---
title: Cloudforce One
---
[Skip to content](#_top)
[API Reference](https://developers.cloudflare.com/api)
Copy Markdown
Open in **Claude**Open in **ChatGPT**Open in **Cursor**
---
**Copy Markdown****View as Markdown**
# Cloudforce One
#### Cloudforce OneBinary Storage
##### [Retrieves a file from Binary Storage](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/binary_storage/methods/get)
GET/accounts/{account\_id}/cloudforce-one/binary/{hash}
##### [Posts a file to Binary Storage](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/binary_storage/methods/create)
POST/accounts/{account\_id}/cloudforce-one/binary
##### ModelsExpand Collapse
BinaryStorageCreateResponse object {content\_type, md5, sha1, sha256 }
content\_type: string
Link to this property
md5: string
Link to this property
sha1: string
Link to this property
sha256: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.binary_storage%20%3E%20(model)%20binary_storage_create_response%20%3E%20(schema)>)
#### Cloudforce OneRequests
##### [List Requests](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/methods/list)
POST/accounts/{account\_id}/cloudforce-one/requests
##### [Get a Request](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/methods/get)
GET/accounts/{account\_id}/cloudforce-one/requests/{request\_id}
##### [Create a New Request.](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/methods/create)
POST/accounts/{account\_id}/cloudforce-one/requests/new
##### [Update a Request](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/methods/update)
PUT/accounts/{account\_id}/cloudforce-one/requests/{request\_id}
##### [Delete a Request](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/methods/delete)
DELETE/accounts/{account\_id}/cloudforce-one/requests/{request\_id}
##### [Get Request Quota](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/methods/quota)
GET/accounts/{account\_id}/cloudforce-one/requests/quota
##### [Get Request Types](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/methods/types)
GET/accounts/{account\_id}/cloudforce-one/requests/types
##### [Get Request Priority, Status, and TLP constants](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/methods/constants)
GET/accounts/{account\_id}/cloudforce-one/requests/constants
##### ModelsExpand Collapse
Item object {id, content, created, 10 more }
id: string
UUID.
maxLength36
Link to this property
content: string
Request content.
Link to this property
created: string
formatdate-time
Link to this property
priority: string
formatdate-time
Link to this property
request: string
Requested information from request.
Link to this property
summary: string
Brief description of the request.
Link to this property
tlp: "clear"or "amber"or "amber-strict"or 2 more
The CISA defined Traffic Light Protocol (TLP).
One of the following:
"clear"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"red"
Link to this property
Link to this property
updated: string
formatdate-time
Link to this property
completed: optional string
formatdate-time
Link to this property
message\_tokens: optional number
Tokens for the request messages.
Link to this property
readable\_id: optional string
Readable Request ID.
Link to this property
status: optional "open"or "accepted"or "reported"or 3 more
Request Status.
One of the following:
"open"
Link to this property
"accepted"
Link to this property
"reported"
Link to this property
"approved"
Link to this property
"completed"
Link to this property
"declined"
Link to this property
Link to this property
tokens: optional number
Tokens for the request.
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20item%20%3E%20(schema)>)
ListItem object {id, created, priority, 9 more }
id: string
UUID.
maxLength36
Link to this property
created: string
Request creation time.
formatdate-time
Link to this property
priority: "routine"or "high"or "urgent"
One of the following:
"routine"
Link to this property
"high"
Link to this property
"urgent"
Link to this property
Link to this property
request: string
Requested information from request.
Link to this property
summary: string
Brief description of the request.
Link to this property
tlp: "clear"or "amber"or "amber-strict"or 2 more
The CISA defined Traffic Light Protocol (TLP).
One of the following:
"clear"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"red"
Link to this property
Link to this property
updated: string
Request last updated time.
formatdate-time
Link to this property
completed: optional string
Request completion time.
formatdate-time
Link to this property
message\_tokens: optional number
Tokens for the request messages.
Link to this property
readable\_id: optional string
Readable Request ID.
Link to this property
status: optional "open"or "accepted"or "reported"or 3 more
Request Status.
One of the following:
"open"
Link to this property
"accepted"
Link to this property
"reported"
Link to this property
"approved"
Link to this property
"completed"
Link to this property
"declined"
Link to this property
Link to this property
tokens: optional number
Tokens for the request.
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20list_item%20%3E%20(schema)>)
Quota object {anniversary\_date, quarter\_anniversary\_date, quota, remaining }
anniversary\_date: optional string
Anniversary date is when annual quota limit is refreshed.
formatdate-time
Link to this property
quarter\_anniversary\_date: optional string
Quarter anniversary date is when quota limit is refreshed each quarter.
formatdate-time
Link to this property
quota: optional number
Tokens for the quarter.
Link to this property
remaining: optional number
Tokens remaining for the quarter.
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20quota%20%3E%20(schema)>)
RequestConstants object {priority, status, tlp }
priority: optional array of "routine"or "high"or "urgent"
One of the following:
"routine"
Link to this property
"high"
Link to this property
"urgent"
Link to this property
Link to this property
status: optional array of "open"or "accepted"or "reported"or 3 more
One of the following:
"open"
Link to this property
"accepted"
Link to this property
"reported"
Link to this property
"approved"
Link to this property
"completed"
Link to this property
"declined"
Link to this property
Link to this property
tlp: optional array of "clear"or "amber"or "amber-strict"or 2 more
One of the following:
"clear"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"red"
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20request_constants%20%3E%20(schema)>)
RequestTypes = array of string
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20request_types%20%3E%20(schema)>)
RequestDeleteResponse object {errors, messages, success }
errors: array of object {code, message, documentation\_url, source }
code: number
minimum1000
Link to this property
message: string
Link to this property
documentation\_url: optional string
Link to this property
source: optional object {pointer }
pointer: optional string
Link to this property
Link to this property
Link to this property
messages: array of object {code, message, documentation\_url, source }
code: number
minimum1000
Link to this property
message: string
Link to this property
documentation\_url: optional string
Link to this property
source: optional object {pointer }
pointer: optional string
Link to this property
Link to this property
Link to this property
success: true
Whether the API call was successful.
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20request_delete_response%20%3E%20(schema)>)
RequestTypesResponse = string
Request Types.
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20request_types_response%20%3E%20(schema)>)
#### Cloudforce OneRequestsMessage
##### [List Request Messages](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/subresources/message/methods/get)
POST/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/message
##### [Create a New Request Message](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/subresources/message/methods/create)
POST/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/message/new
##### [Update a Request Message](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/subresources/message/methods/update)
PUT/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/message/{message\_id}
##### [Delete a Request Message](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/subresources/message/methods/delete)
DELETE/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/message/{message\_id}
##### ModelsExpand Collapse
Message object {id, author, content, 3 more }
id: number
Message ID.
Link to this property
author: string
Author of message.
Link to this property
content: string
Content of message.
Link to this property
is\_follow\_on\_request: boolean
Whether the message is a follow-on request.
Link to this property
updated: string
Defines the message last updated time.
formatdate-time
Link to this property
created: optional string
Defines the message creation time.
formatdate-time
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.message%20%3E%20(model)%20message%20%3E%20(schema)>)
MessageDeleteResponse object {errors, messages, success }
errors: array of object {code, message, documentation\_url, source }
code: number
minimum1000
Link to this property
message: string
Link to this property
documentation\_url: optional string
Link to this property
source: optional object {pointer }
pointer: optional string
Link to this property
Link to this property
Link to this property
messages: array of object {code, message, documentation\_url, source }
code: number
minimum1000
Link to this property
message: string
Link to this property
documentation\_url: optional string
Link to this property
source: optional object {pointer }
pointer: optional string
Link to this property
Link to this property
Link to this property
success: true
Whether the API call was successful.
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.message%20%3E%20(model)%20message_delete_response%20%3E%20(schema)>)
#### Cloudforce OneRequestsPriority
##### [Get a Priority Intelligence Requirement](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/subresources/priority/methods/get)
GET/accounts/{account\_id}/cloudforce-one/requests/priority/{priority\_id}
##### [Create a New Priority Intelligence Requirement](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/subresources/priority/methods/create)
POST/accounts/{account\_id}/cloudforce-one/requests/priority/new
##### [Update a Priority Intelligence Requirement](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/subresources/priority/methods/update)
PUT/accounts/{account\_id}/cloudforce-one/requests/priority/{priority\_id}
##### [Delete a Priority Intelligence Requirement](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/subresources/priority/methods/delete)
DELETE/accounts/{account\_id}/cloudforce-one/requests/priority/{priority\_id}
##### [Get Priority Intelligence Requirement Quota](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/subresources/priority/methods/quota)
GET/accounts/{account\_id}/cloudforce-one/requests/priority/quota
##### ModelsExpand Collapse
Label = string
[Link to this property](<#(resource)%20cloudforce_one.requests.priority%20%3E%20(model)%20label%20%3E%20(schema)>)
Priority object {id, created, labels, 4 more }
id: string
UUID.
maxLength36
Link to this property
created: string
Priority creation time.
formatdate-time
Link to this property
labels: array of Label
List of labels.
Link to this property
priority: number
Priority.
Link to this property
requirement: string
Requirement.
Link to this property
tlp: "clear"or "amber"or "amber-strict"or 2 more
The CISA defined Traffic Light Protocol (TLP).
One of the following:
"clear"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"red"
Link to this property
Link to this property
updated: string
Priority last updated time.
formatdate-time
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.priority%20%3E%20(model)%20priority%20%3E%20(schema)>)
PriorityEdit object {labels, priority, requirement, tlp }
labels: array of Label
List of labels.
Link to this property
priority: number
Priority.
Link to this property
requirement: string
Requirement.
Link to this property
tlp: "clear"or "amber"or "amber-strict"or 2 more
The CISA defined Traffic Light Protocol (TLP).
One of the following:
"clear"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"red"
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.priority%20%3E%20(model)%20priority_edit%20%3E%20(schema)>)
PriorityDeleteResponse object {errors, messages, success }
errors: array of object {code, message, documentation\_url, source }
code: number
minimum1000
Link to this property
message: string
Link to this property
documentation\_url: optional string
Link to this property
source: optional object {pointer }
pointer: optional string
Link to this property
Link to this property
Link to this property
messages: array of object {code, message, documentation\_url, source }
code: number
minimum1000
Link to this property
message: string
Link to this property
documentation\_url: optional string
Link to this property
source: optional object {pointer }
pointer: optional string
Link to this property
Link to this property
Link to this property
success: true
Whether the API call was successful.
