API Integrations

API integrations connect your Foundry app to external services and CrowdStrike APIs. Once configured, integration operations can be called from functions, exposed as Fusion SOAR workflow actions, and used by UI extensions.

Creating an API integration

You can create API integrations from the Falcon console or the Foundry CLI.

From the Falcon console

1. In the App Builder, go to API integrations.
2. Click Create integration.
3. Choose one of the following:
   • Import OpenAPI spec — Upload a Swagger/OpenAPI JSON or YAML file to auto-generate operations.
   • Create manually — Define the base URL, authentication, and operations by hand.

From the CLI

API integrations are defined in the manifest.yml file under the api_integrations key. See the App Manifest Reference for the full schema.

Configuration steps

Creating an integration involves seven steps:

1. Basic info — Name, description, and base URL of the external API.
2. Authentication — Choose the authentication method: API key, OAuth 2.0 client credentials, OAuth 2.0 authorization code, bearer token, basic auth, or no auth.
3. Operations — Define the API operations (HTTP method, path, parameters, request/response schemas).
4. Permissions — Configure which Falcon roles can use the integration’s operations.
5. Testing — Test each operation against the live API.
6. Advanced settings — Configure autocomplete, multiselect, and search behavior for operation parameters.
7. Review — Verify the configuration and save.

Autocomplete dropdown lists

API integration parameters can be configured to display autocomplete dropdown lists when used in Fusion SOAR workflows. This gives workflow builders a guided experience instead of requiring raw input.

Static lists

Define a fixed set of allowed values for a parameter. Use static lists when the options don’t change (e.g., status values, priority levels).

Dynamic lists

Populate the dropdown by calling another operation on the same integration. Use dynamic lists when the options come from the external API (e.g., a list of users, projects, or repositories).

To configure a dynamic list:

1. Create a “list” operation that returns the available options.
2. On the parameter that should use autocomplete, configure the Autocomplete setting to reference the list operation.
3. Map the response fields to the dropdown’s display label and value.

Multiselect

Enable multiselect to allow workflow builders to choose more than one value from the dropdown.

Search and filtering

For large datasets, enable server-side search to send the user’s typed input to the API as a filter parameter. This avoids loading all options upfront.

HTTP Actions

For simple API calls that don’t require a full integration, Fusion SOAR workflows support HTTP Actions — direct REST API calls configured inline within a workflow. HTTP Actions support three modes:

Mode	Description
Cloud	Calls external APIs from the CrowdStrike cloud. Supports API key, OAuth 2.0, and bearer token auth.
CrowdStrike	Calls CrowdStrike APIs using the workflow’s execution context. No additional credentials needed.
On-Premises	Routes requests through an on-premises proxy for APIs not accessible from the internet.

For a walkthrough, see Build API Integrations with Falcon Fusion SOAR HTTP Actions.