.

Create a new audit report definition. Defines what data is included, how it is scheduled, and where it is delivered. After creating, use `trigger_report_definition` to generate a report on demand. Args: name: Unique display name for the definition. integration_type: Data source type. Values: "oltp", "snowflake". description: Optional human-readable description. lookback_days: Number of complete calendar days to include in each report window (excludes the trigger day). timezone: IANA timezone for the report window (e.g. "America/New_York"). Required by the …

Sign off on a report instance. Records the current user's approval of the report. After signing off, comments can be pinned on the instance. Args: definition_id: ID of the report definition. instance_id: ID of the report instance. action: Sign-off action. Values: "approve" (default). attestation: Whether to attest to the accuracy of the report (default True). comments: Optional comments to include with the sign-off.

Create a new ALTR agent. Args: agent_type: "SIS" or "CLASSIFIER". name: Agent name. description: Agent description. public_key_1: First public key for mTLS. public_key_2: Second public key for mTLS rotation.

Create a task for an agent. A task runs against a specific repo on a schedule. Configuration depends on agent type (check with `get_sc_agent` first). **CLASSIFIER agent** configuration: - classification_type: 5 (ALTR Native) or 6 (GDLP BYOK) - sample_strategy: ROWS, METADATA, ROW_COUNT, ROW_PERCENT, or COMBINED - collection_name: classifier collection name - condition_types: list of condition targets to enable beyond the default (e.g. ["ROW_DATA", "METADATA", "AMAZON_COMPREHEND"]). Required to activate METADATA-only scans, AMAZON_COMPREHEND entity detection, DATA_LENGTH, COLUMN_SIZE, o…

Create a new database repository for sidecar proxying. Args: name: Repository name. repo_type: Database type (e.g., "Oracle", "MSSQL", "MySQL", "Postgres"). hostname: Database server hostname. port: Database server port. description: Repository description.

Create a repo user with credential reference. Provide exactly one of aws_secrets_manager or azure_key_vault. Args: repo_name: Repository name. username: Database username. aws_secrets_manager: Dict with 'secrets_path' (required) and 'iam_role' (optional). azure_key_vault: Dict with 'key_vault_uri' and 'secret_name'.

Create a service user for a repository. Provide exactly one of aws_secrets_manager or azure_key_vault. Args: repo_name: Repository name. username: Service user name. resource: Resource identifier. aws_secrets_manager: Dict with 'secrets_path' and optional 'iam_role'. azure_key_vault: Dict with 'key_vault_uri' and 'secret_name'.

Create a new sidecar. Args: name: Sidecar name (max 64 chars). hostname: Sidecar hostname (max 500 chars). description: Sidecar description (max 400 chars). public_key_1: First public key for mTLS. public_key_2: Second public key for mTLS rotation. unsupported_query_bypass: If true, unsupported queries bypass the query parser. disable_platform_audits: If true, sidecar won't send activity audits.

Bind a repository to a sidecar listener port. Args: sidecar_id: Sidecar UUID. port: Listener port number. repo_name: Repository name to bind.

Create an access management policy for a Snowflake datasource. Defines which roles can access which databases, schemas, or tables with read or write permissions. Policies are enforced by ALTR and checked on a schedule. Each rule in the list must contain: - actors: list of dicts with 'type' ("role"), 'condition' ("equals"|"starts_with"|"ends_with"), and 'identifiers' (list of str). - objects: list of dicts with 'type' ("database"|"schema"|"table"), 'condition' ("equals"|"starts_with"|"ends_with"| "fully_qualified"), and 'identifiers' (list of str) or 'fully_qualified_identifiers' …

Create a new FPE tweak. Generates a new named random value for use in format-preserving encryption. The tweak name must not have leading or trailing spaces. Args: name: Name for the new tweak (1–256 characters, no leading or trailing spaces).

Delete critical tokens, removing them from the token store. Invalid tokens are silently ignored (no failure). If a deleted deterministic token is re-tokenized with the same plaintext, a new token is generated. Maximum 1024 values per call. Args: tokens: Dict mapping user-defined keys to critical tokens to delete (e.g. {"ssn": "token_abc123...", "email": "token_xyz456..."}).

Detokenize critical tokens to recover plaintext values. Fails if any value in `tokens` is not a valid critical token (format: `token_XXXX...`, 64+ chars). For mixed inputs (tokens and non-tokens), use `critical_partial_detokenize` instead. Maximum 1024 values per call. Tokens are case-sensitive. Args: tokens: Dict mapping user-defined keys to critical tokens (e.g. {"ssn": "token_abc123...", "email": "token_xyz456..."}).

