--- title: Casb --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) [Zero Trust](https://developers.cloudflare.com/api/resources/zero_trust) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Casb #### CasbApplications ##### [List applications](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/applications/methods/list) GET/accounts/{account\_id}/one/applications ##### [Get application details](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/applications/methods/get) GET/accounts/{account\_id}/one/applications/{application\_id} ##### ModelsExpand Collapse

ApplicationListResponse object {id, auth\_methods, category, 7 more } Application item in list response.

id: "ANTHROPIC"or "AWS"or "BITBUCKET"or 12 more Vendor identifier (e.g. microsoft\_internal, google\_workspace). - ANTHROPIC - ANTHROPIC - AWS - AWS - BITBUCKET - BITBUCKET - BOX - BOX - CONFLUENCE - CONFLUENCE - DROPBOX - DROPBOX - GITHUB - GITHUB - GOOGLE_CLOUD_PLATFORM - GOOGLE\_CLOUD\_PLATFORM - GOOGLE_WORKSPACE - GOOGLE\_WORKSPACE - JIRA - JIRA - MICROSOFT_INTERNAL - MICROSOFT\_INTERNAL - OPENAI - OPENAI - SALESFORCE - SALESFORCE - SERVICENOW - SERVICENOW - SLACK - SLACK

One of the following: "ANTHROPIC" Link to this property "AWS" Link to this property "BITBUCKET" Link to this property "BOX" Link to this property "CONFLUENCE" Link to this property "DROPBOX" Link to this property "GITHUB" Link to this property "GOOGLE\_CLOUD\_PLATFORM" Link to this property "GOOGLE\_WORKSPACE" Link to this property "JIRA" Link to this property "MICROSOFT\_INTERNAL" Link to this property "OPENAI" Link to this property "SALESFORCE" Link to this property "SERVICENOW" Link to this property "SLACK" Link to this property

Link to this property

auth\_methods: array of object {id, display\_name } Available auth methods.

id: string Auth method identifier. Link to this property display\_name: string Human-readable auth method name. Link to this property

Link to this property category: string Vendor category (e.g. Productivity, AI). Link to this property description: string Brief description of the integration. Link to this property display\_name: string Human-readable vendor name. Link to this property dlp\_enabled: boolean Whether DLP scanning is supported. Link to this property logo: string Logo path. Link to this property

permissions: array of object {display\_name, scope, severity } All permissions with severity.

display\_name: string Human-readable permission name. Link to this property scope: string Vendor-native scope identifier. Link to this property

severity: "low"or "medium"or "high"or "critical" Permission sensitivity level. - low - low - medium - medium - high - high - critical - critical

One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "critical" Link to this property

Link to this property

Link to this property supported\_environments: array of string Environments this vendor supports (standard, fedramp). Link to this property

use\_cases: array of object {id, display\_name } Supported use cases.

id: string Use case identifier (e.g. casb, ces). Link to this property display\_name: string Human-readable use case name. Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.applications%20%3E%20(model)%20application_list_response%20%3E%20(schema)>)

ApplicationGetResponse object {id, auth\_methods, category, 6 more } The requested item.

id: "ANTHROPIC"or "AWS"or "BITBUCKET"or 12 more Vendor identifier. - ANTHROPIC - ANTHROPIC - AWS - AWS - BITBUCKET - BITBUCKET - BOX - BOX - CONFLUENCE - CONFLUENCE - DROPBOX - DROPBOX - GITHUB - GITHUB - GOOGLE_CLOUD_PLATFORM - GOOGLE\_CLOUD\_PLATFORM - GOOGLE_WORKSPACE - GOOGLE\_WORKSPACE - JIRA - JIRA - MICROSOFT_INTERNAL - MICROSOFT\_INTERNAL - OPENAI - OPENAI - SALESFORCE - SALESFORCE - SERVICENOW - SERVICENOW - SLACK - SLACK

One of the following: "ANTHROPIC" Link to this property "AWS" Link to this property "BITBUCKET" Link to this property "BOX" Link to this property "CONFLUENCE" Link to this property "DROPBOX" Link to this property "GITHUB" Link to this property "GOOGLE\_CLOUD\_PLATFORM" Link to this property "GOOGLE\_WORKSPACE" Link to this property "JIRA" Link to this property "MICROSOFT\_INTERNAL" Link to this property "OPENAI" Link to this property "SALESFORCE" Link to this property "SERVICENOW" Link to this property "SLACK" Link to this property

Link to this property

auth\_methods: array of object {id, display\_name, is\_default, supported\_environments } Available authentication methods.

id: string Auth method identifier. Link to this property display\_name: string Human-readable auth method name. Link to this property is\_default: boolean Whether this is the default auth method. Link to this property supported\_environments: array of string Environments this auth method supports. Link to this property

Link to this property category: string Vendor category. Link to this property description: string Brief description. Link to this property display\_name: string Human-readable vendor name. Link to this property dlp\_enabled: boolean Whether DLP scanning is supported. Link to this property instructions: string Setup instructions for the user. Link to this property logo: string Logo path. Link to this property

use\_cases: array of object {id, base\_scopes, description, 2 more } Use cases with full scope details.

id: string Use case identifier. Link to this property

base\_scopes: array of object {display\_name, scope, severity } Scopes always required for this use case.

display\_name: string Human-readable permission name. Link to this property scope: string Vendor-native scope identifier. Link to this property

severity: "low"or "medium"or "high"or "critical" Permission sensitivity level. - low - low - medium - medium - high - high - critical - critical

One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "critical" Link to this property

Link to this property

Link to this property description: string Use case description. Link to this property display\_name: string Human-readable use case name. Link to this property

features: array of object {id, description, display\_name, scopes } Optional features with extra scopes.

id: string Feature identifier. Link to this property description: string Feature description. Link to this property display\_name: string Human-readable feature name. Link to this property

scopes: array of object {display\_name, scope, severity } Additional scopes when feature is enabled.

display\_name: string Human-readable permission name. Link to this property scope: string Vendor-native scope identifier. Link to this property

severity: "low"or "medium"or "high"or "critical" Permission sensitivity level. - low - low - medium - medium - high - high - critical - critical

One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property "critical" Link to this property

Link to this property

Link to this property

Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.applications%20%3E%20(model)%20application_get_response%20%3E%20(schema)>) #### CasbApplicationsAuth Methods ##### [Get auth methods](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/applications/subresources/auth_methods/methods/list) GET/accounts/{account\_id}/one/applications/{application\_id}/auth-methods ##### ModelsExpand Collapse

AuthMethodListResponse object {id, display\_name, human\_interaction\_required, 4 more } Detailed auth method info including credentials schema and instructions.

id: string Auth method identifier. Link to this property display\_name: string Human-readable auth method name. Link to this property human\_interaction\_required: boolean Whether setup requires human interaction or integration can be created purely using API (e.g., For OAuth can not be created without user interaction). Link to this property

instructions: object {markdown } Step-by-step instructions for obtaining credentials.

markdown: string Detailed instructions in markdown format. Link to this property

Link to this property payload\_example: map\[unknown] Example credentials payload with placeholder values. Link to this property payload\_schema: map\[unknown] JSON Schema for the credentials object in POST /v2/integrations request. Link to this property redirect\_url: string OAuth redirect URL for vendors requiring human interaction. Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.applications.auth_methods%20%3E%20(model)%20auth_method_list_response%20%3E%20(schema)>) #### CasbIntegrations ##### [List integrations](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/integrations/methods/list) GET/accounts/{account\_id}/one/integrations ##### [Get integration details](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/integrations/methods/get) GET/accounts/{account\_id}/one/integrations/{id} ##### [Create integration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/integrations/methods/create) POST/accounts/{account\_id}/one/integrations ##### [Update integration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/integrations/methods/update) PATCH/accounts/{account\_id}/one/integrations/{id} ##### [Delete integration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/integrations/methods/delete) DELETE/accounts/{account\_id}/one/integrations/{id} ##### [Pause integration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/integrations/methods/pause) POST/accounts/{account\_id}/one/integrations/{id}/pause ##### [Resume integration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/integrations/methods/resume) POST/accounts/{account\_id}/one/integrations/{id}/resume ##### ModelsExpand Collapse

IntegrationListResponse object {id, application, created, 4 more } Serializer for v2 integration list responses.

id: string Integration ID. formatuuid Link to this property application: map\[string] Link to this property created: string When the integration was created. formatdate-time Link to this property is\_paused: boolean Whether the user paused the integration. Link to this property name: string Name of the integration. Link to this property status: string Integration status. Link to this property updated: string When the integration was last updated. formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.integrations%20%3E%20(model)%20integration_list_response%20%3E%20(schema)>)

IntegrationGetResponse object {id, application, auth\_method, 11 more } The requested item.

id: string Integration ID. formatuuid Link to this property application: map\[string] Link to this property auth\_method: map\[string] The integration’s authentication method. Link to this property

authorization\_link: object {components, link } Authorization link for the integration.

components: map\[unknown] Link to this property link: string Link to this property

Link to this property created: string When the integration was created. formatdate-time Link to this property credentials\_expiry: string Credentials expiry time. formatdate-time Link to this property dlp\_profiles: array of string DLP Profiles enabled for the integration. Link to this property health\_details: array of map\[unknown] Health details with remediation hints. Link to this property is\_paused: boolean Whether the user paused the integration. Link to this property last\_hydrated: string Last time the integration was hydrated. formatdate-time Link to this property name: string Name of the integration. Link to this property status: string Integration status. Link to this property updated: string When the integration was last updated. formatdate-time Link to this property use\_cases: array of map\[unknown] Use cases enabled for the integration. Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.integrations%20%3E%20(model)%20integration_get_response%20%3E%20(schema)>)

IntegrationCreateResponse object {id, application, auth\_method, 11 more } The requested item.

id: string Integration ID. formatuuid Link to this property application: map\[string] Link to this property auth\_method: map\[string] The integration’s authentication method. Link to this property

authorization\_link: object {components, link } Authorization link for the integration.

components: map\[unknown] Link to this property link: string Link to this property

Link to this property created: string When the integration was created. formatdate-time Link to this property credentials\_expiry: string Credentials expiry time. formatdate-time Link to this property dlp\_profiles: array of string DLP Profiles enabled for the integration. Link to this property health\_details: array of map\[unknown] Health details with remediation hints. Link to this property is\_paused: boolean Whether the user paused the integration. Link to this property last\_hydrated: string Last time the integration was hydrated. formatdate-time Link to this property name: string Name of the integration. Link to this property status: string Integration status. Link to this property updated: string When the integration was last updated. formatdate-time Link to this property use\_cases: array of map\[unknown] Use cases enabled for the integration. Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.integrations%20%3E%20(model)%20integration_create_response%20%3E%20(schema)>)

IntegrationUpdateResponse object {id, application, auth\_method, 11 more } The requested item.

