--- title: Threat Signals --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [Cloudforce One](https://developers.cloudflare.com/api/python/resources/cloudforce_one) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Threat Signals Threat Signals API for managing threat intelligence feeds, articles, indicators, and AI skills in Cloudforce One. ## Prerequisites 1. **API token** — requests must use an API token with Cloudforce One permissions; write operations (creating, editing, or deleting feeds, skills, and tags) require write access. 2. **Plan limits** — access on the Free plan is limited; feed quotas and managed default skills apply. #### Threat SignalsSearch ##### [Search Threat Signals articles using AI Search](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/search/methods/search) cloudforce\_one.threat\_signals.search.search(SearchSearchParams\*\*kwargs) -> [SearchSearchResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/search ##### ModelsExpand Collapse
class SearchSearchResponse: … count: int Number of unique article candidates returned in this response. Equal to results.length. minimum0 Link to this property
results: List\[Result] article\_id: str formatuuid Link to this property dataset\_id: Optional\[str] formatuuid Link to this property event\_id: Optional\[str] formatuuid Link to this property feed\_id: str formatuuid Link to this property score: float Link to this property text: str Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.search%20%3E%20(model)%20search_search_response%20%3E%20(schema)>) #### Threat SignalsCategories ##### [List Threat Signals feed categories](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/categories/methods/list) cloudforce\_one.threat\_signals.categories.list(CategoryListParams\*\*kwargs) -> [CategoryListResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/categories ##### ModelsExpand Collapse
class CategoryListResponse: …
categories: List\[Category] id: str Wire value accepted by the feed category_id field. formatuuid Link to this property description: str Plain-language description of the category. Link to this property name: str Human-readable display label. Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>) #### Threat SignalsFeeds ##### [List Threat Signals feeds](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/list) cloudforce\_one.threat\_signals.feeds.list(FeedListParams\*\*kwargs) -> SyncV4PagePagination\[[FeedListResponse]()] GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds ##### [Create Threat Signals feed](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/create) cloudforce\_one.threat\_signals.feeds.create(FeedCreateParams\*\*kwargs) -> [FeedCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds ##### [Update Threat Signals feed](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/edit) cloudforce\_one.threat\_signals.feeds.edit(strfeed\_id, FeedEditParams\*\*kwargs) -> [FeedEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id} ##### [Delete Threat Signals feed](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/delete) cloudforce\_one.threat\_signals.feeds.delete(strfeed\_id, FeedDeleteParams\*\*kwargs) -> [FeedDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id} ##### [Trigger Threat Signals feed poll](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/poll) cloudforce\_one.threat\_signals.feeds.poll(FeedPollParams\*\*kwargs) -> [FeedPollResponse]() POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/poll ##### ModelsExpand Collapse
class FeedListResponse: … count: int Number of feeds on this page. Link to this property
feeds: List\[Feed] id: str formatuuid Link to this property category\_id: Optional\[str] Feed category identifier. Null when unset. Link to this property category\_name: Optional\[str] Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: str Link to this property curated\_feed\_id: Optional\[str] Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: Optional\[str] Link to this property enabled: bool Link to this property last\_polled\_at: Optional\[str] Link to this property poll\_interval\_s: int Link to this property source\_type: str custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: str Polling health: active, or error after a failed poll. Link to this property subscribed\_at: Optional\[str] Link to this property title: Optional\[str] Link to this property updated\_at: str Link to this property url: str Link to this property
Link to this property page: int Link to this property per\_page: int Link to this property total\_count: int Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_list_response%20%3E%20(schema)>)
class FeedCreateResponse: … id: str formatuuid Link to this property category\_id: Optional\[str] Feed category identifier. Null when unset. Link to this property category\_name: Optional\[str] Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: str Link to this property curated\_feed\_id: Optional\[str] Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: Optional\[str] Link to this property enabled: bool Link to this property last\_polled\_at: Optional\[str] Link to this property poll\_interval\_s: int Link to this property source\_type: str custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: str Polling health: active, or error after a failed poll. Link to this property subscribed\_at: Optional\[str] Link to this property title: Optional\[str] Link to this property updated\_at: str Link to this property url: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_create_response%20%3E%20(schema)>)