Detokenize critical tokens, passing non-token values through unchanged. Unlike `critical_detokenize`, this does not fail when non-token values are present. Valid tokens are detokenized; all other values are returned as-is. Maximum 1024 values per call. Args: values: Dict mapping user-defined keys to critical tokens or plaintext strings. Non-token values are passed through (e.g. {"ssn": "token_abc123...", "name": "already-plaintext"}).

Tokenize plaintext values using ALTR critical tokenization. Replaces plaintext strings with critical tokens (format: `token_XXXX...`, 64+ chars). Tokens can be detokenized later. Deterministic tokenization produces the same token for the same input value. Maximum 1024 values per call. Each value must be under 128 UTF-8 code units. Args: values: Dict mapping user-defined keys to plaintext strings to tokenize (e.g. {"ssn": "123-45-6789", "email": "user@example.com"}). deterministic: If True, the same plaintext always produces the same token. Default False (rand…

Deactivate a specific version of an FPE key. Deactivated keys cannot be used for new encryption operations. Use `get_key` to discover the sequence identifier for a key version. Args: namespace: Namespace where the key resides. name: Name of the key. sequence: Version sequence identifier to deactivate.

Deactivate a specific version of an FPE tweak. Deactivated tweaks cannot be used for new FPE operations. Use `get_tweak` to discover the sequence identifier of a tweak version. Args: name: Name of the tweak. sequence: Version sequence identifier to deactivate.

Remove a custom classifier you created. Cannot delete ALTR managed classifiers. Only use for classifiers you created with `create_classifier`. Args: classifier_name: Exact classifier name as returned by `get_classifiers`.

Delete a classifier collection. Cannot delete collections that are in use by active or recent jobs. Only delete collections you created that are no longer needed. Args: collection_name: Exact collection name as returned by `get_collections`.

Delete a masking policy and all its rules. Use with caution - this removes all masking rules associated with the policy. Consider reviewing rules with `get_rules` first to understand what will be deleted. Args: policy_id: Raw policy ID from `get_policies`. Do not URL-encode.

Remove a specific masking rule from a policy. Allows fine-grained removal of individual rules without deleting the entire policy. Use `get_rules` first to identify the rule_id you want to remove. Args: policy_id: Raw policy ID containing the rule. Do not URL-encode. rule_id: Raw rule ID to delete. Do not URL-encode.

Delete an agent task. Atomically removes the task and decrements the agent's and service user's task counts. Args: agent_id: Agent UUID. task_id: Task UUID.

Delete telemetry for a specific task. Args: task_id: Task UUID.

Deny a pending access request. Args: request_id: Access request ID (UUID). justification: Reason for denying the request.

Remove a listener port from a sidecar. Args: sidecar_id: Sidecar UUID. port: Port number to deregister.

Disconnect an agent instance from ALTR's view. Args: agent_id: Agent UUID. instance_id: Instance UUID to disconnect.

Disconnect a data source from ALTR. Removes the ALTR connection to the data source. This does not affect the underlying database — only the ALTR connection to it. Args: database_id: Numeric ALTR database ID (from `get_databases`). ignore_errors: If true, force disconnection even if cleanup fails.

Disconnect an agent from ALTR. Agent must have task_count of 0. Args: agent_id: Agent UUID.

Disconnect a repository from ALTR. Must have no users or bindings. Args: repo_name: Repository name.

Disconnect a repo user from ALTR. Args: repo_name: Repository name. username: Database username to disconnect.

Disconnect a service user from ALTR. Args: repo_name: Repository name. username: Service user name to disconnect.

Disconnect a sidecar from ALTR. Must have no listeners. Args: sidecar_id: Sidecar UUID.

Remove a repo binding from a sidecar listener port. Args: sidecar_id: Sidecar UUID. port: Listener port number. repo_name: Repository name to unbind.

Disconnect a sidecar instance from ALTR's view. Args: sidecar_id: Sidecar UUID. instance_id: Instance UUID to disconnect.

Disconnect a connected Snowflake tag from ALTR. SNOWFLAKE ONLY. Databricks tags are not ALTR objects (they are raw strings referenced at policy-creation time), so there is nothing to disconnect here for Databricks — to stop masking a Databricks column tag, remove the policy with `delete_policy` instead. All policies on the tag must be removed first, or the disconnect will fail. Args: tag_group_id: Tag group identifier to disconnect.