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.priority%20%3E%20(model)%20priority_delete_response%20%3E%20(schema)>)
#### Cloudforce OneRequestsAssets
##### [Get a Request Asset](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/subresources/assets/methods/get)
GET/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/asset/{asset\_id}
##### [List Request Assets](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/subresources/assets/methods/create)
POST/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/asset
##### [Update a Request Asset](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/subresources/assets/methods/update)
PUT/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/asset/{asset\_id}
##### [Delete a Request Asset](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/requests/subresources/assets/methods/delete)
DELETE/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/asset/{asset\_id}
##### ModelsExpand Collapse
AssetGetResponse object {id, name, created, 2 more }
id: number
Asset ID.
Link to this property
name: string
Asset name.
Link to this property
created: optional string
Defines the asset creation time.
formatdate-time
Link to this property
description: optional string
Asset description.
Link to this property
file\_type: optional string
Asset file type.
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.assets%20%3E%20(model)%20asset_get_response%20%3E%20(schema)>)
AssetCreateResponse object {id, name, created, 2 more }
id: number
Asset ID.
Link to this property
name: string
Asset name.
Link to this property
created: optional string
Defines the asset creation time.
formatdate-time
Link to this property
description: optional string
Asset description.
Link to this property
file\_type: optional string
Asset file type.
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.assets%20%3E%20(model)%20asset_create_response%20%3E%20(schema)>)
AssetUpdateResponse object {id, name, created, 2 more }
id: number
Asset ID.
Link to this property
name: string
Asset name.
Link to this property
created: optional string
Defines the asset creation time.
formatdate-time
Link to this property
description: optional string
Asset description.
Link to this property
file\_type: optional string
Asset file type.
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.assets%20%3E%20(model)%20asset_update_response%20%3E%20(schema)>)
AssetDeleteResponse object {errors, messages, success }
errors: array of object {code, message, documentation\_url, source }
code: number
minimum1000
Link to this property
message: string
Link to this property
documentation\_url: optional string
Link to this property
source: optional object {pointer }
pointer: optional string
Link to this property
Link to this property
Link to this property
messages: array of object {code, message, documentation\_url, source }
code: number
minimum1000
Link to this property
message: string
Link to this property
documentation\_url: optional string
Link to this property
source: optional object {pointer }
pointer: optional string
Link to this property
Link to this property
Link to this property
success: true
Whether the API call was successful.
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.assets%20%3E%20(model)%20asset_delete_response%20%3E%20(schema)>)
#### Cloudforce OneScans
#### Cloudforce OneScansResults
##### [Get the Latest Scan Result](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/scans/subresources/results/methods/get)
GET/accounts/{account\_id}/cloudforce-one/scans/results/{config\_id}
##### ModelsExpand Collapse
ScanResult object {number, proto, status }
number: optional number
Link to this property
proto: optional string
Link to this property
status: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.scans.results%20%3E%20(model)%20scan_result%20%3E%20(schema)>)
ResultGetResponse object {"1.1.1.1" }
"1.1.1.1": array of ScanResult { number, proto, status }
number: optional number
Link to this property
proto: optional string
Link to this property
status: optional string
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.scans.results%20%3E%20(model)%20result_get_response%20%3E%20(schema)>)
#### Cloudforce OneScansConfig
##### [List Scan Configs](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/scans/subresources/config/methods/list)
GET/accounts/{account\_id}/cloudforce-one/scans/config
##### [Create a new Scan Config](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/scans/subresources/config/methods/create)
POST/accounts/{account\_id}/cloudforce-one/scans/config
##### [Update an existing Scan Config](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/scans/subresources/config/methods/edit)
PATCH/accounts/{account\_id}/cloudforce-one/scans/config/{config\_id}
##### [Delete a Scan Config](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/scans/subresources/config/methods/delete)
DELETE/accounts/{account\_id}/cloudforce-one/scans/config/{config\_id}
##### ModelsExpand Collapse
ConfigListResponse object {id, account\_id, frequency, 2 more }
id: string
Defines the Config ID.
Link to this property
account\_id: string
Link to this property
frequency: number
Defines the number of days between each scan (0 = One-off scan).
Link to this property
ips: array of string
Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.
Link to this property
ports: array of string
Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. \[“1-80”, “443”]). “default” scans the 100 most commonly open ports.
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.scans.config%20%3E%20(model)%20config_list_response%20%3E%20(schema)>)
ConfigCreateResponse object {id, account\_id, frequency, 2 more }
id: string
Defines the Config ID.
Link to this property
account\_id: string
Link to this property
frequency: number
Defines the number of days between each scan (0 = One-off scan).
Link to this property
ips: array of string
Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.
Link to this property
ports: array of string
Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. \[“1-80”, “443”]). “default” scans the 100 most commonly open ports.
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.scans.config%20%3E%20(model)%20config_create_response%20%3E%20(schema)>)
ConfigEditResponse object {id, account\_id, frequency, 2 more }
id: string
Defines the Config ID.
Link to this property
account\_id: string
Link to this property
frequency: number
Defines the number of days between each scan (0 = One-off scan).
Link to this property
ips: array of string
Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.
Link to this property
ports: array of string
Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. \[“1-80”, “443”]). “default” scans the 100 most commonly open ports.
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.scans.config%20%3E%20(model)%20config_edit_response%20%3E%20(schema)>)
ConfigDeleteResponse = unknown
[Link to this property](<#(resource)%20cloudforce_one.scans.config%20%3E%20(model)%20config_delete_response%20%3E%20(schema)>)
#### Cloudforce OneThreat Events
##### [Filter and list events](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events
##### [Reads an event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/get)
Deprecated
GET/accounts/{account\_id}/cloudforce-one/events/{event\_id}
##### [Creates a new event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/create)
POST/accounts/{account\_id}/cloudforce-one/events/create
##### [Updates an event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/edit)
PATCH/accounts/{account\_id}/cloudforce-one/events/{event\_id}
##### [Creates bulk events](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/bulk_create)
POST/accounts/{account\_id}/cloudforce-one/events/create/bulk
##### [Creates bulk DOS event with relationships and indicators](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/bulk_create_relationships)
Deprecated
POST/accounts/{account\_id}/cloudforce-one/events/create/bulk/relationships
##### ModelsExpand Collapse
ThreatEventListResponse = array of object {attacker, attackerCountry, attackerCountryAlpha3, 26 more }
attacker: string
Link to this property
attackerCountry: string
Link to this property
attackerCountryAlpha3: string
Link to this property
category: string
Link to this property
datasetId: string
Link to this property
date: string
Link to this property
event: string
Link to this property
hasChildren: boolean
Link to this property
indicator: string
Link to this property
indicatorType: string
Link to this property
indicatorTypeId: number
Link to this property
killChain: number
Link to this property
mitreAttack: array of string
Link to this property
mitreCapec: array of string
Link to this property
numReferenced: number
Link to this property
numReferences: number
Link to this property
rawId: string
Link to this property
referenced: array of string
Link to this property
referencedIds: array of number
Link to this property
references: array of string
Link to this property
referencesIds: array of number
Link to this property
tags: array of string
Link to this property
targetCountry: string
Link to this property
targetCountryAlpha3: string
Link to this property
targetIndustry: string
Link to this property
tlp: string
Link to this property
uuid: string
Link to this property
insight: optional string
Link to this property
releasabilityId: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_list_response%20%3E%20(schema)>)
ThreatEventGetResponse object {attacker, attackerCountry, attackerCountryAlpha3, 26 more }
attacker: string
Link to this property
attackerCountry: string
Link to this property
attackerCountryAlpha3: string
Link to this property
category: string
Link to this property
datasetId: string
Link to this property
date: string
Link to this property
event: string
Link to this property
hasChildren: boolean
Link to this property
indicator: string
Link to this property
indicatorType: string
Link to this property
indicatorTypeId: number
Link to this property
killChain: number
Link to this property
mitreAttack: array of string
Link to this property
mitreCapec: array of string
Link to this property
numReferenced: number
Link to this property
numReferences: number
Link to this property
rawId: string
Link to this property
referenced: array of string
Link to this property
referencedIds: array of number
Link to this property
references: array of string
Link to this property
referencesIds: array of number
Link to this property
tags: array of string
Link to this property
targetCountry: string
Link to this property
targetCountryAlpha3: string
Link to this property
targetIndustry: string
Link to this property
tlp: string
Link to this property
uuid: string
Link to this property
insight: optional string
Link to this property
releasabilityId: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_get_response%20%3E%20(schema)>)
ThreatEventCreateResponse object {attacker, attackerCountry, attackerCountryAlpha3, 26 more }
attacker: string
Link to this property
attackerCountry: string
Link to this property
attackerCountryAlpha3: string
Link to this property
category: string
Link to this property
datasetId: string
Link to this property
date: string
Link to this property
event: string
Link to this property
hasChildren: boolean
Link to this property
indicator: string
Link to this property
indicatorType: string
Link to this property
indicatorTypeId: number
Link to this property
killChain: number
Link to this property
mitreAttack: array of string
Link to this property
mitreCapec: array of string
Link to this property
numReferenced: number
Link to this property
numReferences: number
Link to this property
rawId: string
Link to this property
referenced: array of string
Link to this property
referencedIds: array of number
Link to this property
references: array of string
Link to this property
referencesIds: array of number
Link to this property
tags: array of string
Link to this property
targetCountry: string
Link to this property
targetCountryAlpha3: string
Link to this property
targetIndustry: string
Link to this property
tlp: string
Link to this property
uuid: string
Link to this property
insight: optional string
Link to this property
releasabilityId: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_create_response%20%3E%20(schema)>)
ThreatEventEditResponse object {attacker, attackerCountry, attackerCountryAlpha3, 26 more }
attacker: string
Link to this property
attackerCountry: string
Link to this property
attackerCountryAlpha3: string
Link to this property
category: string
Link to this property
datasetId: string
Link to this property
date: string
Link to this property
event: string
Link to this property
hasChildren: boolean
Link to this property
indicator: string
Link to this property
indicatorType: string
Link to this property
indicatorTypeId: number
Link to this property
killChain: number
Link to this property
mitreAttack: array of string
Link to this property
mitreCapec: array of string
Link to this property
numReferenced: number
Link to this property
numReferences: number
Link to this property
rawId: string
Link to this property
referenced: array of string
Link to this property
referencedIds: array of number
Link to this property
references: array of string
Link to this property
referencesIds: array of number
Link to this property
tags: array of string
Link to this property
targetCountry: string
Link to this property
targetCountryAlpha3: string
Link to this property
targetIndustry: string
Link to this property
tlp: string
Link to this property
uuid: string
Link to this property
insight: optional string
Link to this property
