--- title: Indicator Feeds --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [Intel](https://developers.cloudflare.com/api/python/resources/intel) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Indicator Feeds ##### [Get indicator feeds owned by this account](https://developers.cloudflare.com/api/python/resources/intel/subresources/indicator_feeds/methods/list) intel.indicator\_feeds.list(IndicatorFeedListParams\*\*kwargs) -> SyncSinglePage\[[IndicatorFeedListResponse]()] GET/accounts/{account\_id}/intel/indicator-feeds ##### [Get indicator feed metadata](https://developers.cloudflare.com/api/python/resources/intel/subresources/indicator_feeds/methods/get) intel.indicator\_feeds.get(intfeed\_id, IndicatorFeedGetParams\*\*kwargs) -> [IndicatorFeedGetResponse]() GET/accounts/{account\_id}/intel/indicator-feeds/{feed\_id} ##### [Create new indicator feed](https://developers.cloudflare.com/api/python/resources/intel/subresources/indicator_feeds/methods/create) intel.indicator\_feeds.create(IndicatorFeedCreateParams\*\*kwargs) -> [IndicatorFeedCreateResponse]() POST/accounts/{account\_id}/intel/indicator-feeds ##### [Update indicator feed metadata](https://developers.cloudflare.com/api/python/resources/intel/subresources/indicator_feeds/methods/update) intel.indicator\_feeds.update(intfeed\_id, IndicatorFeedUpdateParams\*\*kwargs) -> [IndicatorFeedUpdateResponse]() PUT/accounts/{account\_id}/intel/indicator-feeds/{feed\_id} ##### [Get indicator feed data](https://developers.cloudflare.com/api/python/resources/intel/subresources/indicator_feeds/methods/data) intel.indicator\_feeds.data(intfeed\_id, IndicatorFeedDataParams\*\*kwargs) -> [IndicatorFeedDataResponse]() GET/accounts/{account\_id}/intel/indicator-feeds/{feed\_id}/data ##### ModelsExpand Collapse
class IndicatorFeedListResponse: … id: Optional\[int] The unique identifier for the indicator feed Link to this property created\_on: Optional\[datetime] The date and time when the data entry was created formatdate-time Link to this property description: Optional\[str] The description of the example test Link to this property is\_attributable: Optional\[bool] Whether the indicator feed can be attributed to a provider Link to this property is\_downloadable: Optional\[bool] Whether the indicator feed can be downloaded Link to this property is\_public: Optional\[bool] Whether the indicator feed is exposed to customers Link to this property modified\_on: Optional\[datetime] The date and time when the data entry was last modified formatdate-time Link to this property name: Optional\[str] The name of the indicator feed Link to this property
[Link to this property](<#(resource)%20intel.indicator_feeds%20%3E%20(model)%20indicator_feed_list_response%20%3E%20(schema)>)
class IndicatorFeedGetResponse: … id: Optional\[int] The unique identifier for the indicator feed Link to this property created\_on: Optional\[datetime] The date and time when the data entry was created formatdate-time Link to this property description: Optional\[str] The description of the example test Link to this property is\_attributable: Optional\[bool] Whether the indicator feed can be attributed to a provider Link to this property is\_downloadable: Optional\[bool] Whether the indicator feed can be downloaded Link to this property is\_public: Optional\[bool] Whether the indicator feed is exposed to customers Link to this property
last\_upload\_summary: Optional\[LastUploadSummary] Summary of indicator counts from the last successful upload to this feed. Populated by the custom-threat-feeds loader at the end of each successful load. Absent (omitted) when no upload has completed successfully or the upload errored before the summary write. Surfaces silent-failure paths so operators can see when their indicators were dropped (popularity allowlist, expired valid\_until, etc.) without reading loader logs.