Disconnect a tag from ALTR by database, schema, and tag name. SNOWFLAKE ONLY. Databricks tags are not ALTR objects; to stop masking a Databricks column, delete the policy with `delete_policy` instead. Alternative to `disconnect_tag` when you don't have the tag_group_id but know the database/schema/tag details. Args: database_id: Numeric ALTR database ID. database_name: Database name in ALTR. schema_name: Schema name containing the tag. tag_name: Tag name to disconnect. ignore_errors: If true, force-forget the tag even if cleanup fails.

Get details for a specific access request. Args: request_id: Access request ID (UUID).

List access requests in your ALTR organization. Args: limit: Max requests to return (default 10). requester: Filter by requester name. status: Filter by status. Values: OPEN, PENDING, PENDING_APPROVED, CLOSED_APPROVED, PENDING_DENIED, CLOSED_DENIED, PENDING_CANCELLED, CLOSED_CANCELLED, CLOSED, FAILED. sort: Sort order by creation time ("asc" or "desc"). exclusive_start_key: Pagination token from a prior call.

List all currently active (non-terminal) classification jobs. Returns only jobs in RUNNING or PAUSED states. Useful for checking what's in flight without filtering through all historical jobs. Args: limit: Max jobs to return. contiguous_id: Pagination token. database_id: Filter by database ID. agent_id: Filter by agent UUID.

Get details for a specific agent instance. Args: agent_id: Agent UUID. instance_id: Instance UUID.

List running instances for a specific ALTR agent. Args: agent_id: Agent UUID. limit: Max items to return. contiguous_id: Pagination token from a prior call.

Get task telemetry for a specific agent. Returns task status, messages, and metadata for tasks assigned to this agent. Args: agent_id: Agent UUID. limit: Max items to return. contiguous_id: Pagination token from a prior call.

Check whether a newer version of ALTR-managed classifiers is available. Returns the latest available version timestamp alongside the version currently installed in your org. If they differ, call `import_altr_managed_classifiers` to update.

Get results from a previously triggered audit search. Results may not be immediately available — a 202 response means the search is still processing. Retry after a short wait. Args: search_uuid: UUID returned by `search_audits`. limit: Max results per page (default 250, max 250). next_page_token: Pagination token from a prior call.

Get detailed results from a completed classification job. Returns which columns were detected as containing sensitive data along with confidence scores. Only call after the job status is COMPLETED (verify with `get_jobs`). For interactive navigation, prefer `get_job_findings` which lets you drill down without downloading the full report. After reviewing results, check if the needed Snowflake tags exist using `get_tags`. If tags are missing, they must be created in Snowflake first before connecting with `connect_tag`. Args: job_id: Job identifier returned from `create_job` or li…

Get details for a single classifier by name. Args: classifier_name: Exact classifier name as returned by `get_classifiers`.

List all available data classifiers (pattern-based detectors) in ALTR. Classifiers automatically detect sensitive data types like SSNs, emails, and phone numbers. Includes both ALTR-managed and custom classifiers.

Get details for a single collection by name. Args: collection_name: Exact collection name as returned by `get_collections`.

List classifiers that belong to a collection. Args: collection_name: Collection name to inspect. limit: Max items to return. contiguous_id: Pagination token.

List classifier collections (groups of classifiers used for classification jobs). A collection is required when creating a classification job with `create_job`. Check for existing collections (e.g., "ALTR Managed") before creating new ones.

Get the ALTR database ID for a database name. Required before creating classification jobs. The database ID is a numeric identifier that ALTR uses internally to reference your Snowflake database. Typical workflow: After identifying your database with `get_databases`, call this to get the ID needed for `create_job`. Args: database_name: Friendly database name as shown in the ALTR UI.

Discover which Snowflake databases are connected to ALTR. Returns connection metadata including database names and IDs. Use `get_database_id` to get the numeric ID required for classification jobs.

Get details for a single classification job by ID. Args: job_id: Job identifier returned from a create-job tool or listed by `get_jobs`.

List human review decisions recorded for a classification job. Args: job_id: Job identifier. database: Filter to this database. schema: Filter to this schema. table: Filter to this table. column: Filter to this column. limit: Max decisions to return. page_token: Pagination token.

