> For the complete documentation index, see [llms.txt](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/reference/workflow-trigger-data-elements.md).

# Workflow Trigger Data Elements

The data each workflow trigger makes available — the fields you can drop into a message, ticket, or webhook — plus the common elements present on every trigger.

When a [workflow](/mrecEO40m5D6bt7Pq5pE/operate/workflows.md) fires, Heeler builds a **context** for that event and hands it to your [actions](/mrecEO40m5D6bt7Pq5pE/operate/workflows/actions.md) — the message and ticket [templates](/mrecEO40m5D6bt7Pq5pE/operate/workflows/routing-and-templates.md) render against it, and a [webhook](/mrecEO40m5D6bt7Pq5pE/operate/workflows/actions.md#domain-actions) receives it as its JSON payload. This page lists the data elements each trigger exposes.

{% hint style="info" %}
You don't have to memorize these. The workflow builder's variable picker lists the elements for the trigger you chose and inserts the exact expression for you — including the `data.` prefix where a trigger uses one. This page is the reference behind that picker. For how the expressions render, see [Workflow Template Variables](/mrecEO40m5D6bt7Pq5pE/reference/workflow-template-variables.md).
{% endhint %}

## Common data elements

Every trigger's context carries these, whatever the event:

<table><thead><tr><th width="300">Element</th><th>Description</th></tr></thead><tbody><tr><td><code>workflow_name</code></td><td>The name of the workflow that's running.</td></tr><tr><td><code>workflow_id</code> / <code>workflow_execution_id</code></td><td>Identifiers for the workflow and this specific run.</td></tr><tr><td><code>tenant_id</code></td><td>Your Heeler tenant.</td></tr><tr><td><code>created_ticket</code> / <code>created_tickets</code></td><td>Populated after a ticketing action runs, so a later step can reference the ticket it just opened — see <a href="/mrecEO40m5D6bt7Pq5pE/reference/workflow-template-variables.md#referring-to-an-earlier-step">Referring to an earlier step</a>.</td></tr></tbody></table>

## Shared field groups

Several triggers include the repository and module the event came from. Rather than repeat them under every trigger, they're defined once here; a trigger's section notes when it carries them. Where a trigger namespaces its context under `data.`, these expressions take the same prefix (e.g. `{{ data.resource.full_name }}`).

**Repository fields**

<table><thead><tr><th width="330">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>resource.full_name</code></td><td>Full repository name</td></tr><tr><td><code>resource.html_url</code></td><td>Repository URL</td></tr><tr><td><code>resource.visibility</code></td><td>Public / private</td></tr><tr><td><code>resource.language</code></td><td>Primary language</td></tr><tr><td><code>resource.default_branch</code></td><td>Default branch</td></tr></tbody></table>

**Module fields**

<table><thead><tr><th width="330">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>code_root.url</code></td><td>Module URL</td></tr><tr><td><code>code_root.path</code> / <code>code_root.file</code></td><td>Module path and manifest file</td></tr><tr><td><code>code_root.package_manager</code> / <code>code_root.package_ecosystem</code></td><td>Package manager and ecosystem</td></tr><tr><td><code>code_root.tier_name</code> / <code>code_root.environment_name</code></td><td>Business tier and environment (humanized)</td></tr><tr><td><code>code_root.artifact_name</code></td><td>Artifact name</td></tr></tbody></table>

## By trigger

Each trigger below lists the field groups unique to it. Expressions are shown exactly as the picker inserts them.

### New Finding Detected

*Finding — identity & status*

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>data.finding.vuln_id</code></td><td>Vulnerability ID</td></tr><tr><td><code>data.finding.url</code></td><td>Finding URL in Heeler</td></tr><tr><td><code>data.finding.package_name</code> / <code>data.finding.package_version</code></td><td>Affected package and version</td></tr><tr><td><code>data.finding.severity</code></td><td>Severity — <code>CRITICAL</code> / <code>HIGH</code> / <code>MEDIUM</code> / <code>LOW</code></td></tr><tr><td><code>data.finding.created_at</code> / <code>data.finding.updated_at</code></td><td>First detected / last updated</td></tr></tbody></table>

