HighQ

List all iSheets in a site with admin-level configuration (site administrators only) List all iSheets in one site with each iSheet's admin configuration (type, status, access type, feature flags). By default the response is trimmed to keep it small - the per-column summary is omitted; pass includedetails=true to also return each iSheet's columns (id, name, section, type, description). Use it to inventory a site's iSheets, inspect their setup, or get an iSheet id for follow-up column, view, or record lookups. Returns configuration and structure only - not the rows inside an iSheet, and not full column detail. The list includes both ACTIVE and PENDING iSheets. Requires the numeric id of a site you already have (no lookup by name). Caller must be a site administrator (org/system admins and the site creator also qualify); other members are denied. No paging or count; filter only by type. API Endpoint: GET /20/isheets/admin Returns: Dict with keys: - status_code: HTTP response status code - data: Response data (JSON or text) - headers: Response headers - url: Request URL - endpoint: API endpoint called - tool_name: Name of this tool - error: Error message (if failed)

List the members of one site (identity, contact, organisation, status, role) List the members of one HighQ site with their identity, contact, organisation, status and role - each returns userid, name (firstname/lastname), email, status and roles. Use when you have a numeric site ID and need who belongs to that site - not a tenant-wide people search, and not a user's files or activity. Requires Member Manager rights on an active site, else the call is rejected. Filter by group, status, invitation, or login, or fetch named users via userid/emailidcsv; free-text search with q; sort by ordertype (field) and orderby (direction). No total is returned - a page shorter than limit is the last (up to 100 per call, 25 default). API Endpoint: GET /20/sites/{siteid}/users Returns: Dict with keys: - status_code: HTTP response status code - data: Response data (JSON or text) - headers: Response headers - url: Request URL - endpoint: API endpoint called - tool_name: Name of this tool - error: Error message (if failed)

List site purposes (site categories) for the tenant Lists the site categories configured for the current Collaborate tenant. The product calls these site purposes, so use it when a user asks which site purposes or categories exist, or to turn a purpose name into its numeric id. Takes no required input: call it with no arguments for the full list. Each entry has siteCategoryID (numeric, sent as a string) and siteCategoryName, plus name translations where they exist. It returns this taxonomy only, never sites, site membership or file data. Results are limited to the categories the caller is allowed to see, so an empty list is a normal result rather than an error. API Endpoint: GET /20/sitecategories Returns: Dict with keys: - status_code: HTTP response status code - data: Response data (JSON or text) - headers: Response headers - url: Request URL - endpoint: API endpoint called - tool_name: Name of this tool - error: Error message (if failed)

Find or list the HighQ sites you can access (name -> id) List or find the HighQ sites the caller can access; the main use is turning a site name into the numeric site id and root folder id (sitefolderID) that other operations need. No input required - the default returns the 25 most recently accessed sites. Filter by name, site purpose (category), module, matter/client number, or specific site ids; each parameter's help says how it combines with the others. Each site returns id, sitename, sitedescription, sitefolderID, categories, status, statusid (1=Active, 2=Readonly, 3=Archived, 4=Preparation), siteowner and lastaccesseddate; set includedetails=true for module flags, computed site size and file/security settings. sitecount is the total before paging - compare it with the rows returned to see whether more remain; page with offset/limit. An empty result is a normal 200 - do not retry. Never send an empty string for a filter; omit the parameter instead (matterno= and clientno= return HTTP 500). API Endpoint: GET /20/sites Returns: Dict with keys: - status_code: HTTP response status code - data: Response data (JSON or text) - headers: Response headers - url: Request URL - endpoint: API endpoint called - tool_name: Name of this tool - error: Error message (if failed)

Read HighQ's platform-wide audit trail (admin only) Read HighQ's platform-wide audit trail - who did what, when, across every site in the instance - for security and compliance questions: sign-ins and two-factor or impersonation events, membership/permission/role changes, site lifecycle and settings changes, and document or folder activity (downloads, uploads, deletes, e-signature, sharing). Admin-only: the caller needs a System User Admin or Org Admin token or the API returns 403 (this is not pre-checked). Not for iSheet row/record-level history. Pick exactly ONE auditAlias by intent (see the parameter). Always give a time range - there is no all-time default: either set dateFilter to a rolling window (Last 5 Mins, Last 15 Mins, Last 1 Hour, Last 6 Hours) and send no dates, or set dateFilter=Custom and send startDate AND endDate as 'DD MMM YYYY' (e.g. 01 Jan 2026). Omitting dateFilter defaults it to Custom, so Custom without both dates - or dates in any other format - returns 403. actionType is optional: omit for all events of the alias, or pass only codes that belong to the chosen alias (a code from another alias returns 403). Narrow further with siteId, userId, userRole, userType, userStatus and siteStatus (combinable). Results come grouped by site, up to 500 records per page (default 100), with totalCount as the full match count; page by advancing offset by limit, and STOP once offset reaches totalCount (or a page returns fewer than limit) - do not keep paging past the end. API Endpoint: GET /20/systemaudits Supports jq_filter: pass it whenever the response is a collection or large object to trim it server-side and reduce token usage. See 'Response data fields' below for real field names. Returns: Dict with keys: - status_code: HTTP response status code - data: Response data (JSON or text), filtered if jq_filter was provided - headers: Response headers - url: Request URL - endpoint: API endpoint called - tool_name: Name of this tool - jq_filter: The jq filter that was applied (only present when a filter ran) - error: Error message (if failed) Response data fields (schema: object): totalCount (integer(int32)) offset (integer(int32)) limit (integer(int32)) sortType (string) sortOrder (string) siteAudit (array<SiteAuditGroupDBO>) siteId (integer(int32)) siteName (string) siteStatus (string) audits (array<BaseAuditDBO>) auditId (integer(int32)) actionAlias (string) actionDescription (string) actionDateTime (string) actionUser (object) userid (integer(int32)) fullName (string) userStatus (string) userType (string) userRole (string) actionUserOrganisation (string) ipAddress (string) path (string) actionDetails (object) oldValueLabel (string) newValueLabel (string) fields (array<AuditDetailFieldDBO>) fieldName (string) oldValue (string) newValue (string) auditType (string, required) targetSite (object) id (integer(int32)) name (string) targetFolder (object) id (integer(int32)) name (string) targetDocument (object) id (integer(int32)) name (string) Use exact field names above in your jq_filter — do not rename, abbreviate, or guess paths.

