--- title: Cloudforce One --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Cloudforce One #### Cloudforce OneBinary Storage ##### [Retrieves a file from Binary Storage](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/binary_storage/methods/get) cloudforce\_one.binary\_storage.get(strhash, BinaryStorageGetParams\*\*kwargs) GET/accounts/{account\_id}/cloudforce-one/binary/{hash} ##### [Posts a file to Binary Storage](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/binary_storage/methods/create) cloudforce\_one.binary\_storage.create(BinaryStorageCreateParams\*\*kwargs) -> [BinaryStorageCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/binary ##### ModelsExpand Collapse
class BinaryStorageCreateResponse: … content\_type: str Link to this property md5: str Link to this property sha1: str Link to this property sha256: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.binary_storage%20%3E%20(model)%20binary_storage_create_response%20%3E%20(schema)>) #### Cloudforce OneRequests ##### [List Requests](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/methods/list) cloudforce\_one.requests.list(RequestListParams\*\*kwargs) -> SyncSinglePage\[[ListItem]()] POST/accounts/{account\_id}/cloudforce-one/requests ##### [Get a Request](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/methods/get) cloudforce\_one.requests.get(strrequest\_id, RequestGetParams\*\*kwargs) -> [Item]() GET/accounts/{account\_id}/cloudforce-one/requests/{request\_id} ##### [Create a New Request.](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/methods/create) cloudforce\_one.requests.create(RequestCreateParams\*\*kwargs) -> [Item]() POST/accounts/{account\_id}/cloudforce-one/requests/new ##### [Update a Request](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/methods/update) cloudforce\_one.requests.update(strrequest\_id, RequestUpdateParams\*\*kwargs) -> [Item]() PUT/accounts/{account\_id}/cloudforce-one/requests/{request\_id} ##### [Delete a Request](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/methods/delete) cloudforce\_one.requests.delete(strrequest\_id, RequestDeleteParams\*\*kwargs) -> [RequestDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/requests/{request\_id} ##### [Get Request Quota](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/methods/quota) cloudforce\_one.requests.quota(RequestQuotaParams\*\*kwargs) -> [Quota]() GET/accounts/{account\_id}/cloudforce-one/requests/quota ##### [Get Request Types](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/methods/types) cloudforce\_one.requests.types(RequestTypesParams\*\*kwargs) -> SyncSinglePage\[[RequestTypesResponse]()] GET/accounts/{account\_id}/cloudforce-one/requests/types ##### [Get Request Priority, Status, and TLP constants](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/methods/constants) cloudforce\_one.requests.constants(RequestConstantsParams\*\*kwargs) -> [RequestConstants]() GET/accounts/{account\_id}/cloudforce-one/requests/constants ##### ModelsExpand Collapse
class Item: … id: str UUID. maxLength36 Link to this property content: str Request content. Link to this property created: datetime formatdate-time Link to this property priority: datetime formatdate-time Link to this property request: str Requested information from request. Link to this property summary: str Brief description of the request. Link to this property
tlp: Literal\["clear", "amber", "amber-strict", 2 more] The CISA defined Traffic Light Protocol (TLP). One of the following: "clear" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "red" Link to this property
Link to this property updated: datetime formatdate-time Link to this property completed: Optional\[datetime] formatdate-time Link to this property message\_tokens: Optional\[int] Tokens for the request messages. Link to this property readable\_id: Optional\[str] Readable Request ID. Link to this property
status: Optional\[Literal\["open", "accepted", "reported", 3 more]] Request Status. One of the following: "open" Link to this property "accepted" Link to this property "reported" Link to this property "approved" Link to this property "completed" Link to this property "declined" Link to this property
Link to this property tokens: Optional\[int] Tokens for the request. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20item%20%3E%20(schema)>)
class ListItem: … id: str UUID. maxLength36 Link to this property created: datetime Request creation time. formatdate-time Link to this property
priority: Literal\["routine", "high", "urgent"] One of the following: "routine" Link to this property "high" Link to this property "urgent" Link to this property
Link to this property request: str Requested information from request. Link to this property summary: str Brief description of the request. Link to this property
tlp: Literal\["clear", "amber", "amber-strict", 2 more] The CISA defined Traffic Light Protocol (TLP). One of the following: "clear" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "red" Link to this property
Link to this property updated: datetime Request last updated time. formatdate-time Link to this property completed: Optional\[datetime] Request completion time. formatdate-time Link to this property message\_tokens: Optional\[int] Tokens for the request messages. Link to this property readable\_id: Optional\[str] Readable Request ID. Link to this property
status: Optional\[Literal\["open", "accepted", "reported", 3 more]] Request Status. One of the following: "open" Link to this property "accepted" Link to this property "reported" Link to this property "approved" Link to this property "completed" Link to this property "declined" Link to this property
Link to this property tokens: Optional\[int] Tokens for the request. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20list_item%20%3E%20(schema)>)
class Quota: … anniversary\_date: Optional\[datetime] Anniversary date is when annual quota limit is refreshed. formatdate-time Link to this property quarter\_anniversary\_date: Optional\[datetime] Quarter anniversary date is when quota limit is refreshed each quarter. formatdate-time Link to this property quota: Optional\[int] Tokens for the quarter. Link to this property remaining: Optional\[int] Tokens remaining for the quarter. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20quota%20%3E%20(schema)>)
class RequestConstants: …
priority: Optional\[List\[Literal\["routine", "high", "urgent"]]] One of the following: "routine" Link to this property "high" Link to this property "urgent" Link to this property
Link to this property
status: Optional\[List\[Literal\["open", "accepted", "reported", 3 more]]] One of the following: "open" Link to this property "accepted" Link to this property "reported" Link to this property "approved" Link to this property "completed" Link to this property "declined" Link to this property
Link to this property
tlp: Optional\[List\[Literal\["clear", "amber", "amber-strict", 2 more]]] One of the following: "clear" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "red" Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20request_constants%20%3E%20(schema)>) List\[[RequestTypesResponse]()] [Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20request_types%20%3E%20(schema)>)
class RequestDeleteResponse: …
errors: List\[Error] code: int minimum1000 Link to this property message: str Link to this property documentation\_url: Optional\[str] Link to this property
source: Optional\[ErrorSource] pointer: Optional\[str] Link to this property
Link to this property
Link to this property
messages: List\[Message] code: int minimum1000 Link to this property message: str Link to this property documentation\_url: Optional\[str] Link to this property
source: Optional\[MessageSource] pointer: Optional\[str] Link to this property
Link to this property
Link to this property success: Literal\[true] Whether the API call was successful. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20request_delete_response%20%3E%20(schema)>) str Request Types. [Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20request_types_response%20%3E%20(schema)>) #### Cloudforce OneRequestsMessage ##### [List Request Messages](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/subresources/message/methods/get) cloudforce\_one.requests.message.get(strrequest\_id, MessageGetParams\*\*kwargs) -> SyncSinglePage\[[Message]()] POST/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/message ##### [Create a New Request Message](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/subresources/message/methods/create) cloudforce\_one.requests.message.create(strrequest\_id, MessageCreateParams\*\*kwargs) -> [Message]() POST/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/message/new ##### [Update a Request Message](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/subresources/message/methods/update) cloudforce\_one.requests.message.update(intmessage\_id, MessageUpdateParams\*\*kwargs) -> [Message]() PUT/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/message/{message\_id} ##### [Delete a Request Message](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/subresources/message/methods/delete) cloudforce\_one.requests.message.delete(intmessage\_id, MessageDeleteParams\*\*kwargs) -> [MessageDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/message/{message\_id} ##### ModelsExpand Collapse
class Message: … id: int Message ID. Link to this property author: str Author of message. Link to this property content: str Content of message. Link to this property is\_follow\_on\_request: bool Whether the message is a follow-on request. Link to this property updated: datetime Defines the message last updated time. formatdate-time Link to this property created: Optional\[datetime] Defines the message creation time. formatdate-time Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.message%20%3E%20(model)%20message%20%3E%20(schema)>)
class MessageDeleteResponse: …
errors: List\[Error] code: int minimum1000 Link to this property message: str Link to this property documentation\_url: Optional\[str] Link to this property
source: Optional\[ErrorSource] pointer: Optional\[str] Link to this property
Link to this property
Link to this property
messages: List\[Message] code: int minimum1000 Link to this property message: str Link to this property documentation\_url: Optional\[str] Link to this property
source: Optional\[MessageSource] pointer: Optional\[str] Link to this property
Link to this property
Link to this property success: Literal\[true] Whether the API call was successful. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.message%20%3E%20(model)%20message_delete_response%20%3E%20(schema)>) #### Cloudforce OneRequestsPriority ##### [Get a Priority Intelligence Requirement](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/subresources/priority/methods/get) cloudforce\_one.requests.priority.get(strpriority\_id, PriorityGetParams\*\*kwargs) -> [Item]() GET/accounts/{account\_id}/cloudforce-one/requests/priority/{priority\_id} ##### [Create a New Priority Intelligence Requirement](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/subresources/priority/methods/create) cloudforce\_one.requests.priority.create(PriorityCreateParams\*\*kwargs) -> [Priority]() POST/accounts/{account\_id}/cloudforce-one/requests/priority/new ##### [Update a Priority Intelligence Requirement](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/subresources/priority/methods/update) cloudforce\_one.requests.priority.update(strpriority\_id, PriorityUpdateParams\*\*kwargs) -> [Item]() PUT/accounts/{account\_id}/cloudforce-one/requests/priority/{priority\_id} ##### [Delete a Priority Intelligence Requirement](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/subresources/priority/methods/delete) cloudforce\_one.requests.priority.delete(strpriority\_id, PriorityDeleteParams\*\*kwargs) -> [PriorityDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/requests/priority/{priority\_id} ##### [Get Priority Intelligence Requirement Quota](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/subresources/priority/methods/quota) cloudforce\_one.requests.priority.quota(PriorityQuotaParams\*\*kwargs) -> [Quota]() GET/accounts/{account\_id}/cloudforce-one/requests/priority/quota ##### ModelsExpand Collapse str [Link to this property](<#(resource)%20cloudforce_one.requests.priority%20%3E%20(model)%20label%20%3E%20(schema)>)
class Priority: … id: str UUID. maxLength36 Link to this property created: datetime Priority creation time. formatdate-time Link to this property labels: List\[Label] List of labels. Link to this property priority: int Priority. Link to this property requirement: str Requirement. Link to this property
tlp: Literal\["clear", "amber", "amber-strict", 2 more] The CISA defined Traffic Light Protocol (TLP). One of the following: "clear" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "red" Link to this property
Link to this property updated: datetime Priority last updated time. formatdate-time Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.priority%20%3E%20(model)%20priority%20%3E%20(schema)>)
class PriorityEdit: … labels: List\[Label] List of labels. Link to this property priority: int Priority. Link to this property requirement: str Requirement. Link to this property
tlp: Literal\["clear", "amber", "amber-strict", 2 more] The CISA defined Traffic Light Protocol (TLP). One of the following: "clear" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "red" Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.priority%20%3E%20(model)%20priority_edit%20%3E%20(schema)>)
class PriorityDeleteResponse: …
errors: List\[Error] code: int minimum1000 Link to this property message: str Link to this property documentation\_url: Optional\[str] Link to this property
source: Optional\[ErrorSource] pointer: Optional\[str] Link to this property
Link to this property
Link to this property
