fix(integrations): close regressions found in the final validation sweep

An independent read-only audit of the eight integrations merged to staging
today found defects in every one, most of them side effects of the surgery
those PRs performed on already-shipped code.

Data loss and destructive paths:
- cloudflare: restore the shipped subBlock ids on read filters so existing
  workflows keep their DNS/zone/purge filters. Losing them made
  list_dns_records return the entire zone with success: true, which a
  downstream delete fan-out would then target. The colliding write controls
  are renamed instead, chosen by blast radius.
- cloudflare: refuse an update_ruleset_rule that would tear down the rule it
  edits. PATCH is a replace, so an omitted action_parameters unbound the WAF
  managed ruleset and every override under it.
- cloudflare: split the hidden `enabled` control so a value set while drafting
  can no longer disable a live WAF or rate-limiting rule.
- cloudflare: stop `name` leaking into update_dns_record and renaming a live record.
- okta: stop a blank name overwriting a stored group name via the LLM path.
  The block guard covered only the UI.

Broken on the default path:
- microsoft_ad: update_user sent accountEnabled: "" on its own default, so
  every call left at "No Change" failed. Same tri-state defect already fixed
  for forceChangePasswordNextSignInWithMfa; `visibility` fixed alongside it.
- cloudflare: `domain` is required for self_hosted (the default app type),
  ssh, vnc and rdp; add saas_app/target_criteria and drop dash_sso, which has
  no request variant.

Silent wrong results:
- datadog: list_monitors inherited Create Monitor's tag filter and returned a
  filtered list as if complete.
- servicenow: `fields` carried both a JSON body and a projection on the three
  legacy generic operations. The regression test for this fed already-JSON and
  could not fail; it now feeds a real projection.
- splunk: cancel_search_job reported failure on success by parsing an XML body
  as JSON; readSplunkJson now tolerates it.
- okta: sendEmail === true dropped a string 'true', silently skipping the
  deactivation email.

Security:
- mssql: add writetext/updatetext/readtext to the statement screen. \bupdate\b
  cannot match UPDATETEXT, so both were reachable through the read-only path.
- crowdstrike: chunk repeated-query ids. At the published caps a single request
  built a ~68 KB query string, past typical proxy limits.

Also: splunk count=0 unbounded read, splunk pagination totals, the `nobody`
placeholder that reintroduced the namespace bug by copy-paste, okta cursor and
activate controls split per operation, servicenow sysparm_having syntax and two
required controls no longer pre-seeded with consequential values, datadog block
outputs reconciled with tool outputs, and 16 escaped apostrophes that corrupted
the published Entra docs.

One scope removed from microsoft_ad (User.Read.All). Directory.Read.All and
GroupMember.ReadWrite.All were proposed for removal and verified still required;
a test now asserts they stay.

