Submission actions

A submission action answers: For this output type, which destination receives which payload?

Open Org Settings → Integrations. The Projects column controls which project’s actions appear in the Actions column. Each action belongs to one project, points at one org-level connection, and only matches outputs whose item_type equals the action’s Item type value.

Create an action

1. Open Org Settings → Integrations.
2. Select the target project in Projects.
3. In Actions, choose the + button (Add project action).
4. Enter the action fields, then choose Create.

Field	Use
Name	Label shown in the Submit to… menu and staged review queue.
Item type	Exact output type to match, such as finding, asset, or a capability-defined type.
Connection	Destination connection that receives the rendered payload.
Template JSON	JSON object rendered with {{path}} tokens at preview and submit time.
Enabled	Makes the action available for human-confirmed submission.
Allow agents to stage	Lets an agent add matching outputs to the project’s Staged Findings queue for approval.

The template must be a JSON object. HackerOne requires title, vulnerability details, and impact. Linear requires a top-level title. Webhooks accept any rendered JSON object.

Render output data into the payload

Use {{path}} tokens in the template. This example works for Linear and webhook destinations:

{
  "title": "{{title}}",
  "description": "{{data.description}}",
  "severity": "{{data.severity}}",
  "evidence": "{{data.evidence}}",
  "item_id": "{{item.id}}"
}

Available paths include:

Path	Value
title	Output display title.
item.id	Output UUID.
item.ref	Agent-assigned output reference, when present.
item.item_type	Exact output type.
project.key	Project key.
project.name	Project name.
data.*	Output payload fields.

Whole-string tokens preserve JSON types. Embedded tokens convert values to strings.

{
  "raw_evidence": "{{data.evidence}}",
  "summary": "Evidence: {{data.evidence}}"
}

If data.evidence is an object, raw_evidence remains an object. summary contains a JSON string. Missing paths render as an empty string and produce a preview warning.

Use nested capability data

Capability-defined output types expose their payload under data.*. Use dotted paths for nested objects and numeric segments for array positions.

{
  "title": "{{title}}",
  "severity": "{{data.risk.severity}}",
  "endpoint": "{{data.endpoint.url}}",
  "first_asset": "{{data.impacted_assets.0.hostname}}",
  "full_payload": "{{data}}"
}

The action’s Item type must exactly match the type emitted by the capability. If a capability reports web_vulnerability, set Item type to web_vulnerability.

Allow an agent to stage work

Turn on Allow agents to stage when an agent should place matching outputs in the review queue. The agent records the action and run provenance in a durable stage. Staging does not contact the destination or decrypt connection credentials.

Give a coding agent this sequence:

1. Call report_item and retain the returned UUID.
2. Call list_staging_actions and select an enabled action with the same item_type.
3. Call stage_item with the output UUID and action UUID.
4. Report that the output is staged for human review, not submitted externally.

The staging tools appear only when platform sync and project context are available, the active capability produces outputs, and at least one action allows agent staging.

Edit fields during single-result review

The single-result preview lets reviewers edit adapter-approved top-level fields. Edits change only that submission attempt, not the source output or action template.

Adapter	Destination behavior	Required top-level fields	Editable top-level fields
HackerOne	Creates a report, maps info to none, and adds the item URL.	title, description/details, impact	title, description, vulnerability_information, impact, severity, evidence, weakness_id, structured_scope_id
Linear	Creates a Linear issue and maps severity to Linear priority.	title	title, description, severity, evidence
Webhook	Posts the full rendered JSON payload.	None	title, description, severity, evidence

Use top-level fields for human review

If reviewers need to adjust severity before submission, render it as a top-level severity field. Nested fields are read-only in the preview modal.

Bulk review does not apply payload edits

Bulk execution renders the saved action template again. Update the source output or action template before bulk submission instead of relying on edits made in the bulk payload editor.