messages: List\[Message] code: int minimum1000 Link to this property message: str Link to this property documentation\_url: Optional\[str] Link to this property
source: Optional\[MessageSource] pointer: Optional\[str] Link to this property
Link to this property
Link to this property success: Literal\[true] Whether the API call was successful. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.priority%20%3E%20(model)%20priority_delete_response%20%3E%20(schema)>) #### Cloudforce OneRequestsAssets ##### [Get a Request Asset](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/subresources/assets/methods/get) cloudforce\_one.requests.assets.get(strasset\_id, AssetGetParams\*\*kwargs) -> SyncSinglePage\[[AssetGetResponse]()] GET/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/asset/{asset\_id} ##### [List Request Assets](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/subresources/assets/methods/create) cloudforce\_one.requests.assets.create(strrequest\_id, AssetCreateParams\*\*kwargs) -> SyncSinglePage\[[AssetCreateResponse]()] POST/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/asset ##### [Update a Request Asset](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/subresources/assets/methods/update) cloudforce\_one.requests.assets.update(strasset\_id, AssetUpdateParams\*\*kwargs) -> [AssetUpdateResponse]() PUT/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/asset/{asset\_id} ##### [Delete a Request Asset](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/requests/subresources/assets/methods/delete) cloudforce\_one.requests.assets.delete(strasset\_id, AssetDeleteParams\*\*kwargs) -> [AssetDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/asset/{asset\_id} ##### ModelsExpand Collapse
class AssetGetResponse: … id: int Asset ID. Link to this property name: str Asset name. Link to this property created: Optional\[datetime] Defines the asset creation time. formatdate-time Link to this property description: Optional\[str] Asset description. Link to this property file\_type: Optional\[str] Asset file type. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.assets%20%3E%20(model)%20asset_get_response%20%3E%20(schema)>)
class AssetCreateResponse: … id: int Asset ID. Link to this property name: str Asset name. Link to this property created: Optional\[datetime] Defines the asset creation time. formatdate-time Link to this property description: Optional\[str] Asset description. Link to this property file\_type: Optional\[str] Asset file type. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.assets%20%3E%20(model)%20asset_create_response%20%3E%20(schema)>)
class AssetUpdateResponse: … id: int Asset ID. Link to this property name: str Asset name. Link to this property created: Optional\[datetime] Defines the asset creation time. formatdate-time Link to this property description: Optional\[str] Asset description. Link to this property file\_type: Optional\[str] Asset file type. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.assets%20%3E%20(model)%20asset_update_response%20%3E%20(schema)>)
class AssetDeleteResponse: …
errors: List\[Error] code: int minimum1000 Link to this property message: str Link to this property documentation\_url: Optional\[str] Link to this property
source: Optional\[ErrorSource] pointer: Optional\[str] Link to this property
Link to this property
Link to this property
messages: List\[Message] code: int minimum1000 Link to this property message: str Link to this property documentation\_url: Optional\[str] Link to this property
source: Optional\[MessageSource] pointer: Optional\[str] Link to this property
Link to this property
Link to this property success: Literal\[true] Whether the API call was successful. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.assets%20%3E%20(model)%20asset_delete_response%20%3E%20(schema)>) #### Cloudforce OneScans #### Cloudforce OneScansResults ##### [Get the Latest Scan Result](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/scans/subresources/results/methods/get) cloudforce\_one.scans.results.get(strconfig\_id, ResultGetParams\*\*kwargs) -> [ResultGetResponse]() GET/accounts/{account\_id}/cloudforce-one/scans/results/{config\_id} ##### ModelsExpand Collapse
class ScanResult: … number: Optional\[float] Link to this property proto: Optional\[str] Link to this property status: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.scans.results%20%3E%20(model)%20scan_result%20%3E%20(schema)>)
class ResultGetResponse: …
\_1\_1\_1\_1: List\[ScanResult] number: Optional\[float] Link to this property proto: Optional\[str] Link to this property status: Optional\[str] Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.scans.results%20%3E%20(model)%20result_get_response%20%3E%20(schema)>) #### Cloudforce OneScansConfig ##### [List Scan Configs](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/scans/subresources/config/methods/list) cloudforce\_one.scans.config.list(ConfigListParams\*\*kwargs) -> SyncSinglePage\[[ConfigListResponse]()] GET/accounts/{account\_id}/cloudforce-one/scans/config ##### [Create a new Scan Config](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/scans/subresources/config/methods/create) cloudforce\_one.scans.config.create(ConfigCreateParams\*\*kwargs) -> [ConfigCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/scans/config ##### [Update an existing Scan Config](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/scans/subresources/config/methods/edit) cloudforce\_one.scans.config.edit(strconfig\_id, ConfigEditParams\*\*kwargs) -> [ConfigEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/scans/config/{config\_id} ##### [Delete a Scan Config](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/scans/subresources/config/methods/delete) cloudforce\_one.scans.config.delete(strconfig\_id, ConfigDeleteParams\*\*kwargs) -> object DELETE/accounts/{account\_id}/cloudforce-one/scans/config/{config\_id} ##### ModelsExpand Collapse
class ConfigListResponse: … id: str Defines the Config ID. Link to this property account\_id: str Link to this property frequency: float Defines the number of days between each scan (0 = One-off scan). Link to this property ips: List\[str] Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000. Link to this property ports: List\[str] Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. \[“1-80”, “443”]). “default” scans the 100 most commonly open ports. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.scans.config%20%3E%20(model)%20config_list_response%20%3E%20(schema)>)
class ConfigCreateResponse: … id: str Defines the Config ID. Link to this property account\_id: str Link to this property frequency: float Defines the number of days between each scan (0 = One-off scan). Link to this property ips: List\[str] Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000. Link to this property ports: List\[str] Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. \[“1-80”, “443”]). “default” scans the 100 most commonly open ports. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.scans.config%20%3E%20(model)%20config_create_response%20%3E%20(schema)>)
class ConfigEditResponse: … id: str Defines the Config ID. Link to this property account\_id: str Link to this property frequency: float Defines the number of days between each scan (0 = One-off scan). Link to this property ips: List\[str] Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000. Link to this property ports: List\[str] Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. \[“1-80”, “443”]). “default” scans the 100 most commonly open ports. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.scans.config%20%3E%20(model)%20config_edit_response%20%3E%20(schema)>) #### Cloudforce OneThreat Events ##### [Filter and list events](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/methods/list) cloudforce\_one.threat\_events.list(ThreatEventListParams\*\*kwargs) -> [ThreatEventListResponse]() GET/accounts/{account\_id}/cloudforce-one/events ##### [Reads an event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/methods/get) Deprecated cloudforce\_one.threat\_events.get(strevent\_id, ThreatEventGetParams\*\*kwargs) -> [ThreatEventGetResponse]() GET/accounts/{account\_id}/cloudforce-one/events/{event\_id} ##### [Creates a new event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/methods/create) cloudforce\_one.threat\_events.create(ThreatEventCreateParams\*\*kwargs) -> [ThreatEventCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/create ##### [Updates an event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/methods/edit) cloudforce\_one.threat\_events.edit(strevent\_id, ThreatEventEditParams\*\*kwargs) -> [ThreatEventEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/events/{event\_id} ##### [Creates bulk events](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/methods/bulk_create) cloudforce\_one.threat\_events.bulk\_create(ThreatEventBulkCreateParams\*\*kwargs) -> [ThreatEventBulkCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/create/bulk ##### [Creates bulk DOS event with relationships and indicators](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/methods/bulk_create_relationships) Deprecated cloudforce\_one.threat\_events.bulk\_create\_relationships(ThreatEventBulkCreateRelationshipsParams\*\*kwargs) -> [ThreatEventBulkCreateRelationshipsResponse]() POST/accounts/{account\_id}/cloudforce-one/events/create/bulk/relationships ##### ModelsExpand Collapse
List\[ThreatEventListResponseItem] attacker: str Link to this property attacker\_country: str Link to this property attacker\_country\_alpha3: str Link to this property category: str Link to this property dataset\_id: str Link to this property date: str Link to this property event: str Link to this property has\_children: bool Link to this property indicator: str Link to this property indicator\_type: str Link to this property indicator\_type\_id: float Link to this property kill\_chain: float Link to this property mitre\_attack: List\[str] Link to this property mitre\_capec: List\[str] Link to this property num\_referenced: float Link to this property num\_references: float Link to this property raw\_id: str Link to this property referenced: List\[str] Link to this property referenced\_ids: List\[float] Link to this property references: List\[str] Link to this property references\_ids: List\[float] Link to this property tags: List\[str] Link to this property target\_country: str Link to this property target\_country\_alpha3: str Link to this property target\_industry: str Link to this property tlp: str Link to this property uuid: str Link to this property insight: Optional\[str] Link to this property releasability\_id: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_list_response%20%3E%20(schema)>)
class ThreatEventGetResponse: … attacker: str Link to this property attacker\_country: str Link to this property attacker\_country\_alpha3: str Link to this property category: str Link to this property dataset\_id: str Link to this property date: str Link to this property event: str Link to this property has\_children: bool Link to this property indicator: str Link to this property indicator\_type: str Link to this property indicator\_type\_id: float Link to this property kill\_chain: float Link to this property mitre\_attack: List\[str] Link to this property mitre\_capec: List\[str] Link to this property num\_referenced: float Link to this property num\_references: float Link to this property raw\_id: str Link to this property referenced: List\[str] Link to this property referenced\_ids: List\[float] Link to this property references: List\[str] Link to this property references\_ids: List\[float] Link to this property tags: List\[str] Link to this property target\_country: str Link to this property target\_country\_alpha3: str Link to this property target\_industry: str Link to this property tlp: str Link to this property uuid: str Link to this property insight: Optional\[str] Link to this property releasability\_id: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_get_response%20%3E%20(schema)>)
class ThreatEventCreateResponse: … attacker: str Link to this property attacker\_country: str Link to this property attacker\_country\_alpha3: str Link to this property category: str Link to this property dataset\_id: str Link to this property date: str Link to this property event: str Link to this property has\_children: bool Link to this property indicator: str Link to this property indicator\_type: str Link to this property indicator\_type\_id: float Link to this property kill\_chain: float Link to this property mitre\_attack: List\[str] Link to this property mitre\_capec: List\[str] Link to this property num\_referenced: float Link to this property num\_references: float Link to this property raw\_id: str Link to this property referenced: List\[str] Link to this property referenced\_ids: List\[float] Link to this property references: List\[str] Link to this property references\_ids: List\[float] Link to this property tags: List\[str] Link to this property target\_country: str Link to this property target\_country\_alpha3: str Link to this property target\_industry: str Link to this property tlp: str Link to this property uuid: str Link to this property insight: Optional\[str] Link to this property releasability\_id: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_create_response%20%3E%20(schema)>)