Author: waleedlatif1

apps/docs/content/docs/en/integrations/cloudflare.mdx

@@ -494,7 +494,7 @@ Gets DNS analytics report for a zone including query counts and trends.
 | `zoneId` | string | Yes | The zone ID to get DNS analytics for |
 | `since` | string | No | Start date for analytics \(ISO 8601, e.g., "2024-01-01T00:00:00Z"\) or relative \(e.g., "-6h"\) |
 | `until` | string | No | End date for analytics \(ISO 8601, e.g., "2024-01-31T23:59:59Z"\) or relative \(e.g., "now"\) |
-| `metrics` | string | Yes | Comma-separated metrics to retrieve \(e.g., "queryCount,uncachedCount,staleCount,responseTimeAvg,responseTimeMedian,responseTime90th,responseTime99th"\) |
+| `metrics` | string | No | Comma-separated metrics to retrieve \(e.g., "queryCount,uncachedCount,staleCount,responseTimeAvg,responseTimeMedian,responseTime90th,responseTime99th"\). Optional — Cloudflare returns its default metric set when it is omitted |
 | `dimensions` | string | No | Comma-separated dimensions to group by \(e.g., "queryName,queryType,responseCode,responseCached,coloName,origin,dayOfWeek,tcp,ipVersion,querySizeBucket,responseSizeBucket"\) |
 | `filters` | string | No | Filters to apply to the data \(e.g., "queryType==A"\) |
 | `sort` | string | No | Sort order for the result set. Fields must be included in metrics or dimensions \(e.g., "+queryCount" or "-responseTimeAvg"\) |
@@ -678,7 +678,7 @@ Creates a zone ruleset for a phase, optionally seeded with its first rules. Use
 | `zoneId` | string | Yes | The zone ID to create the ruleset in |
 | `name` | string | Yes | Human-readable name for the ruleset |
 | `phase` | string | Yes | The ruleset phase, e.g. http_ratelimit, http_request_firewall_custom, http_request_firewall_managed, http_request_transform, http_request_dynamic_redirect |
-| `kind` | string | No | Ruleset kind: zone, custom, managed, or root. Use zone to create a phase entry point ruleset. Defaults to zone |
+| `kind` | string | No | Ruleset kind: zone or custom. Use zone to create a phase entry point ruleset and custom for a ruleset an execute rule deploys. Defaults to zone. "root" is the account-level phase entry point and "managed" is Cloudflare-owned, so neither can be created on this zone-scoped endpoint |
 | `description` | string | No | Description of the ruleset |
 | `rules` | json | No | JSON array of rules to seed the ruleset with, in evaluation order. Each rule takes action, expression, and optionally description, enabled, action_parameters, and ratelimit |
 | `apiKey` | string | Yes | Cloudflare API Token |
@@ -767,8 +767,8 @@ Updates a rule in a zone ruleset. Cloudflare replaces the rule definition rather
 | `expression` | string | Yes | Cloudflare filter expression selecting matching requests. Required because this endpoint replaces the rule definition — omitting it resets the stored expression |
 | `description` | string | No | Human-readable description of the rule |
 | `enabled` | boolean | No | Whether the rule is enabled |
-| `ref` | string | No | Reference tag that stays stable across rule updates |
-| `actionParameters` | string | No | JSON object of action-specific parameters, e.g. \{"id":"<MANAGED_RULESET_ID>","overrides":\{"rules":\[\{"id":"<RULE_ID>","action":"log","enabled":true,"score_threshold":40\}\]\}\} |
+| `ref` | string | No | Reference tag that stays stable across rule updates. Because the update replaces the rule, omitting it resets the tag to the rule ID and breaks anything matching on the old value |
+| `actionParameters` | string | No | JSON object of action-specific parameters, e.g. \{"id":"<MANAGED_RULESET_ID>","overrides":\{"rules":\[\{"id":"<RULE_ID>","action":"log","enabled":true,"score_threshold":40\}\]\}\}. Required on an execute rule and must be sent on every update: the endpoint replaces the rule, so omitting it resets action_parameters to \{\} — which unbinds the managed ruleset the rule deploys and every override under it |
 | `ratelimit` | string | No | JSON rate limiting configuration to preserve on a rule in the http_ratelimit phase, e.g. \{"characteristics":\["cf.colo.id","ip.src"\],"period":60,"requests_per_period":100\}. Because the update replaces the rule, omitting this on a rate limiting rule stops it rate limiting |
 | `logging` | string | No | JSON logging configuration to preserve, e.g. \{"enabled":true\}. Omitting it on a rule that had logging configured resets it to the default |
 | `apiKey` | string | Yes | Cloudflare API Token |
@@ -1075,8 +1075,8 @@ Creates a Cloudflare Access (Zero Trust) application that puts an identity check
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
 | `accountId` | string | Yes | The Cloudflare account ID. Access applications are account-scoped |
-| `type` | string | Yes | Application type: self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, dash_sso, infrastructure, rdp, mcp, mcp_portal, or proxy_endpoint |
-| `domain` | string | No | The primary hostname and path secured by Access, e.g. internal.example.com or example.com/admin. Required for the self_hosted, ssh, vnc, rdp, and bookmark types; the saas, app_launcher, warp, biso, dash_sso, infrastructure, mcp, mcp_portal, and proxy_endpoint types do not accept it |
+| `type` | string | Yes | Application type: self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, infrastructure, rdp, mcp, mcp_portal, or proxy_endpoint. dash_sso has no request variant and cannot be created through the API |
+| `domain` | string | No | The primary hostname and path secured by Access, e.g. internal.example.com or example.com/admin. Required for the self_hosted, ssh, vnc, and rdp types; optional for bookmark and mcp_portal; read-only for app_launcher, warp, biso, and proxy_endpoint; and absent from the saas, infrastructure, and mcp variants |
 | `name` | string | No | Friendly name shown in the dashboard and App Launcher |
 | `sessionDuration` | string | No | How long an Access session stays valid, e.g. 24h or 30m |
 | `allowedIdps` | string | No | Comma-separated identity provider IDs users may authenticate with. Leave empty to allow all configured providers |
@@ -1087,6 +1087,8 @@ Creates a Cloudflare Access (Zero Trust) application that puts an identity check
 | `logoUrl` | string | No | Logo image URL shown in the dashboard and App Launcher |
 | `tags` | string | No | Comma-separated tag names categorizing the application |
 | `policies` | string | No | JSON array of policies to attach. Entries may be reusable policy IDs or inline policy objects, e.g. \["<POLICY_ID>"\] |
+| `saasApp` | string | No | JSON SaaS configuration, required for the saas type and rejected on every other type. SAML, e.g. \{"auth_type":"saml","consumer_service_url":"https://example.com/acs","sp_entity_id":"https://example.com"\}; OIDC, e.g. \{"auth_type":"oidc","client_id":"...","redirect_uris":\["https://example.com/callback"\]\} |
+| `targetCriteria` | string | No | JSON array of infrastructure target criteria, required for the infrastructure and rdp types and rejected on every other type, e.g. \[\{"port":22,"protocol":"SSH","target_attributes":\{"hostname":\["production"\]\}\}\] |
 | `apiKey` | string | Yes | Cloudflare API Token |
 