List databases found in a completed classification job. Entry point for navigating classification results hierarchically without downloading the full report. Returns the databases that contain detected columns. Drill down with `get_job_findings_schemas`, then tables, columns, and classifiers. Prefer this over `get_classification_report` when you want to interactively explore or filter results by status or classifier. Args: job_id: COMPLETED job identifier. limit: Max databases to return. page_token: Pagination token from a prior call. classifier_name: Filter to databases con…

List classifiers that fired on a specific column in a completed job. Fifth (leaf) level of the findings tree. Shows per-classifier detection results for a column with confidence scores. Use `get_job_findings_lineage` to see the full compound-ruleset evaluation trace for a specific classifier. Args: job_id: COMPLETED job identifier. database: Database name. schema: Schema name. table: Table name. column: Column name from `get_job_findings_columns`. limit: Max classifiers to return. page_token: Pagination token. confirmed_status: Filter by review status (approve…

List columns in a table from a classification job's findings. Fourth level of the findings tree. Args: job_id: COMPLETED job identifier. database: Database name. schema: Schema name. table: Table name from `get_job_findings_tables`. limit: Max columns to return. page_token: Pagination token. classifier_name: Filter by classifier name(s). confirmed_status: Filter by review status (approved/rejected/pending).

Get the compound-ruleset evaluation trace (lineage) for a classifier on a specific column in a completed job. Returns the full decision tree showing which conditions evaluated, which matched, and why the classifier did or did not fire. Useful for debugging custom classifiers or understanding AMAZON_COMPREHEND / METADATA condition results. Args: job_id: COMPLETED job identifier. database: Database name. schema: Schema name. table: Table name. column: Column name. classifier_name: Classifier name to inspect.

List schemas in a database from a classification job's findings. Second level of the findings tree. Call after `get_job_findings` to drill into a specific database. Args: job_id: COMPLETED job identifier. database: Database name from `get_job_findings`. limit: Max schemas to return. page_token: Pagination token. classifier_name: Filter by classifier name(s). confirmed_status: Filter by review status (approved/rejected/pending).

List tables in a schema from a classification job's findings. Third level of the findings tree. Args: job_id: COMPLETED job identifier. database: Database name. schema: Schema name from `get_job_findings_schemas`. limit: Max tables to return. page_token: Pagination token. classifier_name: Filter by classifier name(s). confirmed_status: Filter by review status (approved/rejected/pending).

Get the review progress for a completed classification job. Returns total/approved/rejected/pending counts across all findings. Use after recording decisions with `record_job_decision` to check how much review work remains. Args: job_id: COMPLETED job identifier.

Get an inline per-classifier classification summary for a completed job. Returns classification counts grouped by classifier — faster than `get_classification_report` because it doesn't require a presigned S3 round-trip. Use this to get a quick count of detected columns before drilling into `get_job_findings`. Args: job_id: Job identifier of a COMPLETED job.

Check the status of classification jobs you've run. Classification jobs run asynchronously and can take 10-30+ minutes to complete depending on your database size. Use this to check if a job has finished after waiting an appropriate amount of time. Once a job shows status COMPLETED, you can fetch its detailed report with `get_classification_report` or browse results with `get_job_findings`. If status is still RUNNING, wait longer before checking again. Typical workflow: After creating a job, wait 15-30+ minutes, then use this function to check status. When status is COMPLETED, use `get_job_…

Get a single FPE key by namespace and name. Returns the current (latest) version of the key. Pass `sequence` to retrieve a specific historical version. Args: namespace: Namespace where the key resides (e.g. "fpe"). name: Name of the key. sequence: Version sequence identifier. Omit to get the latest.

List masking policies configured in your ALTR organization. Returns each policy's tag, policy ID, and current rule count. Use the policy_id from results when calling `add_rules`, `get_rules`, or `delete_policy`. Masking levels reference: - 10000: No mask (show raw value) - 10001: Full mask (replace with * matching data length) - 10002: Email mask (show domain only) - 10003: Show last four - 10004: Constant mask (1 for numbers, * for strings, 1/1/2000 for dates) - 10005: Null (replace with NULL) - 10006: Full mask hash (replace with hashed value) - 10007: Email hash (show domain, hash local…

Get results from a previously triggered query audit search. Results may not be immediately available — a 202 response means the search is still processing. Retry after a short wait. Use this to retrieve results from `search_query_audits`. For sidecar audit results, use `get_audit_results` instead. Args: search_uuid: UUID returned by `search_query_audits`. limit: Max results per page (default 250, max 250). next_page_token: Pagination token from a prior call.

Get a single audit report definition by ID. Args: definition_id: ID of the report definition.

Get a single report instance by ID. Args: definition_id: ID of the report definition. instance_id: ID of the report instance.

Get a download URL for a report instance. Returns a pre-signed URL to download the report file. Args: definition_id: ID of the report definition. instance_id: ID of the report instance. format: File format. Values: "pdf" (default), "csv".

Get the current user's sign-off for a report instance. Returns null/empty if the current user has not yet signed off. Args: definition_id: ID of the report definition. instance_id: ID of the report instance.