id: string Integration ID. formatuuid Link to this property application: map\[string] Link to this property auth\_method: map\[string] The integration’s authentication method. Link to this property

authorization\_link: object {components, link } Authorization link for the integration.

components: map\[unknown] Link to this property link: string Link to this property

Link to this property created: string When the integration was created. formatdate-time Link to this property credentials\_expiry: string Credentials expiry time. formatdate-time Link to this property dlp\_profiles: array of string DLP Profiles enabled for the integration. Link to this property health\_details: array of map\[unknown] Health details with remediation hints. Link to this property is\_paused: boolean Whether the user paused the integration. Link to this property last\_hydrated: string Last time the integration was hydrated. formatdate-time Link to this property name: string Name of the integration. Link to this property status: string Integration status. Link to this property updated: string When the integration was last updated. formatdate-time Link to this property use\_cases: array of map\[unknown] Use cases enabled for the integration. Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.integrations%20%3E%20(model)%20integration_update_response%20%3E%20(schema)>)

IntegrationPauseResponse object {id, application, auth\_method, 11 more } The requested item.

id: string Integration ID. formatuuid Link to this property application: map\[string] Link to this property auth\_method: map\[string] The integration’s authentication method. Link to this property

authorization\_link: object {components, link } Authorization link for the integration.

components: map\[unknown] Link to this property link: string Link to this property

Link to this property created: string When the integration was created. formatdate-time Link to this property credentials\_expiry: string Credentials expiry time. formatdate-time Link to this property dlp\_profiles: array of string DLP Profiles enabled for the integration. Link to this property health\_details: array of map\[unknown] Health details with remediation hints. Link to this property is\_paused: boolean Whether the user paused the integration. Link to this property last\_hydrated: string Last time the integration was hydrated. formatdate-time Link to this property name: string Name of the integration. Link to this property status: string Integration status. Link to this property updated: string When the integration was last updated. formatdate-time Link to this property use\_cases: array of map\[unknown] Use cases enabled for the integration. Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.integrations%20%3E%20(model)%20integration_pause_response%20%3E%20(schema)>)

IntegrationResumeResponse object {id, application, auth\_method, 11 more } The requested item.

id: string Integration ID. formatuuid Link to this property application: map\[string] Link to this property auth\_method: map\[string] The integration’s authentication method. Link to this property

authorization\_link: object {components, link } Authorization link for the integration.

components: map\[unknown] Link to this property link: string Link to this property

Link to this property created: string When the integration was created. formatdate-time Link to this property credentials\_expiry: string Credentials expiry time. formatdate-time Link to this property dlp\_profiles: array of string DLP Profiles enabled for the integration. Link to this property health\_details: array of map\[unknown] Health details with remediation hints. Link to this property is\_paused: boolean Whether the user paused the integration. Link to this property last\_hydrated: string Last time the integration was hydrated. formatdate-time Link to this property name: string Name of the integration. Link to this property status: string Integration status. Link to this property updated: string When the integration was last updated. formatdate-time Link to this property use\_cases: array of map\[unknown] Use cases enabled for the integration. Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.integrations%20%3E%20(model)%20integration_resume_response%20%3E%20(schema)>) #### CasbPosture #### CasbPostureFindings ##### [List posture findings](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/findings/methods/list) GET/accounts/{account\_id}/data-security/posture/findings ##### [Get a posture finding](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/findings/methods/get) GET/accounts/{account\_id}/data-security/posture/findings/{finding\_id} ##### [Create new findings export request](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/findings/methods/export) POST/accounts/{account\_id}/data-security/posture/findings/export ##### [Mark a finding as ignored](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/findings/methods/ignore) POST/accounts/{account\_id}/data-security/posture/findings/ignore ##### [Remove ignore marker from a finding](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/findings/methods/unignore) POST/accounts/{account\_id}/data-security/posture/findings/unignore ##### [Update the severity for a finding](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/findings/methods/tune_severity) POST/accounts/{account\_id}/data-security/posture/findings/{finding\_id}/tune\_finding\_severity ##### [Reset severity for a finding back to the default](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/findings/methods/reset_severity) POST/accounts/{account\_id}/data-security/posture/findings/{finding\_id}/reset\_finding\_severity ##### ModelsExpand Collapse

FindingListResponse object {id, active\_count, archived\_count, 6 more } Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics.

id: string Base64 encoded identifier of the security finding. formatbyte Link to this property active\_count: number Number of active problematic instances identified in the security finding. Link to this property archived\_count: number Number of archived instances identified in the security finding. Link to this property

finding: object {id, category, name, 4 more } Basic finding type information.

id: string The unique identifier of the finding. formatuuid Link to this property

category: object {observation, product, type }

observation: "Issue"or "Insight"or "Activity" The type of the observation.

One of the following: "Issue" Link to this property "Insight" Link to this property "Activity" Link to this property

Link to this property

product: "SaaS"or "Cloud" The product category.

One of the following: "SaaS" Link to this property "Cloud" Link to this property

Link to this property

type: "Content"or "Posture" The type of the finding category.

One of the following: "Content" Link to this property "Posture" Link to this property

Link to this property

Link to this property name: string The name of the finding. Link to this property

severity: "Critical"or "High"or "Medium"or "Low" Default severity used when no integration-specific severity override exists.

One of the following: "Critical" Link to this property "High" Link to this property "Medium" Link to this property "Low" Link to this property

Link to this property vendor: string The SaaS/Cloud vendor of the platform with which the finding is associated. Link to this property description: optional string Detailed description of the finding. Link to this property

remediation: optional object {id, frameworks, guide, 3 more } Remediation guide information for a finding.

id: string Remediation Id. formatuuid Link to this property frameworks: array of string Relevant Compliance Frameworks. Link to this property guide: string Remediation guide text. Link to this property impact: string Description of the potential impact. Link to this property locale: string I18N Locale. Link to this property threat: string Description of the threat. Link to this property

Link to this property

Link to this property ignored: boolean Determines if finding is currently ignored. Link to this property instance\_count: number Number of total (Active or archived) problematic instances identified in the security finding. Link to this property

integration: object {created, last\_hydrated, name, 12 more } Summary information about an integration.

created: string When entity was created. formatdate-time Link to this property last\_hydrated: string When were the integration credentials last updated. formatdate-time Link to this property name: string Name of the integration. maxLength256 Link to this property permissions: array of string The vendor-specific permissions associated with the integration. Link to this property

policy: object {id, client\_id, compliance\_level, 4 more } Policy configuration for an integration.

id: optional string Policy identifier. formatuuid Link to this property client\_id: optional string OAuth client ID for the policy. Link to this property compliance\_level: optional string Compliance level for the policy. Link to this property dlp\_enabled: optional boolean Whether DLP is enabled for this policy. Link to this property link: optional string Link to policy documentation. formaturi Link to this property name: optional string Policy name. Link to this property permissions: optional array of string List of permissions included in the policy. Link to this property

Link to this property status: string Current status of the integration. Link to this property updated: string Last entity was updated. formatdate-time Link to this property upgradable: boolean Whether the integrations permissions can be updated. Link to this property

vendor: object {id, description, display\_name, 5 more } Information about a vendor/service provider.

id: string The id of the vendor. Link to this property description: string Detailed information about what kinds of issues are detected for this vendor. Link to this property display\_name: string The display name of the vendor. Link to this property logo: string Logo URL for the vendor. formaturi Link to this property name: string The name of the vendor. Link to this property static\_logo: string Static logo URL for the vendor. formaturi Link to this property zt\_enrollments: array of string The vendor’s compatible Zero Trust products. Link to this property policies: optional array of map\[unknown] The policies related to the vendor. Link to this property

Link to this property

zt\_enrollments: array of object {id, description, display\_name, enabled } Zero Trust products associated with this integration.

id: optional string The internal identifier of the Zero Trust Product. Link to this property description: optional string Brief description of the Zero Trust Product. Link to this property display\_name: optional string The verbose name of the Zero Trust Product. Link to this property enabled: optional boolean Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. Link to this property

Link to this property id: optional string Integration ID. formatuuid Link to this property

credential\_health\_status: optional "Initializing"or "Healthy"or "Unhealthy" Health status of integration credentials.

One of the following: "Initializing" Link to this property "Healthy" Link to this property "Unhealthy" Link to this property

Link to this property credentials\_expiry: optional string The date and time when the integration credentials will expire. formatdate-time Link to this property is\_paused: optional boolean Whether the given integration is paused by the user. Link to this property upgrade\_dismissed: optional boolean UI State as to whether a potential permissions upgrade has been dismissed. Link to this property

Link to this property latest\_affliction\_date: string Timestamp of the latest affliction date of an active finding. formatdate-time Link to this property

severity\_override: optional object {created\_by, severity } Override information for finding severity.

created\_by: string User ID who created the override. Link to this property

severity: "Critical"or "High"or "Medium"or "Low" The severity level of a finding.

One of the following: "Critical" Link to this property "High" Link to this property "Medium" Link to this property "Low" Link to this property

Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.findings%20%3E%20(model)%20finding_list_response%20%3E%20(schema)>)

FindingGetResponse object {id, active\_count, archived\_count, 6 more } Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics.

id: string Base64 encoded identifier of the security finding. formatbyte Link to this property active\_count: number Number of active problematic instances identified in the security finding. Link to this property archived\_count: number Number of archived instances identified in the security finding. Link to this property

finding: object {id, category, name, 4 more } Basic finding type information.

id: string The unique identifier of the finding. formatuuid Link to this property

category: object {observation, product, type }

observation: "Issue"or "Insight"or "Activity" The type of the observation.

One of the following: "Issue" Link to this property "Insight" Link to this property "Activity" Link to this property

Link to this property

product: "SaaS"or "Cloud" The product category.

One of the following: "SaaS" Link to this property "Cloud" Link to this property

Link to this property

type: "Content"or "Posture" The type of the finding category.

One of the following: "Content" Link to this property "Posture" Link to this property

Link to this property

Link to this property name: string The name of the finding. Link to this property

severity: "Critical"or "High"or "Medium"or "Low" Default severity used when no integration-specific severity override exists.