class ThreatEventEditResponse: … attacker: str Link to this property attacker\_country: str Link to this property attacker\_country\_alpha3: str Link to this property category: str Link to this property dataset\_id: str Link to this property date: str Link to this property event: str Link to this property has\_children: bool Link to this property indicator: str Link to this property indicator\_type: str Link to this property indicator\_type\_id: float Link to this property kill\_chain: float Link to this property mitre\_attack: List\[str] Link to this property mitre\_capec: List\[str] Link to this property num\_referenced: float Link to this property num\_references: float Link to this property raw\_id: str Link to this property referenced: List\[str] Link to this property referenced\_ids: List\[float] Link to this property references: List\[str] Link to this property references\_ids: List\[float] Link to this property tags: List\[str] Link to this property target\_country: str Link to this property target\_country\_alpha3: str Link to this property target\_industry: str Link to this property tlp: str Link to this property uuid: str Link to this property insight: Optional\[str] Link to this property releasability\_id: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_edit_response%20%3E%20(schema)>)
class ThreatEventBulkCreateResponse: … Detailed result of bulk event creation with auto-tag management created\_events\_count: float Number of events created Link to this property created\_tags\_count: float Number of new tags created in SoT Link to this property error\_count: float Number of errors encountered Link to this property queued\_indicators\_count: float Number of indicators queued for async processing Link to this property create\_bulk\_events\_request\_id: Optional\[str] Correlation ID for async indicator processing formatuuid Link to this property
created\_events: Optional\[List\[CreatedEvent]] Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true event\_index: float Original index in the input data array Link to this property shard\_id: str Dataset ID of the shard where the event was created Link to this property uuid: str UUID of the created event formatuuid Link to this property
Link to this property
errors: Optional\[List\[Error]] Array of error details error: str Error message Link to this property event\_index: float Index of the event that caused the error Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_response%20%3E%20(schema)>)
class ThreatEventBulkCreateRelationshipsResponse: … Result of bulk relationship creation operation created\_events\_count: float Number of events created Link to this property created\_indicators\_count: float Number of indicators created Link to this property created\_relationships\_count: float Number of relationships created Link to this property error\_count: float Number of errors encountered Link to this property
errors: Optional\[List\[Error]] Array of error details error: str Error message Link to this property event\_index: float Index of the event that caused the error Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_relationships_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsAggregate ##### [Aggregate events by single or multiple columns with optional date filtering](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/aggregate/methods/list) cloudforce\_one.threat\_events.aggregate.list(AggregateListParams\*\*kwargs) -> [AggregateListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/aggregate ##### ModelsExpand Collapse
class AggregateListResponse: … aggregate\_by: str Column(s) that were aggregated by Link to this property
aggregations: List\[Aggregation] Array of aggregation results with dynamic fields based on aggregateBy columns count: float Number of events for this aggregation Link to this property date: Optional\[str] Date (if groupByDate is true) Link to this property
Link to this property total: float Total number of events in the aggregation Link to this property
date\_range: Optional\[DateRange] Date range used for filtering end\_date: Optional\[str] Link to this property start\_date: Optional\[str] Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.aggregate%20%3E%20(model)%20aggregate_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsGraphql ##### [GraphQL endpoint for event aggregation](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/graphql/methods/create) cloudforce\_one.threat\_events.graphql.create(GraphqlCreateParams\*\*kwargs) -> [GraphqlCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/graphql ##### ModelsExpand Collapse
class GraphqlCreateResponse: … data: Optional\[object] Link to this property errors: Optional\[List\[object]] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.graphql%20%3E%20(model)%20graphql_create_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsGraph ##### [Query graph neighborhood from R2 Data Catalog](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/graph/methods/list) cloudforce\_one.threat\_events.graph.list(GraphListParams\*\*kwargs) -> [GraphListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/graph ##### ModelsExpand Collapse
class GraphListResponse: …
edges: List\[Edge] id: str Deterministic composite edge id (source→target:relationshipType) Link to this property relationship\_type: str Link to this property source: str Compact id of the source node (type:uuid) Link to this property source\_id: str Link to this property source\_type: str Link to this property target: str Compact id of the target node (type:uuid) Link to this property target\_id: str Link to this property target\_type: str Link to this property
Link to this property node: Optional\[Dict\[str, object]] Focal node object (legacy single-seed). Null when unavailable. Link to this property nodes: List\[Dict\[str, object]] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.graph%20%3E%20(model)%20graph_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsQueries ##### [List all saved event queries](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/list) cloudforce\_one.threat\_events.queries.list(QueryListParams\*\*kwargs) -> [QueryListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/queries ##### [Create a saved event query](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/create) cloudforce\_one.threat\_events.queries.create(QueryCreateParams\*\*kwargs) -> [QueryCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/queries/create ##### [Read a saved event query](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/get) cloudforce\_one.threat\_events.queries.get(intquery\_id, QueryGetParams\*\*kwargs) -> [QueryGetResponse]() GET/accounts/{account\_id}/cloudforce-one/events/queries/{query\_id} ##### [Update a saved event query](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/edit) cloudforce\_one.threat\_events.queries.edit(intquery\_id, QueryEditParams\*\*kwargs) -> [QueryEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/events/queries/{query\_id} ##### [Delete a saved event query](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/delete) cloudforce\_one.threat\_events.queries.delete(intquery\_id, QueryDeleteParams\*\*kwargs) DELETE/accounts/{account\_id}/cloudforce-one/events/queries/{query\_id} ##### ModelsExpand Collapse
List\[QueryListResponseItem] id: int Unique identifier for the saved query Link to this property account\_id: int Account ID Link to this property alert\_enabled: bool Whether alerts are enabled Link to this property alert\_rollup\_enabled: bool Whether alert rollup is enabled Link to this property created\_at: str Creation timestamp Link to this property name: str Name of the saved query Link to this property query\_json: str JSON string containing the query parameters Link to this property rule\_enabled: bool Whether rule is enabled Link to this property updated\_at: str Last update timestamp Link to this property user\_email: str Email of the user who created the query Link to this property custom\_threat\_feed\_id: Optional\[int] Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id: Optional\[str] WAF rules list ID for blocking Link to this property rule\_scope: Optional\[str] Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_list_response%20%3E%20(schema)>)
class QueryCreateResponse: … id: int Unique identifier for the saved query Link to this property account\_id: int Account ID Link to this property alert\_enabled: bool Whether alerts are enabled Link to this property alert\_rollup\_enabled: bool Whether alert rollup is enabled Link to this property created\_at: str Creation timestamp Link to this property name: str Name of the saved query Link to this property query\_json: str JSON string containing the query parameters Link to this property rule\_enabled: bool Whether rule is enabled Link to this property updated\_at: str Last update timestamp Link to this property user\_email: str Email of the user who created the query Link to this property custom\_threat\_feed\_id: Optional\[int] Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id: Optional\[str] WAF rules list ID for blocking Link to this property rule\_scope: Optional\[str] Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_create_response%20%3E%20(schema)>)
class QueryGetResponse: … id: int Unique identifier for the saved query Link to this property account\_id: int Account ID Link to this property alert\_enabled: bool Whether alerts are enabled Link to this property alert\_rollup\_enabled: bool Whether alert rollup is enabled Link to this property created\_at: str Creation timestamp Link to this property name: str Name of the saved query Link to this property query\_json: str JSON string containing the query parameters Link to this property rule\_enabled: bool Whether rule is enabled Link to this property updated\_at: str Last update timestamp Link to this property user\_email: str Email of the user who created the query Link to this property custom\_threat\_feed\_id: Optional\[int] Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id: Optional\[str] WAF rules list ID for blocking Link to this property rule\_scope: Optional\[str] Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_get_response%20%3E%20(schema)>)
class QueryEditResponse: … id: int Unique identifier for the saved query Link to this property account\_id: int Account ID Link to this property alert\_enabled: bool Whether alerts are enabled Link to this property alert\_rollup\_enabled: bool Whether alert rollup is enabled Link to this property created\_at: str Creation timestamp Link to this property name: str Name of the saved query Link to this property query\_json: str JSON string containing the query parameters Link to this property rule\_enabled: bool Whether rule is enabled Link to this property updated\_at: str Last update timestamp Link to this property user\_email: str Email of the user who created the query Link to this property custom\_threat\_feed\_id: Optional\[int] Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id: Optional\[str] WAF rules list ID for blocking Link to this property rule\_scope: Optional\[str] Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_edit_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsRelationships ##### [Filter and list events related to specific event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/relationships/methods/list) Deprecated cloudforce\_one.threat\_events.relationships.list(strevent\_id, RelationshipListParams\*\*kwargs) -> [RelationshipListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/{event\_id}/relationships ##### ModelsExpand Collapse
List\[RelationshipListResponseItem] attacker: str Link to this property attacker\_country: str Link to this property attacker\_country\_alpha3: str Link to this property category: str Link to this property dataset\_id: str Link to this property date: str Link to this property event: str Link to this property has\_children: bool Link to this property indicator: str Link to this property indicator\_type: str Link to this property indicator\_type\_id: float Link to this property kill\_chain: float Link to this property mitre\_attack: List\[str] Link to this property mitre\_capec: List\[str] Link to this property num\_referenced: float Link to this property num\_references: float Link to this property raw\_id: str Link to this property referenced: List\[str] Link to this property referenced\_ids: List\[float] Link to this property references: List\[str] Link to this property references\_ids: List\[float] Link to this property tags: List\[str] Link to this property target\_country: str Link to this property target\_country\_alpha3: str Link to this property target\_industry: str Link to this property tlp: str Link to this property uuid: str Link to this property insight: Optional\[str] Link to this property releasability\_id: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.relationships%20%3E%20(model)%20relationship_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsIndicators ##### [Lists indicators across multiple datasets](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/indicators/methods/list) cloudforce\_one.threat\_events.indicators.list(IndicatorListParams\*\*kwargs) -> [IndicatorListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/indicators ##### ModelsExpand Collapse
class IndicatorListResponse: …
properties: Properties
completeness: PropertiesCompleteness
properties: PropertiesCompletenessProperties
complete: PropertiesCompletenessPropertiesComplete type: str Link to this property
Link to this property
failed\_datasets: PropertiesCompletenessPropertiesFailedDatasets
items: PropertiesCompletenessPropertiesFailedDatasetsItems type: str Link to this property
Link to this property type: str Link to this property
Link to this property
failed\_shards: PropertiesCompletenessPropertiesFailedShards
items: PropertiesCompletenessPropertiesFailedShardsItems
properties: PropertiesCompletenessPropertiesFailedShardsItemsProperties
dataset\_id: PropertiesCompletenessPropertiesFailedShardsItemsPropertiesDatasetID type: str Link to this property
Link to this property
shard\_id: PropertiesCompletenessPropertiesFailedShardsItemsPropertiesShardID type: str Link to this property
Link to this property
Link to this property type: str Link to this property
Link to this property type: str Link to this property
Link to this property
warnings: PropertiesCompletenessPropertiesWarnings
items: PropertiesCompletenessPropertiesWarningsItems type: str Link to this property
Link to this property type: str Link to this property
Link to this property