releasabilityId: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_edit_response%20%3E%20(schema)>)
ThreatEventBulkCreateResponse object {createdEventsCount, createdTagsCount, errorCount, 4 more }
Detailed result of bulk event creation with auto-tag management
createdEventsCount: number
Number of events created
Link to this property
createdTagsCount: number
Number of new tags created in SoT
Link to this property
errorCount: number
Number of errors encountered
Link to this property
queuedIndicatorsCount: number
Number of indicators queued for async processing
Link to this property
createBulkEventsRequestId: optional string
Correlation ID for async indicator processing
formatuuid
Link to this property
createdEvents: optional array of object {eventIndex, shardId, uuid }
Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true
eventIndex: number
Original index in the input data array
Link to this property
shardId: string
Dataset ID of the shard where the event was created
Link to this property
uuid: string
UUID of the created event
formatuuid
Link to this property
Link to this property
errors: optional array of object {error, eventIndex }
Array of error details
error: string
Error message
Link to this property
eventIndex: number
Index of the event that caused the error
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_response%20%3E%20(schema)>)
ThreatEventBulkCreateRelationshipsResponse object {createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more }
Result of bulk relationship creation operation
createdEventsCount: number
Number of events created
Link to this property
createdIndicatorsCount: number
Number of indicators created
Link to this property
createdRelationshipsCount: number
Number of relationships created
Link to this property
errorCount: number
Number of errors encountered
Link to this property
errors: optional array of object {error, eventIndex }
Array of error details
error: string
Error message
Link to this property
eventIndex: number
Index of the event that caused the error
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_relationships_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsAggregate
##### [Aggregate events by single or multiple columns with optional date filtering](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/aggregate/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/aggregate
##### ModelsExpand Collapse
AggregateListResponse object {aggregateBy, aggregations, total, dateRange }
aggregateBy: string
Column(s) that were aggregated by
Link to this property
aggregations: array of object {count, date }
Array of aggregation results with dynamic fields based on aggregateBy columns
count: number
Number of events for this aggregation
Link to this property
date: optional string
Date (if groupByDate is true)
Link to this property
Link to this property
total: number
Total number of events in the aggregation
Link to this property
dateRange: optional object {endDate, startDate }
Date range used for filtering
endDate: optional string
Link to this property
startDate: optional string
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.aggregate%20%3E%20(model)%20aggregate_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsGraphql
##### [GraphQL endpoint for event aggregation](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/graphql/methods/create)
POST/accounts/{account\_id}/cloudforce-one/events/graphql
##### ModelsExpand Collapse
GraphqlCreateResponse object {data, errors }
data: optional unknown
Link to this property
errors: optional array of unknown
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.graphql%20%3E%20(model)%20graphql_create_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsGraph
##### [Query graph neighborhood from R2 Data Catalog](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/graph/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/graph
##### ModelsExpand Collapse
GraphListResponse object {edges, node, nodes }
edges: array of object {id, relationshipType, source, 5 more }
id: string
Deterministic composite edge id (source→target:relationshipType)
Link to this property
relationshipType: string
Link to this property
source: string
Compact id of the source node (type:uuid)
Link to this property
sourceId: string
Link to this property
sourceType: string
Link to this property
target: string
Compact id of the target node (type:uuid)
Link to this property
targetId: string
Link to this property
targetType: string
Link to this property
Link to this property
node: map\[unknown]
Focal node object (legacy single-seed). Null when unavailable.
Link to this property
nodes: array of map\[unknown]
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.graph%20%3E%20(model)%20graph_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsQueries
##### [List all saved event queries](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/queries
##### [Create a saved event query](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/create)
POST/accounts/{account\_id}/cloudforce-one/events/queries/create
##### [Read a saved event query](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/get)
GET/accounts/{account\_id}/cloudforce-one/events/queries/{query\_id}
##### [Update a saved event query](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/edit)
PATCH/accounts/{account\_id}/cloudforce-one/events/queries/{query\_id}
##### [Delete a saved event query](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/delete)
DELETE/accounts/{account\_id}/cloudforce-one/events/queries/{query\_id}
##### ModelsExpand Collapse
QueryListResponse = array of object {id, account\_id, alert\_enabled, 10 more }
id: number
Unique identifier for the saved query
Link to this property
account\_id: number
Account ID
Link to this property
alert\_enabled: boolean
Whether alerts are enabled
Link to this property
alert\_rollup\_enabled: boolean
Whether alert rollup is enabled
Link to this property
created\_at: string
Creation timestamp
Link to this property
name: string
Name of the saved query
Link to this property
query\_json: string
JSON string containing the query parameters
Link to this property
rule\_enabled: boolean
Whether rule is enabled
Link to this property
updated\_at: string
Last update timestamp
Link to this property
user\_email: string
Email of the user who created the query
Link to this property
custom\_threat\_feed\_id: optional number
Intel Indicator Feed ID (numeric)
Link to this property
rule\_list\_id: optional string
WAF rules list ID for blocking
Link to this property
rule\_scope: optional string
Scope for the rule
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_list_response%20%3E%20(schema)>)
QueryCreateResponse object {id, account\_id, alert\_enabled, 10 more }
id: number
Unique identifier for the saved query
Link to this property
account\_id: number
Account ID
Link to this property
alert\_enabled: boolean
Whether alerts are enabled
Link to this property
alert\_rollup\_enabled: boolean
Whether alert rollup is enabled
Link to this property
created\_at: string
Creation timestamp
Link to this property
name: string
Name of the saved query
Link to this property
query\_json: string
JSON string containing the query parameters
Link to this property
rule\_enabled: boolean
Whether rule is enabled
Link to this property
updated\_at: string
Last update timestamp
Link to this property
user\_email: string
Email of the user who created the query
Link to this property
custom\_threat\_feed\_id: optional number
Intel Indicator Feed ID (numeric)
Link to this property
rule\_list\_id: optional string
WAF rules list ID for blocking
Link to this property
rule\_scope: optional string
Scope for the rule
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_create_response%20%3E%20(schema)>)
QueryGetResponse object {id, account\_id, alert\_enabled, 10 more }
id: number
Unique identifier for the saved query
Link to this property
account\_id: number
Account ID
Link to this property
alert\_enabled: boolean
Whether alerts are enabled
Link to this property
alert\_rollup\_enabled: boolean
Whether alert rollup is enabled
Link to this property
created\_at: string
Creation timestamp
Link to this property
name: string
Name of the saved query
Link to this property
query\_json: string
JSON string containing the query parameters
Link to this property
rule\_enabled: boolean
Whether rule is enabled
Link to this property
updated\_at: string
Last update timestamp
Link to this property
user\_email: string
Email of the user who created the query
Link to this property
custom\_threat\_feed\_id: optional number
Intel Indicator Feed ID (numeric)
Link to this property
rule\_list\_id: optional string
WAF rules list ID for blocking
Link to this property
rule\_scope: optional string
Scope for the rule
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_get_response%20%3E%20(schema)>)
QueryEditResponse object {id, account\_id, alert\_enabled, 10 more }
id: number
Unique identifier for the saved query
Link to this property
account\_id: number
Account ID
Link to this property
alert\_enabled: boolean
Whether alerts are enabled
Link to this property
alert\_rollup\_enabled: boolean
Whether alert rollup is enabled
Link to this property
created\_at: string
Creation timestamp
Link to this property
name: string
Name of the saved query
Link to this property
query\_json: string
JSON string containing the query parameters
Link to this property
rule\_enabled: boolean
Whether rule is enabled
Link to this property
updated\_at: string
Last update timestamp
Link to this property
user\_email: string
Email of the user who created the query
Link to this property
custom\_threat\_feed\_id: optional number
Intel Indicator Feed ID (numeric)
Link to this property
rule\_list\_id: optional string
WAF rules list ID for blocking
Link to this property
rule\_scope: optional string
Scope for the rule
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_edit_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsRelationships
##### [Filter and list events related to specific event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/relationships/methods/list)
Deprecated
GET/accounts/{account\_id}/cloudforce-one/events/{event\_id}/relationships
##### ModelsExpand Collapse
RelationshipListResponse = array of object {attacker, attackerCountry, attackerCountryAlpha3, 26 more }
attacker: string
Link to this property
attackerCountry: string
Link to this property
attackerCountryAlpha3: string
Link to this property
category: string
Link to this property
datasetId: string
Link to this property
date: string
Link to this property
event: string
Link to this property
hasChildren: boolean
Link to this property
indicator: string
Link to this property
indicatorType: string
Link to this property
indicatorTypeId: number
Link to this property
killChain: number
Link to this property
mitreAttack: array of string
Link to this property
mitreCapec: array of string
Link to this property
numReferenced: number
Link to this property
numReferences: number
Link to this property
rawId: string
Link to this property
referenced: array of string
Link to this property
referencedIds: array of number
Link to this property
references: array of string
Link to this property
referencesIds: array of number
Link to this property
tags: array of string
Link to this property
targetCountry: string
Link to this property
targetCountryAlpha3: string
Link to this property
targetIndustry: string
Link to this property
tlp: string
Link to this property
uuid: string
Link to this property
insight: optional string
Link to this property
releasabilityId: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.relationships%20%3E%20(model)%20relationship_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsIndicators
##### [Lists indicators across multiple datasets](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/indicators/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/indicators
##### ModelsExpand Collapse
IndicatorListResponse object {properties, type }
properties: object {completeness, indicators, pagination }
completeness: object {properties, type }
properties: object {complete, failedDatasets, failedShards, warnings }
complete: object {type }
type: string
Link to this property
Link to this property
failedDatasets: object {items, type }
items: object {type }
type: string
Link to this property
Link to this property
type: string
Link to this property
Link to this property
failedShards: object {items, type }
items: object {properties, type }
properties: object {datasetId, shardId }
datasetId: object {type }
type: string
Link to this property
Link to this property
shardId: object {type }
type: string
Link to this property
Link to this property
Link to this property
type: string
Link to this property
Link to this property
type: string
Link to this property
Link to this property
warnings: object {items, type }
items: object {type }
type: string
Link to this property
Link to this property
type: string
Link to this property
Link to this property
Link to this property
type: string
Link to this property
Link to this property
indicators: object {items, type }
items: object {createdAt, indicatorType, sources, 8 more }
createdAt: string
formatdate-time
Link to this property
indicatorType: string
Link to this property
sources: array of object {resourceId, resourceType, system, title }
RSS article sources from which this indicator was extracted.
resourceId: string
formatuuid
Link to this property
resourceType: "article"
Link to this property
system: "threat-signals"
Link to this property
title: string
Threat Signals article title; null for historical provenance without a stored title.