 #### Output
@@ -1120,8 +1122,8 @@ Updates a Cloudflare Access (Zero Trust) application. This replaces the applicat
 | --------- | ---- | -------- | ----------- |
 | `accountId` | string | Yes | The Cloudflare account ID. Access applications are account-scoped |
 | `appId` | string | Yes | The Access application ID to update |
-| `type` | string | Yes | Application type: self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, dash_sso, infrastructure, rdp, mcp, mcp_portal, or proxy_endpoint |
-| `domain` | string | No | The primary hostname and path secured by Access. Required for the self_hosted, ssh, vnc, rdp, and bookmark types; the saas, app_launcher, warp, biso, dash_sso, infrastructure, mcp, mcp_portal, and proxy_endpoint types do not accept it |
+| `type` | string | Yes | Application type: self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, infrastructure, rdp, mcp, mcp_portal, or proxy_endpoint. dash_sso has no request variant and cannot be written through the API |
+| `domain` | string | No | The primary hostname and path secured by Access. Required for the self_hosted, ssh, vnc, and rdp types; optional for bookmark and mcp_portal; read-only for app_launcher, warp, biso, and proxy_endpoint; and absent from the saas, infrastructure, and mcp variants |
 | `name` | string | No | Friendly name shown in the dashboard and App Launcher |
 | `sessionDuration` | string | No | How long an Access session stays valid, e.g. 24h or 30m |
 | `allowedIdps` | string | No | Comma-separated identity provider IDs users may authenticate with |
@@ -1131,6 +1133,8 @@ Updates a Cloudflare Access (Zero Trust) application. This replaces the applicat
 | `customDenyUrl` | string | No | URL denied users are redirected to |
 | `logoUrl` | string | No | Logo image URL shown in the dashboard and App Launcher |
 | `tags` | string | No | Comma-separated tag names categorizing the application |
+| `saasApp` | string | No | JSON SaaS configuration, required for the saas type and rejected on every other type. SAML, e.g. \{"auth_type":"saml","consumer_service_url":"https://example.com/acs","sp_entity_id":"https://example.com"\}; OIDC, e.g. \{"auth_type":"oidc","client_id":"...","redirect_uris":\["https://example.com/callback"\]\} |
+| `targetCriteria` | string | No | JSON array of infrastructure target criteria, required for the infrastructure and rdp types and rejected on every other type, e.g. \[\{"port":22,"protocol":"SSH","target_attributes":\{"hostname":\["production"\]\}\}\] |
 | `policies` | string | No | JSON array of policies to attach. Entries may be reusable policy IDs or inline policy objects |
 | `apiKey` | string | Yes | Cloudflare API Token |
 
