--- title: Threat Signals --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) [Cloudforce One](https://developers.cloudflare.com/api/resources/cloudforce_one) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Threat Signals Threat Signals API for managing threat intelligence feeds, articles, indicators, and AI skills in Cloudforce One. ## Prerequisites 1. **API token** — requests must use an API token with Cloudforce One permissions; write operations (creating, editing, or deleting feeds, skills, and tags) require write access. 2. **Plan limits** — access on the Free plan is limited; feed quotas and managed default skills apply. #### Threat SignalsSearch ##### [Search Threat Signals articles using AI Search](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/search/methods/search) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/search ##### ModelsExpand Collapse

SearchSearchResponse object {count, results }

count: number Number of unique article candidates returned in this response. Equal to results.length. minimum0 Link to this property

results: array of object {article\_id, dataset\_id, event\_id, 3 more }

article\_id: string formatuuid Link to this property dataset\_id: string formatuuid Link to this property event\_id: string formatuuid Link to this property feed\_id: string formatuuid Link to this property score: number Link to this property text: string Link to this property

Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.search%20%3E%20(model)%20search_search_response%20%3E%20(schema)>) #### Threat SignalsCategories ##### [List Threat Signals feed categories](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/categories/methods/list) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/categories ##### ModelsExpand Collapse

CategoryListResponse object {categories }

categories: array of object {id, description, name }

id: string Wire value accepted by the feed category_id field. formatuuid Link to this property description: string Plain-language description of the category. Link to this property name: string Human-readable display label. Link to this property

Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>) #### Threat SignalsFeeds ##### [List Threat Signals feeds](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/list) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds ##### [Create Threat Signals feed](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/create) POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds ##### [Update Threat Signals feed](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/edit) PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id} ##### [Delete Threat Signals feed](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/delete) DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id} ##### [Trigger Threat Signals feed poll](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/poll) POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/poll ##### ModelsExpand Collapse

FeedListResponse object {count, feeds, page, 2 more }

count: number Number of feeds on this page. Link to this property

feeds: array of object {id, category\_id, category\_name, 12 more }

id: string formatuuid Link to this property category\_id: string Feed category identifier. Null when unset. Link to this property category\_name: string Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: string Link to this property curated\_feed\_id: string Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: string Link to this property enabled: boolean Link to this property last\_polled\_at: string Link to this property poll\_interval\_s: number Link to this property source\_type: string custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: string Polling health: active, or error after a failed poll. Link to this property subscribed\_at: string Link to this property title: string Link to this property updated\_at: string Link to this property url: string Link to this property

Link to this property page: number Link to this property per\_page: number Link to this property total\_count: number Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_list_response%20%3E%20(schema)>)

FeedCreateResponse object {id, category\_id, category\_name, 12 more }

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_create_response%20%3E%20(schema)>)

FeedEditResponse object {id, category\_id, category\_name, 12 more }

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_edit_response%20%3E%20(schema)>)

FeedDeleteResponse object {id, category\_id, category\_name, 12 more }

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_delete_response%20%3E%20(schema)>)

FeedPollResponse object {errors, feeds, triggered }

errors: number Link to this property

feeds: array of object {feed\_id, status, workflow\_id, feed\_enabled }

feed\_id: string formatuuid Link to this property

status: "workflow\_created"or "error"

One of the following: "workflow\_created" Link to this property "error" Link to this property

Link to this property workflow\_id: string Link to this property feed\_enabled: optional boolean Link to this property

Link to this property triggered: number Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_poll_response%20%3E%20(schema)>) #### Threat SignalsFeedsRaw ##### [Get Threat Signals feed XML](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/raw/methods/get) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/raw ##### ModelsExpand Collapse RawGetResponse = string [Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>) #### Threat SignalsFeedsSkills ##### [Get Threat Signals feed skills](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/skills/methods/get) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/skills ##### [Set Threat Signals feed skills](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/skills/methods/update) PUT/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/skills ##### ModelsExpand Collapse

SkillGetResponse object {feed\_id, skills }

feed\_id: string formatuuid Link to this property

skills: array of object {id, config, created\_at, 7 more }

id: string Link to this property config: string JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: string Link to this property is\_active: number 1 when active, 0 when inactive. Link to this property name: string Link to this property output\_schema: string JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: string Link to this property

source: "default"or "custom" default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following: "default" Link to this property "custom" Link to this property

Link to this property type: string Link to this property updated\_at: string Link to this property

Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.skills%20%3E%20(model)%20skill_get_response%20%3E%20(schema)>)

SkillUpdateResponse object {feed\_id, skills }

feed\_id: string formatuuid Link to this property

skills: array of object {position, skill\_id }

position: number Zero-based pipeline position. Link to this property skill\_id: string Link to this property

Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.skills%20%3E%20(model)%20skill_update_response%20%3E%20(schema)>) #### Threat SignalsArticles ##### [List Threat Signals articles](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/list) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles ##### [Bulk update Threat Signals article read status](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/bulk_edit) PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles ##### [Get Threat Signals article](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/get) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id} ##### [Update Threat Signals article read status](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/edit) PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id} ##### ModelsExpand Collapse

ArticleListResponse object {articles, has\_more, next\_cursor, 2 more }

articles: array of object {id, dataset\_id, event\_id, 10 more }

id: string formatuuid Link to this property dataset\_id: string Threat Events dataset identifier for the article redirect. Null when the account feeds dataset mapping is unavailable. Link to this property event\_id: string Threat Events event identifier associated with this article for a UI redirect. Null when no event has been linked. Link to this property feed\_display\_name: string Link to this property feed\_id: string formatuuid Link to this property fetched\_at: string Link to this property link: string Link to this property published\_at: string Link to this property read: boolean Link to this property read\_at: string Link to this property summary: string Persisted enrichment summary. Null until enrichment produces a summary. Link to this property

tags: array of object {applied\_by, categoryId, uuid, value }

applied\_by: "ai"or "analyst"or "system"

One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property

Link to this property categoryId: string formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property

Link to this property title: string Link to this property

Link to this property has\_more: boolean Link to this property next\_cursor: string Link to this property total\_count: number Link to this property total\_count\_is\_exact: boolean Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_list_response%20%3E%20(schema)>)

ArticleBulkEditResponse object {updated\_count }

updated\_count: number Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_bulk_edit_response%20%3E%20(schema)>)

ArticleGetResponse object {id, bullet\_points, content\_r2\_key, 16 more }

id: string formatuuid Link to this property

bullet\_points: object {impact, what\_happened, who\_affected }

impact: string Link to this property what\_happened: string Link to this property who\_affected: string Link to this property

Link to this property content\_r2\_key: string Link to this property feed\_display\_name: string Link to this property feed\_id: string formatuuid Link to this property fetched\_at: string Link to this property

indicator\_extraction\_status: "in\_progress"or "complete"or "failed"or "unknown" Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded.

One of the following: "in\_progress" Link to this property "complete" Link to this property "failed" Link to this property "unknown" Link to this property

Link to this property link: string Link to this property metadata: map\[unknown] Link to this property published\_at: string Link to this property read: boolean Link to this property read\_at: string Link to this property source\_count: number Link to this property summary: string Persisted enrichment summary. Null until enrichment produces a summary. Link to this property summary\_r2\_key: string Link to this property

tags: array of object {applied\_by, categoryId, uuid, value }

applied\_by: "ai"or "analyst"or "system"

One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property

Link to this property categoryId: string formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property

Link to this property title: string Link to this property skill\_version: optional string Link to this property tag\_skill\_version: optional string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_get_response%20%3E%20(schema)>)

ArticleEditResponse object {id, bullet\_points, content\_r2\_key, 16 more }

id: string formatuuid Link to this property

bullet\_points: object {impact, what\_happened, who\_affected }

impact: string Link to this property what\_happened: string Link to this property who\_affected: string Link to this property

One of the following: "in\_progress" Link to this property "complete" Link to this property "failed" Link to this property "unknown" Link to this property

tags: array of object {applied\_by, categoryId, uuid, value }

applied\_by: "ai"or "analyst"or "system"

One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property

Link to this property categoryId: string formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property

Link to this property title: string Link to this property skill\_version: optional string Link to this property tag\_skill\_version: optional string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_edit_response%20%3E%20(schema)>) #### Threat SignalsArticlesContent ##### [Get Threat Signals article content](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/content/methods/get) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/content ##### ModelsExpand Collapse ContentGetResponse = string [Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.content%20%3E%20(model)%20content_get_response%20%3E%20(schema)>) #### Threat SignalsArticlesTags ##### [Add tag to Threat Signals article](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/create) POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tags ##### [Remove tag from Threat Signals article](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/delete) DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tags/{tag\_id} ##### [Generate Threat Signals article AI tags](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/generate) POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tag ##### ModelsExpand Collapse

TagCreateResponse object {applied\_by, categoryId, uuid, value }

applied\_by: "ai"or "analyst"or "system"

One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property

Link to this property categoryId: string formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_create_response%20%3E%20(schema)>)

TagDeleteResponse object {applied\_by, categoryId, uuid, value }

applied\_by: "ai"or "analyst"or "system"

One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property

Link to this property categoryId: string formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_delete_response%20%3E%20(schema)>)

TagGenerateResponse object {tag\_skill\_version, tags }

tag\_skill\_version: string Link to this property

tags: array of object {applied\_by, categoryId, uuid, value } Final hydrated assignment set; may be empty when no applicable tags are selected.