Link to this property
Link to this property
updatedAt: string
formatdate-time
Link to this property
uuid: string
Link to this property
value: string
Link to this property
datasetId: optional string
The dataset ID this indicator belongs to. Included in list responses.
Link to this property
relatedEvents: optional array of object {datasetId, eventId, eventDate }
Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
datasetId: string
Link to this property
eventId: string
Link to this property
eventDate: optional string
ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.
Link to this property
Link to this property
relatedEventsHasMore: optional boolean
True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.
Link to this property
tags: optional array of object {categoryId, categoryName, uuid, value }
categoryId: optional string
The UUID of the tag category, or null when the tag is uncategorized.
Link to this property
categoryName: optional string
Link to this property
uuid: optional string
Link to this property
value: optional string
Link to this property
Link to this property
tlp: optional string
Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.
Link to this property
Link to this property
type: string
Link to this property
Link to this property
pagination: object {properties, type }
properties: object {count, cursor, has\_more, 4 more }
count: object {type }
type: string
Link to this property
Link to this property
cursor: object {description, nullable, type }
description: string
Link to this property
nullable: boolean
Link to this property
type: string
Link to this property
Link to this property
has\_more: object {description, type }
description: string
Link to this property
type: string
Link to this property
Link to this property
page: object {type }
type: string
Link to this property
Link to this property
per\_page: object {type }
type: string
Link to this property
Link to this property
total\_count: object {description, nullable, type }
description: string
Link to this property
nullable: boolean
Link to this property
type: string
Link to this property
Link to this property
total\_count\_is\_exact: object {description, type }
description: string
Link to this property
type: string
Link to this property
Link to this property
Link to this property
type: string
Link to this property
Link to this property
Link to this property
type: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsIndicatorsAggregate
##### [Aggregate indicators by column(s)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/aggregate/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/indicators/aggregate
##### ModelsExpand Collapse
AggregateListResponse object {aggregateBy, aggregations, failedDatasets, total }
aggregateBy: string
Column(s) that were aggregated by
Link to this property
aggregations: array of object {count }
Array of aggregation results with dynamic fields based on aggregateBy columns
count: number
Number of indicators for this aggregation
Link to this property
Link to this property
failedDatasets: number
Number of datasets whose aggregation failed and were excluded from the result
Link to this property
total: number
Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.aggregate%20%3E%20(model)%20aggregate_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsIndicatorsTypes
##### [Lists indicator types across multiple datasets](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/types/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/indicator-types
##### ModelsExpand Collapse
TypeListResponse object {items, type }
items: object {type }
type: string
Link to this property
Link to this property
type: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.types%20%3E%20(model)%20type_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsIndicatorsBy Dataset
##### [Lists indicators](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/by_dataset/methods/list)
Deprecated
GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/indicators
##### [Reads an indicator](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/by_dataset/methods/get)
GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/indicators/{indicator\_id}
##### ModelsExpand Collapse
ByDatasetListResponse object {indicators, pagination }
indicators: array of object {createdAt, indicatorType, sources, 8 more }
createdAt: string
formatdate-time
Link to this property
indicatorType: string
Link to this property
sources: array of object {resourceId, resourceType, system, title }
RSS article sources from which this indicator was extracted.
resourceId: string
formatuuid
Link to this property
resourceType: "article"
Link to this property
system: "threat-signals"
Link to this property
title: string
Threat Signals article title; null for historical provenance without a stored title.
Link to this property
Link to this property
updatedAt: string
formatdate-time
Link to this property
uuid: string
Link to this property
value: string
Link to this property
datasetId: optional string
The dataset ID this indicator belongs to. Included in list responses.
Link to this property
relatedEvents: optional array of object {datasetId, eventId, eventDate }
Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
datasetId: string
Link to this property
eventId: string
Link to this property
eventDate: optional string
ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.
Link to this property
Link to this property
relatedEventsHasMore: optional boolean
True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.
Link to this property
tags: optional array of object {categoryId, categoryName, uuid, value }
categoryId: optional string
The UUID of the tag category, or null when the tag is uncategorized.
Link to this property
categoryName: optional string
Link to this property
uuid: optional string
Link to this property
value: optional string
Link to this property
Link to this property
tlp: optional string
Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.
Link to this property
Link to this property
pagination: object {page, pageSize, totalCount, totalPages }
page: number
Link to this property
pageSize: number
Link to this property
totalCount: number
Link to this property
totalPages: number
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.by_dataset%20%3E%20(model)%20by_dataset_list_response%20%3E%20(schema)>)
ByDatasetGetResponse object {createdAt, indicatorType, updatedAt, 7 more }
createdAt: string
formatdate-time
Link to this property
indicatorType: string
Link to this property
updatedAt: string
formatdate-time
Link to this property
uuid: string
Link to this property
value: string
Link to this property
datasetId: optional string
The dataset ID this indicator belongs to. Included in list responses.
Link to this property
relatedEvents: optional array of object {datasetId, eventId, eventDate }
Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
datasetId: string
Link to this property
eventId: string
Link to this property
eventDate: optional string
ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.
Link to this property
Link to this property
relatedEventsHasMore: optional boolean
True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.
Link to this property
tags: optional array of object {categoryId, categoryName, uuid, value }
categoryId: optional string
The UUID of the tag category, or null when the tag is uncategorized.
Link to this property
categoryName: optional string
Link to this property
uuid: optional string
Link to this property
value: optional string
Link to this property
Link to this property
tlp: optional string
Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.by_dataset%20%3E%20(model)%20by_dataset_get_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsIndicatorsBy DatasetTags
##### [List mirrored tags for an indicator dataset](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/by_dataset/subresources/tags/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/indicators/tags
##### ModelsExpand Collapse
TagListResponse = array of unknown
Array of mirror tag rows
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.by_dataset.tags%20%3E%20(model)%20tag_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsAttackers
##### [Lists attackers across multiple datasets](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/attackers/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/attackers
##### ModelsExpand Collapse
AttackerListResponse object {items, type }
items: object {type }
type: string
Link to this property
Link to this property
type: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.attackers%20%3E%20(model)%20attacker_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsCategories
##### [Lists categories across multiple datasets](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/categories
##### [Reads a category](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/get)
Deprecated
GET/accounts/{account\_id}/cloudforce-one/events/categories/{category\_id}
##### [Creates a new category](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/create)
POST/accounts/{account\_id}/cloudforce-one/events/categories/create
##### [Updates a category](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/edit)
Deprecated
PATCH/accounts/{account\_id}/cloudforce-one/events/categories/{category\_id}
##### [Deletes a category](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/delete)
Deprecated
DELETE/accounts/{account\_id}/cloudforce-one/events/categories/{category\_id}
##### ModelsExpand Collapse
CategoryListResponse = array of object {killChain, name, uuid, 3 more }
killChain: number
Link to this property
name: string
Link to this property
uuid: string
Link to this property
mitreAttack: optional array of string
Link to this property
mitreCapec: optional array of string
Link to this property
shortname: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>)
CategoryGetResponse object {killChain, name, uuid, 3 more }
killChain: number
Link to this property
name: string
Link to this property
uuid: string
Link to this property
mitreAttack: optional array of string
Link to this property
mitreCapec: optional array of string
Link to this property
shortname: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_get_response%20%3E%20(schema)>)
CategoryCreateResponse object {killChain, name, uuid, 3 more }
killChain: number
Link to this property
name: string
Link to this property
uuid: string
Link to this property
mitreAttack: optional array of string
Link to this property
mitreCapec: optional array of string
Link to this property
shortname: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_create_response%20%3E%20(schema)>)
CategoryEditResponse object {killChain, name, uuid, 3 more }
killChain: number
Link to this property
name: string
Link to this property
uuid: string
Link to this property
mitreAttack: optional array of string
Link to this property
mitreCapec: optional array of string
Link to this property
shortname: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_edit_response%20%3E%20(schema)>)
CategoryDeleteResponse object {uuid }
uuid: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_delete_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsCategoriesCatalog
##### [Lists categories](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/categories/subresources/catalog/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/categories/catalog
##### ModelsExpand Collapse
CatalogListResponse = array of object {killChain, name, uuid, 3 more }
killChain: number
Link to this property
name: string
Link to this property
uuid: string
Link to this property
mitreAttack: optional array of string
Link to this property
mitreCapec: optional array of string
Link to this property
shortname: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories.catalog%20%3E%20(model)%20catalog_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsCountries
##### [Retrieves countries information for all countries](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/countries/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/countries
##### ModelsExpand Collapse
CountryListResponse = array of object {result, success }
result: array of object {alpha2, alpha3, name }
alpha2: string
Link to this property
alpha3: string
Link to this property
name: string
Link to this property
Link to this property
success: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.countries%20%3E%20(model)%20country_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsCrons
#### Cloudforce OneThreat EventsDatasets
##### [Lists all datasets in an account](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/dataset
##### [Reads a dataset](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/get)
GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}
##### [Creates a dataset](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create)
POST/accounts/{account\_id}/cloudforce-one/events/dataset/create
##### [Updates an existing dataset](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/edit)
PATCH/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}
##### [Delete a dataset](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/delete)
DELETE/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}
##### [Reads raw data for an event by UUID](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/raw)
Deprecated
GET/accounts/{account\_id}/cloudforce-one/events/raw/{dataset\_id}/{event\_id}
##### ModelsExpand Collapse
DatasetListResponse = array of object {indicatorWriteMode, isAnalytics, isPublic, 3 more }
indicatorWriteMode: "read\_only"or "create\_only"or "full"
Effective indicator mutation capability after account/dataset authorization and dataset storage capability are applied. API Gateway method permissions are separate and must also allow the requested operation.
