Template tools

Overview

Templates let your teams create workflows from a reviewed, reusable starting point instead of a raw repository URL. These tools cover:

• the marketplace templates your organization has subscribed to
• registering a git repository as an IaC template in your library
• configuring a template's revisions, and publishing them
• adding new revisions as your code evolves
• deleting revisions after reviewing the workflows that depend on them

To find and inspect templates in your library, see search_marketplace_templates and get_marketplace_template_by_id. For template concepts, see Library and Manage template revisions.

get_subscription is a read tool. The other four are write tools, see Availability. The write tools work with IaC templates owned by your organization.

Drafts, publishing and marketplace listing

Two separate one-way switches are easy to confuse, so the tools name them apart:

Switch	Applies to	What it means
Publish	One revision	The revision goes from draft to published. Its configuration is frozen from then on. It can't go back to draft, only be deprecated.
Visible to all orgs	The whole template	The template, including its repository URL, is listed for every organization on the platform. Only possible for public repositories. These tools can't turn it off again; de-list the template in the dashboard.

A new revision starts as a draft. Drafts are usable: workflows can be created from them, with a warning. Your assistant should ask you before turning on either switch.

get_subscription

Lists the marketplace templates your organization has subscribed to, which are the templates that appear in your dev portal. It returns each template's name, id, description, tags, kind, owner, verification status and when it was subscribed. It returns template metadata, not the templates' IaC code.

Input	Description
Template kinds	Any of: IaC templates, stack templates, policy templates, and workflow step templates. Default is all four.
Text search	Case-sensitive match on id, name, tags and short description.
Page size	Default 10, maximum 100, across all requested kinds together. Newest subscriptions first.

Example prompts

"Which policy templates are we subscribed to?"

"Do we have a Helm template for Redis in our subscriptions?"

create_workflow_template

Registers a git repository as an IaC template in your organization's library, with its first revision.

Input	Description
Name (required)	1–100 characters. Unless you give a custom id, the id comes from the name: a name made only of letters, digits, - and _ is used as is. Any other name is lowercased and given a random suffix.
Git source (required)	The repository, branch or tag, working directory, and whether it's public or private. Private repositories need a VCS connector or a vault secret holding a token. Generic git hosts accept a vault secret only.
IaC kind (required)	Terraform, OpenTofu, Ansible playbook, Helm, Kubectl, CloudFormation or Custom. It can't be changed later, so your assistant should ask rather than assume.
Short description, tags, context tags	Up to 25 tags.
Custom id	Use this instead of an id derived from the name. Recommended when a predictable id matters.
Share with organizations	Share the private template with specific other organizations.
Visible to all orgs	List it for every organization, see above. Off by default.

What you get

The first revision (:1) holds only the git source and the IaC kind. It's a skeleton: no input form, Terraform settings, environment variables or approvals yet. The response gives the template id to use with create_workflow.

The tool then stops and asks whether you want to configure revision 1. That's your decision, and you can do it with update_workflow_template.

• A Terraform or OpenTofu skeleton works as is: workflow inputs pass straight through as Terraform variables.
• Every other kind (Ansible playbook, Helm, Kubectl, CloudFormation or Custom) runs as a step pipeline. It needs steps before any workflow can be created from it.

Good to know

• If the name is already taken, the response names the existing template.
• If listing for all organizations fails after the template is created, the template stays private and the response tells you to retry.

Example prompts

"Register github.com/acme/tf-modules, folder modules/vpc, as a Terraform template called aws-vpc."

update_workflow_template

Edits a template, passing only the fields to change. What you can change depends on the target:

Target	What you can change
The template itself	Name, short description, tags, context tags, sharing with organizations, visibility to all orgs, git source settings, and automatic revisions on new git tags.
One revision (by number, or the latest)	The workflow configuration (input form, Terraform settings, custom steps, environment variables, default connector, approvals and runner), plus its alias, notes, documentation and deprecation. You can also publish it.

Tags, context tags and git source settings can be set on either the template or a draft revision. For other fields, if you send one to the wrong target, the tool explains where it belongs instead of silently ignoring it.