*Finding — Heeler Risk & exposure* — the signals you'll most often build conditions on:

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>data.finding.risk</code> / <code>data.finding.risk_original</code></td><td>Heeler Risk (1 = Defer, 2 = Plan, 3 = Urgent); original value before any override</td></tr><tr><td><code>data.finding.business_impact</code></td><td>1 = Low, 2 = Medium, 3 = High</td></tr><tr><td><code>data.finding.threat_impact</code></td><td>1 = Likely-not, 2 = Possibly, 3 = Actively exploited</td></tr><tr><td><code>data.finding.tier</code></td><td>Repo tier: 0 = Tier 4 … 3 = Tier 1</td></tr><tr><td><code>data.finding.environment</code></td><td>Deployment-environment impact</td></tr><tr><td><code>data.finding.accessibility</code></td><td>Reachable from the attack surface (bool)</td></tr><tr><td><code>data.finding.exploitability</code></td><td>A known exploit exists (bool)</td></tr><tr><td><code>data.finding.runtime</code></td><td>Loaded at runtime (bool)</td></tr><tr><td><code>data.finding.chaining</code></td><td>Part of an exploit chain (bool)</td></tr><tr><td><code>data.finding.compromise</code></td><td>1 = None, 2 = Partial, 3 = Total</td></tr><tr><td><code>data.finding.mitigated</code></td><td>A mitigation is in place (bool)</td></tr></tbody></table>

*Finding — SLO & overrides*

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>data.finding.slo_due_date</code> / <code>data.finding.slo_started_at</code></td><td>SLO due date / clock start</td></tr><tr><td><code>data.finding.slo_days_until_expiry</code></td><td>Days left until the SLO due date</td></tr><tr><td><code>data.finding.slo_override</code></td><td>Active SLO-override reason, if any</td></tr><tr><td><code>data.finding.mitigation_override</code></td><td>Active risk-override reason, if any</td></tr><tr><td><code>data.finding.mitigation_days_until_expiry</code></td><td>Days until that override expires</td></tr></tbody></table>

*Finding — fix tracking*

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>data.finding.autofixed</code></td><td>Heeler auto-applied a fix (bool)</td></tr><tr><td><code>data.finding.fixed_at</code> / <code>data.finding.fix_committer</code></td><td>When / who resolved it</td></tr><tr><td><code>data.finding.earliest_fix_deployed_at</code> / <code>data.finding.latest_fix_deployed_at</code></td><td>Fix first / most recently observed in a deployment</td></tr></tbody></table>

*Vulnerability*

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>data.vulnerability.title</code> / <code>data.vulnerability.description</code></td><td>Advisory title and description</td></tr><tr><td><code>data.vulnerability.severity</code> / <code>data.vulnerability.cvss_score</code> / <code>data.vulnerability.cvss_vector</code></td><td>Severity, CVSS score, and vector</td></tr><tr><td><code>data.vulnerability.epss</code></td><td>EPSS probability of in-the-wild exploitation</td></tr><tr><td><code>data.vulnerability.cwe_ids</code></td><td>Associated CWEs (array)</td></tr><tr><td><code>data.vulnerability.published_at</code></td><td>Published date</td></tr><tr><td><code>data.vulnerability.vulnerable_versions | join(', ')</code></td><td>Affected version ranges</td></tr><tr><td><code>data.vulnerability.fixed_versions | join(', ')</code></td><td>Fixed versions</td></tr></tbody></table>

*Dependency* (`data.dependency_version.*`)

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>.name</code> / <code>.version</code> / <code>.version_constraint</code></td><td>Package, installed version, and declared constraint</td></tr><tr><td><code>.is_direct</code></td><td>Direct vs transitive (bool)</td></tr><tr><td><code>.found_in_code</code> / <code>.found_at_runtime</code></td><td>Present in source / observed at runtime (bool)</td></tr><tr><td><code>.introduced_at</code> / <code>.introduced_changeset</code> / <code>.introduced_committer</code></td><td>When, which commit, and who introduced it</td></tr><tr><td><code>.first_seen_at</code> / <code>.most_recently_seen_at</code> / <code>.pin_status</code></td><td>First and most-recent observation; pinning status</td></tr></tbody></table>

Plus **Repository** and **Module** fields (under the `data.` prefix).