persisted: Optional\[LastUploadSummaryPersisted] Net delta applied to feed indicators by this upload. Snapshot uploads emit both \*\_added and \*\_removed; delta-add emits only \*\_added; delta-remove emits only \*\_removed. domains\_added: Optional\[int] Link to this property domains\_removed: Optional\[int] Link to this property ips\_added: Optional\[int] Link to this property ips\_removed: Optional\[int] Link to this property urls\_added: Optional\[int] Link to this property urls\_removed: Optional\[int] Link to this property
Link to this property
skipped: Optional\[LastUploadSummarySkipped] Counts of indicators that were uploaded but did not reach QuickSilver, broken down by reason. allowlisted\_domains: Optional\[int] Domains filtered by the global popularity allowlist at QS provisioning time. Popular domains (bing.com, naver.com, etc.) are protected from custom-threat-feed enforcement. Link to this property expired\_indicators: Optional\[int] Indicators in the upload whose valid\_until is already in the past. These are not added to QS; the expiration cron handles cleanup. Link to this property invalid\_indicators: Optional\[int] Reserved for future use. Currently always 0 — the unifier aborts the entire upload on a single bad indicator. Link to this property
Link to this property
uploaded: Optional\[LastUploadSummaryUploaded] Indicator counts from the unified file the loader received domains: Optional\[int] Number of domain indicators in the upload Link to this property ips: Optional\[int] Number of IP indicators in the upload Link to this property urls: Optional\[int] Number of URL indicators in the upload Link to this property
Link to this property
Link to this property latest\_upload\_error: Optional\[str] Human-readable error message describing why the latest upload failed. Populated only when latest_upload_status is Error. Returns one of a small fixed set of category-level messages (invalid domain / IP / URL entries, malformed row or header, invalid valid\_until timestamp, etc.) or the generic Upload failed for unknown or infrastructure-level errors. Never echoes raw error text from the underlying loader. Intel accounts receive the verbatim loader/API error text (including specific offending values) instead of these category-level messages. Link to this property
latest\_upload\_status: Optional\[Literal\["Mirroring", "Unifying", "Loading", 3 more]] Status of the latest snapshot uploaded One of the following: "Mirroring" Link to this property "Unifying" Link to this property "Loading" Link to this property "Provisioning" Link to this property "Complete" Link to this property "Error" Link to this property
Link to this property modified\_on: Optional\[datetime] The date and time when the data entry was last modified formatdate-time Link to this property name: Optional\[str] The name of the indicator feed Link to this property provider\_id: Optional\[int] The unique identifier for the provider Link to this property provider\_name: Optional\[str] The provider of the indicator feed Link to this property
[Link to this property](<#(resource)%20intel.indicator_feeds%20%3E%20(model)%20indicator_feed_get_response%20%3E%20(schema)>)
class IndicatorFeedCreateResponse: … id: Optional\[int] The unique identifier for the indicator feed Link to this property created\_on: Optional\[datetime] The date and time when the data entry was created formatdate-time Link to this property description: Optional\[str] The description of the example test Link to this property is\_attributable: Optional\[bool] Whether the indicator feed can be attributed to a provider Link to this property is\_downloadable: Optional\[bool] Whether the indicator feed can be downloaded Link to this property is\_public: Optional\[bool] Whether the indicator feed is exposed to customers Link to this property modified\_on: Optional\[datetime] The date and time when the data entry was last modified formatdate-time Link to this property name: Optional\[str] The name of the indicator feed Link to this property
[Link to this property](<#(resource)%20intel.indicator_feeds%20%3E%20(model)%20indicator_feed_create_response%20%3E%20(schema)>)