List all ALTR roles (user groups) available in your organization. Role names are used in `add_rules` to define which user groups see what level of data masking.

View all masking rules configured for a specific policy. Shows which roles have what masking levels for which tag values. Masking levels reference: - 10000: No mask (show raw value) - 10001: Full mask (replace with * matching data length) - 10002: Email mask (show domain only) - 10003: Show last four - 10004: Constant mask (1 for numbers, * for strings, 1/1/2000 for dates) - 10005: Null (replace with NULL) - 10006: Full mask hash (replace with hashed value) - 10007: Email hash (show domain, hash local part) - 10008: Show last four hash (hash prefix, show last 4) - 10009: Constant date (rep…

Get details for a specific agent. Args: agent_id: Agent UUID.

Get details for a specific repository. Args: repo_name: Repository name.

Get details for a specific repo user. Args: repo_name: Repository name. username: Database username.

Get details for a specific service user. Args: repo_name: Repository name. username: Service user name.

Get details for a specific sidecar. Args: sidecar_id: Sidecar UUID.

Get a specific sidecar-repo binding. Args: sidecar_id: Sidecar UUID. port: Listener port number. repo_name: Repository name.

List Snowflake service users available for database connections. Returns service user IDs needed for `create_database` when using keypair authentication (the recommended approach for Snowflake).

Get details for a specific sidecar instance. Args: sidecar_id: Sidecar UUID. instance_id: Instance UUID.

List running instances for a specific sidecar. Args: sidecar_id: Sidecar UUID. limit: Max items to return. contiguous_id: Pagination token from a prior call.

Get results from a system audit query. Use the token returned by `search_system_audits`. If the response has `moreData: true`, use the new token to fetch the next page. Args: token: Token from `search_system_audits` or a prior call's response.

Get full details for a specific tag masking by database, tag, and schema. SNOWFLAKE ONLY. Databricks tags are not stored as ALTR objects, so they have no detail record to fetch. Returns masking configuration, status, and timestamps. Use when you know the exact database/schema/tag but not the tag_group_id. Args: database_id: Numeric ALTR database ID (from `get_database_id`). database_name: Database name in ALTR. tag_name: Tag name. schema_name: Schema name containing the tag. protection_type: Optional filter — "governed", "governed-pushdown", "tokenized-vault", or…

Get full details for a specific connected tag by its group ID. SNOWFLAKE ONLY. `tag_group_id` only exists for connected Snowflake tags; Databricks tags are raw strings and have no group ID. Returns masking configuration, status, database info, and timestamps. Use `get_tags` first to find the tag_group_id. Args: tag_group_id: Tag group identifier from `get_tags`.

List all allowed values configured for a specific tag. SNOWFLAKE ONLY. Databricks tags are raw strings, not ALTR-managed objects, so they have no stored allowed-values list here — use whatever tag values exist in the Databricks catalog directly. These values are referenced when creating masking rules with `add_rules`. Args: tag_name: Tag name (from `get_tags`) whose values you want to inspect.

List all Snowflake tags connected to ALTR (available for use in policies). SNOWFLAKE ONLY. Databricks tags are NOT first-class objects in ALTR — they are raw string references used at policy-creation time only — so they will never appear in this list. Do not call `get_tags` to discover Databricks tags; pass the raw tag name directly to `create_policy` instead. For Snowflake, only tags that have been connected to ALTR via `connect_tag` appear here. Tags created in Snowflake but never connected will not be listed and cannot be used in a policy.

Get telemetry for a specific task by its ID. Args: task_id: Task UUID.

Get a single FPE tweak by name. Returns the current (latest) version of the tweak. Pass `sequence` to retrieve a specific historical version instead. Args: name: Name of the tweak. sequence: Version sequence identifier. Omit to get the latest.

Import all ALTR-managed classifiers and create/update the "ALTR Managed" collection. ALTR maintains a curated set of classifiers for common sensitive data types (SSN, credit cards, email, phone numbers, etc.). Call this to sync the latest prebuilt classifiers into your organization. Use `get_altr_managed_timestamp` first to check if an update is available before importing.

List available ALTR-managed (prebuilt) classifiers. Shows the canonical set maintained by ALTR, not what's currently in your org. Call `import_altr_managed_classifiers` to sync them. Args: limit: Max items to return. contiguous_id: Pagination token.