Link to this property type: str Link to this property
Link to this property
indicators: PropertiesIndicators
items: PropertiesIndicatorsItems created\_at: datetime formatdate-time Link to this property indicator\_type: str Link to this property
sources: List\[PropertiesIndicatorsItemsSource] RSS article sources from which this indicator was extracted. resource\_id: str formatuuid Link to this property resource\_type: Literal\["article"] Link to this property system: Literal\["threat-signals"] Link to this property title: Optional\[str] Threat Signals article title; null for historical provenance without a stored title. Link to this property
Link to this property updated\_at: datetime formatdate-time Link to this property uuid: str Link to this property value: str Link to this property dataset\_id: Optional\[str] The dataset ID this indicator belongs to. Included in list responses. Link to this property
related\_events: Optional\[List\[PropertiesIndicatorsItemsRelatedEvent]] Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. dataset\_id: str Link to this property event\_id: str Link to this property event\_date: Optional\[str] ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property related\_events\_has\_more: Optional\[bool] True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags: Optional\[List\[PropertiesIndicatorsItemsTag]] category\_id: Optional\[str] The UUID of the tag category, or null when the tag is uncategorized. Link to this property category\_name: Optional\[str] Link to this property uuid: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property tlp: Optional\[str] Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property type: str Link to this property
Link to this property
pagination: PropertiesPagination
properties: PropertiesPaginationProperties
count: PropertiesPaginationPropertiesCount type: str Link to this property
Link to this property
cursor: PropertiesPaginationPropertiesCursor description: str Link to this property nullable: bool Link to this property type: str Link to this property
Link to this property
has\_more: PropertiesPaginationPropertiesHasMore description: str Link to this property type: str Link to this property
Link to this property
page: PropertiesPaginationPropertiesPage type: str Link to this property
Link to this property
per\_page: PropertiesPaginationPropertiesPerPage type: str Link to this property
Link to this property
total\_count: PropertiesPaginationPropertiesTotalCount description: str Link to this property nullable: bool Link to this property type: str Link to this property
Link to this property
total\_count\_is\_exact: PropertiesPaginationPropertiesTotalCountIsExact description: str Link to this property type: str Link to this property
Link to this property
Link to this property type: str Link to this property
Link to this property
Link to this property type: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsIndicatorsAggregate ##### [Aggregate indicators by column(s)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/aggregate/methods/list) cloudforce\_one.threat\_events.indicators.aggregate.list(AggregateListParams\*\*kwargs) -> [AggregateListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/indicators/aggregate ##### ModelsExpand Collapse
class AggregateListResponse: … aggregate\_by: str Column(s) that were aggregated by Link to this property
aggregations: List\[Aggregation] Array of aggregation results with dynamic fields based on aggregateBy columns count: float Number of indicators for this aggregation Link to this property
Link to this property failed\_datasets: float Number of datasets whose aggregation failed and were excluded from the result Link to this property total: float Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.aggregate%20%3E%20(model)%20aggregate_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsIndicatorsTypes ##### [Lists indicator types across multiple datasets](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/types/methods/list) cloudforce\_one.threat\_events.indicators.types.list(TypeListParams\*\*kwargs) -> [TypeListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/indicator-types ##### ModelsExpand Collapse
class TypeListResponse: …
items: Items type: str Link to this property
Link to this property type: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.types%20%3E%20(model)%20type_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsIndicatorsBy Dataset ##### [Lists indicators](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/by_dataset/methods/list) Deprecated cloudforce\_one.threat\_events.indicators.by\_dataset.list(strdataset\_id, ByDatasetListParams\*\*kwargs) -> [ByDatasetListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/indicators ##### [Reads an indicator](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/by_dataset/methods/get) cloudforce\_one.threat\_events.indicators.by\_dataset.get(strindicator\_id, ByDatasetGetParams\*\*kwargs) -> [ByDatasetGetResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/indicators/{indicator\_id} ##### ModelsExpand Collapse
class ByDatasetListResponse: …
indicators: List\[Indicator] created\_at: datetime formatdate-time Link to this property indicator\_type: str Link to this property
sources: List\[IndicatorSource] RSS article sources from which this indicator was extracted. resource\_id: str formatuuid Link to this property resource\_type: Literal\["article"] Link to this property system: Literal\["threat-signals"] Link to this property title: Optional\[str] Threat Signals article title; null for historical provenance without a stored title. Link to this property
Link to this property updated\_at: datetime formatdate-time Link to this property uuid: str Link to this property value: str Link to this property dataset\_id: Optional\[str] The dataset ID this indicator belongs to. Included in list responses. Link to this property
related\_events: Optional\[List\[IndicatorRelatedEvent]] Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. dataset\_id: str Link to this property event\_id: str Link to this property event\_date: Optional\[str] ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property related\_events\_has\_more: Optional\[bool] True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags: Optional\[List\[IndicatorTag]] category\_id: Optional\[str] The UUID of the tag category, or null when the tag is uncategorized. Link to this property category\_name: Optional\[str] Link to this property uuid: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property tlp: Optional\[str] Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property
pagination: Pagination page: float Link to this property page\_size: float Link to this property total\_count: float Link to this property total\_pages: float Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.by_dataset%20%3E%20(model)%20by_dataset_list_response%20%3E%20(schema)>)
class ByDatasetGetResponse: … created\_at: datetime formatdate-time Link to this property indicator\_type: str Link to this property updated\_at: datetime formatdate-time Link to this property uuid: str Link to this property value: str Link to this property dataset\_id: Optional\[str] The dataset ID this indicator belongs to. Included in list responses. Link to this property
related\_events: Optional\[List\[RelatedEvent]] Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. dataset\_id: str Link to this property event\_id: str Link to this property event\_date: Optional\[str] ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property related\_events\_has\_more: Optional\[bool] True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags: Optional\[List\[Tag]] category\_id: Optional\[str] The UUID of the tag category, or null when the tag is uncategorized. Link to this property category\_name: Optional\[str] Link to this property uuid: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property tlp: Optional\[str] Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.by_dataset%20%3E%20(model)%20by_dataset_get_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsIndicatorsBy DatasetTags ##### [List mirrored tags for an indicator dataset](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/by_dataset/subresources/tags/methods/list) cloudforce\_one.threat\_events.indicators.by\_dataset.tags.list(strdataset\_id, TagListParams\*\*kwargs) -> [TagListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/indicators/tags ##### ModelsExpand Collapse List\[object] Array of mirror tag rows [Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.by_dataset.tags%20%3E%20(model)%20tag_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsAttackers ##### [Lists attackers across multiple datasets](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/attackers/methods/list) cloudforce\_one.threat\_events.attackers.list(AttackerListParams\*\*kwargs) -> [AttackerListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/attackers ##### ModelsExpand Collapse
class AttackerListResponse: …
items: Items type: str Link to this property
Link to this property type: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.attackers%20%3E%20(model)%20attacker_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsCategories ##### [Lists categories across multiple datasets](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/list) cloudforce\_one.threat\_events.categories.list(CategoryListParams\*\*kwargs) -> [CategoryListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/categories ##### [Reads a category](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/get) Deprecated cloudforce\_one.threat\_events.categories.get(strcategory\_id, CategoryGetParams\*\*kwargs) -> [CategoryGetResponse]() GET/accounts/{account\_id}/cloudforce-one/events/categories/{category\_id} ##### [Creates a new category](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/create) cloudforce\_one.threat\_events.categories.create(CategoryCreateParams\*\*kwargs) -> [CategoryCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/categories/create ##### [Updates a category](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/edit) Deprecated cloudforce\_one.threat\_events.categories.edit(strcategory\_id, CategoryEditParams\*\*kwargs) -> [CategoryEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/events/categories/{category\_id} ##### [Deletes a category](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/delete) Deprecated cloudforce\_one.threat\_events.categories.delete(strcategory\_id, CategoryDeleteParams\*\*kwargs) -> [CategoryDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/events/categories/{category\_id} ##### ModelsExpand Collapse
List\[CategoryListResponseItem] kill\_chain: float Link to this property name: str Link to this property uuid: str Link to this property mitre\_attack: Optional\[List\[str]] Link to this property mitre\_capec: Optional\[List\[str]] Link to this property shortname: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>)
class CategoryGetResponse: … kill\_chain: float Link to this property name: str Link to this property uuid: str Link to this property mitre\_attack: Optional\[List\[str]] Link to this property mitre\_capec: Optional\[List\[str]] Link to this property shortname: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_get_response%20%3E%20(schema)>)
class CategoryCreateResponse: … kill\_chain: float Link to this property name: str Link to this property uuid: str Link to this property mitre\_attack: Optional\[List\[str]] Link to this property mitre\_capec: Optional\[List\[str]] Link to this property shortname: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_create_response%20%3E%20(schema)>)
class CategoryEditResponse: … kill\_chain: float Link to this property name: str Link to this property uuid: str Link to this property mitre\_attack: Optional\[List\[str]] Link to this property mitre\_capec: Optional\[List\[str]] Link to this property shortname: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_edit_response%20%3E%20(schema)>)
class CategoryDeleteResponse: … uuid: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_delete_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsCategoriesCatalog ##### [Lists categories](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/categories/subresources/catalog/methods/list) cloudforce\_one.threat\_events.categories.catalog.list(CatalogListParams\*\*kwargs) -> [CatalogListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/categories/catalog ##### ModelsExpand Collapse
List\[CatalogListResponseItem] kill\_chain: float Link to this property name: str Link to this property uuid: str Link to this property mitre\_attack: Optional\[List\[str]] Link to this property mitre\_capec: Optional\[List\[str]] Link to this property shortname: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories.catalog%20%3E%20(model)%20catalog_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsCountries ##### [Retrieves countries information for all countries](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/countries/methods/list) cloudforce\_one.threat\_events.countries.list(CountryListParams\*\*kwargs) -> [CountryListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/countries ##### ModelsExpand Collapse
List\[CountryListResponseItem]
result: List\[CountryListResponseItemResult] alpha2: str Link to this property alpha3: str Link to this property name: str Link to this property