One of the following:
"read\_only"
Link to this property
"create\_only"
Link to this property
"full"
Link to this property
Link to this property
isAnalytics: boolean
Link to this property
isPublic: boolean
Link to this property
name: string
Link to this property
uuid: string
Link to this property
deletedAt: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_list_response%20%3E%20(schema)>)
DatasetGetResponse object {isAnalytics, isPublic, name, uuid }
isAnalytics: boolean
Link to this property
isPublic: boolean
Link to this property
name: string
Link to this property
uuid: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_get_response%20%3E%20(schema)>)
DatasetCreateResponse object {isAnalytics, isPublic, name, uuid }
isAnalytics: boolean
Link to this property
isPublic: boolean
Link to this property
name: string
Link to this property
uuid: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_create_response%20%3E%20(schema)>)
DatasetEditResponse object {isAnalytics, isPublic, name, uuid }
isAnalytics: boolean
Link to this property
isPublic: boolean
Link to this property
name: string
Link to this property
uuid: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_edit_response%20%3E%20(schema)>)
DatasetDeleteResponse object {name, uuid }
name: string
Link to this property
uuid: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_delete_response%20%3E%20(schema)>)
DatasetRawResponse object {id, accountId, created, 3 more }
id: number
Link to this property
accountId: number
Link to this property
created: string
Link to this property
data: string
Link to this property
source: string
Link to this property
tlp: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_raw_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsDatasetsHealth
#### Cloudforce OneThreat EventsDatasetsEvents
##### [Reads an event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/subresources/events/methods/get)
GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/events/{event\_id}
##### ModelsExpand Collapse
EventGetResponse object {attacker, attackerCountry, attackerCountryAlpha3, 26 more }
attacker: string
Link to this property
attackerCountry: string
Link to this property
attackerCountryAlpha3: string
Link to this property
category: string
Link to this property
datasetId: string
Link to this property
date: string
Link to this property
event: string
Link to this property
hasChildren: boolean
Link to this property
indicator: string
Link to this property
indicatorType: string
Link to this property
indicatorTypeId: number
Link to this property
killChain: number
Link to this property
mitreAttack: array of string
Link to this property
mitreCapec: array of string
Link to this property
numReferenced: number
Link to this property
numReferences: number
Link to this property
rawId: string
Link to this property
referenced: array of string
Link to this property
referencedIds: array of number
Link to this property
references: array of string
Link to this property
referencesIds: array of number
Link to this property
tags: array of string
Link to this property
targetCountry: string
Link to this property
targetCountryAlpha3: string
Link to this property
targetIndustry: string
Link to this property
tlp: string
Link to this property
uuid: string
Link to this property
insight: optional string
Link to this property
releasabilityId: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets.events%20%3E%20(model)%20event_get_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsRaw
##### [Reads data for a raw event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/raw/methods/get)
GET/accounts/{account\_id}/cloudforce-one/events/{event\_id}/raw/{raw\_id}
##### [Updates a raw event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/raw/methods/edit)
PATCH/accounts/{account\_id}/cloudforce-one/events/{event\_id}/raw/{raw\_id}
##### ModelsExpand Collapse
RawGetResponse object {id, accountId, created, 3 more }
id: string
Link to this property
accountId: number
Link to this property
created: string
Link to this property
data: unknown
Link to this property
source: string
Link to this property
tlp: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>)
RawEditResponse object {id, data }
id: string
Link to this property
data: unknown
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.raw%20%3E%20(model)%20raw_edit_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsRelate
##### [Removes an event reference](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/relate/methods/delete)
DELETE/accounts/{account\_id}/cloudforce-one/events/relate/{event\_id}
##### ModelsExpand Collapse
RelateDeleteResponse object {success }
success: boolean
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.relate%20%3E%20(model)%20relate_delete_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsTags
##### [Lists all tags (SoT)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/tags
##### [Creates a new tag](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/create)
POST/accounts/{account\_id}/cloudforce-one/events/tags/create
##### [Updates a tag (SoT)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/edit)
PATCH/accounts/{account\_id}/cloudforce-one/events/tags/{tag\_uuid}
##### [Deletes a tag (SoT)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/delete)
DELETE/accounts/{account\_id}/cloudforce-one/events/tags/{tag\_uuid}
##### ModelsExpand Collapse
TagListResponse object {pagination, tags }
pagination: object {page, pageSize, totalCount, totalPages }
page: number
Link to this property
pageSize: number
Link to this property
totalCount: number
Link to this property
totalPages: number
Link to this property
Link to this property
tags: array of object {uuid, value, activeDuration, 34 more }
uuid: string
Link to this property
value: string
Link to this property
activeDuration: optional string
Link to this property
activeDuration\_annotated: optional object {value, tlp }
value: string
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
actorCategory: optional string
Link to this property
actorCategory\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
aliases: optional array of object {value, confidence, tlp }
Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).
value: string
Link to this property
confidence: optional number
maximum10
minimum1
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
aliasGroupNames: optional array of string
Link to this property
aliasGroupNamesInternal: optional array of string
Link to this property
attributionOrganization: optional string
Link to this property
attributionOrganization\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
categoryName: optional string
Link to this property
categoryUuid: optional string
Link to this property
confidence: optional number
Overall tag confidence (1-10).
maximum10
minimum1
Link to this property
createdAt: optional string
Link to this property
dateOfDiscovery: optional string
Link to this property
description: optional string
Link to this property
externalReferenceLinks: optional array of string
Link to this property
externalReferences: optional array of object {url, description }
Structured external references ({ url, description }). Public: returned to all accounts.
url: string
Link to this property
description: optional string
Link to this property
Link to this property
externalReferences\_annotated: optional array of object {value, tlp }
value: string
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
internalAliases: optional array of object {value, confidence, tlp }
Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.
value: string
Link to this property
confidence: optional number
maximum10
minimum1
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
internalDescription: optional string
Link to this property
lastSeen: optional string
Link to this property
motive: optional string
Link to this property
motive\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
opsecLevel: optional string
Link to this property
opsecLevel\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
originCountryISO: optional string
ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.
Link to this property
originCountryISO\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
priority: optional number
Link to this property
priority\_annotated: optional object {value, tlp }
value: number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
properties: optional map\[unknown]
Parsed custom field values. Null when the tag has no custom fields.
Link to this property
sophisticationLevel: optional string
Link to this property
sophisticationLevel\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
Tag-level TLP handling marking.
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
updatedAt: optional string
Link to this property
version: optional number
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_list_response%20%3E%20(schema)>)
TagCreateResponse object {uuid, value, activeDuration, 34 more }
uuid: string
Link to this property
value: string
Link to this property
activeDuration: optional string
Link to this property
activeDuration\_annotated: optional object {value, tlp }
value: string
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
actorCategory: optional string
Link to this property
actorCategory\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
aliases: optional array of object {value, confidence, tlp }
Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).
value: string
Link to this property
confidence: optional number
maximum10
minimum1
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
aliasGroupNames: optional array of string
Link to this property
aliasGroupNamesInternal: optional array of string
Link to this property
attributionOrganization: optional string
Link to this property
attributionOrganization\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
categoryName: optional string
Link to this property
categoryUuid: optional string
Link to this property
confidence: optional number
Overall tag confidence (1-10).
maximum10
minimum1
Link to this property
createdAt: optional string
Link to this property
dateOfDiscovery: optional string
Link to this property
description: optional string
Link to this property
externalReferenceLinks: optional array of string
Link to this property
externalReferences: optional array of object {url, description }
Structured external references ({ url, description }). Public: returned to all accounts.
url: string
Link to this property
description: optional string
Link to this property
Link to this property
externalReferences\_annotated: optional array of object {value, tlp }
value: string
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
internalAliases: optional array of object {value, confidence, tlp }
Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.
value: string
Link to this property
confidence: optional number
maximum10
minimum1
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
internalDescription: optional string
Link to this property
lastSeen: optional string
Link to this property
motive: optional string
Link to this property
motive\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
opsecLevel: optional string
Link to this property
opsecLevel\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
originCountryISO: optional string
ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.
Link to this property
originCountryISO\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
priority: optional number
Link to this property
priority\_annotated: optional object {value, tlp }
value: number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
properties: optional map\[unknown]
Parsed custom field values. Null when the tag has no custom fields.
Link to this property
sophisticationLevel: optional string
Link to this property
sophisticationLevel\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
Tag-level TLP handling marking.
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
updatedAt: optional string
Link to this property
version: optional number
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_create_response%20%3E%20(schema)>)
TagEditResponse object {uuid, value, activeDuration, 34 more }
uuid: string
Link to this property
value: string
Link to this property
activeDuration: optional string
Link to this property
activeDuration\_annotated: optional object {value, tlp }
value: string
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
actorCategory: optional string
Link to this property
actorCategory\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
aliases: optional array of object {value, confidence, tlp }
Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).
value: string
Link to this property
confidence: optional number
maximum10
minimum1
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
aliasGroupNames: optional array of string
Link to this property
aliasGroupNamesInternal: optional array of string
Link to this property
attributionOrganization: optional string
Link to this property
attributionOrganization\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
categoryName: optional string
Link to this property
categoryUuid: optional string
Link to this property
confidence: optional number
Overall tag confidence (1-10).
maximum10
minimum1
Link to this property
createdAt: optional string
Link to this property
dateOfDiscovery: optional string
Link to this property
description: optional string
Link to this property
externalReferenceLinks: optional array of string
Link to this property
externalReferences: optional array of object {url, description }
Structured external references ({ url, description }). Public: returned to all accounts.
url: string
Link to this property
description: optional string
Link to this property
Link to this property
externalReferences\_annotated: optional array of object {value, tlp }
value: string
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
internalAliases: optional array of object {value, confidence, tlp }
Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.
value: string
Link to this property
confidence: optional number
maximum10
minimum1
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
internalDescription: optional string
Link to this property
lastSeen: optional string
Link to this property
motive: optional string
Link to this property
motive\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
opsecLevel: optional string
Link to this property
opsecLevel\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
originCountryISO: optional string
ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.
Link to this property
originCountryISO\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
priority: optional number
Link to this property
priority\_annotated: optional object {value, tlp }
value: number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
properties: optional map\[unknown]
Parsed custom field values. Null when the tag has no custom fields.
Link to this property
sophisticationLevel: optional string
Link to this property
sophisticationLevel\_annotated: optional object {value, confidence, tlp }
value: string
Link to this property
confidence: optional number
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more
Tag-level TLP handling marking.