Rules the tool checks for you

• A published revision only accepts changes to its alias, notes, documentation and deprecation. To change its configuration, add a new revision with create_workflow_template_revision.
• Once a deprecation's effective date has passed, only the deprecation message and alias can change.
• A revision's repository, VCS provider and template name are fixed. Its git authentication can change only while it's a draft.
• A template from a private repository can't be made visible to all orgs.
• Creating revisions automatically on new git tags needs a private repository on GitHub.com (including a GitHub App connection) or GitLab.com.

Merge or replace

• Terraform settings, environment variables, context tags and git source settings are merged into what's stored. Environment variables are added or replaced by name.
• Lists inside the Terraform settings, such as lifecycle hooks, replace the stored list. To add a hook, send the existing ones too.
• Custom steps, the input form, tags, approvals and the list of shared organizations replace what's stored, so send the full list.

Example prompts

"Add an input form to revision 1 of aws-vpc with a required cidr_block field, then publish it."

"Deprecate revision 2 of aws-vpc from 1 December with the message 'Use revision 3'."

"Share the aws-vpc template with the acme-emea organization."

create_workflow_template_revision

Adds a new revision to an existing template, for example to point at a new git tag or to change the configuration. It's the only way to move a template forward once a revision is published.

Workflows stay pinned to the revision they were created from, so adding a revision never changes existing workflows. They move when someone upgrades them with update_workflow.

Input	Description
Template (required)	The template to add a revision to.
Based on	The revision to copy from: a revision number, or the latest (the default). It's only read, never changed.
Copy configuration	On by default: carry over the base revision's whole configuration, then apply your changes. Turn it off to start from the git source only.
Git source changes	Usually just a new branch, tag or commit. The repository itself is fixed for the template.
Alias, notes, documentation	A friendly unique name such as v2 or stable, and what changed.
Configuration changes	Input form, Terraform settings, custom steps, environment variables, default connector, approvals, runner and tags. Merged or replaced the same way as in update_workflow_template.
Publish	Off by default. The new revision is a draft unless you ask for it to be published.

Good to know

• The git source is always carried over from the base revision, so the new revision can check out code even when you change only the configuration.
• Alias, notes, deprecation and published status are never copied. The new revision starts as a fresh draft.
• The IaC kind always comes from the template and can't be changed.

Example prompts

"Create a new revision of aws-vpc from tag v2.0 with the note 'Adds IPv6 support'."

"Make a new revision of aws-vpc based on revision 3, but with Terraform 1.9."

delete_workflow_template

Permanently deletes one IaC template revision, or a template record that has no revisions left. There is no undo. Workflows still pinned to a deleted revision fail at their next run. Deleting the last revision also deletes the template record.

The assistant first asks for an impact report without confirming deletion. The tool returns the referencing workflows and warnings, and changes nothing. The assistant should show you the report and get explicit confirmation before deleting.

Input	Description
Template id (required)	The exact id found with the template search tools. Use a numbered revision such as /acme/aws-vpc:3, or /acme/aws-vpc for a record with no revisions. Display names aren't accepted.
Confirmation	Required to actually delete.

Good to know

• Draft revisions can be deleted. A published revision must first be deprecated, and its deprecation date must have passed.
• :latest can be used to request the impact report, but the confirmed deletion must name the revision number returned by that report.
• A template record with revisions can't be deleted directly. Delete its revisions individually; the last deletion removes the record too.
• The impact report includes workflows pinned by revision number or alias, and followers of :latest when the newest revision is being deleted. Those followers can fall back to an older revision if one remains.
• The report is partial: it covers only workflows you can read in your organization, can lag recent changes, and can return a sample. It doesn't cover other organizations using a shared template or stack templates referencing the revision. Review the report's coverage warnings before confirming.
• A failed platform request can still have deleted the revision. The tool rechecks the target and reports whether it is gone, still present or unknown. A partial result can mean the revision is gone but the template record still needs cleanup. Check the reported outcome before retrying.

Example prompts

"What would be affected if I deleted revision 2 of aws-vpc?"

"Delete revision 2 of aws-vpc after I review its impact report."