Link to this property success: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.countries%20%3E%20(model)%20country_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsCrons #### Cloudforce OneThreat EventsDatasets ##### [Lists all datasets in an account](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list) cloudforce\_one.threat\_events.datasets.list(DatasetListParams\*\*kwargs) -> [DatasetListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset ##### [Reads a dataset](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/get) cloudforce\_one.threat\_events.datasets.get(strdataset\_id, DatasetGetParams\*\*kwargs) -> [DatasetGetResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id} ##### [Creates a dataset](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create) cloudforce\_one.threat\_events.datasets.create(DatasetCreateParams\*\*kwargs) -> [DatasetCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/dataset/create ##### [Updates an existing dataset](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/edit) cloudforce\_one.threat\_events.datasets.edit(strdataset\_id, DatasetEditParams\*\*kwargs) -> [DatasetEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id} ##### [Delete a dataset](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/delete) cloudforce\_one.threat\_events.datasets.delete(strdataset\_id, DatasetDeleteParams\*\*kwargs) -> [DatasetDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id} ##### [Reads raw data for an event by UUID](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/raw) Deprecated cloudforce\_one.threat\_events.datasets.raw(strevent\_id, DatasetRawParams\*\*kwargs) -> [DatasetRawResponse]() GET/accounts/{account\_id}/cloudforce-one/events/raw/{dataset\_id}/{event\_id} ##### ModelsExpand Collapse
List\[DatasetListResponseItem]
indicator\_write\_mode: Literal\["read\_only", "create\_only", "full"] Effective indicator mutation capability after account/dataset authorization and dataset storage capability are applied. API Gateway method permissions are separate and must also allow the requested operation. One of the following: "read\_only" Link to this property "create\_only" Link to this property "full" Link to this property
Link to this property is\_analytics: bool Link to this property is\_public: bool Link to this property name: str Link to this property uuid: str Link to this property deleted\_at: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_list_response%20%3E%20(schema)>)
class DatasetGetResponse: … is\_analytics: bool Link to this property is\_public: bool Link to this property name: str Link to this property uuid: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_get_response%20%3E%20(schema)>)
class DatasetCreateResponse: … is\_analytics: bool Link to this property is\_public: bool Link to this property name: str Link to this property uuid: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_create_response%20%3E%20(schema)>)
class DatasetEditResponse: … is\_analytics: bool Link to this property is\_public: bool Link to this property name: str Link to this property uuid: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_edit_response%20%3E%20(schema)>)
class DatasetDeleteResponse: … name: str Link to this property uuid: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_delete_response%20%3E%20(schema)>)
class DatasetRawResponse: … id: float Link to this property account\_id: float Link to this property created: str Link to this property data: str Link to this property source: str Link to this property tlp: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_raw_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsDatasetsHealth #### Cloudforce OneThreat EventsDatasetsEvents ##### [Reads an event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/datasets/subresources/events/methods/get) cloudforce\_one.threat\_events.datasets.events.get(strevent\_id, EventGetParams\*\*kwargs) -> [EventGetResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/events/{event\_id} ##### ModelsExpand Collapse
class EventGetResponse: … attacker: str Link to this property attacker\_country: str Link to this property attacker\_country\_alpha3: str Link to this property category: str Link to this property dataset\_id: str Link to this property date: str Link to this property event: str Link to this property has\_children: bool Link to this property indicator: str Link to this property indicator\_type: str Link to this property indicator\_type\_id: float Link to this property kill\_chain: float Link to this property mitre\_attack: List\[str] Link to this property mitre\_capec: List\[str] Link to this property num\_referenced: float Link to this property num\_references: float Link to this property raw\_id: str Link to this property referenced: List\[str] Link to this property referenced\_ids: List\[float] Link to this property references: List\[str] Link to this property references\_ids: List\[float] Link to this property tags: List\[str] Link to this property target\_country: str Link to this property target\_country\_alpha3: str Link to this property target\_industry: str Link to this property tlp: str Link to this property uuid: str Link to this property insight: Optional\[str] Link to this property releasability\_id: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets.events%20%3E%20(model)%20event_get_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsRaw ##### [Reads data for a raw event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/raw/methods/get) cloudforce\_one.threat\_events.raw.get(strraw\_id, RawGetParams\*\*kwargs) -> [RawGetResponse]() GET/accounts/{account\_id}/cloudforce-one/events/{event\_id}/raw/{raw\_id} ##### [Updates a raw event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/raw/methods/edit) cloudforce\_one.threat\_events.raw.edit(strraw\_id, RawEditParams\*\*kwargs) -> [RawEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/events/{event\_id}/raw/{raw\_id} ##### ModelsExpand Collapse
class RawGetResponse: … id: str Link to this property account\_id: float Link to this property created: str Link to this property data: object Link to this property source: str Link to this property tlp: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>)
class RawEditResponse: … id: str Link to this property data: object Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.raw%20%3E%20(model)%20raw_edit_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsRelate ##### [Removes an event reference](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/relate/methods/delete) cloudforce\_one.threat\_events.relate.delete(strevent\_id, RelateDeleteParams\*\*kwargs) -> [RelateDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/events/relate/{event\_id} ##### ModelsExpand Collapse
class RelateDeleteResponse: … success: bool Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.relate%20%3E%20(model)%20relate_delete_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsTags ##### [Lists all tags (SoT)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/list) cloudforce\_one.threat\_events.tags.list(TagListParams\*\*kwargs) -> [TagListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/tags ##### [Creates a new tag](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/create) cloudforce\_one.threat\_events.tags.create(TagCreateParams\*\*kwargs) -> [TagCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/tags/create ##### [Updates a tag (SoT)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/edit) cloudforce\_one.threat\_events.tags.edit(strtag\_uuid, TagEditParams\*\*kwargs) -> [TagEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/events/tags/{tag\_uuid} ##### [Deletes a tag (SoT)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/delete) cloudforce\_one.threat\_events.tags.delete(strtag\_uuid, TagDeleteParams\*\*kwargs) -> [TagDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/events/tags/{tag\_uuid} ##### ModelsExpand Collapse
class TagListResponse: …
pagination: Pagination page: float Link to this property page\_size: float Link to this property total\_count: float Link to this property total\_pages: float Link to this property
Link to this property
tags: List\[Tag] uuid: str Link to this property value: str Link to this property active\_duration: Optional\[str] Link to this property
active\_duration\_annotated: Optional\[TagActiveDurationAnnotated] value: str Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property actor\_category: Optional\[str] Link to this property
actor\_category\_annotated: Optional\[TagActorCategoryAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
aliases: Optional\[List\[TagAlias]] Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts). value: str Link to this property confidence: Optional\[int] maximum10 minimum1 Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property alias\_group\_names: Optional\[List\[str]] Link to this property alias\_group\_names\_internal: Optional\[List\[str]] Link to this property attribution\_organization: Optional\[str] Link to this property
attribution\_organization\_annotated: Optional\[TagAttributionOrganizationAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property category\_name: Optional\[str] Link to this property category\_uuid: Optional\[str] Link to this property confidence: Optional\[int] Overall tag confidence (1-10). maximum10 minimum1 Link to this property created\_at: Optional\[str] Link to this property date\_of\_discovery: Optional\[str] Link to this property description: Optional\[str] Link to this property external\_reference\_links: Optional\[List\[str]] Link to this property
external\_references: Optional\[List\[TagExternalReference]] Structured external references ({ url, description }). Public: returned to all accounts. url: str Link to this property description: Optional\[str] Link to this property
Link to this property
external\_references\_annotated: Optional\[List\[TagExternalReferencesAnnotated]] value: str Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
internal\_aliases: Optional\[List\[TagInternalAlias]] Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses. value: str Link to this property confidence: Optional\[int] maximum10 minimum1 Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property internal\_description: Optional\[str] Link to this property last\_seen: Optional\[str] Link to this property motive: Optional\[str] Link to this property
motive\_annotated: Optional\[TagMotiveAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property opsec\_level: Optional\[str] Link to this property
opsec\_level\_annotated: Optional\[TagOpsecLevelAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property origin\_country\_iso: Optional\[str] ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace. Link to this property
origin\_country\_iso\_annotated: Optional\[TagOriginCountryISOAnnotated] value: Optional\[str] Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property priority: Optional\[float] Link to this property
priority\_annotated: Optional\[TagPriorityAnnotated] value: float Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property properties: Optional\[Dict\[str, object]] Parsed custom field values. Null when the tag has no custom fields. Link to this property sophistication\_level: Optional\[str] Link to this property
sophistication\_level\_annotated: Optional\[TagSophisticationLevelAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] Tag-level TLP handling marking. One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property updated\_at: Optional\[str] Link to this property version: Optional\[float] Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_list_response%20%3E%20(schema)>)
class TagCreateResponse: … uuid: str Link to this property value: str Link to this property active\_duration: Optional\[str] Link to this property
active\_duration\_annotated: Optional\[ActiveDurationAnnotated] value: str Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property actor\_category: Optional\[str] Link to this property
actor\_category\_annotated: Optional\[ActorCategoryAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
aliases: Optional\[List\[Alias]] Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts). value: str Link to this property confidence: Optional\[int] maximum10 minimum1 Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property alias\_group\_names: Optional\[List\[str]] Link to this property alias\_group\_names\_internal: Optional\[List\[str]] Link to this property attribution\_organization: Optional\[str] Link to this property
attribution\_organization\_annotated: Optional\[AttributionOrganizationAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property category\_name: Optional\[str] Link to this property category\_uuid: Optional\[str] Link to this property confidence: Optional\[int] Overall tag confidence (1-10). maximum10 minimum1 Link to this property created\_at: Optional\[str] Link to this property date\_of\_discovery: Optional\[str] Link to this property description: Optional\[str] Link to this property external\_reference\_links: Optional\[List\[str]] Link to this property
external\_references: Optional\[List\[ExternalReference]] Structured external references ({ url, description }). Public: returned to all accounts. url: str Link to this property description: Optional\[str] Link to this property
Link to this property
external\_references\_annotated: Optional\[List\[ExternalReferencesAnnotated]] value: str Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
internal\_aliases: Optional\[List\[InternalAlias]] Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses. value: str Link to this property confidence: Optional\[int] maximum10 minimum1 Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property internal\_description: Optional\[str] Link to this property last\_seen: Optional\[str] Link to this property motive: Optional\[str] Link to this property
motive\_annotated: Optional\[MotiveAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property opsec\_level: Optional\[str] Link to this property
opsec\_level\_annotated: Optional\[OpsecLevelAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property origin\_country\_iso: Optional\[str] ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace. Link to this property
origin\_country\_iso\_annotated: Optional\[OriginCountryISOAnnotated] value: Optional\[str] Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property priority: Optional\[float] Link to this property