### New Finding Fix Available

*Finding:* `data.finding.vuln_id`, `data.finding.url`, `data.finding.package_name`, `data.finding.package_version`. *Vulnerability:* `data.vulnerability.title`, `data.vulnerability.severity`, `data.vulnerability.cvss_score`, `data.vulnerability.fixed_versions | join(', ')`. Plus **Repository** and **Module** fields (`data.` prefix).

### New Remediation Available

*Remediation*

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>remediation.url</code></td><td>Remediation URL</td></tr><tr><td><code>remediation.package_name</code></td><td>Package being upgraded</td></tr><tr><td><code>remediation.solution.action</code></td><td>Solution action (e.g. upgrade)</td></tr><tr><td><code>remediation.solution.complexity</code></td><td>Solution complexity</td></tr><tr><td><code>remediation.solution.details</code></td><td>Human-readable solution details</td></tr><tr><td><code>remediation.solution.fixed_vulnerabilities</code></td><td>Vulnerabilities this remediation resolves</td></tr><tr><td><code>remediation.solution.additional_actions</code></td><td>Any additional actions required</td></tr></tbody></table>

*Findings fixed by this remediation:* `findings[0].vuln_id`, `findings[0].severity`, and `findings` (the full list). Plus **Repository**, **Module** (with `code_root.dependencies`), and **Team** (`team.name`).

### New Compromised Dependency

*Malicious Package*

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>malicious_package.name</code> / <code>malicious_package.version</code> / <code>malicious_package.version_range</code></td><td>Package identity</td></tr><tr><td><code>malicious_package.osv_id</code></td><td>OSV advisory ID</td></tr><tr><td><code>malicious_package.published</code> / <code>malicious_package.modified</code></td><td>Advisory dates</td></tr><tr><td><code>malicious_package.summary</code> / <code>malicious_package.details</code></td><td>Advisory summary and details</td></tr><tr><td><code>malicious_package.references</code></td><td>Reference links</td></tr></tbody></table>

*Dependency:* `dependency_version.first_seen_at`. Plus **Repository** and **Module** fields.

### New SAST Finding Detected

*SAST Finding*

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>sast_finding.rule_name</code> / <code>sast_finding.rule_category</code></td><td>Rule and category</td></tr><tr><td><code>sast_finding.finding_lane</code></td><td>The finding's lane — Indicator of Compromise, Vulnerability (CWE), Supply Chain, or Code Quality. The same dimension the <a href="/mrecEO40m5D6bt7Pq5pE/operate/workflows/conditions.md">Finding Lane</a> condition filters on. SAST only; the IaC trigger carries <code>resource_type</code> in its place.</td></tr><tr><td><code>sast_finding.severity</code> / <code>sast_finding.confidence</code></td><td>Severity and confidence</td></tr><tr><td><code>sast_finding.file_path</code> / <code>sast_finding.source_url</code></td><td>File and source location</td></tr><tr><td><code>sast_finding.language</code></td><td>Language</td></tr><tr><td><code>sast_finding.code_snippet[:500]</code> / <code>[:1000]</code></td><td>Offending code snippet (short / long)</td></tr></tbody></table>

Plus **Repository** fields.

### New IaC Finding Detected

*IaC Finding*

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>sast_finding.rule_name</code> / <code>sast_finding.rule_category</code></td><td>Rule and category</td></tr><tr><td><code>sast_finding.resource_type</code></td><td>The resource the rule was evaluated against, for example <code>aws_s3_bucket</code></td></tr><tr><td><code>sast_finding.severity</code> / <code>sast_finding.confidence</code></td><td>Severity and confidence</td></tr><tr><td><code>sast_finding.file_path</code> / <code>sast_finding.source_url</code></td><td>Template file and source location</td></tr><tr><td><code>sast_finding.language</code></td><td>Framework — Terraform, OpenTofu, CloudFormation, Kubernetes, or Pulumi</td></tr><tr><td><code>sast_finding.code_snippet[:500]</code> / <code>[:1000]</code></td><td>Offending template snippet (short / long)</td></tr></tbody></table>

Plus **Repository** fields.