List FPE keys within a namespace. Results are paginated; use `contiguous_id` from the response to fetch subsequent pages. The `fpe` namespace is most common for format-preserving encryption keys. Args: namespace: Namespace to list keys from (e.g. "fpe"). contiguous_id: Pagination cursor returned by a prior call. limit: Max number of keys to return. contain: Filter keys whose name contains this substring. status: Filter by status — "active", "deactivated", or "any" (default "any").

List comments on a report instance. Pinned comments appear first, followed by the rest in chronological order. Args: definition_id: ID of the report definition. instance_id: ID of the report instance. limit: Max results per page. cursor: Pagination cursor from a prior call.

List audit report definitions. Returns paginated definitions ordered by creation time descending. Use `cursor` to page through results. Args: limit: Max results per page. cursor: Pagination cursor from a prior call. archived: If True, return only archived definitions. If False or omitted, return only active definitions.

List report instances for a given definition. Each instance represents one generated report. Instances are returned newest-first. Args: definition_id: ID of the report definition. limit: Max results per page. cursor: Pagination cursor from a prior call.

List all sign-offs for a report instance. Returns sign-offs from all users who have reviewed the instance. Args: definition_id: ID of the report definition. instance_id: ID of the report instance. limit: Max results per page. cursor: Pagination cursor from a prior call.

List tasks assigned to an agent. Args: agent_id: Agent UUID. limit: Max items (default 50, max 100). contiguous_id: Pagination token.

List ALTR agents (SIS or CLASSIFIER) in your organization. Args: limit: Max items (default 50, max 100). contiguous_id: Pagination token. agent_type: Filter by "SIS" or "CLASSIFIER". name_starts_with: Case-insensitive name prefix filter.

List sidecar bindings for a repository. Args: repo_name: Repository name. ports: Comma-separated port filter. sidecar_ids: Comma-separated sidecar ID filter. limit: Max items (default 50, max 100). contiguous_id: Pagination token.

List users configured for a repository. Args: repo_name: Repository name. limit: Max items (default 50, max 100). contiguous_id: Pagination token.

List database repositories configured for sidecar proxying. Args: limit: Max items (default 50, max 100). contiguous_id: Pagination token. repo_type: Filter by "Oracle", "MSSQL", "MySQL", or "Postgres".

List service users. Optionally filter by repo. Args: repo_name: If provided, list only service users for this repo. limit: Max items (default 50, max 100). contiguous_id: Pagination token. username_starts_with: Filter by username prefix (only works with repo_name).

List repo bindings for a sidecar. Args: sidecar_id: Sidecar UUID. ports: Comma-separated port filter. repo_names: Comma-separated repo name filter. limit: Max items (default 50, max 100). contiguous_id: Pagination token.

List listener ports registered on a sidecar. Args: sidecar_id: Sidecar UUID. limit: Max items (default 50, max 100). contiguous_id: Pagination token.

List sidecars in your organization. Args: limit: Max items (default 50, max 100). contiguous_id: Pagination token.

List FPE tweaks for the organization. Tweaks are named random values used in format-preserving encryption. Results are paginated; use `contiguous_id` from the response to fetch subsequent pages. Args: contiguous_id: Pagination cursor returned by a prior call. limit: Max number of tweaks to return. contain: Filter tweaks whose name contains this substring. status: Filter by status — "active", "deactivated", or "any" (default "any").

Pin a comment on a report instance. Only one comment per instance can be pinned at a time. Pinning is allowed after the instance has been signed off. Args: definition_id: ID of the report definition. instance_id: ID of the report instance. comment_id: ID of the comment to pin.

Approve or reject classification findings in a completed job. Decisions can be scoped from the entire job down to a specific classifier on a specific column. Broader scopes (e.g., entire table) apply to all columns and classifiers within that scope. After recording decisions, check overall progress with `get_job_review_status`. Args: job_id: COMPLETED job identifier. confirmed_status: Decision to record: "approved" or "rejected". database: Scope to this database (omit for job-wide). schema: Scope to this schema (requires database). table: Scope to this table (requires sc…

Register a listener port on a sidecar. Args: sidecar_id: Sidecar UUID. port: Port number to listen on. database_type: Database type for this listener. advertised_version: Optional version string to advertise.

Remove classifiers from a collection. Args: collection_name: Collection to remove classifiers from. classifier_names: Classifier name(s) to remove. Pass a single string or a list of strings.

Restore an archived audit report definition. Args: definition_id: ID of the archived definition to restore.

Revoke (remove) previously recorded review decisions for a job. Scope works the same as `record_job_decision` — revoke at any granularity from the whole job down to a single classifier on a column. After revoking, those findings return to "pending" status. Args: job_id: Job identifier. database: Scope to this database. schema: Scope to this schema. table: Scope to this table. column: Scope to this column. classifier_name: Scope to this classifier.