priority\_annotated: Optional\[PriorityAnnotated] value: float Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property properties: Optional\[Dict\[str, object]] Parsed custom field values. Null when the tag has no custom fields. Link to this property sophistication\_level: Optional\[str] Link to this property
sophistication\_level\_annotated: Optional\[SophisticationLevelAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] Tag-level TLP handling marking. One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property updated\_at: Optional\[str] Link to this property version: Optional\[float] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_create_response%20%3E%20(schema)>)
class TagEditResponse: … uuid: str Link to this property value: str Link to this property active\_duration: Optional\[str] Link to this property
active\_duration\_annotated: Optional\[ActiveDurationAnnotated] value: str Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property actor\_category: Optional\[str] Link to this property
actor\_category\_annotated: Optional\[ActorCategoryAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
aliases: Optional\[List\[Alias]] Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts). value: str Link to this property confidence: Optional\[int] maximum10 minimum1 Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property alias\_group\_names: Optional\[List\[str]] Link to this property alias\_group\_names\_internal: Optional\[List\[str]] Link to this property attribution\_organization: Optional\[str] Link to this property
attribution\_organization\_annotated: Optional\[AttributionOrganizationAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property category\_name: Optional\[str] Link to this property category\_uuid: Optional\[str] Link to this property confidence: Optional\[int] Overall tag confidence (1-10). maximum10 minimum1 Link to this property created\_at: Optional\[str] Link to this property date\_of\_discovery: Optional\[str] Link to this property description: Optional\[str] Link to this property external\_reference\_links: Optional\[List\[str]] Link to this property
external\_references: Optional\[List\[ExternalReference]] Structured external references ({ url, description }). Public: returned to all accounts. url: str Link to this property description: Optional\[str] Link to this property
Link to this property
external\_references\_annotated: Optional\[List\[ExternalReferencesAnnotated]] value: str Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
internal\_aliases: Optional\[List\[InternalAlias]] Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses. value: str Link to this property confidence: Optional\[int] maximum10 minimum1 Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property internal\_description: Optional\[str] Link to this property last\_seen: Optional\[str] Link to this property motive: Optional\[str] Link to this property
motive\_annotated: Optional\[MotiveAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property opsec\_level: Optional\[str] Link to this property
opsec\_level\_annotated: Optional\[OpsecLevelAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property origin\_country\_iso: Optional\[str] ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace. Link to this property
origin\_country\_iso\_annotated: Optional\[OriginCountryISOAnnotated] value: Optional\[str] Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property priority: Optional\[float] Link to this property
priority\_annotated: Optional\[PriorityAnnotated] value: float Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property properties: Optional\[Dict\[str, object]] Parsed custom field values. Null when the tag has no custom fields. Link to this property sophistication\_level: Optional\[str] Link to this property
sophistication\_level\_annotated: Optional\[SophisticationLevelAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] Tag-level TLP handling marking. One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property updated\_at: Optional\[str] Link to this property version: Optional\[float] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_edit_response%20%3E%20(schema)>)
class TagDeleteResponse: … uuid: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_delete_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsTagsCategories ##### [Lists all tag categories (SoT)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/list) cloudforce\_one.threat\_events.tags.categories.list(CategoryListParams\*\*kwargs) -> [CategoryListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/tags/categories ##### [Creates a new tag category (SoT)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/create) cloudforce\_one.threat\_events.tags.categories.create(CategoryCreateParams\*\*kwargs) -> [CategoryCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/tags/categories/create ##### [Updates a tag category (SoT)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/edit) Deprecated cloudforce\_one.threat\_events.tags.categories.edit(strcategory\_uuid, CategoryEditParams\*\*kwargs) -> [CategoryEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/events/tags/categories/{category\_uuid} ##### [Deletes a tag category (SoT)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/delete) Deprecated cloudforce\_one.threat\_events.tags.categories.delete(strcategory\_uuid, CategoryDeleteParams\*\*kwargs) -> [CategoryDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/events/tags/categories/{category\_uuid} ##### ModelsExpand Collapse
class CategoryListResponse: …
categories: List\[Category] name: str Link to this property uuid: str Link to this property created\_at: Optional\[str] Link to this property description: Optional\[str] Link to this property
schema: Optional\[List\[CategorySchema]] Parsed FieldDefinition\[] defining custom fields for this category, or null if none. key: str Link to this property
kind: Literal\["string", "number", "enum", 3 more] One of the following: "string" Link to this property "number" Link to this property "enum" Link to this property "date" Link to this property "array" Link to this property "object" Link to this property
Link to this property allowed\_values: Optional\[List\[str]] Link to this property
annotations: Optional\[CategorySchemaAnnotations] confidence: Optional\[bool] Link to this property tlp: Optional\[bool] Link to this property
Link to this property deprecated: Optional\[bool] Marks a field as unavailable for new values while retaining its definition for historical values. Link to this property deprecated\_values: Optional\[List\[str]] Enum values unavailable for new writes but retained in allowedValues for historical display. Link to this property element: Optional\[object] Link to this property
enforcement: Optional\[Literal\["error", "warn", "off"]] One of the following: "error" Link to this property "warn" Link to this property "off" Link to this property
Link to this property
format: Optional\[Literal\["date", "url", "duration", "country"]] One of the following: "date" Link to this property "url" Link to this property "duration" Link to this property "country" Link to this property
Link to this property label: Optional\[str] maxLength128 minLength1 Link to this property max\_length: Optional\[int] exclusiveMinimum minimum0 Link to this property
number\_constraint: Optional\[CategorySchemaNumberConstraint] integer: Optional\[bool] Link to this property max: Optional\[float] Link to this property min: Optional\[float] Link to this property
Link to this property properties: Optional\[Dict\[str, object]] Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive). Link to this property required: Optional\[bool] Link to this property
Link to this property updated\_at: Optional\[str] Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>)
class CategoryCreateResponse: … name: str Link to this property uuid: str Link to this property created\_at: Optional\[str] Link to this property description: Optional\[str] Link to this property
schema: Optional\[List\[Schema]] Parsed FieldDefinition\[] defining custom fields for this category, or null if none. key: str Link to this property
kind: Literal\["string", "number", "enum", 3 more] One of the following: "string" Link to this property "number" Link to this property "enum" Link to this property "date" Link to this property "array" Link to this property "object" Link to this property
Link to this property allowed\_values: Optional\[List\[str]] Link to this property
annotations: Optional\[SchemaAnnotations] confidence: Optional\[bool] Link to this property tlp: Optional\[bool] Link to this property
Link to this property deprecated: Optional\[bool] Marks a field as unavailable for new values while retaining its definition for historical values. Link to this property deprecated\_values: Optional\[List\[str]] Enum values unavailable for new writes but retained in allowedValues for historical display. Link to this property element: Optional\[object] Link to this property
enforcement: Optional\[Literal\["error", "warn", "off"]] One of the following: "error" Link to this property "warn" Link to this property "off" Link to this property
Link to this property
format: Optional\[Literal\["date", "url", "duration", "country"]] One of the following: "date" Link to this property "url" Link to this property "duration" Link to this property "country" Link to this property
Link to this property label: Optional\[str] maxLength128 minLength1 Link to this property max\_length: Optional\[int] exclusiveMinimum minimum0 Link to this property
number\_constraint: Optional\[SchemaNumberConstraint] integer: Optional\[bool] Link to this property max: Optional\[float] Link to this property min: Optional\[float] Link to this property
Link to this property properties: Optional\[Dict\[str, object]] Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive). Link to this property required: Optional\[bool] Link to this property
Link to this property updated\_at: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_create_response%20%3E%20(schema)>)
class CategoryEditResponse: … name: str Link to this property uuid: str Link to this property created\_at: Optional\[str] Link to this property description: Optional\[str] Link to this property
schema: Optional\[List\[Schema]] Parsed FieldDefinition\[] defining custom fields for this category, or null if none. key: str Link to this property
kind: Literal\["string", "number", "enum", 3 more] One of the following: "string" Link to this property "number" Link to this property "enum" Link to this property "date" Link to this property "array" Link to this property "object" Link to this property
Link to this property allowed\_values: Optional\[List\[str]] Link to this property
annotations: Optional\[SchemaAnnotations] confidence: Optional\[bool] Link to this property tlp: Optional\[bool] Link to this property
Link to this property deprecated: Optional\[bool] Marks a field as unavailable for new values while retaining its definition for historical values. Link to this property deprecated\_values: Optional\[List\[str]] Enum values unavailable for new writes but retained in allowedValues for historical display. Link to this property element: Optional\[object] Link to this property
enforcement: Optional\[Literal\["error", "warn", "off"]] One of the following: "error" Link to this property "warn" Link to this property "off" Link to this property
Link to this property
format: Optional\[Literal\["date", "url", "duration", "country"]] One of the following: "date" Link to this property "url" Link to this property "duration" Link to this property "country" Link to this property
Link to this property label: Optional\[str] maxLength128 minLength1 Link to this property max\_length: Optional\[int] exclusiveMinimum minimum0 Link to this property
number\_constraint: Optional\[SchemaNumberConstraint] integer: Optional\[bool] Link to this property max: Optional\[float] Link to this property min: Optional\[float] Link to this property
Link to this property properties: Optional\[Dict\[str, object]] Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive). Link to this property required: Optional\[bool] Link to this property
Link to this property updated\_at: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_edit_response%20%3E%20(schema)>)
class CategoryDeleteResponse: … uuid: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_delete_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsTagsIndicators ##### [List indicators related to a tag](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/indicators/methods/list) cloudforce\_one.threat\_events.tags.indicators.list(strtag\_uuid, IndicatorListParams\*\*kwargs) -> [IndicatorListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/tags/{tag\_uuid}/indicators ##### ModelsExpand Collapse
class IndicatorListResponse: …
indicators: List\[Indicator] created\_at: datetime formatdate-time Link to this property indicator\_type: str Link to this property updated\_at: datetime formatdate-time Link to this property uuid: str Link to this property value: str Link to this property dataset\_id: Optional\[str] The dataset ID this indicator belongs to. Included in list responses. Link to this property
related\_events: Optional\[List\[IndicatorRelatedEvent]] Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. dataset\_id: str Link to this property event\_id: str Link to this property event\_date: Optional\[str] ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property related\_events\_has\_more: Optional\[bool] True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags: Optional\[List\[IndicatorTag]] category\_id: Optional\[str] The UUID of the tag category, or null when the tag is uncategorized. Link to this property category\_name: Optional\[str] Link to this property uuid: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property tlp: Optional\[str] Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property
