> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Action1

> Ingest Action1 managed endpoints, vulnerabilities, missing updates, and audit activity

Action1 is a patch management and vulnerability remediation platform. The integration reads every Action1 organization the API credentials can see and ingests:

* **Endpoints**: managed endpoints for asset correlation
* **Vulnerabilities**: one detection per CVE per affected endpoint
* **Missing updates**: a daily snapshot of updates missing across your organizations
* **Audit trail**: logins, remote sessions, and configuration changes

Vulnerability detections are informational while the integration is in beta, so they do not escalate.

## Prerequisites

* An Action1 user who can manage API credentials
* Your Action1 region: **NA**, **NA2**, **EU**, **UK**, or **AU**

## Create API Credentials

1. Log in to the Action1 console
2. Open **Configuration** > **Users & API Credentials** and select the **API Credentials** tab
3. Click **Create new API credentials**
4. Enter a descriptive **Name**, such as `Wirespeed`
5. For **Assign Role**, select **Enterprise Viewer**. Wirespeed only reads data, and this role covers every organization
6. Click **Proceed**
7. Copy the **Client id** and **Client Secret**. The secret is write-only: if you lose it, generate a new one from the same dialog

> [!TIP]
>
> The **Authenticate request** example in the credentials dialog starts with your regional host, for example `https://app.na-2.action1.com`. You can paste that host as the region in Wirespeed.

## Add the Integration in Wirespeed

1. In Wirespeed, navigate to **Integrations** > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Action1**
2. Enter your **Region**, **Client ID**, and **Client Secret**
3. Submit the integration

| Region | Console host |
| - | - |
| NA | `app.action1.com` |
| NA2 | `app.na-2.action1.com` |
| EU | `app.eu.action1.com` |
| UK | `app.uk.action1.com` |
| AU | `app.au.action1.com` |

## What Wirespeed Ingests

| Source | Action1 API | Frequency | Purpose |
| - | - | - | - |
| Endpoints | `GET /endpoints/managed/all` | Each endpoint sync | Managed endpoint inventory for asset correlation |
| Vulnerabilities | `GET /vulnerabilities/all` and `GET /vulnerabilities/all/{cveId}/endpoints` | Daily | One informational detection per CVE per affected endpoint |
| Missing updates | `GET /updates/all` | Daily | Patch posture snapshot in the SIEM |
| Audit trail | `GET /audit/events` | Each log sync; the first sync backfills seven days, later syncs re-read the hour before the newest ingested event | Logins, remote sessions, and configuration changes in the SIEM |

Action1 allows 30 API requests per minute across an enterprise, so Wirespeed spaces its requests and spreads a large vulnerability scan over several runs. The audit trail excludes `GET` events, which Action1 records for every read API call, including Wirespeed's own.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.