class FeedEditResponse: … id: str formatuuid Link to this property category\_id: Optional\[str] Feed category identifier. Null when unset. Link to this property category\_name: Optional\[str] Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: str Link to this property curated\_feed\_id: Optional\[str] Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: Optional\[str] Link to this property enabled: bool Link to this property last\_polled\_at: Optional\[str] Link to this property poll\_interval\_s: int Link to this property source\_type: str custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: str Polling health: active, or error after a failed poll. Link to this property subscribed\_at: Optional\[str] Link to this property title: Optional\[str] Link to this property updated\_at: str Link to this property url: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_edit_response%20%3E%20(schema)>)
class FeedDeleteResponse: … id: str formatuuid Link to this property category\_id: Optional\[str] Feed category identifier. Null when unset. Link to this property category\_name: Optional\[str] Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: str Link to this property curated\_feed\_id: Optional\[str] Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: Optional\[str] Link to this property enabled: bool Link to this property last\_polled\_at: Optional\[str] Link to this property poll\_interval\_s: int Link to this property source\_type: str custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: str Polling health: active, or error after a failed poll. Link to this property subscribed\_at: Optional\[str] Link to this property title: Optional\[str] Link to this property updated\_at: str Link to this property url: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_delete_response%20%3E%20(schema)>)
class FeedPollResponse: … errors: float Link to this property
feeds: List\[Feed] feed\_id: str formatuuid Link to this property
status: Literal\["workflow\_created", "error"] One of the following: "workflow\_created" Link to this property "error" Link to this property
Link to this property workflow\_id: str Link to this property feed\_enabled: Optional\[bool] Link to this property
Link to this property triggered: float Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_poll_response%20%3E%20(schema)>) #### Threat SignalsFeedsRaw ##### [Get Threat Signals feed XML](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/raw/methods/get) cloudforce\_one.threat\_signals.feeds.raw.get(strfeed\_id, RawGetParams\*\*kwargs) -> [RawGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/raw ##### ModelsExpand Collapse str [Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>) #### Threat SignalsFeedsSkills ##### [Get Threat Signals feed skills](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/skills/methods/get) cloudforce\_one.threat\_signals.feeds.skills.get(strfeed\_id, SkillGetParams\*\*kwargs) -> [SkillGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/skills ##### [Set Threat Signals feed skills](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/skills/methods/update) cloudforce\_one.threat\_signals.feeds.skills.update(strfeed\_id, SkillUpdateParams\*\*kwargs) -> [SkillUpdateResponse]() PUT/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/skills ##### ModelsExpand Collapse
class SkillGetResponse: … feed\_id: str formatuuid Link to this property
skills: List\[Skill] id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.skills%20%3E%20(model)%20skill_get_response%20%3E%20(schema)>)
class SkillUpdateResponse: … feed\_id: str formatuuid Link to this property
skills: List\[Skill] position: int Zero-based pipeline position. Link to this property skill\_id: str Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.skills%20%3E%20(model)%20skill_update_response%20%3E%20(schema)>) #### Threat SignalsArticles ##### [List Threat Signals articles](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/list) cloudforce\_one.threat\_signals.articles.list(ArticleListParams\*\*kwargs) -> [ArticleListResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles ##### [Bulk update Threat Signals article read status](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/bulk_edit) cloudforce\_one.threat\_signals.articles.bulk\_edit(ArticleBulkEditParams\*\*kwargs) -> [ArticleBulkEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles ##### [Get Threat Signals article](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/get) cloudforce\_one.threat\_signals.articles.get(strarticle\_id, ArticleGetParams\*\*kwargs) -> [ArticleGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id} ##### [Update Threat Signals article read status](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/edit) cloudforce\_one.threat\_signals.articles.edit(strarticle\_id, ArticleEditParams\*\*kwargs) -> [ArticleEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id} ##### ModelsExpand Collapse
class ArticleListResponse: …
articles: List\[Article] id: str formatuuid Link to this property dataset\_id: Optional\[str] Threat Events dataset identifier for the article redirect. Null when the account feeds dataset mapping is unavailable. Link to this property event\_id: Optional\[str] Threat Events event identifier associated with this article for a UI redirect. Null when no event has been linked. Link to this property feed\_display\_name: Optional\[str] Link to this property feed\_id: str formatuuid Link to this property fetched\_at: str Link to this property link: Optional\[str] Link to this property published\_at: Optional\[str] Link to this property read: bool Link to this property read\_at: Optional\[str] Link to this property summary: Optional\[str] Persisted enrichment summary. Null until enrichment produces a summary. Link to this property