class IndicatorFeedUpdateResponse: … id: Optional\[int] The unique identifier for the indicator feed Link to this property created\_on: Optional\[datetime] The date and time when the data entry was created formatdate-time Link to this property description: Optional\[str] The description of the example test Link to this property is\_attributable: Optional\[bool] Whether the indicator feed can be attributed to a provider Link to this property is\_downloadable: Optional\[bool] Whether the indicator feed can be downloaded Link to this property is\_public: Optional\[bool] Whether the indicator feed is exposed to customers Link to this property modified\_on: Optional\[datetime] The date and time when the data entry was last modified formatdate-time Link to this property name: Optional\[str] The name of the indicator feed Link to this property
[Link to this property](<#(resource)%20intel.indicator_feeds%20%3E%20(model)%20indicator_feed_update_response%20%3E%20(schema)>) str [Link to this property](<#(resource)%20intel.indicator_feeds%20%3E%20(model)%20indicator_feed_data_response%20%3E%20(schema)>) #### Indicator FeedsSnapshots ##### [Update indicator feed data](https://developers.cloudflare.com/api/python/resources/intel/subresources/indicator_feeds/subresources/snapshots/methods/update) intel.indicator\_feeds.snapshots.update(intfeed\_id, SnapshotUpdateParams\*\*kwargs) -> [SnapshotUpdateResponse]() PUT/accounts/{account\_id}/intel/indicator-feeds/{feed\_id}/snapshot ##### ModelsExpand Collapse
class SnapshotUpdateResponse: … file\_id: Optional\[int] Feed id Link to this property filename: Optional\[str] Name of the file unified in our system Link to this property poll\_url: Optional\[str] Account-relative polling path. Prepend /accounts/{account_id} using the same account identifier and API host as the upload request. The path omits the account segment because the service does not have your account identifier in this context. Link to this property status: Optional\[str] Current status of the upload at the moment the request returned. This is NOT a terminal state: the file is unified inline, but the durable loader has only accepted it, so the upload is still Unifying. Poll poll_url until the status reaches a terminal value (Unified or Error). Link to this property upload\_id: Optional\[int] Identifier of the upload row, for polling this upload to a terminal state via poll_url. formatint64 Link to this property
[Link to this property](<#(resource)%20intel.indicator_feeds.snapshots%20%3E%20(model)%20snapshot_update_response%20%3E%20(schema)>) #### Indicator FeedsPermissions ##### [List indicator feed permissions](https://developers.cloudflare.com/api/python/resources/intel/subresources/indicator_feeds/subresources/permissions/methods/list) intel.indicator\_feeds.permissions.list(PermissionListParams\*\*kwargs) -> [PermissionListResponse]() GET/accounts/{account\_id}/intel/indicator-feeds/permissions/view ##### [Grant permission to indicator feed](https://developers.cloudflare.com/api/python/resources/intel/subresources/indicator_feeds/subresources/permissions/methods/create) intel.indicator\_feeds.permissions.create(PermissionCreateParams\*\*kwargs) -> [PermissionCreateResponse]() PUT/accounts/{account\_id}/intel/indicator-feeds/permissions/add ##### [Revoke permission to indicator feed](https://developers.cloudflare.com/api/python/resources/intel/subresources/indicator_feeds/subresources/permissions/methods/delete) intel.indicator\_feeds.permissions.delete(PermissionDeleteParams\*\*kwargs) -> [PermissionDeleteResponse]() PUT/accounts/{account\_id}/intel/indicator-feeds/permissions/remove ##### ModelsExpand Collapse
List\[PermissionListResponseItem] id: Optional\[int] The unique identifier for the indicator feed Link to this property description: Optional\[str] The description of the example test Link to this property is\_attributable: Optional\[bool] Whether the indicator feed can be attributed to a provider Link to this property is\_downloadable: Optional\[bool] Whether the indicator feed can be downloaded Link to this property is\_public: Optional\[bool] Whether the indicator feed is exposed to customers Link to this property name: Optional\[str] The name of the indicator feed Link to this property
[Link to this property](<#(resource)%20intel.indicator_feeds.permissions%20%3E%20(model)%20permission_list_response%20%3E%20(schema)>)
class PermissionCreateResponse: … success: Optional\[bool] Whether the update succeeded or not Link to this property
[Link to this property](<#(resource)%20intel.indicator_feeds.permissions%20%3E%20(model)%20permission_create_response%20%3E%20(schema)>)
class PermissionDeleteResponse: … success: Optional\[bool] Whether the update succeeded or not Link to this property
[Link to this property](<#(resource)%20intel.indicator_feeds.permissions%20%3E%20(model)%20permission_delete_response%20%3E%20(schema)>) #### Indicator FeedsDownloads