applied\_by: "ai"or "analyst"or "system"

One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property

Link to this property categoryId: string formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property

Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_generate_response%20%3E%20(schema)>) #### Threat SignalsArticlesSkill Outputs ##### [Get Threat Signals article skill output](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/skill_outputs/methods/get) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/skills/{skill\_id}/output ##### ModelsExpand Collapse

SkillOutputGetResponse object {article\_id, custom\_skill\_version, output\_schema, 2 more }

article\_id: string formatuuid Link to this property custom\_skill\_version: string Link to this property output\_schema: string JSON-encoded output schema of the skill. Null when the skill no longer exists. Link to this property skill\_id: string Link to this property custom\_output: optional unknown Skill output. Parsed JSON when the stored output is valid JSON, otherwise the raw string. Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.skill_outputs%20%3E%20(model)%20skill_output_get_response%20%3E%20(schema)>) #### Threat SignalsIndicators ##### [List Threat Signals article indicators](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/indicators/methods/list) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/indicators ##### ModelsExpand Collapse

IndicatorListResponse object {indicators, pagination }

indicators: array of object {id, article\_id, article\_title, 5 more }

id: string formatuuid Link to this property article\_id: string formatuuid Link to this property article\_title: string Link to this property dataset\_id: string Threat Events dataset identifier for navigating from this indicator. Null when the account feeds dataset mapping is unavailable. Link to this property feed\_display\_name: string Link to this property feed\_id: string formatuuid Link to this property type: string Link to this property value: string Link to this property

Link to this property

pagination: object {count, cursor, has\_more, 4 more }

count: number minimum0 Link to this property cursor: string Link to this property has\_more: boolean Link to this property page: number Ordinal of this cursor page; not a total-results offset. minimum1 Link to this property per\_page: number maximum100 minimum1 Link to this property total\_count: number minimum0 Link to this property total\_count\_is\_exact: boolean Link to this property

Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>) #### Threat SignalsSkills ##### [List Threat Signals skills](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/list) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills ##### [Create Threat Signals skill](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/create) POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills ##### [Get Threat Signals skill](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/get) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### [Update Threat Signals skill](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/edit) PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### [Delete Threat Signals skill](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/delete) DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### ModelsExpand Collapse

SkillListResponse object {count, custom\_skills\_available, page, 3 more }

count: number Number of skills on this page. Link to this property custom\_skills\_available: boolean Whether the authenticated account may access custom-skill capabilities under Stakeout’s Threat Signals access-mode policy. This is a policy availability indicator, not a row-existence indicator. False for threat\_signals\_only mode; true for entitled, allowlisted, cfone\_internal, and service modes. Link to this property page: number Link to this property per\_page: number Link to this property

skills: array of object {id, config, created\_at, 7 more }

source: "default"or "custom" default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following: "default" Link to this property "custom" Link to this property

Link to this property type: string Link to this property updated\_at: string Link to this property

Link to this property total\_count: number Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_list_response%20%3E%20(schema)>)

SkillCreateResponse object {id, config, created\_at, 7 more }

source: "default"or "custom" default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following: "default" Link to this property "custom" Link to this property

Link to this property type: string Link to this property updated\_at: string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_create_response%20%3E%20(schema)>)

SkillGetResponse object {id, config, created\_at, 7 more }

source: "default"or "custom" default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following: "default" Link to this property "custom" Link to this property

Link to this property type: string Link to this property updated\_at: string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_get_response%20%3E%20(schema)>)

SkillEditResponse object {id, config, created\_at, 7 more }

source: "default"or "custom" default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following: "default" Link to this property "custom" Link to this property

Link to this property type: string Link to this property updated\_at: string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_edit_response%20%3E%20(schema)>)

SkillDeleteResponse object {id, config, created\_at, 7 more }

source: "default"or "custom" default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following: "default" Link to this property "custom" Link to this property

Link to this property type: string Link to this property updated\_at: string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_delete_response%20%3E%20(schema)>) #### Threat SignalsSkillsTag Categories ##### [Get Threat Signals skill tag categories](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/subresources/tag_categories/methods/get) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}/tag-categories ##### [Replace Threat Signals skill tag categories](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/subresources/tag_categories/methods/update) PUT/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}/tag-categories ##### ModelsExpand Collapse

TagCategoryGetResponse object {category\_uuids, skill\_id }

category\_uuids: array of string Link to this property skill\_id: "default-tagging-skill" Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills.tag_categories%20%3E%20(model)%20tag_category_get_response%20%3E%20(schema)>)

TagCategoryUpdateResponse object {category\_uuids, skill\_id }

category\_uuids: array of string Link to this property skill\_id: "default-tagging-skill" Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills.tag_categories%20%3E%20(model)%20tag_category_update_response%20%3E%20(schema)>)