tags: List\[ArticleTag]
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
Link to this property title: Optional\[str] Link to this property
Link to this property has\_more: bool Link to this property next\_cursor: Optional\[str] Link to this property total\_count: Optional\[float] Link to this property total\_count\_is\_exact: bool Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_list_response%20%3E%20(schema)>)
class ArticleBulkEditResponse: … updated\_count: float Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_bulk_edit_response%20%3E%20(schema)>)
class ArticleGetResponse: … id: str formatuuid Link to this property
bullet\_points: Optional\[BulletPoints] impact: str Link to this property what\_happened: str Link to this property who\_affected: str Link to this property
Link to this property content\_r2\_key: Optional\[str] Link to this property feed\_display\_name: Optional\[str] Link to this property feed\_id: str formatuuid Link to this property fetched\_at: str Link to this property
indicator\_extraction\_status: Literal\["in\_progress", "complete", "failed", "unknown"] Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded. One of the following: "in\_progress" Link to this property "complete" Link to this property "failed" Link to this property "unknown" Link to this property
Link to this property link: Optional\[str] Link to this property metadata: Optional\[Dict\[str, object]] Link to this property published\_at: Optional\[str] Link to this property read: bool Link to this property read\_at: Optional\[str] Link to this property source\_count: float Link to this property summary: Optional\[str] Persisted enrichment summary. Null until enrichment produces a summary. Link to this property summary\_r2\_key: Optional\[str] Link to this property
tags: List\[Tag]
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
Link to this property title: Optional\[str] Link to this property skill\_version: Optional\[str] Link to this property tag\_skill\_version: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_get_response%20%3E%20(schema)>)
class ArticleEditResponse: … id: str formatuuid Link to this property
bullet\_points: Optional\[BulletPoints] impact: str Link to this property what\_happened: str Link to this property who\_affected: str Link to this property
Link to this property content\_r2\_key: Optional\[str] Link to this property feed\_display\_name: Optional\[str] Link to this property feed\_id: str formatuuid Link to this property fetched\_at: str Link to this property
indicator\_extraction\_status: Literal\["in\_progress", "complete", "failed", "unknown"] Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded. One of the following: "in\_progress" Link to this property "complete" Link to this property "failed" Link to this property "unknown" Link to this property
Link to this property link: Optional\[str] Link to this property metadata: Optional\[Dict\[str, object]] Link to this property published\_at: Optional\[str] Link to this property read: bool Link to this property read\_at: Optional\[str] Link to this property source\_count: float Link to this property summary: Optional\[str] Persisted enrichment summary. Null until enrichment produces a summary. Link to this property summary\_r2\_key: Optional\[str] Link to this property
tags: List\[Tag]
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
Link to this property title: Optional\[str] Link to this property skill\_version: Optional\[str] Link to this property tag\_skill\_version: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_edit_response%20%3E%20(schema)>) #### Threat SignalsArticlesContent ##### [Get Threat Signals article content](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/content/methods/get) cloudforce\_one.threat\_signals.articles.content.get(strarticle\_id, ContentGetParams\*\*kwargs) -> [ContentGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/content ##### ModelsExpand Collapse str [Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.content%20%3E%20(model)%20content_get_response%20%3E%20(schema)>) #### Threat SignalsArticlesTags ##### [Add tag to Threat Signals article](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/create) cloudforce\_one.threat\_signals.articles.tags.create(strarticle\_id, TagCreateParams\*\*kwargs) -> [TagCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tags ##### [Remove tag from Threat Signals article](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/delete) cloudforce\_one.threat\_signals.articles.tags.delete(strtag\_id, TagDeleteParams\*\*kwargs) -> [TagDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tags/{tag\_id} ##### [Generate Threat Signals article AI tags](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/generate) cloudforce\_one.threat\_signals.articles.tags.generate(strarticle\_id, TagGenerateParams\*\*kwargs) -> [TagGenerateResponse]() POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tag ##### ModelsExpand Collapse
class TagCreateResponse: …
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_create_response%20%3E%20(schema)>)
class TagDeleteResponse: …
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_delete_response%20%3E%20(schema)>)
class TagGenerateResponse: … tag\_skill\_version: str Link to this property
tags: List\[Tag] Final hydrated assignment set; may be empty when no applicable tags are selected.
