--- title: Filter and list events --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/go) [Cloudforce One](https://developers.cloudflare.com/api/go/resources/cloudforce_one) [Threat Events](https://developers.cloudflare.com/api/go/resources/cloudforce_one/subresources/threat_events) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Filter and list events client.CloudforceOne.ThreatEvents.List(ctx, params) (\*\[] [ThreatEventListResponse](), error) GET/accounts/{account\_id}/cloudforce-one/events Use `datasetId=all` or `datasetId=*` for the legacy all-datasets scope, `datasetId=analytics` for datasets with `isAnalytics=true`, or `datasetId=operational` for datasets with `isAnalytics=false` (limited to 50). Scope values must be used alone. When `datasetId` is unspecified, events are listed from the default Cloudforce One Threat Events dataset. To list existing datasets, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint. ##### Security API Token The preferred authorization scheme for interacting with the Cloudflare API. [Create a token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). **Example:**`Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY` ##### Accepted Permissions (at least one required) `Cloudforce One Write``Cloudforce One Read` ##### ParametersExpand Collapse

params ThreatEventListParams

AccountID param.Field\[string] Path param: Account ID. Link to this property

Cache param.Field\[ThreatEventListParamsCache]Optional Query param: Cache strategy. ‘from-graph’ serves results from the graph-node KV cache when all requested UUIDs are cached; falls back to normal path on partial/zero hit.

const ThreatEventListParamsCacheFromGraph ThreatEventListParamsCache = "from-graph" Link to this property

Link to this property Cursor param.Field\[string]Optional Query param: Cursor for pagination. When provided, filters are embedded in the cursor so you only need to pass cursor and pageSize. Returned in the previous response’s result\_info.cursor field. Use cursor-based pagination for deep pagination (beyond 100,000 records) or for optimal performance. Link to this property DatasetID param.Field\[\[]string]Optional Query param: Dataset UUIDs to query, or one standalone scope value: ‘all’/’\*’ for the legacy all-datasets behavior, ‘analytics’ for isAnalytics=true datasets, or ‘operational’ for isAnalytics=false datasets. If not provided, uses the default dataset. Link to this property ForceRefresh param.Field\[bool]Optional Query param Link to this property

Format param.Field\[ThreatEventListParamsFormat]Optional Query param

const ThreatEventListParamsFormatJson ThreatEventListParamsFormat = "json" Link to this property const ThreatEventListParamsFormatStix2 ThreatEventListParamsFormat = "stix2" Link to this property const ThreatEventListParamsFormatTaxii ThreatEventListParamsFormat = "taxii" Link to this property