@@ -1224,7 +1228,7 @@ Creates a Cloudflare Access (Zero Trust) policy on an application, deciding who
 | `exclude` | string | No | JSON array of Access rules evaluated with NOT logic — matching any one rejects the request |
 | `require` | string | No | JSON array of Access rules evaluated with AND logic — all of them must match |
 | `precedence` | number | No | Evaluation order of the policy within the application |
-| `sessionDuration` | string | No | How long a session granted by this policy stays valid, e.g. 24h |
+| `sessionDuration` | string | No | How long a session granted by this policy stays valid, e.g. 24h. Leave it unset on a policy attached to an infrastructure-typed application — Cloudflare rejects those with error 12130 |
 | `approvalRequired` | boolean | No | Whether an approver must grant each access request |
 | `isolationRequired` | boolean | No | Whether the session must run in a remote isolated browser |
 | `purposeJustificationRequired` | boolean | No | Whether users must state a reason for access |
@@ -1267,7 +1271,7 @@ Updates a Cloudflare Access (Zero Trust) policy on an application. This replaces
 | `exclude` | string | No | JSON array of Access rules evaluated with NOT logic |
 | `require` | string | No | JSON array of Access rules evaluated with AND logic |
 | `precedence` | number | No | Evaluation order of the policy within the application |
-| `sessionDuration` | string | No | How long a session granted by this policy stays valid, e.g. 24h |
+| `sessionDuration` | string | No | How long a session granted by this policy stays valid, e.g. 24h. Leave it unset on a policy attached to an infrastructure-typed application — Cloudflare rejects those with error 12130 |
 | `approvalRequired` | boolean | No | Whether an approver must grant each access request |
 | `isolationRequired` | boolean | No | Whether the session must run in a remote isolated browser |
 | `purposeJustificationRequired` | boolean | No | Whether users must state a reason for access |

apps/docs/content/docs/en/integrations/crowdstrike.mdx

@@ -148,7 +148,7 @@ Close an open CrowdStrike Falcon Real Time Response session (DELETE /real-time-r
 
 ### CrowdStrike Execute RTR Command
 
-Run a read-only Real Time Response command in an open CrowdStrike Falcon session (POST /real-time-response/entities/command/v1). baseCommand names the family only (cat, cd, clear, csrutil, env, eventlog, filehash, getsid, help, history, ipconfig, ls, mount, netstat, ps, reg); subcommands go in commandString. Host-modifying commands need the Active Responder or Admin endpoints. Requires the "Real time response: Read" API scope.
+Run a read-only Real Time Response command in an open CrowdStrike Falcon session (POST /real-time-response/entities/command/v1). baseCommand names the family only (cat, cd, clear, csrutil, env, eventlog, filehash, getsid, help, history, ifconfig, ipconfig, ls, mount, netstat, ps, reg, users); subcommands go in commandString. Host-modifying commands need the Active Responder or Admin endpoints. Requires the "Real time response: Read" API scope.
 
 #### Input
 
@@ -158,7 +158,7 @@ Run a read-only Real Time Response command in an open CrowdStrike Falcon session
 | `clientSecret` | string | Yes | CrowdStrike Falcon API client secret |
 | `cloud` | string | Yes | CrowdStrike Falcon cloud region |
 | `sessionId` | string | Yes | RTR session ID returned by Init RTR Session |
-| `baseCommand` | string | Yes | Read-only RTR base command family, one of: cat, cd, clear, csrutil, env, eventlog, filehash, getsid, help, history, ipconfig, ls, mount, netstat, ps, reg. Subcommands belong in commandString, not here. |
+| `baseCommand` | string | Yes | Read-only RTR base command family, one of: cat, cd, clear, csrutil, env, eventlog, filehash, getsid, help, history, ifconfig, ipconfig, ls, mount, netstat, ps, reg, users. Subcommands belong in commandString, not here — and only reg query is read-tier, since reg set and reg delete are Active Responder commands. |
 | `commandString` | string | Yes | Full command line to run, such as "ls C:\\Windows" or "reg query HKLM\\Software" |
 
