--- title: Risk Scoring --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [Zero Trust](https://developers.cloudflare.com/api/python/resources/zero_trust) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Risk Scoring ##### [Get risk event/score information for a specific user](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/risk_scoring/methods/get) zero\_trust.risk\_scoring.get(struser\_id, RiskScoringGetParams\*\*kwargs) -> [RiskScoringGetResponse]() GET/accounts/{account\_id}/zt\_risk\_scoring/{user\_id} ##### [Clear the risk score for a particular user](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/risk_scoring/methods/reset) zero\_trust.risk\_scoring.reset(struser\_id, RiskScoringResetParams\*\*kwargs) -> object POST/accounts/{account\_id}/zt\_risk\_scoring/{user\_id}/reset ##### ModelsExpand Collapse
class RiskScoringGetResponse: … email: str Link to this property
events: List\[Event] id: str Link to this property name: str Link to this property
risk\_level: Literal\["low", "medium", "high"] One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property
Link to this property timestamp: datetime formatdate-time Link to this property event\_details: Optional\[object] Link to this property
Link to this property name: str Link to this property last\_reset\_time: Optional\[datetime] formatdate-time Link to this property
risk\_level: Optional\[Literal\["low", "medium", "high"]] One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.risk_scoring%20%3E%20(model)%20risk_scoring_get_response%20%3E%20(schema)>) #### Risk ScoringBehaviours ##### [Get all behaviors and associated configuration](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/risk_scoring/subresources/behaviours/methods/get) zero\_trust.risk\_scoring.behaviours.get(BehaviourGetParams\*\*kwargs) -> [BehaviourGetResponse]() GET/accounts/{account\_id}/zt\_risk\_scoring/behaviors ##### [Update configuration for risk behaviors](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/risk_scoring/subresources/behaviours/methods/update) zero\_trust.risk\_scoring.behaviours.update(BehaviourUpdateParams\*\*kwargs) -> [BehaviourUpdateResponse]() PUT/accounts/{account\_id}/zt\_risk\_scoring/behaviors ##### ModelsExpand Collapse
class BehaviourGetResponse: …
behaviors: Dict\[str, Behaviors] description: str Link to this property enabled: bool Link to this property name: str Link to this property
risk\_level: Literal\["low", "medium", "high"] One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.risk_scoring.behaviours%20%3E%20(model)%20behaviour_get_response%20%3E%20(schema)>)
class BehaviourUpdateResponse: …
behaviors: Dict\[str, Behaviors] enabled: bool Link to this property
risk\_level: Literal\["low", "medium", "high"] One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.risk_scoring.behaviours%20%3E%20(model)%20behaviour_update_response%20%3E%20(schema)>) #### Risk ScoringSummary ##### [Get risk score info for all users in the account](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/risk_scoring/subresources/summary/methods/get) zero\_trust.risk\_scoring.summary.get(SummaryGetParams\*\*kwargs) -> [SummaryGetResponse]() GET/accounts/{account\_id}/zt\_risk\_scoring/summary ##### ModelsExpand Collapse
class SummaryGetResponse: …
users: List\[User] email: str Link to this property event\_count: int minimum0 Link to this property last\_event: datetime formatdate-time Link to this property
max\_risk\_level: Literal\["low", "medium", "high"] One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property
Link to this property name: str Link to this property user\_id: str formatuuid Link to this property
Link to this property
[Link to this property](<#(resource)%20zero_trust.risk_scoring.summary%20%3E%20(model)%20summary_get_response%20%3E%20(schema)>) #### Risk ScoringIntegrations ##### [List all risk score integrations for the account.](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/risk_scoring/subresources/integrations/methods/list) zero\_trust.risk\_scoring.integrations.list(IntegrationListParams\*\*kwargs) -> SyncSinglePage\[[IntegrationListResponse]()] GET/accounts/{account\_id}/zt\_risk\_scoring/integrations ##### [Get risk score integration by id.](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/risk_scoring/subresources/integrations/methods/get) zero\_trust.risk\_scoring.integrations.get(strintegration\_id, IntegrationGetParams\*\*kwargs) -> [IntegrationGetResponse]() GET/accounts/{account\_id}/zt\_risk\_scoring/integrations/{integration\_id} ##### [Create new risk score integration.](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/risk_scoring/subresources/integrations/methods/create) zero\_trust.risk\_scoring.integrations.create(IntegrationCreateParams\*\*kwargs) -> [IntegrationCreateResponse]() POST/accounts/{account\_id}/zt\_risk\_scoring/integrations ##### [Update a risk score integration.](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/risk_scoring/subresources/integrations/methods/update) zero\_trust.risk\_scoring.integrations.update(strintegration\_id, IntegrationUpdateParams\*\*kwargs) -> [IntegrationUpdateResponse]() PUT/accounts/{account\_id}/zt\_risk\_scoring/integrations/{integration\_id} ##### [Delete a risk score integration.](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/risk_scoring/subresources/integrations/methods/delete) zero\_trust.risk\_scoring.integrations.delete(strintegration\_id, IntegrationDeleteParams\*\*kwargs) -> object DELETE/accounts/{account\_id}/zt\_risk\_scoring/integrations/{integration\_id} ##### ModelsExpand Collapse