One of the following:
"red"
Link to this property
"amber"
Link to this property
"amber-strict"
Link to this property
"green"
Link to this property
"clear"
Link to this property
"purple"
Link to this property
"amber+strict"
Link to this property
Link to this property
updatedAt: optional string
Link to this property
version: optional number
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_edit_response%20%3E%20(schema)>)
TagDeleteResponse object {uuid }
uuid: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_delete_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsTagsCategories
##### [Lists all tag categories (SoT)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/tags/categories
##### [Creates a new tag category (SoT)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/create)
POST/accounts/{account\_id}/cloudforce-one/events/tags/categories/create
##### [Updates a tag category (SoT)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/edit)
Deprecated
PATCH/accounts/{account\_id}/cloudforce-one/events/tags/categories/{category\_uuid}
##### [Deletes a tag category (SoT)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/delete)
Deprecated
DELETE/accounts/{account\_id}/cloudforce-one/events/tags/categories/{category\_uuid}
##### ModelsExpand Collapse
CategoryListResponse object {categories }
categories: array of object {name, uuid, createdAt, 3 more }
name: string
Link to this property
uuid: string
Link to this property
createdAt: optional string
Link to this property
description: optional string
Link to this property
schema: optional array of object {key, kind, allowedValues, 11 more }
Parsed FieldDefinition\[] defining custom fields for this category, or null if none.
key: string
Link to this property
kind: "string"or "number"or "enum"or 3 more
One of the following:
"string"
Link to this property
"number"
Link to this property
"enum"
Link to this property
"date"
Link to this property
"array"
Link to this property
"object"
Link to this property
Link to this property
allowedValues: optional array of string
Link to this property
annotations: optional object {confidence, tlp }
confidence: optional boolean
Link to this property
tlp: optional boolean
Link to this property
Link to this property
deprecated: optional boolean
Marks a field as unavailable for new values while retaining its definition for historical values.
Link to this property
deprecatedValues: optional array of string
Enum values unavailable for new writes but retained in allowedValues for historical display.
Link to this property
element: optional unknown
Link to this property
enforcement: optional "error"or "warn"or "off"
One of the following:
"error"
Link to this property
"warn"
Link to this property
"off"
Link to this property
Link to this property
format: optional "date"or "url"or "duration"or "country"
One of the following:
"date"
Link to this property
"url"
Link to this property
"duration"
Link to this property
"country"
Link to this property
Link to this property
label: optional string
maxLength128
minLength1
Link to this property
maxLength: optional number
exclusiveMinimum
minimum0
Link to this property
numberConstraint: optional object {integer, max, min }
integer: optional boolean
Link to this property
max: optional number
Link to this property
min: optional number
Link to this property
Link to this property
properties: optional map\[unknown]
Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).
Link to this property
required: optional boolean
Link to this property
Link to this property
updatedAt: optional string
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>)
CategoryCreateResponse object {name, uuid, createdAt, 3 more }
name: string
Link to this property
uuid: string
Link to this property
createdAt: optional string
Link to this property
description: optional string
Link to this property
schema: optional array of object {key, kind, allowedValues, 11 more }
Parsed FieldDefinition\[] defining custom fields for this category, or null if none.
key: string
Link to this property
kind: "string"or "number"or "enum"or 3 more
One of the following:
"string"
Link to this property
"number"
Link to this property
"enum"
Link to this property
"date"
Link to this property
"array"
Link to this property
"object"
Link to this property
Link to this property
allowedValues: optional array of string
Link to this property
annotations: optional object {confidence, tlp }
confidence: optional boolean
Link to this property
tlp: optional boolean
Link to this property
Link to this property
deprecated: optional boolean
Marks a field as unavailable for new values while retaining its definition for historical values.
Link to this property
deprecatedValues: optional array of string
Enum values unavailable for new writes but retained in allowedValues for historical display.
Link to this property
element: optional unknown
Link to this property
enforcement: optional "error"or "warn"or "off"
One of the following:
"error"
Link to this property
"warn"
Link to this property
"off"
Link to this property
Link to this property
format: optional "date"or "url"or "duration"or "country"
One of the following:
"date"
Link to this property
"url"
Link to this property
"duration"
Link to this property
"country"
Link to this property
Link to this property
label: optional string
maxLength128
minLength1
Link to this property
maxLength: optional number
exclusiveMinimum
minimum0
Link to this property
numberConstraint: optional object {integer, max, min }
integer: optional boolean
Link to this property
max: optional number
Link to this property
min: optional number
Link to this property
Link to this property
properties: optional map\[unknown]
Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).
Link to this property
required: optional boolean
Link to this property
Link to this property
updatedAt: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_create_response%20%3E%20(schema)>)
CategoryEditResponse object {name, uuid, createdAt, 3 more }
name: string
Link to this property
uuid: string
Link to this property
createdAt: optional string
Link to this property
description: optional string
Link to this property
schema: optional array of object {key, kind, allowedValues, 11 more }
Parsed FieldDefinition\[] defining custom fields for this category, or null if none.
key: string
Link to this property
kind: "string"or "number"or "enum"or 3 more
One of the following:
"string"
Link to this property
"number"
Link to this property
"enum"
Link to this property
"date"
Link to this property
"array"
Link to this property
"object"
Link to this property
Link to this property
allowedValues: optional array of string
Link to this property
annotations: optional object {confidence, tlp }
confidence: optional boolean
Link to this property
tlp: optional boolean
Link to this property
Link to this property
deprecated: optional boolean
Marks a field as unavailable for new values while retaining its definition for historical values.
Link to this property
deprecatedValues: optional array of string
Enum values unavailable for new writes but retained in allowedValues for historical display.
Link to this property
element: optional unknown
Link to this property
enforcement: optional "error"or "warn"or "off"
One of the following:
"error"
Link to this property
"warn"
Link to this property
"off"
Link to this property
Link to this property
format: optional "date"or "url"or "duration"or "country"
One of the following:
"date"
Link to this property
"url"
Link to this property
"duration"
Link to this property
"country"
Link to this property
Link to this property
label: optional string
maxLength128
minLength1
Link to this property
maxLength: optional number
exclusiveMinimum
minimum0
Link to this property
numberConstraint: optional object {integer, max, min }
integer: optional boolean
Link to this property
max: optional number
Link to this property
min: optional number
Link to this property
Link to this property
properties: optional map\[unknown]
Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).
Link to this property
required: optional boolean
Link to this property
Link to this property
updatedAt: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_edit_response%20%3E%20(schema)>)
CategoryDeleteResponse object {uuid }
uuid: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_delete_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsTagsIndicators
##### [List indicators related to a tag](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/indicators/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/tags/{tag\_uuid}/indicators
##### ModelsExpand Collapse
IndicatorListResponse object {indicators, pagination }
indicators: array of object {createdAt, indicatorType, updatedAt, 7 more }
createdAt: string
formatdate-time
Link to this property
indicatorType: string
Link to this property
updatedAt: string
formatdate-time
Link to this property
uuid: string
Link to this property
value: string
Link to this property
datasetId: optional string
The dataset ID this indicator belongs to. Included in list responses.
Link to this property
relatedEvents: optional array of object {datasetId, eventId, eventDate }
Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
datasetId: string
Link to this property
eventId: string
Link to this property
eventDate: optional string
ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.
Link to this property
Link to this property
relatedEventsHasMore: optional boolean
True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.
Link to this property
tags: optional array of object {categoryId, categoryName, uuid, value }
categoryId: optional string
The UUID of the tag category, or null when the tag is uncategorized.
Link to this property
categoryName: optional string
Link to this property
uuid: optional string
Link to this property
value: optional string
Link to this property
Link to this property
tlp: optional string
Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.
Link to this property
Link to this property
pagination: object {page, pageSize, totalCount, totalPages }
page: number
Link to this property
pageSize: number
Link to this property
totalCount: number
Link to this property
totalPages: number
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsTagsIndicatorsBy Dataset
##### [List indicators related to a tag within a dataset (deprecated)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/indicators/subresources/by_dataset/methods/list)
Deprecated
GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/tags/{tag\_uuid}/indicators
##### ModelsExpand Collapse
ByDatasetListResponse object {indicators, pagination }
indicators: array of object {createdAt, indicatorType, updatedAt, 7 more }
createdAt: string
formatdate-time
Link to this property
indicatorType: string
Link to this property
updatedAt: string
formatdate-time
Link to this property
uuid: string
Link to this property
value: string
Link to this property
datasetId: optional string
The dataset ID this indicator belongs to. Included in list responses.
Link to this property
relatedEvents: optional array of object {datasetId, eventId, eventDate }
Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
datasetId: string
Link to this property
eventId: string
Link to this property
eventDate: optional string
ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.
Link to this property
Link to this property
relatedEventsHasMore: optional boolean
True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.
Link to this property
tags: optional array of object {categoryId, categoryName, uuid, value }
categoryId: optional string
The UUID of the tag category, or null when the tag is uncategorized.
Link to this property
categoryName: optional string
Link to this property
uuid: optional string
Link to this property
value: optional string
Link to this property
Link to this property
tlp: optional string
Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.
Link to this property
Link to this property
pagination: object {page, pageSize, totalCount, totalPages }
page: number
Link to this property
pageSize: number
Link to this property
totalCount: number
Link to this property
totalPages: number
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.indicators.by_dataset%20%3E%20(model)%20by_dataset_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsEvent Tags
##### [Adds a tag to an event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/event_tags/methods/create)
POST/accounts/{account\_id}/cloudforce-one/events/event\_tag/{event\_id}/create
##### [Removes a tag from an event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/event_tags/methods/delete)
DELETE/accounts/{account\_id}/cloudforce-one/events/event\_tag/{event\_id}
##### ModelsExpand Collapse
EventTagCreateResponse object {success }
success: boolean
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.event_tags%20%3E%20(model)%20event_tag_create_response%20%3E%20(schema)>)
EventTagDeleteResponse object {success }
success: boolean
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.event_tags%20%3E%20(model)%20event_tag_delete_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsTarget Industries
##### [Lists target industries across multiple datasets](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/target_industries/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/targetIndustries
##### ModelsExpand Collapse
TargetIndustryListResponse object {items, type }
items: object {type }
type: string
Link to this property
Link to this property
type: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.target_industries%20%3E%20(model)%20target_industry_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsTarget IndustriesBy Dataset
##### [Lists all target industries for a specific dataset](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/target_industries/subresources/by_dataset/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/targetIndustries
##### ModelsExpand Collapse
ByDatasetListResponse object {items, type }
items: object {type }
type: string
Link to this property
Link to this property
type: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.target_industries.by_dataset%20%3E%20(model)%20by_dataset_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsTarget IndustriesCatalog
##### [Lists all target industries from industry map catalog](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/target_industries/subresources/catalog/methods/list)
GET/accounts/{account\_id}/cloudforce-one/events/targetIndustries/catalog
##### ModelsExpand Collapse
CatalogListResponse object {items, type }
items: object {type }
type: string
Link to this property
Link to this property
type: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.target_industries.catalog%20%3E%20(model)%20catalog_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat EventsInsights
#### Cloudforce OneThreat Signals
Threat Signals API for managing threat intelligence feeds, articles, indicators, and AI skills in Cloudforce One.
## Prerequisites
1. **API token** — requests must use an API token with Cloudforce One permissions; write operations (creating, editing, or deleting feeds, skills, and tags) require write access.
2. **Plan limits** — access on the Free plan is limited; feed quotas and managed default skills apply.