One of the following: "Critical" Link to this property "High" Link to this property "Medium" Link to this property "Low" Link to this property

Link to this property vendor: string The SaaS/Cloud vendor of the platform with which the finding is associated. Link to this property description: optional string Detailed description of the finding. Link to this property

remediation: optional object {id, frameworks, guide, 3 more } Remediation guide information for a finding.

id: string Remediation Id. formatuuid Link to this property frameworks: array of string Relevant Compliance Frameworks. Link to this property guide: string Remediation guide text. Link to this property impact: string Description of the potential impact. Link to this property locale: string I18N Locale. Link to this property threat: string Description of the threat. Link to this property

Link to this property

Link to this property ignored: boolean Determines if finding is currently ignored. Link to this property instance\_count: number Number of total (Active or archived) problematic instances identified in the security finding. Link to this property

integration: object {created, last\_hydrated, name, 12 more } Summary information about an integration.

created: string When entity was created. formatdate-time Link to this property last\_hydrated: string When were the integration credentials last updated. formatdate-time Link to this property name: string Name of the integration. maxLength256 Link to this property permissions: array of string The vendor-specific permissions associated with the integration. Link to this property

policy: object {id, client\_id, compliance\_level, 4 more } Policy configuration for an integration.

id: optional string Policy identifier. formatuuid Link to this property client\_id: optional string OAuth client ID for the policy. Link to this property compliance\_level: optional string Compliance level for the policy. Link to this property dlp\_enabled: optional boolean Whether DLP is enabled for this policy. Link to this property link: optional string Link to policy documentation. formaturi Link to this property name: optional string Policy name. Link to this property permissions: optional array of string List of permissions included in the policy. Link to this property

Link to this property status: string Current status of the integration. Link to this property updated: string Last entity was updated. formatdate-time Link to this property upgradable: boolean Whether the integrations permissions can be updated. Link to this property

vendor: object {id, description, display\_name, 5 more } Information about a vendor/service provider.

id: string The id of the vendor. Link to this property description: string Detailed information about what kinds of issues are detected for this vendor. Link to this property display\_name: string The display name of the vendor. Link to this property logo: string Logo URL for the vendor. formaturi Link to this property name: string The name of the vendor. Link to this property static\_logo: string Static logo URL for the vendor. formaturi Link to this property zt\_enrollments: array of string The vendor’s compatible Zero Trust products. Link to this property policies: optional array of map\[unknown] The policies related to the vendor. Link to this property

Link to this property

zt\_enrollments: array of object {id, description, display\_name, enabled } Zero Trust products associated with this integration.

id: optional string The internal identifier of the Zero Trust Product. Link to this property description: optional string Brief description of the Zero Trust Product. Link to this property display\_name: optional string The verbose name of the Zero Trust Product. Link to this property enabled: optional boolean Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. Link to this property

Link to this property id: optional string Integration ID. formatuuid Link to this property

credential\_health\_status: optional "Initializing"or "Healthy"or "Unhealthy" Health status of integration credentials.

One of the following: "Initializing" Link to this property "Healthy" Link to this property "Unhealthy" Link to this property

Link to this property credentials\_expiry: optional string The date and time when the integration credentials will expire. formatdate-time Link to this property is\_paused: optional boolean Whether the given integration is paused by the user. Link to this property upgrade\_dismissed: optional boolean UI State as to whether a potential permissions upgrade has been dismissed. Link to this property

Link to this property latest\_affliction\_date: string Timestamp of the latest affliction date of an active finding. formatdate-time Link to this property

severity\_override: optional object {created\_by, severity } Override information for finding severity.

created\_by: string User ID who created the override. Link to this property

severity: "Critical"or "High"or "Medium"or "Low" The severity level of a finding.

One of the following: "Critical" Link to this property "High" Link to this property "Medium" Link to this property "Low" Link to this property

Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.findings%20%3E%20(model)%20finding_get_response%20%3E%20(schema)>)

FindingExportResponse object {id, status, type, 5 more } Information about an export job.

id: string Unique identifier for the export job. formatuuid Link to this property

status: "Pending"or "Success"or "Failure"or 2 more Status of an export job.

One of the following: "Pending" Link to this property "Success" Link to this property "Failure" Link to this property "Rescheduled" Link to this property "In-Progress" Link to this property

Link to this property

type: "finding"or "findingInstance"or "content"or "remediationJob" Type of export job.

One of the following: "finding" Link to this property "findingInstance" Link to this property "content" Link to this property "remediationJob" Link to this property

Link to this property user\_id: string ID of the export-requesting user. maxLength128 Link to this property download\_url: optional string The URL by which the successfully created export can be downloaded by the end users. formaturi maxLength1024 Link to this property errors: optional string Contains information on errors which may have occurred during export creation. Link to this property file\_name: optional string The base name of the file that is/was generated by the export job. maxLength256 Link to this property file\_path: optional string The full path of the file that is stored within external storage (currently R2). maxLength512 Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.findings%20%3E%20(model)%20finding_export_response%20%3E%20(schema)>)

FindingIgnoreResponse object {id, active\_count, archived\_count, 6 more } Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics.

id: string Base64 encoded identifier of the security finding. formatbyte Link to this property active\_count: number Number of active problematic instances identified in the security finding. Link to this property archived\_count: number Number of archived instances identified in the security finding. Link to this property

finding: object {id, category, name, 4 more } Basic finding type information.

id: string The unique identifier of the finding. formatuuid Link to this property

category: object {observation, product, type }

observation: "Issue"or "Insight"or "Activity" The type of the observation.

One of the following: "Issue" Link to this property "Insight" Link to this property "Activity" Link to this property

Link to this property

product: "SaaS"or "Cloud" The product category.

One of the following: "SaaS" Link to this property "Cloud" Link to this property

Link to this property

type: "Content"or "Posture" The type of the finding category.

One of the following: "Content" Link to this property "Posture" Link to this property

Link to this property

Link to this property name: string The name of the finding. Link to this property

severity: "Critical"or "High"or "Medium"or "Low" Default severity used when no integration-specific severity override exists.

One of the following: "Critical" Link to this property "High" Link to this property "Medium" Link to this property "Low" Link to this property

Link to this property vendor: string The SaaS/Cloud vendor of the platform with which the finding is associated. Link to this property description: optional string Detailed description of the finding. Link to this property

remediation: optional object {id, frameworks, guide, 3 more } Remediation guide information for a finding.

id: string Remediation Id. formatuuid Link to this property frameworks: array of string Relevant Compliance Frameworks. Link to this property guide: string Remediation guide text. Link to this property impact: string Description of the potential impact. Link to this property locale: string I18N Locale. Link to this property threat: string Description of the threat. Link to this property

Link to this property

Link to this property ignored: boolean Determines if finding is currently ignored. Link to this property instance\_count: number Number of total (Active or archived) problematic instances identified in the security finding. Link to this property

integration: object {created, last\_hydrated, name, 12 more } Summary information about an integration.

created: string When entity was created. formatdate-time Link to this property last\_hydrated: string When were the integration credentials last updated. formatdate-time Link to this property name: string Name of the integration. maxLength256 Link to this property permissions: array of string The vendor-specific permissions associated with the integration. Link to this property

policy: object {id, client\_id, compliance\_level, 4 more } Policy configuration for an integration.

id: optional string Policy identifier. formatuuid Link to this property client\_id: optional string OAuth client ID for the policy. Link to this property compliance\_level: optional string Compliance level for the policy. Link to this property dlp\_enabled: optional boolean Whether DLP is enabled for this policy. Link to this property link: optional string Link to policy documentation. formaturi Link to this property name: optional string Policy name. Link to this property permissions: optional array of string List of permissions included in the policy. Link to this property

Link to this property status: string Current status of the integration. Link to this property updated: string Last entity was updated. formatdate-time Link to this property upgradable: boolean Whether the integrations permissions can be updated. Link to this property

vendor: object {id, description, display\_name, 5 more } Information about a vendor/service provider.

id: string The id of the vendor. Link to this property description: string Detailed information about what kinds of issues are detected for this vendor. Link to this property display\_name: string The display name of the vendor. Link to this property logo: string Logo URL for the vendor. formaturi Link to this property name: string The name of the vendor. Link to this property static\_logo: string Static logo URL for the vendor. formaturi Link to this property zt\_enrollments: array of string The vendor’s compatible Zero Trust products. Link to this property policies: optional array of map\[unknown] The policies related to the vendor. Link to this property

Link to this property

zt\_enrollments: array of object {id, description, display\_name, enabled } Zero Trust products associated with this integration.

id: optional string The internal identifier of the Zero Trust Product. Link to this property description: optional string Brief description of the Zero Trust Product. Link to this property display\_name: optional string The verbose name of the Zero Trust Product. Link to this property enabled: optional boolean Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. Link to this property

Link to this property id: optional string Integration ID. formatuuid Link to this property

credential\_health\_status: optional "Initializing"or "Healthy"or "Unhealthy" Health status of integration credentials.

One of the following: "Initializing" Link to this property "Healthy" Link to this property "Unhealthy" Link to this property

Link to this property credentials\_expiry: optional string The date and time when the integration credentials will expire. formatdate-time Link to this property is\_paused: optional boolean Whether the given integration is paused by the user. Link to this property upgrade\_dismissed: optional boolean UI State as to whether a potential permissions upgrade has been dismissed. Link to this property

Link to this property latest\_affliction\_date: string Timestamp of the latest affliction date of an active finding. formatdate-time Link to this property

severity\_override: optional object {created\_by, severity } Override information for finding severity.

created\_by: string User ID who created the override. Link to this property

severity: "Critical"or "High"or "Medium"or "Low" The severity level of a finding.

One of the following: "Critical" Link to this property "High" Link to this property "Medium" Link to this property "Low" Link to this property

Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.findings%20%3E%20(model)%20finding_ignore_response%20%3E%20(schema)>)

FindingUnignoreResponse object {id, active\_count, archived\_count, 6 more } Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics.

id: string Base64 encoded identifier of the security finding. formatbyte Link to this property active\_count: number Number of active problematic instances identified in the security finding. Link to this property archived\_count: number Number of archived instances identified in the security finding. Link to this property

finding: object {id, category, name, 4 more } Basic finding type information.

id: string The unique identifier of the finding. formatuuid Link to this property

category: object {observation, product, type }

observation: "Issue"or "Insight"or "Activity" The type of the observation.

One of the following: "Issue" Link to this property "Insight" Link to this property "Activity" Link to this property

Link to this property

product: "SaaS"or "Cloud" The product category.

One of the following: "SaaS" Link to this property "Cloud" Link to this property

Link to this property

type: "Content"or "Posture" The type of the finding category.

One of the following: "Content" Link to this property "Posture" Link to this property

Link to this property

Link to this property name: string The name of the finding. Link to this property

severity: "Critical"or "High"or "Medium"or "Low" Default severity used when no integration-specific severity override exists.