 #### Output
@@ -501,6 +501,10 @@ Get CrowdStrike Identity Protection sensor details for one or more device IDs (P
 |   ↳ `statusCauses` | array | Documented causes behind the current status |
 |   ↳ `tiEnabled` | string | Threat intelligence enablement status |
 | `count` | number | Number of sensors returned |
+| `pagination` | json | Pagination metadata \(limit, offset, total\) |
+|   ↳ `limit` | number | Page size used for the query |
+|   ↳ `offset` | number | Offset returned by CrowdStrike |
+|   ↳ `total` | number | Total records available |
 | `errors` | array | Errors CrowdStrike returned alongside a partially successful response |
 |   ↳ `code` | number | CrowdStrike error code |
 |   ↳ `id` | string | Identifier the error applies to |
@@ -676,7 +680,7 @@ Add hosts to or remove hosts from a CrowdStrike Falcon static host group (POST /
 
 ### CrowdStrike Query Alerts
 
-Search CrowdStrike Falcon alerts with a Falcon Query Language filter and return their composite IDs. Uses the current Alerts API (GET /alerts/queries/alerts/v2), which supersedes the deprecated Detects API. Requires the "Alerts: Read" API scope.
+Search CrowdStrike Falcon alerts with a Falcon Query Language filter and return their composite IDs. Uses the current Alerts API (GET /alerts/queries/alerts/v2), which replaced the Detects API decommissioned on September 30, 2025. Requires the "Alerts: Read" API scope.
 
 #### Input
 
@@ -902,7 +906,7 @@ Update CrowdStrike Falcon alerts by composite ID: change status, assign or unass
 
 ### CrowdStrike Update Indicators
 
-Update custom CrowdStrike Falcon indicators of compromise by ID (PATCH /iocs/entities/indicators/v1). DESTRUCTIVE: CrowdStrike blanks out any field you omit, so read each indicator with crowdstrike_get_indicator_details first and resend its full field set with your edits applied. Changing action or scope changes prevention behavior fleet-wide. type and value are immutable. Requires the "IOC Management: Write" API scope.
+Update custom CrowdStrike Falcon indicators of compromise by ID (PATCH /iocs/entities/indicators/v1). DESTRUCTIVE: omitted fields may be cleared, so read each indicator with crowdstrike_get_indicator_details first and resend its full field set with your edits applied. Changing action or scope changes prevention behavior fleet-wide. type and value are immutable. Requires the "IOC Management: Write" API scope.
 
 #### Input
 
@@ -911,7 +915,7 @@ Update custom CrowdStrike Falcon indicators of compromise by ID (PATCH /iocs/ent
 | `clientId` | string | Yes | CrowdStrike Falcon API client ID |
 | `clientSecret` | string | Yes | CrowdStrike Falcon API client secret |
 | `cloud` | string | Yes | CrowdStrike Falcon cloud region |
-| `indicators` | json | Yes | JSON array of indicators to update. Each entry requires id, and must also repeat every field it wants to keep: CrowdStrike blanks out any updatable field the entry omits. Updatable fields: action, severity, description, source, tags \(array\), platforms \(array\), applied_globally \(boolean\), host_groups \(array\), expiration \(ISO 8601\), mobile_action, metadata \(\{ filename \}\). type and value cannot be changed. |
+| `indicators` | json | Yes | JSON array of indicators to update. Each entry requires id, and should also repeat every field it wants to keep: an updatable field the entry omits may be cleared. Updatable fields: action, severity, description, source, tags \(array\), platforms \(array\), applied_globally \(boolean\), host_groups \(array\), expiration \(ISO 8601\), mobile_action, metadata \(\{ filename \}\). type and value cannot be changed. |
 | `comment` | string | No | Audit comment explaining why these indicators were updated |
 | `retrodetects` | boolean | No | Whether to generate retroactive detections for the updated indicators |
 | `ignoreWarnings` | boolean | No | Whether to apply the updates even when CrowdStrike returns warnings |

apps/docs/content/docs/en/integrations/datadog.mdx

@@ -366,7 +366,7 @@ List all scheduled downtimes in Datadog.
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
 | `currentOnly` | boolean | No | Only return currently active downtimes |
-| `limit` | number | No | Number of downtimes to return per page \(default: 30, max: 100\) |
+| `limit` | number | No | Number of downtimes to return per page. Datadog defaults to 30 and declares no maximum; keep this at 100 or below to stay within the bound Sim recommends. |
 | `offset` | number | No | Index of the first downtime to return \(e.g., 0, 30, 60\) |
 | `apiKey` | string | Yes | Datadog API key |
 | `applicationKey` | string | Yes | Datadog Application key |