List instance-wide user accounts Lists user accounts across the entire HighQ instance (the system-level people directory), not the members of a single site. Use it to find or look up people by status, organisation, group, name, email, job title, external id, or free text; to sort them; or to fetch the caller's own account. Any authenticated user may call it, but results are privilege-scoped: a user-admin or org-admin sees every account in the instance, while a regular user sees only accounts already visible to them, and the returned totals reflect that scope - do not assume the result is a complete roster. Each record is account/profile metadata (userid, name, email, status, organisation, job title, department, last-login, and - depending on instance version and configuration - roles with an auto sign-in URL, two-factor-registration status, phone, and postal address); it never returns a user's site content, files, or per-site permissions. Output contains personal data - treat it as sensitive. Pass 'myself', 'me', or 'i' as userid or email to fetch your own account. Paging: offset is a zero-based row offset (rows to skip, not a page number) and each call returns at most 100 accounts, so advance offset to read more. Invalid status, paging, sort, organisation, or group values are rejected. API Endpoint: GET /20/users Returns: Dict with keys: - status_code: HTTP response status code - data: Response data (JSON or text) - headers: Response headers - url: Request URL - endpoint: API endpoint called - tool_name: Name of this tool - error: Error message (if failed)

Search files, folders, and people across HighQ sites Primary, cheap tool for finding files, folders, and people in HighQ by name, keyword, phrase, or tag - use it for almost any document or file lookup: keyword or topic search, finding a named file, checking whether something exists or is mentioned, and resolving a name to the id other operations need. It reads only the search index, so prefer it over a document's full text for search and keyword work; read full text only for the exact wording of a known file. Each match returns context id, name, type, URL, site, folder id, extension, modified date, and a summary. searchTerm picks the mode: 'title:' prefix matches names and titles; no prefix matches text inside documents; 'tag:' prefix matches tags. To constrain title and content together, send the title field with an unprefixed searchTerm - the only way to require both, since 'title:' consumes the whole term and searches no content. Route by intent: 'documents about X' -> unprefixed searchTerm; 'file named X' -> 'title:'; a person -> contentTypes ['people']; 'is X mentioned in <file>' -> one single mode 4 call (file name in title, X in searchTerm), where a match means the document contains it and an empty result set means it does not - answer it here, not by fetching and scanning the document's full text. Send fromDate 'any' for all dates, or a start date for newer content only. If a folder id is known, search it directly: for 'A and B both in folder id 21', send filterInstances [{"folderIds": ["21"]}], searchTerm 'A B', booleanOperation 'AND', contentTypes ['documents']. Page with startIndex and rowCount; no reliable total is returned, so stop when a page returns fewer than rowCount. API Endpoint: POST /20/search Returns: Dict with keys: - status_code: HTTP response status code - data: Response data (JSON or text) - headers: Response headers - url: Request URL - endpoint: API endpoint called - tool_name: Name of this tool - error: Error message (if failed)

Search or list the rows of one iSheet (returns row data) Search or list the rows (items) of one iSheet - a spreadsheet-like data register - returning matching rows with their cell values, up to 500 per call (default 100). Returns row data, not the iSheet's column definitions. Use it to list all rows, keyword-search across columns, filter by column conditions, fetch rows by item id, or read a row's current values before editing it. Requires the numeric iSheet id (no lookup by name); you can only read iSheets you have view access to. Put criteria in the request body - an empty body lists every row; all criteria combine with AND, so an item-id filter plus a keyword none of those rows match returns nothing (send an item-id filter alone to fetch exactly those rows). No total count is returned, so page with offset and stop as soon as a page returns fewer than limit rows - do not keep paging. A single matching row or column may serialize as an object rather than a one-element array, so parse defensively. API Endpoint: POST /20/isheet/{isheetid}/search Returns: Dict with keys: - status_code: HTTP response status code - data: Response data (JSON or text) - headers: Response headers - url: Request URL - endpoint: API endpoint called - tool_name: Name of this tool - error: Error message (if failed)