--- title: Creates bulk events --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [Cloudforce One](https://developers.cloudflare.com/api/python/resources/cloudforce_one) [Threat Events](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Creates bulk events cloudforce\_one.threat\_events.bulk\_create(ThreatEventBulkCreateParams\*\*kwargs) -> [ThreatEventBulkCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/create/bulk The `datasetId` parameter must be defined. To list existing datasets (and their IDs) in your account, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint. ##### Security API Token The preferred authorization scheme for interacting with the Cloudflare API. [Create a token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). **Example:**`Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY` ##### Accepted Permissions (at least one required) `Cloudforce One Write``Cloudforce One Read` ##### ParametersExpand Collapse account\_id: str Account ID. [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create%20%3E%20(params)%20default%20%3E%20(param)%20account_id%20%3E%20(schema)>)
data: Iterable\[Data] category: str Link to this property date: Union\[str, datetime] formatdate-time Link to this property event: str Link to this property
raw: DataRaw data: Optional\[Dict\[str, object]] Link to this property source: Optional\[str] Link to this property tlp: Optional\[str] Link to this property
Link to this property tlp: str Link to this property account\_id: Optional\[float] Link to this property attacker: Optional\[str] Link to this property attacker\_country: Optional\[str] Link to this property dataset\_id: Optional\[str] Link to this property indicator: Optional\[str] Link to this property
indicators: Optional\[Iterable\[DataIndicator]] Array of indicators for this event. Supports multiple indicators per event for complex scenarios. indicator\_type: str The type of indicator (e.g., DOMAIN, IP, JA3, HASH) Link to this property value: str The indicator value (e.g., domain name, IP address, hash) Link to this property
Link to this property indicator\_type: Optional\[str] Link to this property insight: Optional\[str] Link to this property tags: Optional\[Sequence\[str]] Link to this property target\_country: Optional\[str] Link to this property target\_industry: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)>) dataset\_id: str [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create%20%3E%20(params)%20default%20%3E%20(param)%20datasetId%20%3E%20(schema)>) include\_created\_events: Optional\[[bool]()] When true, response includes array of created event UUIDs and shard IDs. Useful for tracking which events were created and where. [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create%20%3E%20(params)%20default%20%3E%20(param)%20includeCreatedEvents%20%3E%20(schema)>) ##### ReturnsExpand Collapse
class ThreatEventBulkCreateResponse: … Detailed result of bulk event creation with auto-tag management created\_events\_count: float Number of events created Link to this property created\_tags\_count: float Number of new tags created in SoT Link to this property error\_count: float Number of errors encountered Link to this property queued\_indicators\_count: float Number of indicators queued for async processing Link to this property create\_bulk\_events\_request\_id: Optional\[str] Correlation ID for async indicator processing formatuuid Link to this property
created\_events: Optional\[List\[CreatedEvent]] Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true event\_index: float Original index in the input data array Link to this property shard\_id: str Dataset ID of the shard where the event was created Link to this property uuid: str UUID of the created event formatuuid Link to this property
Link to this property
errors: Optional\[List\[Error]] Array of error details error: str Error message Link to this property event\_index: float Index of the event that caused the error Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_response%20%3E%20(schema)>) ### Creates bulk events Python HTTPTypeScriptPythonGoTerraform ``` import os from datetime import datetime from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.bulk_create( account_id="account_id", data=[{ "category": "Domain Resolution", "date": datetime.fromisoformat("2022-04-01T00:00:00"), "event": "An attacker registered the domain domain.com", "raw": { "data": { "foo": "bar" } }, "tlp": "amber", }], dataset_id="durableObjectName", ) print(response.created_events_count) ``` 200 example ``` { "createdEventsCount": 0, "createdTagsCount": 0, "errorCount": 0, "queuedIndicatorsCount": 0, "createBulkEventsRequestId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "createdEvents": [ { "eventIndex": 0, "shardId": "shardId", "uuid": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" } ], "errors": [ { "error": "error", "eventIndex": 0 } ] } ``` ##### Returns Examples 200 example ``` { "createdEventsCount": 0, "createdTagsCount": 0, "errorCount": 0, "queuedIndicatorsCount": 0, "createBulkEventsRequestId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "createdEvents": [ { "eventIndex": 0, "shardId": "shardId", "uuid": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" } ], "errors": [ { "error": "error", "eventIndex": 0 } ] } ```