### New Secret Detected

*Secret*

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>secret.validation_selection</code></td><td>The finding's action bucket: Rotate Now, Rotate, Triage, No Action or Expected.</td></tr><tr><td><code>secret.file_path</code> / <code>secret.file_url</code></td><td>Where the secret was found</td></tr><tr><td><code>secret.rule_id</code></td><td>Detection rule</td></tr><tr><td><code>secret.confidence</code></td><td>Detection confidence</td></tr><tr><td><code>secret.validation_status</code></td><td>Validation result (active / inactive / not attempted / unknown)</td></tr><tr><td><code>secret.git_command</code></td><td>Git command to locate the commit</td></tr><tr><td><code>secret.exception_status</code></td><td>Whether it's exempted by policy (e.g. <code>NO_EXCEPTION</code>)</td></tr><tr><td><code>secret.language</code></td><td>Language of the containing file</td></tr><tr><td><code>secret.git_commit_id</code></td><td>Commit SHA where it was introduced</td></tr><tr><td><code>(secret.validation_response or "None")[:500]</code></td><td>Validation response, truncated</td></tr></tbody></table>

Plus **Repository** fields, with the repository URL available as `repository_url`.

### Dependency License Violation

*License Violation*

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>license_violation.license_name</code></td><td>Full license identifier — the combined form for multi-license packages (e.g. <code>GPL-3.0 OR MIT</code>)</td></tr><tr><td><code>license_violation.licenses</code></td><td>The individual license identifiers as an array (more than one when the package offers a choice)</td></tr><tr><td><code>license_violation.operand</code></td><td>How multiple licenses combine — <code>OR</code> or <code>AND</code>; null for a single license</td></tr><tr><td><code>license_violation.package_name</code> / <code>license_violation.package_ecosystem</code></td><td>The offending package and its ecosystem</td></tr><tr><td><code>license_violation.url</code></td><td>Link to the dependency in Heeler</td></tr></tbody></table>

*Dependency*

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>dependency_version.name</code> / <code>dependency_version.version</code></td><td>Package and version</td></tr><tr><td><code>dependency_version.first_seen_at</code></td><td>First observed</td></tr><tr><td><code>dependency_version.is_direct</code></td><td>Direct vs transitive</td></tr><tr><td><code>dependency_version.introduced_changeset</code> / <code>…_url</code></td><td>Commit that introduced it</td></tr><tr><td><code>dependency_version.introduced_file_url</code> / <code>last_seen_file_url</code></td><td>Manifest at first- and most-recently-observed revision</td></tr></tbody></table>

Plus **Repository** and **Module** fields (module includes `code_root.file_url`).

### New At-Risk Agent File Detected

*Agent File*

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>agent_file_risk.path</code></td><td>File path</td></tr><tr><td><code>agent_file_risk.kind</code></td><td>Kind (config, hook script, instructions, skill, subagent)</td></tr><tr><td><code>agent_file_risk.score</code></td><td>Safety score</td></tr><tr><td><code>agent_file_risk.assessed_intent</code> / <code>…_summary</code> / <code>…_confidence</code></td><td>Assessed intent, its summary, and confidence</td></tr><tr><td><code>agent_file_risk.url</code></td><td>Heeler URL</td></tr></tbody></table>

Plus **Repository** fields.

### PR Merged with Unresolved Guardrail Violations

*Pull Request*

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>pull_request.pr_identifier</code></td><td>PR number</td></tr><tr><td><code>pull_request.repository_owner</code> / <code>pull_request.repository</code></td><td>Repository owner and name</td></tr><tr><td><code>pull_request.repository_type</code></td><td>SCM provider</td></tr><tr><td><code>pull_request.contributor</code></td><td>Who merged it</td></tr><tr><td><code>pull_request.feature_branch</code> / <code>pull_request.base_branch</code></td><td>Branches</td></tr><tr><td><code>pull_request.merged_at</code></td><td>Merge time</td></tr><tr><td><code>pull_request.pr_url</code> / <code>repo_url</code> / <code>heeler_url</code></td><td>Links to the PR, repo, and Heeler</td></tr></tbody></table>