Rotate the envelope key for a specific FPE key version. Envelope rotation re-wraps the data key under a new envelope key without changing the underlying encryption material. Use this for key rotation compliance requirements. Args: namespace: Namespace where the key resides. name: Name of the key. sequence: Version sequence identifier of the key to rotate.

Search sidecar query audits with filters. Triggers an async search and returns a search_uuid (valid 30 days). Use `get_audit_results` with the search_uuid to retrieve results. All filters are combined with AND logic. Args: limit: Max results (default 10000, max 100000). offset: Skip this many results. from_date_time: RFC3339 UTC start time (e.g. "2025-01-01T00:00:00Z"). to_date_time: RFC3339 UTC end time. consuming_user: Filter by consuming usernames (case-insensitive). Pass a single string or a list of strings. consuming_user_email: Filter by consumin…

Search Snowflake query audits (tag and column masking). Triggers an async search and returns a search_uuid (valid 30 days). Use `get_query_audit_results` with the search_uuid to retrieve results. All filters are combined with AND logic. Use this for Snowflake tag-based or column-based masking audits. For sidecar proxy audits, use `search_audits` instead. Args: limit: Max results (default 10000, max 10000). offset: Skip this many results. from_date_time: RFC3339 UTC start time (e.g. "2025-01-01T00:00:00Z"). to_date_time: RFC3339 UTC end time. Must not be in the future…

Search ALTR platform system audits. Starts an async query against system audit logs. Returns a token to retrieve results with `get_system_audit_results`. If `wait` is set, the API may return results directly (200) or a token for later retrieval (202). The `from` and `to` time range may be at most one week. Args: category: Audit category. Values: "API Keys", "Locks", "Data", "Administrators", "Thresholds", "Anomalies", "Applications", "User Groups", "Data Sources", "Row Access Policy", "Unified Access Policy", "Access Requests", "Access Management Policy",…

Trigger a manual compliance check for a grant/access management policy. Runs the policy check immediately instead of waiting for the next scheduled run. Args: policy_id: Raw policy ID. Do not URL-encode.

Trigger a database status sync. Sets the database to "in progress" until the status check completes. Use `get_databases` afterward to see the updated status. Args: database_id: Numeric ALTR database ID (from `get_databases`).

Trigger an on-demand audit report for a definition. Generates a report instance immediately outside of the normal schedule. Rate-limited to one trigger per definition per 5 minutes. Args: definition_id: ID of the definition to trigger.

Unpin the currently pinned comment on a report instance. Args: definition_id: ID of the report definition. instance_id: ID of the report instance. comment_id: ID of the comment to unpin.

Update an existing custom classifier. Only provided fields are changed. Args: classifier_name: Exact classifier name to update. description: Updated description. minimum_threshold: Updated confidence threshold (0-100). pattern: Updated regex pattern (legacy; prefer a ROW_DATA condition in `compound_ruleset`). sample_size: Legacy and discouraged — sampling is configured at the job level, not on the classifier. Retained for backward compatibility. compound_ruleset: Updated compound ruleset. See `create_classifier` for structure and valid c…

Update a collection's description. Args: collection_name: Exact collection name to update. description: Updated description.

Update a database connection's properties. Only the fields you provide will be updated; omitted fields remain unchanged. Args: database_id: Numeric ALTR database ID (from `get_databases`). friendly_database_name: Updated display name. max_number_of_connections: Max concurrent connections. max_number_of_batches: Max concurrent batches. service_user_id: Service user identifier. connection_string: Database connection string. database_password: Updated password. database_username: Updated username. snowflake_role: Snowflake role to use. warehouse_name: Sno…

Control a running classification job (pause, cancel, or resume). Use to manage long-running classification jobs. Status options: PAUSED, CANCELLED, or RUNNING. Args: job_id: Job identifier to update. status: New status (PAUSED, CANCELLED, or RUNNING).