#### Cloudforce OneThreat SignalsSearch
##### [Search Threat Signals articles using AI Search](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/search/methods/search)
GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/search
##### ModelsExpand Collapse
SearchSearchResponse object {count, results }
count: number
Number of unique article candidates returned in this response. Equal to results.length.
minimum0
Link to this property
results: array of object {article\_id, dataset\_id, event\_id, 3 more }
article\_id: string
formatuuid
Link to this property
dataset\_id: string
formatuuid
Link to this property
event\_id: string
formatuuid
Link to this property
feed\_id: string
formatuuid
Link to this property
score: number
Link to this property
text: string
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.search%20%3E%20(model)%20search_search_response%20%3E%20(schema)>)
#### Cloudforce OneThreat SignalsCategories
##### [List Threat Signals feed categories](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/categories/methods/list)
GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/categories
##### ModelsExpand Collapse
CategoryListResponse object {categories }
categories: array of object {id, description, name }
id: string
Wire value accepted by the feed category_id field.
formatuuid
Link to this property
description: string
Plain-language description of the category.
Link to this property
name: string
Human-readable display label.
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat SignalsFeeds
##### [List Threat Signals feeds](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/list)
GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds
##### [Create Threat Signals feed](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/create)
POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds
##### [Update Threat Signals feed](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/edit)
PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}
##### [Delete Threat Signals feed](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/delete)
DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}
##### [Trigger Threat Signals feed poll](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/poll)
POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/poll
##### ModelsExpand Collapse
FeedListResponse object {count, feeds, page, 2 more }
count: number
Number of feeds on this page.
Link to this property
feeds: array of object {id, category\_id, category\_name, 12 more }
id: string
formatuuid
Link to this property
category\_id: string
Feed category identifier. Null when unset.
Link to this property
category\_name: string
Display name of the feed category. Null when unset or unresolvable.
Link to this property
created\_at: string
Link to this property
curated\_feed\_id: string
Curated catalog feed this subscription was created from. Null for custom feeds.
Link to this property
display\_name: string
Link to this property
enabled: boolean
Link to this property
last\_polled\_at: string
Link to this property
poll\_interval\_s: number
Link to this property
source\_type: string
custom for a feed added by URL, curated for a curated catalog feed.
Link to this property
status: string
Polling health: active, or error after a failed poll.
Link to this property
subscribed\_at: string
Link to this property
title: string
Link to this property
updated\_at: string
Link to this property
url: string
Link to this property
Link to this property
page: number
Link to this property
per\_page: number
Link to this property
total\_count: number
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_list_response%20%3E%20(schema)>)
FeedCreateResponse object {id, category\_id, category\_name, 12 more }
id: string
formatuuid
Link to this property
category\_id: string
Feed category identifier. Null when unset.
Link to this property
category\_name: string
Display name of the feed category. Null when unset or unresolvable.
Link to this property
created\_at: string
Link to this property
curated\_feed\_id: string
Curated catalog feed this subscription was created from. Null for custom feeds.
Link to this property
display\_name: string
Link to this property
enabled: boolean
Link to this property
last\_polled\_at: string
Link to this property
poll\_interval\_s: number
Link to this property
source\_type: string
custom for a feed added by URL, curated for a curated catalog feed.
Link to this property
status: string
Polling health: active, or error after a failed poll.
Link to this property
subscribed\_at: string
Link to this property
title: string
Link to this property
updated\_at: string
Link to this property
url: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_create_response%20%3E%20(schema)>)
FeedEditResponse object {id, category\_id, category\_name, 12 more }
id: string
formatuuid
Link to this property
category\_id: string
Feed category identifier. Null when unset.
Link to this property
category\_name: string
Display name of the feed category. Null when unset or unresolvable.
Link to this property
created\_at: string
Link to this property
curated\_feed\_id: string
Curated catalog feed this subscription was created from. Null for custom feeds.
Link to this property
display\_name: string
Link to this property
enabled: boolean
Link to this property
last\_polled\_at: string
Link to this property
poll\_interval\_s: number
Link to this property
source\_type: string
custom for a feed added by URL, curated for a curated catalog feed.
Link to this property
status: string
Polling health: active, or error after a failed poll.
Link to this property
subscribed\_at: string
Link to this property
title: string
Link to this property
updated\_at: string
Link to this property
url: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_edit_response%20%3E%20(schema)>)
FeedDeleteResponse object {id, category\_id, category\_name, 12 more }
id: string
formatuuid
Link to this property
category\_id: string
Feed category identifier. Null when unset.
Link to this property
category\_name: string
Display name of the feed category. Null when unset or unresolvable.
Link to this property
created\_at: string
Link to this property
curated\_feed\_id: string
Curated catalog feed this subscription was created from. Null for custom feeds.
Link to this property
display\_name: string
Link to this property
enabled: boolean
Link to this property
last\_polled\_at: string
Link to this property
poll\_interval\_s: number
Link to this property
source\_type: string
custom for a feed added by URL, curated for a curated catalog feed.
Link to this property
status: string
Polling health: active, or error after a failed poll.
Link to this property
subscribed\_at: string
Link to this property
title: string
Link to this property
updated\_at: string
Link to this property
url: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_delete_response%20%3E%20(schema)>)
FeedPollResponse object {errors, feeds, triggered }
errors: number
Link to this property
feeds: array of object {feed\_id, status, workflow\_id, feed\_enabled }
feed\_id: string
formatuuid
Link to this property
status: "workflow\_created"or "error"
One of the following:
"workflow\_created"
Link to this property
"error"
Link to this property
Link to this property
workflow\_id: string
Link to this property
feed\_enabled: optional boolean
Link to this property
Link to this property
triggered: number
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_poll_response%20%3E%20(schema)>)
#### Cloudforce OneThreat SignalsFeedsRaw
##### [Get Threat Signals feed XML](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/raw/methods/get)
GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/raw
##### ModelsExpand Collapse
RawGetResponse = string
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>)
#### Cloudforce OneThreat SignalsFeedsSkills
##### [Get Threat Signals feed skills](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/skills/methods/get)
GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/skills
##### [Set Threat Signals feed skills](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/skills/methods/update)
PUT/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/skills
##### ModelsExpand Collapse
SkillGetResponse object {feed\_id, skills }
feed\_id: string
formatuuid
Link to this property
skills: array of object {id, config, created\_at, 7 more }
id: string
Link to this property
config: string
JSON-encoded skill configuration. Always null for default skills.
Link to this property
created\_at: string
Link to this property
is\_active: number
1 when active, 0 when inactive.
Link to this property
name: string
Link to this property
output\_schema: string
JSON-encoded JSON Schema the skill output must satisfy.
Link to this property
prompt: string
Link to this property
source: "default"or "custom"
default for Cloudforce One managed skills (read-only), custom for account skills.
One of the following:
"default"
Link to this property
"custom"
Link to this property
Link to this property
type: string
Link to this property
updated\_at: string
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.skills%20%3E%20(model)%20skill_get_response%20%3E%20(schema)>)
SkillUpdateResponse object {feed\_id, skills }
feed\_id: string
formatuuid
Link to this property
skills: array of object {position, skill\_id }
position: number
Zero-based pipeline position.
Link to this property
skill\_id: string
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.skills%20%3E%20(model)%20skill_update_response%20%3E%20(schema)>)
#### Cloudforce OneThreat SignalsArticles
##### [List Threat Signals articles](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/list)
GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles
##### [Bulk update Threat Signals article read status](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/bulk_edit)
PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles
##### [Get Threat Signals article](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/get)
GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}
##### [Update Threat Signals article read status](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/edit)
PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}
##### ModelsExpand Collapse
ArticleListResponse object {articles, has\_more, next\_cursor, 2 more }
articles: array of object {id, dataset\_id, event\_id, 10 more }
id: string
formatuuid
Link to this property
dataset\_id: string
Threat Events dataset identifier for the article redirect. Null when the account feeds dataset mapping is unavailable.
Link to this property
event\_id: string
Threat Events event identifier associated with this article for a UI redirect. Null when no event has been linked.
Link to this property
feed\_display\_name: string
Link to this property
feed\_id: string
formatuuid
Link to this property
fetched\_at: string
Link to this property
link: string
Link to this property
published\_at: string
Link to this property
read: boolean
Link to this property
read\_at: string
Link to this property
summary: string
Persisted enrichment summary. Null until enrichment produces a summary.
Link to this property
tags: array of object {applied\_by, categoryId, uuid, value }
applied\_by: "ai"or "analyst"or "system"
One of the following:
"ai"
Link to this property
"analyst"
Link to this property
"system"
Link to this property
Link to this property
categoryId: string
formatuuid
Link to this property
uuid: string
formatuuid
Link to this property
value: string
Link to this property
Link to this property
title: string
Link to this property
Link to this property
has\_more: boolean
Link to this property
next\_cursor: string
Link to this property
total\_count: number
Link to this property
total\_count\_is\_exact: boolean
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_list_response%20%3E%20(schema)>)
ArticleBulkEditResponse object {updated\_count }
updated\_count: number
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_bulk_edit_response%20%3E%20(schema)>)
ArticleGetResponse object {id, bullet\_points, content\_r2\_key, 16 more }
id: string
formatuuid
Link to this property
bullet\_points: object {impact, what\_happened, who\_affected }
impact: string
Link to this property
what\_happened: string
Link to this property
who\_affected: string
Link to this property
Link to this property
content\_r2\_key: string
Link to this property
feed\_display\_name: string
Link to this property
feed\_id: string
formatuuid
Link to this property
fetched\_at: string
Link to this property
indicator\_extraction\_status: "in\_progress"or "complete"or "failed"or "unknown"
Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded.
One of the following:
"in\_progress"
Link to this property
"complete"
Link to this property
"failed"
Link to this property
"unknown"
Link to this property
Link to this property
link: string
Link to this property
metadata: map\[unknown]
Link to this property
published\_at: string
Link to this property
read: boolean
Link to this property
read\_at: string
Link to this property
source\_count: number
Link to this property
summary: string
Persisted enrichment summary. Null until enrichment produces a summary.