One of the following: "Critical" Link to this property "High" Link to this property "Medium" Link to this property "Low" Link to this property

Link to this property vendor: string The SaaS/Cloud vendor of the platform with which the finding is associated. Link to this property description: optional string Detailed description of the finding. Link to this property

remediation: optional object {id, frameworks, guide, 3 more } Remediation guide information for a finding.

id: string Remediation Id. formatuuid Link to this property frameworks: array of string Relevant Compliance Frameworks. Link to this property guide: string Remediation guide text. Link to this property impact: string Description of the potential impact. Link to this property locale: string I18N Locale. Link to this property threat: string Description of the threat. Link to this property

Link to this property

Link to this property ignored: boolean Determines if finding is currently ignored. Link to this property instance\_count: number Number of total (Active or archived) problematic instances identified in the security finding. Link to this property

integration: object {created, last\_hydrated, name, 12 more } Summary information about an integration.

created: string When entity was created. formatdate-time Link to this property last\_hydrated: string When were the integration credentials last updated. formatdate-time Link to this property name: string Name of the integration. maxLength256 Link to this property permissions: array of string The vendor-specific permissions associated with the integration. Link to this property

policy: object {id, client\_id, compliance\_level, 4 more } Policy configuration for an integration.

id: optional string Policy identifier. formatuuid Link to this property client\_id: optional string OAuth client ID for the policy. Link to this property compliance\_level: optional string Compliance level for the policy. Link to this property dlp\_enabled: optional boolean Whether DLP is enabled for this policy. Link to this property link: optional string Link to policy documentation. formaturi Link to this property name: optional string Policy name. Link to this property permissions: optional array of string List of permissions included in the policy. Link to this property

Link to this property status: string Current status of the integration. Link to this property updated: string Last entity was updated. formatdate-time Link to this property upgradable: boolean Whether the integrations permissions can be updated. Link to this property

vendor: object {id, description, display\_name, 5 more } Information about a vendor/service provider.

id: string The id of the vendor. Link to this property description: string Detailed information about what kinds of issues are detected for this vendor. Link to this property display\_name: string The display name of the vendor. Link to this property logo: string Logo URL for the vendor. formaturi Link to this property name: string The name of the vendor. Link to this property static\_logo: string Static logo URL for the vendor. formaturi Link to this property zt\_enrollments: array of string The vendor’s compatible Zero Trust products. Link to this property policies: optional array of map\[unknown] The policies related to the vendor. Link to this property

Link to this property

zt\_enrollments: array of object {id, description, display\_name, enabled } Zero Trust products associated with this integration.

id: optional string The internal identifier of the Zero Trust Product. Link to this property description: optional string Brief description of the Zero Trust Product. Link to this property display\_name: optional string The verbose name of the Zero Trust Product. Link to this property enabled: optional boolean Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. Link to this property

Link to this property id: optional string Integration ID. formatuuid Link to this property

credential\_health\_status: optional "Initializing"or "Healthy"or "Unhealthy" Health status of integration credentials.

One of the following: "Initializing" Link to this property "Healthy" Link to this property "Unhealthy" Link to this property

Link to this property credentials\_expiry: optional string The date and time when the integration credentials will expire. formatdate-time Link to this property is\_paused: optional boolean Whether the given integration is paused by the user. Link to this property upgrade\_dismissed: optional boolean UI State as to whether a potential permissions upgrade has been dismissed. Link to this property

Link to this property latest\_affliction\_date: string Timestamp of the latest affliction date of an active finding. formatdate-time Link to this property

severity\_override: optional object {created\_by, severity } Override information for finding severity.

created\_by: string User ID who created the override. Link to this property

severity: "Critical"or "High"or "Medium"or "Low" The severity level of a finding.

One of the following: "Critical" Link to this property "High" Link to this property "Medium" Link to this property "Low" Link to this property

Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.findings%20%3E%20(model)%20finding_unignore_response%20%3E%20(schema)>)

FindingTuneSeverityResponse object {id, active\_count, archived\_count, 6 more } Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics.

id: string Base64 encoded identifier of the security finding. formatbyte Link to this property active\_count: number Number of active problematic instances identified in the security finding. Link to this property archived\_count: number Number of archived instances identified in the security finding. Link to this property

finding: object {id, category, name, 4 more } Basic finding type information.

id: string The unique identifier of the finding. formatuuid Link to this property

category: object {observation, product, type }

observation: "Issue"or "Insight"or "Activity" The type of the observation.

One of the following: "Issue" Link to this property "Insight" Link to this property "Activity" Link to this property

Link to this property

product: "SaaS"or "Cloud" The product category.

One of the following: "SaaS" Link to this property "Cloud" Link to this property

Link to this property

type: "Content"or "Posture" The type of the finding category.

One of the following: "Content" Link to this property "Posture" Link to this property

Link to this property

Link to this property name: string The name of the finding. Link to this property

severity: "Critical"or "High"or "Medium"or "Low" Default severity used when no integration-specific severity override exists.

One of the following: "Critical" Link to this property "High" Link to this property "Medium" Link to this property "Low" Link to this property

Link to this property vendor: string The SaaS/Cloud vendor of the platform with which the finding is associated. Link to this property description: optional string Detailed description of the finding. Link to this property

remediation: optional object {id, frameworks, guide, 3 more } Remediation guide information for a finding.

id: string Remediation Id. formatuuid Link to this property frameworks: array of string Relevant Compliance Frameworks. Link to this property guide: string Remediation guide text. Link to this property impact: string Description of the potential impact. Link to this property locale: string I18N Locale. Link to this property threat: string Description of the threat. Link to this property

Link to this property

Link to this property ignored: boolean Determines if finding is currently ignored. Link to this property instance\_count: number Number of total (Active or archived) problematic instances identified in the security finding. Link to this property

integration: object {created, last\_hydrated, name, 12 more } Summary information about an integration.

created: string When entity was created. formatdate-time Link to this property last\_hydrated: string When were the integration credentials last updated. formatdate-time Link to this property name: string Name of the integration. maxLength256 Link to this property permissions: array of string The vendor-specific permissions associated with the integration. Link to this property

policy: object {id, client\_id, compliance\_level, 4 more } Policy configuration for an integration.

id: optional string Policy identifier. formatuuid Link to this property client\_id: optional string OAuth client ID for the policy. Link to this property compliance\_level: optional string Compliance level for the policy. Link to this property dlp\_enabled: optional boolean Whether DLP is enabled for this policy. Link to this property link: optional string Link to policy documentation. formaturi Link to this property name: optional string Policy name. Link to this property permissions: optional array of string List of permissions included in the policy. Link to this property

Link to this property status: string Current status of the integration. Link to this property updated: string Last entity was updated. formatdate-time Link to this property upgradable: boolean Whether the integrations permissions can be updated. Link to this property

vendor: object {id, description, display\_name, 5 more } Information about a vendor/service provider.

id: string The id of the vendor. Link to this property description: string Detailed information about what kinds of issues are detected for this vendor. Link to this property display\_name: string The display name of the vendor. Link to this property logo: string Logo URL for the vendor. formaturi Link to this property name: string The name of the vendor. Link to this property static\_logo: string Static logo URL for the vendor. formaturi Link to this property zt\_enrollments: array of string The vendor’s compatible Zero Trust products. Link to this property policies: optional array of map\[unknown] The policies related to the vendor. Link to this property

Link to this property

zt\_enrollments: array of object {id, description, display\_name, enabled } Zero Trust products associated with this integration.

id: optional string The internal identifier of the Zero Trust Product. Link to this property description: optional string Brief description of the Zero Trust Product. Link to this property display\_name: optional string The verbose name of the Zero Trust Product. Link to this property enabled: optional boolean Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. Link to this property

Link to this property id: optional string Integration ID. formatuuid Link to this property

credential\_health\_status: optional "Initializing"or "Healthy"or "Unhealthy" Health status of integration credentials.

One of the following: "Initializing" Link to this property "Healthy" Link to this property "Unhealthy" Link to this property

Link to this property credentials\_expiry: optional string The date and time when the integration credentials will expire. formatdate-time Link to this property is\_paused: optional boolean Whether the given integration is paused by the user. Link to this property upgrade\_dismissed: optional boolean UI State as to whether a potential permissions upgrade has been dismissed. Link to this property

Link to this property latest\_affliction\_date: string Timestamp of the latest affliction date of an active finding. formatdate-time Link to this property

severity\_override: optional object {created\_by, severity } Override information for finding severity.

created\_by: string User ID who created the override. Link to this property

severity: "Critical"or "High"or "Medium"or "Low" The severity level of a finding.

One of the following: "Critical" Link to this property "High" Link to this property "Medium" Link to this property "Low" Link to this property

Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.findings%20%3E%20(model)%20finding_tune_severity_response%20%3E%20(schema)>)

FindingResetSeverityResponse object {id, active\_count, archived\_count, 6 more } Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics.

id: string Base64 encoded identifier of the security finding. formatbyte Link to this property active\_count: number Number of active problematic instances identified in the security finding. Link to this property archived\_count: number Number of archived instances identified in the security finding. Link to this property

finding: object {id, category, name, 4 more } Basic finding type information.

id: string The unique identifier of the finding. formatuuid Link to this property

category: object {observation, product, type }

observation: "Issue"or "Insight"or "Activity" The type of the observation.

One of the following: "Issue" Link to this property "Insight" Link to this property "Activity" Link to this property

Link to this property

product: "SaaS"or "Cloud" The product category.

One of the following: "SaaS" Link to this property "Cloud" Link to this property

Link to this property

type: "Content"or "Posture" The type of the finding category.

One of the following: "Content" Link to this property "Posture" Link to this property

Link to this property

Link to this property name: string The name of the finding. Link to this property

severity: "Critical"or "High"or "Medium"or "Low" Default severity used when no integration-specific severity override exists.

One of the following: "Critical" Link to this property "High" Link to this property "Medium" Link to this property "Low" Link to this property

Link to this property vendor: string The SaaS/Cloud vendor of the platform with which the finding is associated. Link to this property description: optional string Detailed description of the finding. Link to this property

remediation: optional object {id, frameworks, guide, 3 more } Remediation guide information for a finding.

id: string Remediation Id. formatuuid Link to this property frameworks: array of string Relevant Compliance Frameworks. Link to this property guide: string Remediation guide text. Link to this property impact: string Description of the potential impact. Link to this property locale: string I18N Locale. Link to this property threat: string Description of the threat. Link to this property

Link to this property

Link to this property ignored: boolean Determines if finding is currently ignored. Link to this property instance\_count: number Number of total (Active or archived) problematic instances identified in the security finding. Link to this property

integration: object {created, last\_hydrated, name, 12 more } Summary information about an integration.

created: string When entity was created. formatdate-time Link to this property last\_hydrated: string When were the integration credentials last updated. formatdate-time Link to this property name: string Name of the integration. maxLength256 Link to this property permissions: array of string The vendor-specific permissions associated with the integration. Link to this property

policy: object {id, client\_id, compliance\_level, 4 more } Policy configuration for an integration.

id: optional string Policy identifier. formatuuid Link to this property client\_id: optional string OAuth client ID for the policy. Link to this property compliance\_level: optional string Compliance level for the policy. Link to this property dlp\_enabled: optional boolean Whether DLP is enabled for this policy. Link to this property link: optional string Link to policy documentation. formaturi Link to this property name: optional string Policy name. Link to this property permissions: optional array of string List of permissions included in the policy. Link to this property

Link to this property status: string Current status of the integration. Link to this property updated: string Last entity was updated. formatdate-time Link to this property upgradable: boolean Whether the integrations permissions can be updated. Link to this property

vendor: object {id, description, display\_name, 5 more } Information about a vendor/service provider.

id: string The id of the vendor. Link to this property description: string Detailed information about what kinds of issues are detected for this vendor. Link to this property display\_name: string The display name of the vendor. Link to this property logo: string Logo URL for the vendor. formaturi Link to this property name: string The name of the vendor. Link to this property static\_logo: string Static logo URL for the vendor. formaturi Link to this property zt\_enrollments: array of string The vendor’s compatible Zero Trust products. Link to this property policies: optional array of map\[unknown] The policies related to the vendor. Link to this property

Link to this property

zt\_enrollments: array of object {id, description, display\_name, enabled } Zero Trust products associated with this integration.

id: optional string The internal identifier of the Zero Trust Product. Link to this property description: optional string Brief description of the Zero Trust Product. Link to this property display\_name: optional string The verbose name of the Zero Trust Product. Link to this property enabled: optional boolean Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. Link to this property

Link to this property id: optional string Integration ID. formatuuid Link to this property

credential\_health\_status: optional "Initializing"or "Healthy"or "Unhealthy" Health status of integration credentials.