pagination: Pagination page: float Link to this property page\_size: float Link to this property total\_count: float Link to this property total\_pages: float Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsTagsIndicatorsBy Dataset ##### [List indicators related to a tag within a dataset (deprecated)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/indicators/subresources/by_dataset/methods/list) Deprecated cloudforce\_one.threat\_events.tags.indicators.by\_dataset.list(strtag\_uuid, ByDatasetListParams\*\*kwargs) -> [ByDatasetListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/tags/{tag\_uuid}/indicators ##### ModelsExpand Collapse
class ByDatasetListResponse: …
indicators: List\[Indicator] created\_at: datetime formatdate-time Link to this property indicator\_type: str Link to this property updated\_at: datetime formatdate-time Link to this property uuid: str Link to this property value: str Link to this property dataset\_id: Optional\[str] The dataset ID this indicator belongs to. Included in list responses. Link to this property
related\_events: Optional\[List\[IndicatorRelatedEvent]] Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. dataset\_id: str Link to this property event\_id: str Link to this property event\_date: Optional\[str] ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property related\_events\_has\_more: Optional\[bool] True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags: Optional\[List\[IndicatorTag]] category\_id: Optional\[str] The UUID of the tag category, or null when the tag is uncategorized. Link to this property category\_name: Optional\[str] Link to this property uuid: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property tlp: Optional\[str] Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property
pagination: Pagination page: float Link to this property page\_size: float Link to this property total\_count: float Link to this property total\_pages: float Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.indicators.by_dataset%20%3E%20(model)%20by_dataset_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsEvent Tags ##### [Adds a tag to an event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/event_tags/methods/create) cloudforce\_one.threat\_events.event\_tags.create(strevent\_id, EventTagCreateParams\*\*kwargs) -> [EventTagCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/event\_tag/{event\_id}/create ##### [Removes a tag from an event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/event_tags/methods/delete) cloudforce\_one.threat\_events.event\_tags.delete(strevent\_id, EventTagDeleteParams\*\*kwargs) -> [EventTagDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/events/event\_tag/{event\_id} ##### ModelsExpand Collapse
class EventTagCreateResponse: … success: bool Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.event_tags%20%3E%20(model)%20event_tag_create_response%20%3E%20(schema)>)
class EventTagDeleteResponse: … success: bool Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.event_tags%20%3E%20(model)%20event_tag_delete_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsTarget Industries ##### [Lists target industries across multiple datasets](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/target_industries/methods/list) cloudforce\_one.threat\_events.target\_industries.list(TargetIndustryListParams\*\*kwargs) -> [TargetIndustryListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/targetIndustries ##### ModelsExpand Collapse
class TargetIndustryListResponse: …
items: Items type: str Link to this property
Link to this property type: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.target_industries%20%3E%20(model)%20target_industry_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsTarget IndustriesBy Dataset ##### [Lists all target industries for a specific dataset](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/target_industries/subresources/by_dataset/methods/list) cloudforce\_one.threat\_events.target\_industries.by\_dataset.list(strdataset\_id, ByDatasetListParams\*\*kwargs) -> [ByDatasetListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/targetIndustries ##### ModelsExpand Collapse
class ByDatasetListResponse: …
items: Items type: str Link to this property
Link to this property type: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.target_industries.by_dataset%20%3E%20(model)%20by_dataset_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsTarget IndustriesCatalog ##### [Lists all target industries from industry map catalog](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/target_industries/subresources/catalog/methods/list) cloudforce\_one.threat\_events.target\_industries.catalog.list(CatalogListParams\*\*kwargs) -> [CatalogListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/targetIndustries/catalog ##### ModelsExpand Collapse
class CatalogListResponse: …
items: Items type: str Link to this property
Link to this property type: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.target_industries.catalog%20%3E%20(model)%20catalog_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsInsights #### Cloudforce OneThreat Signals Threat Signals API for managing threat intelligence feeds, articles, indicators, and AI skills in Cloudforce One. ## Prerequisites 1. **API token** — requests must use an API token with Cloudforce One permissions; write operations (creating, editing, or deleting feeds, skills, and tags) require write access. 2. **Plan limits** — access on the Free plan is limited; feed quotas and managed default skills apply. #### Cloudforce OneThreat SignalsSearch ##### [Search Threat Signals articles using AI Search](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/search/methods/search) cloudforce\_one.threat\_signals.search.search(SearchSearchParams\*\*kwargs) -> [SearchSearchResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/search ##### ModelsExpand Collapse
class SearchSearchResponse: … count: int Number of unique article candidates returned in this response. Equal to results.length. minimum0 Link to this property
results: List\[Result] article\_id: str formatuuid Link to this property dataset\_id: Optional\[str] formatuuid Link to this property event\_id: Optional\[str] formatuuid Link to this property feed\_id: str formatuuid Link to this property score: float Link to this property text: str Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.search%20%3E%20(model)%20search_search_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsCategories ##### [List Threat Signals feed categories](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/categories/methods/list) cloudforce\_one.threat\_signals.categories.list(CategoryListParams\*\*kwargs) -> [CategoryListResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/categories ##### ModelsExpand Collapse
class CategoryListResponse: …
categories: List\[Category] id: str Wire value accepted by the feed category_id field. formatuuid Link to this property description: str Plain-language description of the category. Link to this property name: str Human-readable display label. Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsFeeds ##### [List Threat Signals feeds](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/list) cloudforce\_one.threat\_signals.feeds.list(FeedListParams\*\*kwargs) -> SyncV4PagePagination\[[FeedListResponse]()] GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds ##### [Create Threat Signals feed](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/create) cloudforce\_one.threat\_signals.feeds.create(FeedCreateParams\*\*kwargs) -> [FeedCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds ##### [Update Threat Signals feed](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/edit) cloudforce\_one.threat\_signals.feeds.edit(strfeed\_id, FeedEditParams\*\*kwargs) -> [FeedEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id} ##### [Delete Threat Signals feed](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/delete) cloudforce\_one.threat\_signals.feeds.delete(strfeed\_id, FeedDeleteParams\*\*kwargs) -> [FeedDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id} ##### [Trigger Threat Signals feed poll](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/poll) cloudforce\_one.threat\_signals.feeds.poll(FeedPollParams\*\*kwargs) -> [FeedPollResponse]() POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/poll ##### ModelsExpand Collapse
class FeedListResponse: … count: int Number of feeds on this page. Link to this property
feeds: List\[Feed] id: str formatuuid Link to this property category\_id: Optional\[str] Feed category identifier. Null when unset. Link to this property category\_name: Optional\[str] Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: str Link to this property curated\_feed\_id: Optional\[str] Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: Optional\[str] Link to this property enabled: bool Link to this property last\_polled\_at: Optional\[str] Link to this property poll\_interval\_s: int Link to this property source\_type: str custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: str Polling health: active, or error after a failed poll. Link to this property subscribed\_at: Optional\[str] Link to this property title: Optional\[str] Link to this property updated\_at: str Link to this property url: str Link to this property
Link to this property page: int Link to this property per\_page: int Link to this property total\_count: int Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_list_response%20%3E%20(schema)>)
class FeedCreateResponse: … id: str formatuuid Link to this property category\_id: Optional\[str] Feed category identifier. Null when unset. Link to this property category\_name: Optional\[str] Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: str Link to this property curated\_feed\_id: Optional\[str] Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: Optional\[str] Link to this property enabled: bool Link to this property last\_polled\_at: Optional\[str] Link to this property poll\_interval\_s: int Link to this property source\_type: str custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: str Polling health: active, or error after a failed poll. Link to this property subscribed\_at: Optional\[str] Link to this property title: Optional\[str] Link to this property updated\_at: str Link to this property url: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_create_response%20%3E%20(schema)>)
class FeedEditResponse: … id: str formatuuid Link to this property category\_id: Optional\[str] Feed category identifier. Null when unset. Link to this property category\_name: Optional\[str] Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: str Link to this property curated\_feed\_id: Optional\[str] Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: Optional\[str] Link to this property enabled: bool Link to this property last\_polled\_at: Optional\[str] Link to this property poll\_interval\_s: int Link to this property source\_type: str custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: str Polling health: active, or error after a failed poll. Link to this property subscribed\_at: Optional\[str] Link to this property title: Optional\[str] Link to this property updated\_at: str Link to this property url: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_edit_response%20%3E%20(schema)>)
class FeedDeleteResponse: … id: str formatuuid Link to this property category\_id: Optional\[str] Feed category identifier. Null when unset. Link to this property category\_name: Optional\[str] Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: str Link to this property curated\_feed\_id: Optional\[str] Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: Optional\[str] Link to this property enabled: bool Link to this property last\_polled\_at: Optional\[str] Link to this property poll\_interval\_s: int Link to this property source\_type: str custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: str Polling health: active, or error after a failed poll. Link to this property subscribed\_at: Optional\[str] Link to this property title: Optional\[str] Link to this property updated\_at: str Link to this property url: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_delete_response%20%3E%20(schema)>)
class FeedPollResponse: … errors: float Link to this property
feeds: List\[Feed] feed\_id: str formatuuid Link to this property
status: Literal\["workflow\_created", "error"] One of the following: "workflow\_created" Link to this property "error" Link to this property
Link to this property workflow\_id: str Link to this property feed\_enabled: Optional\[bool] Link to this property
Link to this property triggered: float Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_poll_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsFeedsRaw ##### [Get Threat Signals feed XML](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/raw/methods/get) cloudforce\_one.threat\_signals.feeds.raw.get(strfeed\_id, RawGetParams\*\*kwargs) -> [RawGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/raw ##### ModelsExpand Collapse str [Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsFeedsSkills ##### [Get Threat Signals feed skills](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/skills/methods/get) cloudforce\_one.threat\_signals.feeds.skills.get(strfeed\_id, SkillGetParams\*\*kwargs) -> [SkillGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/skills ##### [Set Threat Signals feed skills](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/skills/methods/update) cloudforce\_one.threat\_signals.feeds.skills.update(strfeed\_id, SkillUpdateParams\*\*kwargs) -> [SkillUpdateResponse]() PUT/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/skills ##### ModelsExpand Collapse
class SkillGetResponse: … feed\_id: str formatuuid Link to this property