Link to this property
summary\_r2\_key: string
Link to this property
tags: array of object {applied\_by, categoryId, uuid, value }
applied\_by: "ai"or "analyst"or "system"
One of the following:
"ai"
Link to this property
"analyst"
Link to this property
"system"
Link to this property
Link to this property
categoryId: string
formatuuid
Link to this property
uuid: string
formatuuid
Link to this property
value: string
Link to this property
Link to this property
title: string
Link to this property
skill\_version: optional string
Link to this property
tag\_skill\_version: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_get_response%20%3E%20(schema)>)
ArticleEditResponse object {id, bullet\_points, content\_r2\_key, 16 more }
id: string
formatuuid
Link to this property
bullet\_points: object {impact, what\_happened, who\_affected }
impact: string
Link to this property
what\_happened: string
Link to this property
who\_affected: string
Link to this property
Link to this property
content\_r2\_key: string
Link to this property
feed\_display\_name: string
Link to this property
feed\_id: string
formatuuid
Link to this property
fetched\_at: string
Link to this property
indicator\_extraction\_status: "in\_progress"or "complete"or "failed"or "unknown"
Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded.
One of the following:
"in\_progress"
Link to this property
"complete"
Link to this property
"failed"
Link to this property
"unknown"
Link to this property
Link to this property
link: string
Link to this property
metadata: map\[unknown]
Link to this property
published\_at: string
Link to this property
read: boolean
Link to this property
read\_at: string
Link to this property
source\_count: number
Link to this property
summary: string
Persisted enrichment summary. Null until enrichment produces a summary.
Link to this property
summary\_r2\_key: string
Link to this property
tags: array of object {applied\_by, categoryId, uuid, value }
applied\_by: "ai"or "analyst"or "system"
One of the following:
"ai"
Link to this property
"analyst"
Link to this property
"system"
Link to this property
Link to this property
categoryId: string
formatuuid
Link to this property
uuid: string
formatuuid
Link to this property
value: string
Link to this property
Link to this property
title: string
Link to this property
skill\_version: optional string
Link to this property
tag\_skill\_version: optional string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_edit_response%20%3E%20(schema)>)
#### Cloudforce OneThreat SignalsArticlesContent
##### [Get Threat Signals article content](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/content/methods/get)
GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/content
##### ModelsExpand Collapse
ContentGetResponse = string
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.content%20%3E%20(model)%20content_get_response%20%3E%20(schema)>)
#### Cloudforce OneThreat SignalsArticlesTags
##### [Add tag to Threat Signals article](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/create)
POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tags
##### [Remove tag from Threat Signals article](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/delete)
DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tags/{tag\_id}
##### [Generate Threat Signals article AI tags](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/generate)
POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tag
##### ModelsExpand Collapse
TagCreateResponse object {applied\_by, categoryId, uuid, value }
applied\_by: "ai"or "analyst"or "system"
One of the following:
"ai"
Link to this property
"analyst"
Link to this property
"system"
Link to this property
Link to this property
categoryId: string
formatuuid
Link to this property
uuid: string
formatuuid
Link to this property
value: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_create_response%20%3E%20(schema)>)
TagDeleteResponse object {applied\_by, categoryId, uuid, value }
applied\_by: "ai"or "analyst"or "system"
One of the following:
"ai"
Link to this property
"analyst"
Link to this property
"system"
Link to this property
Link to this property
categoryId: string
formatuuid
Link to this property
uuid: string
formatuuid
Link to this property
value: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_delete_response%20%3E%20(schema)>)
TagGenerateResponse object {tag\_skill\_version, tags }
tag\_skill\_version: string
Link to this property
tags: array of object {applied\_by, categoryId, uuid, value }
Final hydrated assignment set; may be empty when no applicable tags are selected.
applied\_by: "ai"or "analyst"or "system"
One of the following:
"ai"
Link to this property
"analyst"
Link to this property
"system"
Link to this property
Link to this property
categoryId: string
formatuuid
Link to this property
uuid: string
formatuuid
Link to this property
value: string
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_generate_response%20%3E%20(schema)>)
#### Cloudforce OneThreat SignalsArticlesSkill Outputs
##### [Get Threat Signals article skill output](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/skill_outputs/methods/get)
GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/skills/{skill\_id}/output
##### ModelsExpand Collapse
SkillOutputGetResponse object {article\_id, custom\_skill\_version, output\_schema, 2 more }
article\_id: string
formatuuid
Link to this property
custom\_skill\_version: string
Link to this property
output\_schema: string
JSON-encoded output schema of the skill. Null when the skill no longer exists.
Link to this property
skill\_id: string
Link to this property
custom\_output: optional unknown
Skill output. Parsed JSON when the stored output is valid JSON, otherwise the raw string.
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.skill_outputs%20%3E%20(model)%20skill_output_get_response%20%3E%20(schema)>)
#### Cloudforce OneThreat SignalsIndicators
##### [List Threat Signals article indicators](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/indicators/methods/list)
GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/indicators
##### ModelsExpand Collapse
IndicatorListResponse object {indicators, pagination }
indicators: array of object {id, article\_id, article\_title, 5 more }
id: string
formatuuid
Link to this property
article\_id: string
formatuuid
Link to this property
article\_title: string
Link to this property
dataset\_id: string
Threat Events dataset identifier for navigating from this indicator. Null when the account feeds dataset mapping is unavailable.
Link to this property
feed\_display\_name: string
Link to this property
feed\_id: string
formatuuid
Link to this property
type: string
Link to this property
value: string
Link to this property
Link to this property
pagination: object {count, cursor, has\_more, 4 more }
count: number
minimum0
Link to this property
cursor: string
Link to this property
has\_more: boolean
Link to this property
page: number
Ordinal of this cursor page; not a total-results offset.
minimum1
Link to this property
per\_page: number
maximum100
minimum1
Link to this property
total\_count: number
minimum0
Link to this property
total\_count\_is\_exact: boolean
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>)
#### Cloudforce OneThreat SignalsSkills
##### [List Threat Signals skills](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/list)
GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills
##### [Create Threat Signals skill](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/create)
POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills
##### [Get Threat Signals skill](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/get)
GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}
##### [Update Threat Signals skill](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/edit)
PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}
##### [Delete Threat Signals skill](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/delete)
DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}
##### ModelsExpand Collapse
SkillListResponse object {count, custom\_skills\_available, page, 3 more }
count: number
Number of skills on this page.
Link to this property
custom\_skills\_available: boolean
Whether the authenticated account may access custom-skill capabilities under Stakeout’s Threat Signals access-mode policy. This is a policy availability indicator, not a row-existence indicator. False for threat\_signals\_only mode; true for entitled, allowlisted, cfone\_internal, and service modes.
Link to this property
page: number
Link to this property
per\_page: number
Link to this property
skills: array of object {id, config, created\_at, 7 more }
id: string
Link to this property
config: string
JSON-encoded skill configuration. Always null for default skills.
Link to this property
created\_at: string
Link to this property
is\_active: number
1 when active, 0 when inactive.
Link to this property
name: string
Link to this property
output\_schema: string
JSON-encoded JSON Schema the skill output must satisfy.
Link to this property
prompt: string
Link to this property
source: "default"or "custom"
default for Cloudforce One managed skills (read-only), custom for account skills.
One of the following:
"default"
Link to this property
"custom"
Link to this property
Link to this property
type: string
Link to this property
updated\_at: string
Link to this property
Link to this property
total\_count: number
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_list_response%20%3E%20(schema)>)
SkillCreateResponse object {id, config, created\_at, 7 more }
id: string
Link to this property
config: string
JSON-encoded skill configuration. Always null for default skills.
Link to this property
created\_at: string
Link to this property
is\_active: number
1 when active, 0 when inactive.
Link to this property
name: string
Link to this property
output\_schema: string
JSON-encoded JSON Schema the skill output must satisfy.
Link to this property
prompt: string
Link to this property
source: "default"or "custom"
default for Cloudforce One managed skills (read-only), custom for account skills.
One of the following:
"default"
Link to this property
"custom"
Link to this property
Link to this property
type: string
Link to this property
updated\_at: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_create_response%20%3E%20(schema)>)
SkillGetResponse object {id, config, created\_at, 7 more }
id: string
Link to this property
config: string
JSON-encoded skill configuration. Always null for default skills.
Link to this property
created\_at: string
Link to this property
is\_active: number
1 when active, 0 when inactive.
Link to this property
name: string
Link to this property
output\_schema: string
JSON-encoded JSON Schema the skill output must satisfy.
Link to this property
prompt: string
Link to this property
source: "default"or "custom"
default for Cloudforce One managed skills (read-only), custom for account skills.
One of the following:
"default"
Link to this property
"custom"
Link to this property
Link to this property
type: string
Link to this property
updated\_at: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_get_response%20%3E%20(schema)>)
SkillEditResponse object {id, config, created\_at, 7 more }
id: string
Link to this property
config: string
JSON-encoded skill configuration. Always null for default skills.
Link to this property
created\_at: string
Link to this property
is\_active: number
1 when active, 0 when inactive.
Link to this property
name: string
Link to this property
output\_schema: string
JSON-encoded JSON Schema the skill output must satisfy.
Link to this property
prompt: string
Link to this property
source: "default"or "custom"
default for Cloudforce One managed skills (read-only), custom for account skills.
One of the following:
"default"
Link to this property
"custom"
Link to this property
Link to this property
type: string
Link to this property
updated\_at: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_edit_response%20%3E%20(schema)>)
SkillDeleteResponse object {id, config, created\_at, 7 more }
id: string
Link to this property
config: string
JSON-encoded skill configuration. Always null for default skills.
Link to this property
created\_at: string
Link to this property
is\_active: number
1 when active, 0 when inactive.
Link to this property
name: string
Link to this property
output\_schema: string
JSON-encoded JSON Schema the skill output must satisfy.
Link to this property
prompt: string
Link to this property
source: "default"or "custom"
default for Cloudforce One managed skills (read-only), custom for account skills.
One of the following:
"default"
Link to this property
"custom"
Link to this property
Link to this property
type: string
Link to this property
updated\_at: string
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_delete_response%20%3E%20(schema)>)
#### Cloudforce OneThreat SignalsSkillsTag Categories
##### [Get Threat Signals skill tag categories](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/subresources/tag_categories/methods/get)
GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}/tag-categories
##### [Replace Threat Signals skill tag categories](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/subresources/tag_categories/methods/update)
PUT/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}/tag-categories
##### ModelsExpand Collapse
TagCategoryGetResponse object {category\_uuids, skill\_id }
category\_uuids: array of string
Link to this property
skill\_id: "default-tagging-skill"
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills.tag_categories%20%3E%20(model)%20tag_category_get_response%20%3E%20(schema)>)
TagCategoryUpdateResponse object {category\_uuids, skill\_id }
category\_uuids: array of string
Link to this property
skill\_id: "default-tagging-skill"
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills.tag_categories%20%3E%20(model)%20tag_category_update_response%20%3E%20(schema)>)