One of the following: "Initializing" Link to this property "Healthy" Link to this property "Unhealthy" Link to this property

Link to this property credentials\_expiry: optional string The date and time when the integration credentials will expire. formatdate-time Link to this property is\_paused: optional boolean Whether the given integration is paused by the user. Link to this property upgrade\_dismissed: optional boolean UI State as to whether a potential permissions upgrade has been dismissed. Link to this property

Link to this property latest\_affliction\_date: string Timestamp of the latest affliction date of an active finding. formatdate-time Link to this property

severity\_override: optional object {created\_by, severity } Override information for finding severity.

created\_by: string User ID who created the override. Link to this property

severity: "Critical"or "High"or "Medium"or "Low" The severity level of a finding.

One of the following: "Critical" Link to this property "High" Link to this property "Medium" Link to this property "Low" Link to this property

Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.findings%20%3E%20(model)%20finding_reset_severity_response%20%3E%20(schema)>) #### CasbPostureFindingsInstances ##### [List instances of a finding](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/findings/subresources/instances/methods/list) GET/accounts/{account\_id}/data-security/posture/findings/{finding\_id}/instances ##### [Get a finding instance using an instance ID](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/findings/subresources/instances/methods/get) GET/accounts/{account\_id}/data-security/posture/findings/{finding\_id}/instances/{instance\_id} ##### [Create a finding instances export](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/findings/subresources/instances/methods/export) POST/accounts/{account\_id}/data-security/posture/findings/{storage\_namespace\_id}/instances/export ##### [Archive a finding](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/findings/subresources/instances/methods/archive) POST/accounts/{account\_id}/data-security/posture/findings/{finding\_id}/instances/archive ##### [Remove the archive marking from a finding instance](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/findings/subresources/instances/methods/unarchive) POST/accounts/{account\_id}/data-security/posture/findings/{finding\_id}/instances/unarchive ##### ModelsExpand Collapse

InstanceListResponse object {affliction\_date, asset, dlp\_contexts, 4 more } A specific instance of a security finding. In the API interface, we refer to the ‘finding’ table in our DB as finding instances, optimized for the p99 use case.

affliction\_date: string When this specific instance was identified. formatdate-time Link to this property

asset: object {category, external\_id, fields, 4 more } Asset information including metadata and categorization.

category: object {service, type, vendor, id } Category information for an asset.

service: string The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. Link to this property type: string The type of asset. Link to this property vendor: string The vendor the asset is part of. Link to this property id: optional string Unique identifier for the asset category. formatuuid Link to this property

Link to this property external\_id: string External identifier from the source system. maxLength512 Link to this property

fields: array of object {name, value, link } The fields associated with the asset.

name: string The name of the field. Link to this property value: string The value of the field. Link to this property link: optional string Optional link associated with the field. formaturi Link to this property

Link to this property name: string Human-readable name of the asset. Link to this property id: optional string Unique identifier for the asset. formatuuid Link to this property link: optional string Direct link to the asset. formaturi maxLength2048 Link to this property updated: optional string Timestamp of the asset row version represented by this data. formatdate-time Link to this property

Link to this property

dlp\_contexts: array of object {created, entry\_ids, profile\_id, 6 more } DLP context information if this is a content finding.

created: string When the DLP context was created. formatdate-time Link to this property entry\_ids: array of string DLP Entry IDs. Link to this property profile\_id: string DLP Profile ID. formatuuid Link to this property updated: string When the DLP context was last updated. formatdate-time Link to this property id: optional string Unique identifier for the DLP context. formatuuid Link to this property deleted: optional string When the DLP context was deleted. formatdate-time Link to this property match\_context\_max\_extent: optional number DLP Right Boundary of match context. maximum2147483647 minimum0 Link to this property match\_context\_min\_extent: optional number DLP Left Boundary of match context. maximum2147483647 minimum0 Link to this property match\_context\_payload: optional map\[unknown] DLP Match context payload that matched the profile in question. Link to this property

Link to this property

remediations: array of object {id, created\_at, stale, status } A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The ‘stale’ field indicates whether the remediation job was created before the finding instance’s affliction\_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array.

id: string Unique identifier for the remediation job. formatuuid Link to this property created\_at: string When the remediation job was created. formatdate-time Link to this property stale: boolean Whether this remediation job is stale (created before the finding instance’s affliction\_date). Link to this property

status: "pending"or "processing"or "completed"or 2 more Status of a remediation job.

One of the following: "pending" Link to this property "processing" Link to this property "completed" Link to this property "failed" Link to this property "validating" Link to this property

Link to this property

Link to this property

webhooks: array of object {latest\_job, webhook\_id, webhook\_label } The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The ‘stale’ field indicates whether the job was invoked before the finding instance’s current affliction\_date. If no webhook jobs have been created, this field will be an empty array.

latest\_job: object {id, created\_at, stale, status } The most recent webhook job for this webhook configuration.

id: string Unique identifier for the webhook job. formatuuid Link to this property created\_at: string When the webhook job was created. formatdate-time Link to this property stale: boolean Whether this webhook job is stale (created before the finding instance’s current affliction\_date). Link to this property

status: "pending"or "processing"or "completed" Current status of the webhook job.

One of the following: "pending" Link to this property "processing" Link to this property "completed" Link to this property

Link to this property

Link to this property webhook\_id: string Unique identifier for the webhook configuration. formatuuid Link to this property webhook\_label: string Account-specified display label for the webhook configuration. Link to this property

Link to this property id: optional string Unique identifier for the finding instance. formatuuid Link to this property is\_archived: optional boolean Whether this finding instance has been archived. Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.findings.instances%20%3E%20(model)%20instance_list_response%20%3E%20(schema)>)

InstanceGetResponse object {affliction\_date, asset, dlp\_contexts, 4 more } A specific instance of a security finding. In the API interface, we refer to the ‘finding’ table in our DB as finding instances, optimized for the p99 use case.

affliction\_date: string When this specific instance was identified. formatdate-time Link to this property

asset: object {category, external\_id, fields, 4 more } Asset information including metadata and categorization.

category: object {service, type, vendor, id } Category information for an asset.

service: string The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. Link to this property type: string The type of asset. Link to this property vendor: string The vendor the asset is part of. Link to this property id: optional string Unique identifier for the asset category. formatuuid Link to this property

Link to this property external\_id: string External identifier from the source system. maxLength512 Link to this property

fields: array of object {name, value, link } The fields associated with the asset.

name: string The name of the field. Link to this property value: string The value of the field. Link to this property link: optional string Optional link associated with the field. formaturi Link to this property

Link to this property name: string Human-readable name of the asset. Link to this property id: optional string Unique identifier for the asset. formatuuid Link to this property link: optional string Direct link to the asset. formaturi maxLength2048 Link to this property updated: optional string Timestamp of the asset row version represented by this data. formatdate-time Link to this property

Link to this property

dlp\_contexts: array of object {created, entry\_ids, profile\_id, 6 more } DLP context information if this is a content finding.

created: string When the DLP context was created. formatdate-time Link to this property entry\_ids: array of string DLP Entry IDs. Link to this property profile\_id: string DLP Profile ID. formatuuid Link to this property updated: string When the DLP context was last updated. formatdate-time Link to this property id: optional string Unique identifier for the DLP context. formatuuid Link to this property deleted: optional string When the DLP context was deleted. formatdate-time Link to this property match\_context\_max\_extent: optional number DLP Right Boundary of match context. maximum2147483647 minimum0 Link to this property match\_context\_min\_extent: optional number DLP Left Boundary of match context. maximum2147483647 minimum0 Link to this property match\_context\_payload: optional map\[unknown] DLP Match context payload that matched the profile in question. Link to this property

Link to this property

remediations: array of object {id, created\_at, stale, status } A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The ‘stale’ field indicates whether the remediation job was created before the finding instance’s affliction\_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array.

id: string Unique identifier for the remediation job. formatuuid Link to this property created\_at: string When the remediation job was created. formatdate-time Link to this property stale: boolean Whether this remediation job is stale (created before the finding instance’s affliction\_date). Link to this property

status: "pending"or "processing"or "completed"or 2 more Status of a remediation job.

One of the following: "pending" Link to this property "processing" Link to this property "completed" Link to this property "failed" Link to this property "validating" Link to this property

Link to this property

Link to this property

webhooks: array of object {latest\_job, webhook\_id, webhook\_label } The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The ‘stale’ field indicates whether the job was invoked before the finding instance’s current affliction\_date. If no webhook jobs have been created, this field will be an empty array.

latest\_job: object {id, created\_at, stale, status } The most recent webhook job for this webhook configuration.

id: string Unique identifier for the webhook job. formatuuid Link to this property created\_at: string When the webhook job was created. formatdate-time Link to this property stale: boolean Whether this webhook job is stale (created before the finding instance’s current affliction\_date). Link to this property

status: "pending"or "processing"or "completed" Current status of the webhook job.

One of the following: "pending" Link to this property "processing" Link to this property "completed" Link to this property

Link to this property

Link to this property webhook\_id: string Unique identifier for the webhook configuration. formatuuid Link to this property webhook\_label: string Account-specified display label for the webhook configuration. Link to this property

Link to this property id: optional string Unique identifier for the finding instance. formatuuid Link to this property is\_archived: optional boolean Whether this finding instance has been archived. Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.findings.instances%20%3E%20(model)%20instance_get_response%20%3E%20(schema)>)

InstanceExportResponse object {id, status, type, 5 more } Information about an export job.

id: string Unique identifier for the export job. formatuuid Link to this property

status: "Pending"or "Success"or "Failure"or 2 more Status of an export job.