*Summary*

<table><thead><tr><th width="360">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>summary.total_unresolved</code></td><td>Total unresolved violations</td></tr><tr><td><code>summary.block_count</code> / <code>summary.warn_count</code></td><td>Block- and warn-level counts</td></tr><tr><td><code>summary.branch_protection_circumvented</code></td><td>Whether a block-level violation was circumvented</td></tr><tr><td><code>summary.guardrail_names</code> / <code>summary.rule_categories</code></td><td>Which guardrails and categories fired</td></tr></tbody></table>

*Violations:* `violations` (the full list, to iterate over).

### Overrides and SLOs

**New Finding Override** — *Finding:* `data.finding.vuln_id`, `data.finding.url`, `data.finding.severity`, `data.finding.risk`, `data.finding.package_name`, `data.finding.slo_due_date`. *Override:* `data.finding.override_note.type`, `data.finding.override_note.details.reason`, `data.finding.override_note.text`. Plus **Repository** fields and **Created By** (`data.created_by.name`, `data.created_by.email`).

**Finding Override Expiration** — *Finding:* as above plus `data.finding.slo_days_until_expiry` and `data.finding.mitigation_days_until_expiry`. Plus **Repository** and **Module** fields.

When the expiring override was on a **SAST** finding, the context carries a *SAST Finding* group in place of the dependency one: `data.sast_finding.url`, `…risk`, `…slo_due_date`, `…slo_days_until_expiry`, `…mitigation_reason`, `…mitigation_expires_at`, `…mitigation_days_until_expiry`. A template on this trigger should handle whichever group it receives, or the workflow should be scoped to one kind with a condition.

**SLO Expiring** — *Finding:* `data.finding.vuln_id`, `data.finding.url`, `data.finding.severity`, `data.finding.risk`, `data.finding.package_name`, `data.finding.slo_due_date`, `data.finding.slo_days_until_expiry`, `data.finding.slo_override`. Plus **Repository** and **Module** fields.

**New License Violation Override** / **License Violation Override Expiration** — *License Override:* `data.license_override.package_name`, `…package_ecosystem`, `…reason`, `…description`, `…expires_at`. New-override also carries an *Override Note* (`data.license_override.override_note.type` — `LICENSE_OVERRIDE` on apply, `LICENSE_OVERRIDE_REMOVED` on remove — and `…override_note.text`) and **Set By** (`data.created_by.name` / `.email`). Plus **Repository** and **Module** fields.

### Repository lifecycle

**New Repository Discovered** — *Repository:* `resource.full_name`, `resource.html_url`, `resource.visibility`, `resource.language`, `resource.default_branch`. *Team:* `team.name`.

**Repository Deleted** — *Repository:* `resource.full_name`, `resource.source`, `resource.organization_name`, `resource.repository_name`.

**Repository Renamed** — this trigger's fields sit at the top level of the context, with no `resource.` prefix. Write `{{ full_name }}`, not `{{ resource.full_name }}`, so the current and previous names are rendered in the same notation.

<table><thead><tr><th width="330">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>full_name</code></td><td>Full repository name after the rename</td></tr><tr><td><code>organization_name</code> / <code>repository_name</code></td><td>The two parts of that name</td></tr><tr><td><code>previous_full_name</code></td><td>Full repository name before the rename</td></tr><tr><td><code>previous_organization_name</code> / <code>previous_repository_name</code></td><td>The two parts of the previous name</td></tr><tr><td><code>previous_repository_id</code></td><td>The repository's identifier before the rename</td></tr><tr><td><code>source</code></td><td>SCM provider</td></tr></tbody></table>

## Related

* [Workflow Template Variables](/mrecEO40m5D6bt7Pq5pE/reference/workflow-template-variables.md) — how to use these fields in message and ticket templates.
* [Conditions](/mrecEO40m5D6bt7Pq5pE/operate/workflows/conditions.md) — the filters built on this same data.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/reference/workflow-trigger-data-elements.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.