skills: List\[Skill] id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.skills%20%3E%20(model)%20skill_get_response%20%3E%20(schema)>)
class SkillUpdateResponse: … feed\_id: str formatuuid Link to this property
skills: List\[Skill] position: int Zero-based pipeline position. Link to this property skill\_id: str Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.skills%20%3E%20(model)%20skill_update_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsArticles ##### [List Threat Signals articles](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/list) cloudforce\_one.threat\_signals.articles.list(ArticleListParams\*\*kwargs) -> [ArticleListResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles ##### [Bulk update Threat Signals article read status](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/bulk_edit) cloudforce\_one.threat\_signals.articles.bulk\_edit(ArticleBulkEditParams\*\*kwargs) -> [ArticleBulkEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles ##### [Get Threat Signals article](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/get) cloudforce\_one.threat\_signals.articles.get(strarticle\_id, ArticleGetParams\*\*kwargs) -> [ArticleGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id} ##### [Update Threat Signals article read status](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/edit) cloudforce\_one.threat\_signals.articles.edit(strarticle\_id, ArticleEditParams\*\*kwargs) -> [ArticleEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id} ##### ModelsExpand Collapse
class ArticleListResponse: …
articles: List\[Article] id: str formatuuid Link to this property dataset\_id: Optional\[str] Threat Events dataset identifier for the article redirect. Null when the account feeds dataset mapping is unavailable. Link to this property event\_id: Optional\[str] Threat Events event identifier associated with this article for a UI redirect. Null when no event has been linked. Link to this property feed\_display\_name: Optional\[str] Link to this property feed\_id: str formatuuid Link to this property fetched\_at: str Link to this property link: Optional\[str] Link to this property published\_at: Optional\[str] Link to this property read: bool Link to this property read\_at: Optional\[str] Link to this property summary: Optional\[str] Persisted enrichment summary. Null until enrichment produces a summary. Link to this property
tags: List\[ArticleTag]
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
Link to this property title: Optional\[str] Link to this property
Link to this property has\_more: bool Link to this property next\_cursor: Optional\[str] Link to this property total\_count: Optional\[float] Link to this property total\_count\_is\_exact: bool Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_list_response%20%3E%20(schema)>)
class ArticleBulkEditResponse: … updated\_count: float Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_bulk_edit_response%20%3E%20(schema)>)
class ArticleGetResponse: … id: str formatuuid Link to this property
bullet\_points: Optional\[BulletPoints] impact: str Link to this property what\_happened: str Link to this property who\_affected: str Link to this property
Link to this property content\_r2\_key: Optional\[str] Link to this property feed\_display\_name: Optional\[str] Link to this property feed\_id: str formatuuid Link to this property fetched\_at: str Link to this property
indicator\_extraction\_status: Literal\["in\_progress", "complete", "failed", "unknown"] Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded. One of the following: "in\_progress" Link to this property "complete" Link to this property "failed" Link to this property "unknown" Link to this property
Link to this property link: Optional\[str] Link to this property metadata: Optional\[Dict\[str, object]] Link to this property published\_at: Optional\[str] Link to this property read: bool Link to this property read\_at: Optional\[str] Link to this property source\_count: float Link to this property summary: Optional\[str] Persisted enrichment summary. Null until enrichment produces a summary. Link to this property summary\_r2\_key: Optional\[str] Link to this property
tags: List\[Tag]
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
Link to this property title: Optional\[str] Link to this property skill\_version: Optional\[str] Link to this property tag\_skill\_version: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_get_response%20%3E%20(schema)>)
class ArticleEditResponse: … id: str formatuuid Link to this property
bullet\_points: Optional\[BulletPoints] impact: str Link to this property what\_happened: str Link to this property who\_affected: str Link to this property
Link to this property content\_r2\_key: Optional\[str] Link to this property feed\_display\_name: Optional\[str] Link to this property feed\_id: str formatuuid Link to this property fetched\_at: str Link to this property
indicator\_extraction\_status: Literal\["in\_progress", "complete", "failed", "unknown"] Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded. One of the following: "in\_progress" Link to this property "complete" Link to this property "failed" Link to this property "unknown" Link to this property
Link to this property link: Optional\[str] Link to this property metadata: Optional\[Dict\[str, object]] Link to this property published\_at: Optional\[str] Link to this property read: bool Link to this property read\_at: Optional\[str] Link to this property source\_count: float Link to this property summary: Optional\[str] Persisted enrichment summary. Null until enrichment produces a summary. Link to this property summary\_r2\_key: Optional\[str] Link to this property
tags: List\[Tag]
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
Link to this property title: Optional\[str] Link to this property skill\_version: Optional\[str] Link to this property tag\_skill\_version: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_edit_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsArticlesContent ##### [Get Threat Signals article content](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/content/methods/get) cloudforce\_one.threat\_signals.articles.content.get(strarticle\_id, ContentGetParams\*\*kwargs) -> [ContentGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/content ##### ModelsExpand Collapse str [Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.content%20%3E%20(model)%20content_get_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsArticlesTags ##### [Add tag to Threat Signals article](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/create) cloudforce\_one.threat\_signals.articles.tags.create(strarticle\_id, TagCreateParams\*\*kwargs) -> [TagCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tags ##### [Remove tag from Threat Signals article](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/delete) cloudforce\_one.threat\_signals.articles.tags.delete(strtag\_id, TagDeleteParams\*\*kwargs) -> [TagDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tags/{tag\_id} ##### [Generate Threat Signals article AI tags](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/generate) cloudforce\_one.threat\_signals.articles.tags.generate(strarticle\_id, TagGenerateParams\*\*kwargs) -> [TagGenerateResponse]() POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tag ##### ModelsExpand Collapse
class TagCreateResponse: …
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_create_response%20%3E%20(schema)>)
class TagDeleteResponse: …
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_delete_response%20%3E%20(schema)>)
class TagGenerateResponse: … tag\_skill\_version: str Link to this property
tags: List\[Tag] Final hydrated assignment set; may be empty when no applicable tags are selected.
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_generate_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsArticlesSkill Outputs ##### [Get Threat Signals article skill output](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/skill_outputs/methods/get) cloudforce\_one.threat\_signals.articles.skill\_outputs.get(strskill\_id, SkillOutputGetParams\*\*kwargs) -> [SkillOutputGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/skills/{skill\_id}/output ##### ModelsExpand Collapse
class SkillOutputGetResponse: … article\_id: str formatuuid Link to this property custom\_skill\_version: Optional\[str] Link to this property output\_schema: Optional\[str] JSON-encoded output schema of the skill. Null when the skill no longer exists. Link to this property skill\_id: str Link to this property custom\_output: Optional\[object] Skill output. Parsed JSON when the stored output is valid JSON, otherwise the raw string. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.skill_outputs%20%3E%20(model)%20skill_output_get_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsIndicators ##### [List Threat Signals article indicators](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/indicators/methods/list) cloudforce\_one.threat\_signals.indicators.list(IndicatorListParams\*\*kwargs) -> [IndicatorListResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/indicators ##### ModelsExpand Collapse
class IndicatorListResponse: …
indicators: List\[Indicator] id: str formatuuid Link to this property article\_id: str formatuuid Link to this property article\_title: Optional\[str] Link to this property dataset\_id: Optional\[str] Threat Events dataset identifier for navigating from this indicator. Null when the account feeds dataset mapping is unavailable. Link to this property feed\_display\_name: Optional\[str] Link to this property feed\_id: str formatuuid Link to this property type: str Link to this property value: str Link to this property
Link to this property
pagination: Pagination count: int minimum0 Link to this property cursor: Optional\[str] Link to this property has\_more: bool Link to this property page: int Ordinal of this cursor page; not a total-results offset. minimum1 Link to this property per\_page: int maximum100 minimum1 Link to this property total\_count: Optional\[int] minimum0 Link to this property total\_count\_is\_exact: bool Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsSkills ##### [List Threat Signals skills](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/list) cloudforce\_one.threat\_signals.skills.list(SkillListParams\*\*kwargs) -> SyncV4PagePagination\[[SkillListResponse]()] GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills ##### [Create Threat Signals skill](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/create) cloudforce\_one.threat\_signals.skills.create(SkillCreateParams\*\*kwargs) -> [SkillCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills ##### [Get Threat Signals skill](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/get) cloudforce\_one.threat\_signals.skills.get(strskill\_id, SkillGetParams\*\*kwargs) -> [SkillGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### [Update Threat Signals skill](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/edit) cloudforce\_one.threat\_signals.skills.edit(strskill\_id, SkillEditParams\*\*kwargs) -> [SkillEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### [Delete Threat Signals skill](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/delete) cloudforce\_one.threat\_signals.skills.delete(strskill\_id, SkillDeleteParams\*\*kwargs) -> [SkillDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### ModelsExpand Collapse
class SkillListResponse: … count: int Number of skills on this page. Link to this property custom\_skills\_available: bool Whether the authenticated account may access custom-skill capabilities under Stakeout’s Threat Signals access-mode policy. This is a policy availability indicator, not a row-existence indicator. False for threat\_signals\_only mode; true for entitled, allowlisted, cfone\_internal, and service modes. Link to this property page: int Link to this property per\_page: int Link to this property
skills: List\[Skill] id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
Link to this property total\_count: int Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_list_response%20%3E%20(schema)>)
class SkillCreateResponse: … id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_create_response%20%3E%20(schema)>)
class SkillGetResponse: … id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_get_response%20%3E%20(schema)>)
class SkillEditResponse: … id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_edit_response%20%3E%20(schema)>)
class SkillDeleteResponse: … id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_delete_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsSkillsTag Categories ##### [Get Threat Signals skill tag categories](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/subresources/tag_categories/methods/get) cloudforce\_one.threat\_signals.skills.tag\_categories.get(Literal\["default-tagging-skill"]skill\_id, TagCategoryGetParams\*\*kwargs) -> [TagCategoryGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}/tag-categories ##### [Replace Threat Signals skill tag categories](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/subresources/tag_categories/methods/update) cloudforce\_one.threat\_signals.skills.tag\_categories.update(Literal\["default-tagging-skill"]skill\_id, TagCategoryUpdateParams\*\*kwargs) -> [TagCategoryUpdateResponse]() PUT/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}/tag-categories ##### ModelsExpand Collapse
class TagCategoryGetResponse: … category\_uuids: List\[str] Link to this property skill\_id: Literal\["default-tagging-skill"] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills.tag_categories%20%3E%20(model)%20tag_category_get_response%20%3E%20(schema)>)
class TagCategoryUpdateResponse: … category\_uuids: List\[str] Link to this property skill\_id: Literal\["default-tagging-skill"] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills.tag_categories%20%3E%20(model)%20tag_category_update_response%20%3E%20(schema)>)