One of the following: "Pending" Link to this property "Success" Link to this property "Failure" Link to this property "Rescheduled" Link to this property "In-Progress" Link to this property

Link to this property

type: "finding"or "findingInstance"or "content"or "remediationJob" Type of export job.

One of the following: "finding" Link to this property "findingInstance" Link to this property "content" Link to this property "remediationJob" Link to this property

Link to this property user\_id: string ID of the export-requesting user. maxLength128 Link to this property download\_url: optional string The URL by which the successfully created export can be downloaded by the end users. formaturi maxLength1024 Link to this property errors: optional string Contains information on errors which may have occurred during export creation. Link to this property file\_name: optional string The base name of the file that is/was generated by the export job. maxLength256 Link to this property file\_path: optional string The full path of the file that is stored within external storage (currently R2). maxLength512 Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.findings.instances%20%3E%20(model)%20instance_export_response%20%3E%20(schema)>)

InstanceArchiveResponse object {affliction\_date, asset, dlp\_contexts, 4 more } A specific instance of a security finding. In the API interface, we refer to the ‘finding’ table in our DB as finding instances, optimized for the p99 use case.

affliction\_date: string When this specific instance was identified. formatdate-time Link to this property

asset: object {category, external\_id, fields, 4 more } Asset information including metadata and categorization.

category: object {service, type, vendor, id } Category information for an asset.

service: string The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. Link to this property type: string The type of asset. Link to this property vendor: string The vendor the asset is part of. Link to this property id: optional string Unique identifier for the asset category. formatuuid Link to this property

Link to this property external\_id: string External identifier from the source system. maxLength512 Link to this property

fields: array of object {name, value, link } The fields associated with the asset.

name: string The name of the field. Link to this property value: string The value of the field. Link to this property link: optional string Optional link associated with the field. formaturi Link to this property

Link to this property name: string Human-readable name of the asset. Link to this property id: optional string Unique identifier for the asset. formatuuid Link to this property link: optional string Direct link to the asset. formaturi maxLength2048 Link to this property updated: optional string Timestamp of the asset row version represented by this data. formatdate-time Link to this property

Link to this property

dlp\_contexts: array of object {created, entry\_ids, profile\_id, 6 more } DLP context information if this is a content finding.

created: string When the DLP context was created. formatdate-time Link to this property entry\_ids: array of string DLP Entry IDs. Link to this property profile\_id: string DLP Profile ID. formatuuid Link to this property updated: string When the DLP context was last updated. formatdate-time Link to this property id: optional string Unique identifier for the DLP context. formatuuid Link to this property deleted: optional string When the DLP context was deleted. formatdate-time Link to this property match\_context\_max\_extent: optional number DLP Right Boundary of match context. maximum2147483647 minimum0 Link to this property match\_context\_min\_extent: optional number DLP Left Boundary of match context. maximum2147483647 minimum0 Link to this property match\_context\_payload: optional map\[unknown] DLP Match context payload that matched the profile in question. Link to this property

Link to this property

remediations: array of object {id, created\_at, stale, status } A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The ‘stale’ field indicates whether the remediation job was created before the finding instance’s affliction\_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array.

id: string Unique identifier for the remediation job. formatuuid Link to this property created\_at: string When the remediation job was created. formatdate-time Link to this property stale: boolean Whether this remediation job is stale (created before the finding instance’s affliction\_date). Link to this property

status: "pending"or "processing"or "completed"or 2 more Status of a remediation job.

One of the following: "pending" Link to this property "processing" Link to this property "completed" Link to this property "failed" Link to this property "validating" Link to this property

Link to this property

Link to this property

webhooks: array of object {latest\_job, webhook\_id, webhook\_label } The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The ‘stale’ field indicates whether the job was invoked before the finding instance’s current affliction\_date. If no webhook jobs have been created, this field will be an empty array.

latest\_job: object {id, created\_at, stale, status } The most recent webhook job for this webhook configuration.

id: string Unique identifier for the webhook job. formatuuid Link to this property created\_at: string When the webhook job was created. formatdate-time Link to this property stale: boolean Whether this webhook job is stale (created before the finding instance’s current affliction\_date). Link to this property

status: "pending"or "processing"or "completed" Current status of the webhook job.

One of the following: "pending" Link to this property "processing" Link to this property "completed" Link to this property

Link to this property

Link to this property webhook\_id: string Unique identifier for the webhook configuration. formatuuid Link to this property webhook\_label: string Account-specified display label for the webhook configuration. Link to this property

Link to this property id: optional string Unique identifier for the finding instance. formatuuid Link to this property is\_archived: optional boolean Whether this finding instance has been archived. Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.findings.instances%20%3E%20(model)%20instance_archive_response%20%3E%20(schema)>)

InstanceUnarchiveResponse object {affliction\_date, asset, dlp\_contexts, 4 more } A specific instance of a security finding. In the API interface, we refer to the ‘finding’ table in our DB as finding instances, optimized for the p99 use case.

affliction\_date: string When this specific instance was identified. formatdate-time Link to this property

asset: object {category, external\_id, fields, 4 more } Asset information including metadata and categorization.

category: object {service, type, vendor, id } Category information for an asset.

service: string The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. Link to this property type: string The type of asset. Link to this property vendor: string The vendor the asset is part of. Link to this property id: optional string Unique identifier for the asset category. formatuuid Link to this property

Link to this property external\_id: string External identifier from the source system. maxLength512 Link to this property

fields: array of object {name, value, link } The fields associated with the asset.

name: string The name of the field. Link to this property value: string The value of the field. Link to this property link: optional string Optional link associated with the field. formaturi Link to this property

Link to this property name: string Human-readable name of the asset. Link to this property id: optional string Unique identifier for the asset. formatuuid Link to this property link: optional string Direct link to the asset. formaturi maxLength2048 Link to this property updated: optional string Timestamp of the asset row version represented by this data. formatdate-time Link to this property

Link to this property

dlp\_contexts: array of object {created, entry\_ids, profile\_id, 6 more } DLP context information if this is a content finding.

created: string When the DLP context was created. formatdate-time Link to this property entry\_ids: array of string DLP Entry IDs. Link to this property profile\_id: string DLP Profile ID. formatuuid Link to this property updated: string When the DLP context was last updated. formatdate-time Link to this property id: optional string Unique identifier for the DLP context. formatuuid Link to this property deleted: optional string When the DLP context was deleted. formatdate-time Link to this property match\_context\_max\_extent: optional number DLP Right Boundary of match context. maximum2147483647 minimum0 Link to this property match\_context\_min\_extent: optional number DLP Left Boundary of match context. maximum2147483647 minimum0 Link to this property match\_context\_payload: optional map\[unknown] DLP Match context payload that matched the profile in question. Link to this property

Link to this property

remediations: array of object {id, created\_at, stale, status } A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The ‘stale’ field indicates whether the remediation job was created before the finding instance’s affliction\_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array.

id: string Unique identifier for the remediation job. formatuuid Link to this property created\_at: string When the remediation job was created. formatdate-time Link to this property stale: boolean Whether this remediation job is stale (created before the finding instance’s affliction\_date). Link to this property

status: "pending"or "processing"or "completed"or 2 more Status of a remediation job.

One of the following: "pending" Link to this property "processing" Link to this property "completed" Link to this property "failed" Link to this property "validating" Link to this property

Link to this property

Link to this property

webhooks: array of object {latest\_job, webhook\_id, webhook\_label } The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The ‘stale’ field indicates whether the job was invoked before the finding instance’s current affliction\_date. If no webhook jobs have been created, this field will be an empty array.

latest\_job: object {id, created\_at, stale, status } The most recent webhook job for this webhook configuration.

id: string Unique identifier for the webhook job. formatuuid Link to this property created\_at: string When the webhook job was created. formatdate-time Link to this property stale: boolean Whether this webhook job is stale (created before the finding instance’s current affliction\_date). Link to this property

status: "pending"or "processing"or "completed" Current status of the webhook job.

One of the following: "pending" Link to this property "processing" Link to this property "completed" Link to this property

Link to this property

Link to this property webhook\_id: string Unique identifier for the webhook configuration. formatuuid Link to this property webhook\_label: string Account-specified display label for the webhook configuration. Link to this property

Link to this property id: optional string Unique identifier for the finding instance. formatuuid Link to this property is\_archived: optional boolean Whether this finding instance has been archived. Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.findings.instances%20%3E%20(model)%20instance_unarchive_response%20%3E%20(schema)>) #### CasbPostureExports ##### [List all export jobs](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/exports/methods/list) GET/accounts/{account\_id}/data-security/posture/exports ##### [Get a single export job](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/exports/methods/get) GET/accounts/{account\_id}/data-security/posture/exports/{id} ##### ModelsExpand Collapse

ExportListResponse object {id, status, type, 5 more } Information about an export job.

id: string Unique identifier for the export job. formatuuid Link to this property

status: "Pending"or "Success"or "Failure"or 2 more Status of an export job.

One of the following: "Pending" Link to this property "Success" Link to this property "Failure" Link to this property "Rescheduled" Link to this property "In-Progress" Link to this property

Link to this property

type: "finding"or "findingInstance"or "content"or "remediationJob" Type of export job.

One of the following: "finding" Link to this property "findingInstance" Link to this property "content" Link to this property "remediationJob" Link to this property

Link to this property user\_id: string ID of the export-requesting user. maxLength128 Link to this property download\_url: optional string The URL by which the successfully created export can be downloaded by the end users. formaturi maxLength1024 Link to this property errors: optional string Contains information on errors which may have occurred during export creation. Link to this property file\_name: optional string The base name of the file that is/was generated by the export job. maxLength256 Link to this property file\_path: optional string The full path of the file that is stored within external storage (currently R2). maxLength512 Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.exports%20%3E%20(model)%20export_list_response%20%3E%20(schema)>)

ExportGetResponse object {id, status, type, 5 more } Information about an export job.

id: string Unique identifier for the export job. formatuuid Link to this property

status: "Pending"or "Success"or "Failure"or 2 more Status of an export job.

One of the following: "Pending" Link to this property "Success" Link to this property "Failure" Link to this property "Rescheduled" Link to this property "In-Progress" Link to this property

Link to this property

type: "finding"or "findingInstance"or "content"or "remediationJob" Type of export job.