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_generate_response%20%3E%20(schema)>) #### Threat SignalsArticlesSkill Outputs ##### [Get Threat Signals article skill output](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/skill_outputs/methods/get) cloudforce\_one.threat\_signals.articles.skill\_outputs.get(strskill\_id, SkillOutputGetParams\*\*kwargs) -> [SkillOutputGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/skills/{skill\_id}/output ##### ModelsExpand Collapse
class SkillOutputGetResponse: … article\_id: str formatuuid Link to this property custom\_skill\_version: Optional\[str] Link to this property output\_schema: Optional\[str] JSON-encoded output schema of the skill. Null when the skill no longer exists. Link to this property skill\_id: str Link to this property custom\_output: Optional\[object] Skill output. Parsed JSON when the stored output is valid JSON, otherwise the raw string. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.skill_outputs%20%3E%20(model)%20skill_output_get_response%20%3E%20(schema)>) #### Threat SignalsIndicators ##### [List Threat Signals article indicators](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/indicators/methods/list) cloudforce\_one.threat\_signals.indicators.list(IndicatorListParams\*\*kwargs) -> [IndicatorListResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/indicators ##### ModelsExpand Collapse
class IndicatorListResponse: …
indicators: List\[Indicator] id: str formatuuid Link to this property article\_id: str formatuuid Link to this property article\_title: Optional\[str] Link to this property dataset\_id: Optional\[str] Threat Events dataset identifier for navigating from this indicator. Null when the account feeds dataset mapping is unavailable. Link to this property feed\_display\_name: Optional\[str] Link to this property feed\_id: str formatuuid Link to this property type: str Link to this property value: str Link to this property
Link to this property
pagination: Pagination count: int minimum0 Link to this property cursor: Optional\[str] Link to this property has\_more: bool Link to this property page: int Ordinal of this cursor page; not a total-results offset. minimum1 Link to this property per\_page: int maximum100 minimum1 Link to this property total\_count: Optional\[int] minimum0 Link to this property total\_count\_is\_exact: bool Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>) #### Threat SignalsSkills ##### [List Threat Signals skills](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/list) cloudforce\_one.threat\_signals.skills.list(SkillListParams\*\*kwargs) -> SyncV4PagePagination\[[SkillListResponse]()] GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills ##### [Create Threat Signals skill](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/create) cloudforce\_one.threat\_signals.skills.create(SkillCreateParams\*\*kwargs) -> [SkillCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills ##### [Get Threat Signals skill](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/get) cloudforce\_one.threat\_signals.skills.get(strskill\_id, SkillGetParams\*\*kwargs) -> [SkillGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### [Update Threat Signals skill](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/edit) cloudforce\_one.threat\_signals.skills.edit(strskill\_id, SkillEditParams\*\*kwargs) -> [SkillEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### [Delete Threat Signals skill](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/delete) cloudforce\_one.threat\_signals.skills.delete(strskill\_id, SkillDeleteParams\*\*kwargs) -> [SkillDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### ModelsExpand Collapse
class SkillListResponse: … count: int Number of skills on this page. Link to this property custom\_skills\_available: bool Whether the authenticated account may access custom-skill capabilities under Stakeout’s Threat Signals access-mode policy. This is a policy availability indicator, not a row-existence indicator. False for threat\_signals\_only mode; true for entitled, allowlisted, cfone\_internal, and service modes. Link to this property page: int Link to this property per\_page: int Link to this property
skills: List\[Skill] id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
Link to this property total\_count: int Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_list_response%20%3E%20(schema)>)
class SkillCreateResponse: … id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_create_response%20%3E%20(schema)>)
class SkillGetResponse: … id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_get_response%20%3E%20(schema)>)
class SkillEditResponse: … id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_edit_response%20%3E%20(schema)>)
class SkillDeleteResponse: … id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_delete_response%20%3E%20(schema)>) #### Threat SignalsSkillsTag Categories ##### [Get Threat Signals skill tag categories](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/subresources/tag_categories/methods/get) cloudforce\_one.threat\_signals.skills.tag\_categories.get(Literal\["default-tagging-skill"]skill\_id, TagCategoryGetParams\*\*kwargs) -> [TagCategoryGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}/tag-categories ##### [Replace Threat Signals skill tag categories](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/subresources/tag_categories/methods/update) cloudforce\_one.threat\_signals.skills.tag\_categories.update(Literal\["default-tagging-skill"]skill\_id, TagCategoryUpdateParams\*\*kwargs) -> [TagCategoryUpdateResponse]() PUT/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}/tag-categories ##### ModelsExpand Collapse
class TagCategoryGetResponse: … category\_uuids: List\[str] Link to this property skill\_id: Literal\["default-tagging-skill"] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills.tag_categories%20%3E%20(model)%20tag_category_get_response%20%3E%20(schema)>)
class TagCategoryUpdateResponse: … category\_uuids: List\[str] Link to this property skill\_id: Literal\["default-tagging-skill"] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills.tag_categories%20%3E%20(model)%20tag_category_update_response%20%3E%20(schema)>)