--- title: Retrieves Security Center Insights --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) [Security Center](https://developers.cloudflare.com/api/resources/security_center) [Insights](https://developers.cloudflare.com/api/resources/security_center/subresources/insights) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Retrieves Security Center Insights GET/{accounts\_or\_zones}/{account\_or\_zone\_id}/security-center/insights Lists all Security Center insights for the account or zone, showing security findings and recommendations. ##### Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token. **Example:**Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key. **Example:**X-Auth-Email: user@example.com The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys. **Example:**X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

##### P ath ParametersExpand Collapse account\_id: optional string The Account ID to use for this endpoint. Mutually exclusive with the Zone ID. [Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20account_id%20%3E%20(schema)>) zone\_id: optional string The Zone ID to use for this endpoint. Mutually exclusive with the Account ID. [Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20zone_id%20%3E%20(schema)>) ##### Q uery ParametersExpand Collapse dismissed: optional boolean [Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20dismissed%20%3E%20(schema)>) issue\_class: optional array of string [Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20issue_class%20%3E%20(schema)>) "issue\_class\~neq": optional array of string [Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20issue_class~neq%20%3E%20(schema)>)

issue\_type: optional array of IssueType

One of the following: "compliance\_violation" Link to this property "email\_security" Link to this property "exposed\_infrastructure" Link to this property "insecure\_configuration" Link to this property "weak\_authentication" Link to this property "configuration\_suggestion" Link to this property

[Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20issue_type%20%3E%20(schema)>)

"issue\_type\~neq": optional array of IssueType

[Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20issue_type~neq%20%3E%20(schema)>) page: optional number Specifies the current page within paginated list of results. [Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20page%20%3E%20(schema)>) per\_page: optional number Sets the number of results per page of results. maximum1000 minimum1 [Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20per_page%20%3E%20(schema)>) product: optional array of string [Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20product%20%3E%20(schema)>) "product\~neq": optional array of string [Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20product~neq%20%3E%20(schema)>)

severity: optional array of SeverityQueryParam

One of the following: "low" Link to this property "moderate" Link to this property "critical" Link to this property

[Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20severity%20%3E%20(schema)>)

"severity\~neq": optional array of SeverityQueryParam

One of the following: "low" Link to this property "moderate" Link to this property "critical" Link to this property

[Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20severity~neq%20%3E%20(schema)>)

source: optional array of "cloudflare"or "riskrecon"

One of the following: "cloudflare" Link to this property "riskrecon" Link to this property

[Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20source%20%3E%20(schema)>) subject: optional array of string [Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20subject%20%3E%20(schema)>) "subject\~neq": optional array of string [Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20subject~neq%20%3E%20(schema)>) ##### ReturnsExpand Collapse

errors: array of object {code, message, documentation\_url, source }

code: number minimum1000 Link to this property message: string Link to this property documentation\_url: optional string Link to this property

source: optional object {pointer }

pointer: optional string Link to this property

Link to this property

[Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(network%20schema)%20%3E%20(property)%20errors>)

messages: array of object {code, message, documentation\_url, source }

code: number minimum1000 Link to this property message: string Link to this property documentation\_url: optional string Link to this property

source: optional object {pointer }

pointer: optional string Link to this property

Link to this property

[Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(network%20schema)%20%3E%20(property)%20messages>) success: true Whether the API call was successful. [Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(network%20schema)%20%3E%20(property)%20success>)

result: optional object {count, issues, page, per\_page }

count: optional number Indicates the total number of results. Link to this property

issues: optional array of object {id, dismissed, has\_extended\_context, 11 more }

id: optional string Link to this property dismissed: optional boolean Link to this property has\_extended\_context: optional boolean Indicates whether the insight has a large payload that requires fetching via the context endpoint. Link to this property issue\_class: optional string Link to this property

issue\_type: optional IssueType

Link to this property

payload: optional object {detection\_method, zone\_tag }

detection\_method: optional string Describes the method used to detect insight. Link to this property zone\_tag: optional string Link to this property

Link to this property resolve\_link: optional string Link to this property resolve\_text: optional string Link to this property

severity: optional "Low"or "Moderate"or "Critical"

One of the following: "Low" Link to this property "Moderate" Link to this property "Critical" Link to this property

Link to this property since: optional string formatdate-time Link to this property

status: optional "active"or "resolved" The current status of the insight.

One of the following: "active" Link to this property "resolved" Link to this property

Link to this property subject: optional string Link to this property timestamp: optional string formatdate-time Link to this property

user\_classification: optional "false\_positive"or "accept\_risk"or "other" User-defined classification for the insight. Can be ‘false\_positive’, ‘accept\_risk’, ‘other’, or null.

One of the following: "false\_positive" Link to this property "accept\_risk" Link to this property "other" Link to this property

Link to this property

Link to this property page: optional number Specifies the current page within paginated list of results. Link to this property per\_page: optional number Sets the number of results per page of results. maximum1000 minimum1 Link to this property

[Link to this property](<#(resource)%20security_center.insights%20%3E%20(method)%20list%20%3E%20(network%20schema)%20%3E%20(property)%20result>) ### Retrieves Security Center Insights HTTP HTTPTypeScriptPythonGoTerraform ``` curl https://api.cloudflare.com/client/v4/$ACCOUNTS_OR_ZONES/$ACCOUNT_OR_ZONE_ID/security-center/insights \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "count": 1, "issues": [ { "id": "id", "dismissed": false, "has_extended_context": false, "issue_class": "always_use_https_not_enabled", "issue_type": "compliance_violation", "payload": { "detection_method": "We detected security rules referencing multiple IP addresses directly in the rules.", "zone_tag": "zone_tag" }, "resolve_link": "resolve_link", "resolve_text": "resolve_text", "severity": "Low", "since": "2019-12-27T18:11:19.117Z", "status": "active", "subject": "example.com", "timestamp": "2019-12-27T18:11:19.117Z", "user_classification": "false_positive" } ], "page": 1, "per_page": 25 } } ``` ##### Returns Examples 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "count": 1, "issues": [ { "id": "id", "dismissed": false, "has_extended_context": false, "issue_class": "always_use_https_not_enabled", "issue_type": "compliance_violation", "payload": { "detection_method": "We detected security rules referencing multiple IP addresses directly in the rules.", "zone_tag": "zone_tag" }, "resolve_link": "resolve_link", "resolve_text": "resolve_text", "severity": "Low", "since": "2019-12-27T18:11:19.117Z", "status": "active", "subject": "example.com", "timestamp": "2019-12-27T18:11:19.117Z", "user_classification": "false_positive" } ], "page": 1, "per_page": 25 } } ```