One of the following: "finding" Link to this property "findingInstance" Link to this property "content" Link to this property "remediationJob" Link to this property

Link to this property user\_id: string ID of the export-requesting user. maxLength128 Link to this property download\_url: optional string The URL by which the successfully created export can be downloaded by the end users. formaturi maxLength1024 Link to this property errors: optional string Contains information on errors which may have occurred during export creation. Link to this property file\_name: optional string The base name of the file that is/was generated by the export job. maxLength256 Link to this property file\_path: optional string The full path of the file that is stored within external storage (currently R2). maxLength512 Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.exports%20%3E%20(model)%20export_get_response%20%3E%20(schema)>) #### CasbPostureFinding Types ##### [List all finding types](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/finding_types/methods/list) GET/accounts/{account\_id}/data-security/posture/finding\_types ##### [Get finding by ID](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/finding_types/methods/get) GET/accounts/{account\_id}/data-security/posture/finding\_types/{finding\_type\_id} ##### ModelsExpand Collapse

FindingTypeListResponse object {id, category, name, 3 more } Basic finding type information.

id: string The unique identifier of the finding. formatuuid Link to this property

category: object {observation, product, type } Category information for a finding.

observation: "Issue"or "Insight"or "Activity" The type of the observation.

One of the following: "Issue" Link to this property "Insight" Link to this property "Activity" Link to this property

Link to this property

product: "SaaS"or "Cloud" The product category.

One of the following: "SaaS" Link to this property "Cloud" Link to this property

Link to this property

type: "Content"or "Posture" The type of the finding category.

One of the following: "Content" Link to this property "Posture" Link to this property

Link to this property

Link to this property name: string The name of the finding. Link to this property

severity: "Critical"or "High"or "Medium"or "Low" Default severity used when no integration-specific severity override exists.

One of the following: "Critical" Link to this property "High" Link to this property "Medium" Link to this property "Low" Link to this property

Link to this property vendor: string The SaaS/Cloud vendor of the platform with which the finding is associated. Link to this property description: optional string Detailed description of the finding. Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.finding_types%20%3E%20(model)%20finding_type_list_response%20%3E%20(schema)>)

FindingTypeGetResponse object {id, category, name, 3 more } Basic finding type information.

id: string The unique identifier of the finding. formatuuid Link to this property

category: object {observation, product, type } Category information for a finding.

observation: "Issue"or "Insight"or "Activity" The type of the observation.

One of the following: "Issue" Link to this property "Insight" Link to this property "Activity" Link to this property

Link to this property

product: "SaaS"or "Cloud" The product category.

One of the following: "SaaS" Link to this property "Cloud" Link to this property

Link to this property

type: "Content"or "Posture" The type of the finding category.

One of the following: "Content" Link to this property "Posture" Link to this property

Link to this property

Link to this property name: string The name of the finding. Link to this property

severity: "Critical"or "High"or "Medium"or "Low" Default severity used when no integration-specific severity override exists.

One of the following: "Critical" Link to this property "High" Link to this property "Medium" Link to this property "Low" Link to this property

Link to this property vendor: string The SaaS/Cloud vendor of the platform with which the finding is associated. Link to this property description: optional string Detailed description of the finding. Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.finding_types%20%3E%20(model)%20finding_type_get_response%20%3E%20(schema)>) #### CasbPostureFinding TypesRemediation Types ##### [List remediation types for a finding type](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/finding_types/subresources/remediation_types/methods/list) GET/accounts/{account\_id}/data-security/posture/finding\_types/{finding\_type\_id}/remediation\_types ##### ModelsExpand Collapse

RemediationTypeListResponse object {id, description, display\_name, 2 more } Information about a remediation type.

id: string The identifier for the remediation type. formatuuid Link to this property description: string A description of the action(s) taken by the remediation type. Link to this property display\_name: string The name of the remediation type as displayed in the cloudflare dashboard. Link to this property finding\_type\_id: string The identifier of the finding\_type which this remediation type should remediate. formatuuid Link to this property remediation\_type: string The name of the remediation type. Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.finding_types.remediation_types%20%3E%20(model)%20remediation_type_list_response%20%3E%20(schema)>) #### CasbPostureContent ##### [List DLP content findings](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/content/methods/list) GET/accounts/{account\_id}/data-security/posture/content ##### [Create a content export](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/content/methods/export) POST/accounts/{account\_id}/data-security/posture/content/export ##### ModelsExpand Collapse

ContentListResponse object {asset\_id, asset\_name, dlp\_contexts, 4 more } Content asset with DLP information.

asset\_id: string Unique identifier for the asset. formatuuid Link to this property asset\_name: string Name of the asset. Link to this property

dlp\_contexts: array of object {created, entry\_ids, profile\_id, 6 more } DLP context information for this asset.

created: string When the DLP context was created. formatdate-time Link to this property entry\_ids: array of string DLP Entry IDs. Link to this property profile\_id: string DLP Profile ID. formatuuid Link to this property updated: string When the DLP context was last updated. formatdate-time Link to this property id: optional string Unique identifier for the DLP context. formatuuid Link to this property deleted: optional string When the DLP context was deleted. formatdate-time Link to this property match\_context\_max\_extent: optional number DLP Right Boundary of match context. maximum2147483647 minimum0 Link to this property match\_context\_min\_extent: optional number DLP Left Boundary of match context. maximum2147483647 minimum0 Link to this property match\_context\_payload: optional map\[unknown] DLP Match context payload that matched the profile in question. Link to this property

Link to this property dlp\_profile\_count: number Number of DLP profiles that flagged this asset. Link to this property dlp\_profile\_ids: array of string IDs of DLP profiles that flagged this asset. Link to this property

integration: object {created, last\_hydrated, name, 12 more } Summary information about an integration.

created: string When entity was created. formatdate-time Link to this property last\_hydrated: string When were the integration credentials last updated. formatdate-time Link to this property name: string Name of the integration. maxLength256 Link to this property permissions: array of string The vendor-specific permissions associated with the integration. Link to this property

policy: object {id, client\_id, compliance\_level, 4 more } Policy configuration for an integration.

id: optional string Policy identifier. formatuuid Link to this property client\_id: optional string OAuth client ID for the policy. Link to this property compliance\_level: optional string Compliance level for the policy. Link to this property dlp\_enabled: optional boolean Whether DLP is enabled for this policy. Link to this property link: optional string Link to policy documentation. formaturi Link to this property name: optional string Policy name. Link to this property permissions: optional array of string List of permissions included in the policy. Link to this property

Link to this property status: string Current status of the integration. Link to this property updated: string Last entity was updated. formatdate-time Link to this property upgradable: boolean Whether the integrations permissions can be updated. Link to this property

vendor: object {id, description, display\_name, 5 more } Information about a vendor/service provider.

id: string The id of the vendor. Link to this property description: string Detailed information about what kinds of issues are detected for this vendor. Link to this property display\_name: string The display name of the vendor. Link to this property logo: string Logo URL for the vendor. formaturi Link to this property name: string The name of the vendor. Link to this property static\_logo: string Static logo URL for the vendor. formaturi Link to this property zt\_enrollments: array of string The vendor’s compatible Zero Trust products. Link to this property policies: optional array of map\[unknown] The policies related to the vendor. Link to this property

Link to this property

zt\_enrollments: array of object {id, description, display\_name, enabled } Zero Trust products associated with this integration.

id: optional string The internal identifier of the Zero Trust Product. Link to this property description: optional string Brief description of the Zero Trust Product. Link to this property display\_name: optional string The verbose name of the Zero Trust Product. Link to this property enabled: optional boolean Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. Link to this property

Link to this property id: optional string Integration ID. formatuuid Link to this property

credential\_health\_status: optional "Initializing"or "Healthy"or "Unhealthy" Health status of integration credentials.

One of the following: "Initializing" Link to this property "Healthy" Link to this property "Unhealthy" Link to this property

Link to this property credentials\_expiry: optional string The date and time when the integration credentials will expire. formatdate-time Link to this property is\_paused: optional boolean Whether the given integration is paused by the user. Link to this property upgrade\_dismissed: optional boolean UI State as to whether a potential permissions upgrade has been dismissed. Link to this property

Link to this property latest\_affliction\_date: string Most recent date this asset was flagged. formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.content%20%3E%20(model)%20content_list_response%20%3E%20(schema)>)

ContentExportResponse object {id, status, type, 5 more } Information about an export job.

id: string Unique identifier for the export job. formatuuid Link to this property

status: "Pending"or "Success"or "Failure"or 2 more Status of an export job.

One of the following: "Pending" Link to this property "Success" Link to this property "Failure" Link to this property "Rescheduled" Link to this property "In-Progress" Link to this property

Link to this property

type: "finding"or "findingInstance"or "content"or "remediationJob" Type of export job.

One of the following: "finding" Link to this property "findingInstance" Link to this property "content" Link to this property "remediationJob" Link to this property

Link to this property user\_id: string ID of the export-requesting user. maxLength128 Link to this property download\_url: optional string The URL by which the successfully created export can be downloaded by the end users. formaturi maxLength1024 Link to this property errors: optional string Contains information on errors which may have occurred during export creation. Link to this property file\_name: optional string The base name of the file that is/was generated by the export job. maxLength256 Link to this property file\_path: optional string The full path of the file that is stored within external storage (currently R2). maxLength512 Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.content%20%3E%20(model)%20content_export_response%20%3E%20(schema)>) #### CasbPostureRemediations #### CasbPostureRemediationsJobs ##### [List remediation jobs](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/remediations/subresources/jobs/methods/list) GET/accounts/{account\_id}/data-security/posture/remediations/jobs ##### [Creates remediation jobs](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/remediations/subresources/jobs/methods/create) POST/accounts/{account\_id}/data-security/posture/remediations/jobs ##### [Create a remediation jobs export](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/remediations/subresources/jobs/methods/export) POST/accounts/{account\_id}/data-security/posture/remediations/jobs/export ##### ModelsExpand Collapse

JobListResponse object {id, asset, created\_at, 11 more } Information about a remediation job.

id: string Unique identifier for the remediation job. formatuuid Link to this property

asset: object {id, category, external\_id, 3 more } Asset information for a remediation job.

id: string Unique identifier for the asset. formatuuid Link to this property

category: object {service, type, vendor } Category information for a remediation job asset.

service: string Specific service within the vendor. Link to this property type: string Asset type. Link to this property

vendor: "AWS"or "Anthropic"or "Bitbucket"or 14 more Display names for vendor types.

One of the following: "AWS" Link to this property "Anthropic" Link to this property "Bitbucket" Link to this property "Box" Link to this property "Confluence" Link to this property "Dropbox" Link to this property "GitHub" Link to this property "Google Cloud Platform" Link to this property "Google Workspace" Link to this property "Jira" Link to this property "Microsoft" Link to this property "Microsoft Internal" Link to this property "OpenAI" Link to this property "Slack" Link to this property "Salesforce" Link to this property "ServiceNow" Link to this property "Zoom" Link to this property

Link to this property

Link to this property external\_id: string External identifier from the source system. Link to this property

fields: array of object {name, value, link } Additional fields associated with the asset.

name: string Field name. Link to this property

value: stringor numberor boolean Field value (can be string, number, or boolean).