Update an existing audit report definition (full replacement). Replaces the definition's configuration entirely. All fields that should be preserved must be included. Args: definition_id: ID of the definition to update. name: Unique display name for the definition. integration_type: Data source type. Values: "oltp", "snowflake". description: Optional human-readable description. lookback_days: Number of complete calendar days to include in each report window (excludes the trigger day). timezone: IANA timezone for the report window (e.g. "America/New_Yor…

Update an existing masking rule's properties without deleting and recreating it. Only the fields you provide will be updated; omitted fields remain unchanged. Use `get_rules` first to find the rule_id and see current values. Masking levels reference: - 10000: No mask (show raw value) - 10001: Full mask (replace with * matching data length) - 10002: Email mask (show domain only) - 10003: Show last four - 10004: Constant mask (1 for numbers, * for strings, 1/1/2000 for dates) - 10005: Null (replace with NULL) - 10006: Full mask hash (replace with hashed value) - 10007: Email hash (show domai…

Update an existing agent. Only provided fields are changed. Args: agent_id: Agent UUID. name: Updated name. description: Updated description. public_key_1: Updated first public key. public_key_2: Updated second public key.

Update an agent task. Only provided fields change. Configuration update rules vary by database type. See `create_sc_agent_task` for details. Args: agent_id: Agent UUID. task_id: Task UUID. name: Updated task name. description: Updated description. configuration: Updated config dict or JSON string. schedule: Updated schedule dict or JSON string.

Update a repository's description. Args: repo_name: Repository name. description: Updated description.

Update a repo user's credential reference. Args: repo_name: Repository name. username: Database username. aws_secrets_manager: Updated AWS Secrets Manager config. azure_key_vault: Updated Azure Key Vault config.

Update a service user. Only provided fields are changed. Args: repo_name: Repository name. username: Service user name. resource: Updated resource identifier. aws_secrets_manager: Updated AWS config. azure_key_vault: Updated Azure config.

Update a sidecar. Only provided fields are changed. Args: sidecar_id: Sidecar UUID. name: Updated name. hostname: Updated hostname. description: Updated description. public_key_1: Updated first public key. public_key_2: Updated second public key. unsupported_query_bypass: Updated bypass setting. disable_platform_audits: Updated audit setting.

Update an existing Snowflake access management policy. Replaces the policy's name, description, and rules. See `create_snowflake_access_policy` for the rule format. Args: policy_id: Raw policy ID. Do not URL-encode. policy_name: Updated policy name (1-255 chars). rules: Updated list of access rule objects, or a JSON string encoding such a list. description: Updated description (1-255 chars).

Update an existing tag connection's masking configuration. SNOWFLAKE ONLY. Databricks tags are not ALTR-managed objects, so there is no Databricks tag configuration to update — change Databricks masking by editing the policy or its rules instead. Use `get_tags` to find the `tag_group_id` of the tag you want to update. To connect a new tag, use `connect_tag` instead. Args: tag_group_id: Tag group identifier from `get_tags`. database_id: Numeric ALTR database ID (from `get_database_id`). friendly_name: Display name for the tag in ALTR. protection_type: Masking type — "governed…

Permanently delete vault tokens from the ALTR vault. Deleted tokens cannot be detokenized. If a deleted deterministic token is re-tokenized with the same plaintext, a new token is generated. Rate-limited to 492 requests/month and 50 requests/second. Maximum 4096 values per call. Args: tokens: Dict mapping user-defined keys to vault tokens to delete (e.g. {"ssn": "vaultn_abc123...", "email": "vaultn_xyz456..."}).

Detokenize vault tokens to recover plaintext values. Fails if any value in `tokens` is not a valid vault token (prefix `vaultd_` or `vaultn_`). For mixed inputs (tokens and non-tokens), use `vault_partial_detokenize` instead. Rate-limited to 492 requests/month and 50 requests/second. Maximum 4096 values per call. Tokens are case-sensitive. Args: tokens: Dict mapping user-defined keys to vault tokens (e.g. {"ssn": "vaultn_abc123...", "email": "vaultn_xyz456..."}).

Detokenize vault tokens, passing non-token values through unchanged. Unlike `vault_detokenize`, this does not fail when non-token values are present. Valid tokens are detokenized; all other values are returned as-is. Rate-limited to 492 requests/month and 50 requests/second. Maximum 4096 values per call. Args: values: Dict mapping user-defined keys to vault tokens or plaintext strings. Non-token values are passed through (e.g. {"ssn": "vaultn_abc123...", "name": "already-plaintext"}).

Tokenize plaintext values using ALTR vaulted tokenization. Replaces plaintext strings with vault tokens. Non-deterministic tokens use the prefix `vaultn_`; deterministic tokens use `vaultd_`. Tokens are stored in the ALTR vault and can be detokenized later. Rate-limited to 492 requests/month and 50 requests/second. Maximum 4096 values per call. Each value must be under 1024 characters. Args: values: Dict mapping user-defined keys to plaintext strings to tokenize (e.g. {"ssn": "123-45-6789", "email": "user@example.com"}). deterministic: If True, the same plaintext alw…