class IntegrationListResponse: … id: str The id of the integration, a UUIDv4. formatuuid Link to this property account\_tag: str The Cloudflare account tag. Link to this property active: bool Whether this integration is enabled and should export changes in risk score. Link to this property created\_at: datetime When the integration was created in RFC3339 format. formatdate-time Link to this property integration\_type: Literal\["Okta"] Link to this property reference\_id: str A reference ID defined by the client. Should be set to the Access-Okta IDP integration ID. Useful when the risk-score integration needs to be associated with a secondary asset and recalled using that ID. Link to this property tenant\_url: str The base URL for the tenant. E.g. “https://tenant.okta.com”. Link to this property well\_known\_url: str The URL for the Shared Signals Framework configuration, e.g. “/.well-known/sse-configuration/{integration\_uuid}/”. https://openid.net/specs/openid-sse-framework-1\_0.html#rfc.section.6.2.1. Link to this property
[Link to this property](<#(resource)%20zero_trust.risk_scoring.integrations%20%3E%20(model)%20integration_list_response%20%3E%20(schema)>)
class IntegrationGetResponse: … id: str The id of the integration, a UUIDv4. formatuuid Link to this property account\_tag: str The Cloudflare account tag. Link to this property active: bool Whether this integration is enabled and should export changes in risk score. Link to this property created\_at: datetime When the integration was created in RFC3339 format. formatdate-time Link to this property integration\_type: Literal\["Okta"] Link to this property reference\_id: str A reference ID defined by the client. Should be set to the Access-Okta IDP integration ID. Useful when the risk-score integration needs to be associated with a secondary asset and recalled using that ID. Link to this property tenant\_url: str The base URL for the tenant. E.g. “https://tenant.okta.com”. Link to this property well\_known\_url: str The URL for the Shared Signals Framework configuration, e.g. “/.well-known/sse-configuration/{integration\_uuid}/”. https://openid.net/specs/openid-sse-framework-1\_0.html#rfc.section.6.2.1. Link to this property
[Link to this property](<#(resource)%20zero_trust.risk_scoring.integrations%20%3E%20(model)%20integration_get_response%20%3E%20(schema)>)
class IntegrationCreateResponse: … id: str The id of the integration, a UUIDv4. formatuuid Link to this property account\_tag: str The Cloudflare account tag. Link to this property active: bool Whether this integration is enabled and should export changes in risk score. Link to this property created\_at: datetime When the integration was created in RFC3339 format. formatdate-time Link to this property integration\_type: Literal\["Okta"] Link to this property reference\_id: str A reference ID defined by the client. Should be set to the Access-Okta IDP integration ID. Useful when the risk-score integration needs to be associated with a secondary asset and recalled using that ID. Link to this property tenant\_url: str The base URL for the tenant. E.g. “https://tenant.okta.com”. Link to this property well\_known\_url: str The URL for the Shared Signals Framework configuration, e.g. “/.well-known/sse-configuration/{integration\_uuid}/”. https://openid.net/specs/openid-sse-framework-1\_0.html#rfc.section.6.2.1. Link to this property
[Link to this property](<#(resource)%20zero_trust.risk_scoring.integrations%20%3E%20(model)%20integration_create_response%20%3E%20(schema)>)
class IntegrationUpdateResponse: … id: str The id of the integration, a UUIDv4. formatuuid Link to this property account\_tag: str The Cloudflare account tag. Link to this property active: bool Whether this integration is enabled and should export changes in risk score. Link to this property created\_at: datetime When the integration was created in RFC3339 format. formatdate-time Link to this property integration\_type: Literal\["Okta"] Link to this property reference\_id: str A reference ID defined by the client. Should be set to the Access-Okta IDP integration ID. Useful when the risk-score integration needs to be associated with a secondary asset and recalled using that ID. Link to this property tenant\_url: str The base URL for the tenant. E.g. “https://tenant.okta.com”. Link to this property well\_known\_url: str The URL for the Shared Signals Framework configuration, e.g. “/.well-known/sse-configuration/{integration\_uuid}/”. https://openid.net/specs/openid-sse-framework-1\_0.html#rfc.section.6.2.1. Link to this property
[Link to this property](<#(resource)%20zero_trust.risk_scoring.integrations%20%3E%20(model)%20integration_update_response%20%3E%20(schema)>) #### Risk ScoringIntegrationsReferences ##### [Get risk score integration by reference id.](https://developers.cloudflare.com/api/python/resources/zero_trust/subresources/risk_scoring/subresources/integrations/subresources/references/methods/get) zero\_trust.risk\_scoring.integrations.references.get(strreference\_id, ReferenceGetParams\*\*kwargs) -> [ReferenceGetResponse]() GET/accounts/{account\_id}/zt\_risk\_scoring/integrations/reference\_id/{reference\_id} ##### ModelsExpand Collapse
class ReferenceGetResponse: … id: str The id of the integration, a UUIDv4. formatuuid Link to this property account\_tag: str The Cloudflare account tag. Link to this property active: bool Whether this integration is enabled and should export changes in risk score. Link to this property created\_at: datetime When the integration was created in RFC3339 format. formatdate-time Link to this property integration\_type: Literal\["Okta"] Link to this property reference\_id: str A reference ID defined by the client. Should be set to the Access-Okta IDP integration ID. Useful when the risk-score integration needs to be associated with a secondary asset and recalled using that ID. Link to this property tenant\_url: str The base URL for the tenant. E.g. “https://tenant.okta.com”. Link to this property well\_known\_url: str The URL for the Shared Signals Framework configuration, e.g. “/.well-known/sse-configuration/{integration\_uuid}/”. https://openid.net/specs/openid-sse-framework-1\_0.html#rfc.section.6.2.1. Link to this property
[Link to this property](<#(resource)%20zero_trust.risk_scoring.integrations.references%20%3E%20(model)%20reference_get_response%20%3E%20(schema)>)