One of the following: string Link to this property number Link to this property boolean Link to this property

Link to this property link: optional string Optional link associated with the field. formaturi Link to this property

Link to this property name: string Human-readable name of the asset. Link to this property link: optional string Direct link to the asset. formaturi Link to this property

Link to this property created\_at: string When the remediation job was created. formatdate-time Link to this property finding\_id: string Encoded finding ID. Link to this property finding\_instance\_id: string ID of the finding instance being remediated. formatuuid Link to this property finding\_type\_id: string ID of the finding type. formatuuid Link to this property finding\_type\_name: string Name of the finding type. Link to this property integration\_name: string Name of the integration. Link to this property last\_updated: string When the remediation job was last updated. formatdate-time Link to this property remediation\_type: string Type of remediation being performed. Link to this property

status: "pending"or "processing"or "completed"or 2 more Status of a remediation job.

One of the following: "pending" Link to this property "processing" Link to this property "completed" Link to this property "failed" Link to this property "validating" Link to this property

Link to this property triggered\_by\_user: string Email of the user who triggered the remediation. For account-token actors this is the literal “Account API Token”; for policy actors this is empty. Link to this property

triggered\_by\_actor: optional "user"or "account\_token" Type of actor that triggered the remediation job. Null on legacy rows created before this column was populated.

One of the following: "user" Link to this property "account\_token" Link to this property

Link to this property triggered\_by\_id: optional string ID of the actor that triggered the job. Meaning depends on triggered\_by\_actor. Null on legacy rows. Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.remediations.jobs%20%3E%20(model)%20job_list_response%20%3E%20(schema)>)

JobCreateResponse object {created, failed }

created: array of object {id, asset, created\_at, 11 more } Successfully created remediation jobs.

id: string Unique identifier for the remediation job. formatuuid Link to this property

asset: object {id, category, external\_id, 3 more } Asset information for a remediation job.

id: string Unique identifier for the asset. formatuuid Link to this property

category: object {service, type, vendor } Category information for a remediation job asset.

service: string Specific service within the vendor. Link to this property type: string Asset type. Link to this property

vendor: "AWS"or "Anthropic"or "Bitbucket"or 14 more Display names for vendor types.

One of the following: "AWS" Link to this property "Anthropic" Link to this property "Bitbucket" Link to this property "Box" Link to this property "Confluence" Link to this property "Dropbox" Link to this property "GitHub" Link to this property "Google Cloud Platform" Link to this property "Google Workspace" Link to this property "Jira" Link to this property "Microsoft" Link to this property "Microsoft Internal" Link to this property "OpenAI" Link to this property "Slack" Link to this property "Salesforce" Link to this property "ServiceNow" Link to this property "Zoom" Link to this property

Link to this property

Link to this property external\_id: string External identifier from the source system. Link to this property

fields: array of object {name, value, link } Additional fields associated with the asset.

name: string Field name. Link to this property

value: stringor numberor boolean Field value (can be string, number, or boolean).

One of the following: string Link to this property number Link to this property boolean Link to this property

Link to this property link: optional string Optional link associated with the field. formaturi Link to this property

Link to this property name: string Human-readable name of the asset. Link to this property link: optional string Direct link to the asset. formaturi Link to this property

Link to this property created\_at: string When the remediation job was created. formatdate-time Link to this property finding\_id: string Encoded finding ID. Link to this property finding\_instance\_id: string ID of the finding instance being remediated. formatuuid Link to this property finding\_type\_id: string ID of the finding type. formatuuid Link to this property finding\_type\_name: string Name of the finding type. Link to this property integration\_name: string Name of the integration. Link to this property last\_updated: string When the remediation job was last updated. formatdate-time Link to this property remediation\_type: string Type of remediation being performed. Link to this property

status: "pending"or "processing"or "completed"or 2 more Status of a remediation job.

One of the following: "pending" Link to this property "processing" Link to this property "completed" Link to this property "failed" Link to this property "validating" Link to this property

Link to this property triggered\_by\_user: string Email of the user who triggered the remediation. For account-token actors this is the literal “Account API Token”; for policy actors this is empty. Link to this property

triggered\_by\_actor: optional "user"or "account\_token" Type of actor that triggered the remediation job. Null on legacy rows created before this column was populated.

One of the following: "user" Link to this property "account\_token" Link to this property

Link to this property triggered\_by\_id: optional string ID of the actor that triggered the job. Meaning depends on triggered\_by\_actor. Null on legacy rows. Link to this property

Link to this property

failed: array of object {error, finding\_instance\_id } Failed remediation job creation attempts.

error: string Error message describing the failure. Link to this property finding\_instance\_id: string ID of the finding instance that failed to create a remediation job. formatuuid Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.remediations.jobs%20%3E%20(model)%20job_create_response%20%3E%20(schema)>)

JobExportResponse object {id, status, type, 5 more } Information about an export job.

id: string Unique identifier for the export job. formatuuid Link to this property

status: "Pending"or "Success"or "Failure"or 2 more Status of an export job.

One of the following: "Pending" Link to this property "Success" Link to this property "Failure" Link to this property "Rescheduled" Link to this property "In-Progress" Link to this property

Link to this property

type: "finding"or "findingInstance"or "content"or "remediationJob" Type of export job.

One of the following: "finding" Link to this property "findingInstance" Link to this property "content" Link to this property "remediationJob" Link to this property

Link to this property user\_id: string ID of the export-requesting user. maxLength128 Link to this property download\_url: optional string The URL by which the successfully created export can be downloaded by the end users. formaturi maxLength1024 Link to this property errors: optional string Contains information on errors which may have occurred during export creation. Link to this property file\_name: optional string The base name of the file that is/was generated by the export job. maxLength256 Link to this property file\_path: optional string The full path of the file that is stored within external storage (currently R2). maxLength512 Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.remediations.jobs%20%3E%20(model)%20job_export_response%20%3E%20(schema)>) #### CasbPosturePolicies ##### [List policy configurations](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/policies/methods/list) GET/accounts/{account\_id}/data-security/posture/policies ##### [Create a new policy configuration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/policies/methods/create) POST/accounts/{account\_id}/data-security/posture/policies ##### [Get a policy configuration by ID](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/policies/methods/get) GET/accounts/{account\_id}/data-security/posture/policies/{policy\_id} ##### [Update a policy configuration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/policies/methods/update) PUT/accounts/{account\_id}/data-security/posture/policies/{policy\_id} ##### [Delete a policy configuration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/policies/methods/delete) DELETE/accounts/{account\_id}/data-security/posture/policies/{policy\_id} ##### ModelsExpand Collapse

PolicyListResponse object {id, actions, applies\_to\_all\_integrations, 9 more } Response body for a policy configuration.

id: string Unique identifier for the policy configuration. formatuuid Link to this property

actions: object {remediation\_types, webhook\_configs } The actions configured for this policy.

remediation\_types: array of object {display\_name, remediation\_type, remediation\_type\_id } List of remediation types that will be executed.

display\_name: string Display name/label of the remediation type. Link to this property remediation\_type: string The system name of the remediation type. Link to this property remediation\_type\_id: string Unique identifier for the remediation type. formatuuid Link to this property

Link to this property

webhook\_configs: array of object {display\_name, webhook\_config\_id } List of webhook configurations that will be triggered.

display\_name: string Display name/label of the webhook configuration. Link to this property webhook\_config\_id: string Unique identifier for the webhook configuration. formatuuid Link to this property

Link to this property

Link to this property applies\_to\_all\_integrations: boolean When true, the policy applies to all integrations for the account. When false, it applies only to the specified integration\_ids. Link to this property created\_at: string Timestamp when the policy was created. formatdate-time Link to this property description: string User-set description of what this policy does. Limited to 1000 characters. Link to this property display\_name: string Display name for the policy configuration. Limited to 255 characters. Link to this property enabled: boolean Whether the policy is enabled. Derived from disabled\_at (enabled when disabled\_at is unset). Link to this property finding\_type\_id: string The finding type this policy is associated with. Immutable after creation; changing it replaces the policy. formatuuid Link to this property integration\_ids: array of string The integrations this policy applies to. Link to this property updated\_at: string Timestamp when the policy was last updated. formatdate-time Link to this property disabled\_at: optional string Timestamp when the policy was disabled. Omitted from the response when the policy is enabled. formatdate-time Link to this property last\_triggered\_at: optional string Timestamp of the most recent successful policy invocation. Omitted from the response when the policy has never been successfully triggered. Only populated on GET responses; absent on responses from create/update endpoints. formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.policies%20%3E%20(model)%20policy_list_response%20%3E%20(schema)>)

PolicyCreateResponse object {id, actions, applies\_to\_all\_integrations, 9 more } Response body for a policy configuration.

id: string Unique identifier for the policy configuration. formatuuid Link to this property

actions: object {remediation\_types, webhook\_configs } The actions configured for this policy.

remediation\_types: array of object {display\_name, remediation\_type, remediation\_type\_id } List of remediation types that will be executed.

display\_name: string Display name/label of the remediation type. Link to this property remediation\_type: string The system name of the remediation type. Link to this property remediation\_type\_id: string Unique identifier for the remediation type. formatuuid Link to this property

Link to this property

webhook\_configs: array of object {display\_name, webhook\_config\_id } List of webhook configurations that will be triggered.

display\_name: string Display name/label of the webhook configuration. Link to this property webhook\_config\_id: string Unique identifier for the webhook configuration. formatuuid Link to this property

Link to this property

Link to this property applies\_to\_all\_integrations: boolean When true, the policy applies to all integrations for the account. When false, it applies only to the specified integration\_ids. Link to this property created\_at: string Timestamp when the policy was created. formatdate-time Link to this property description: string User-set description of what this policy does. Limited to 1000 characters. Link to this property display\_name: string Display name for the policy configuration. Limited to 255 characters. Link to this property enabled: boolean Whether the policy is enabled. Derived from disabled\_at (enabled when disabled\_at is unset). Link to this property finding\_type\_id: string The finding type this policy is associated with. Immutable after creation; changing it replaces the policy. formatuuid Link to this property integration\_ids: array of string The integrations this policy applies to. Link to this property updated\_at: string Timestamp when the policy was last updated. formatdate-time Link to this property disabled\_at: optional string Timestamp when the policy was disabled. Omitted from the response when the policy is enabled. formatdate-time Link to this property last\_triggered\_at: optional string Timestamp of the most recent successful policy invocation. Omitted from the response when the policy has never been successfully triggered. Only populated on GET responses; absent on responses from create/update endpoints. formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.policies%20%3E%20(model)%20policy_create_response%20%3E%20(schema)>)

PolicyGetResponse object {id, actions, applies\_to\_all\_integrations, 9 more } Response body for a policy configuration.

id: string Unique identifier for the policy configuration. formatuuid Link to this property

actions: object {remediation\_types, webhook\_configs } The actions configured for this policy.

remediation\_types: array of object {display\_name, remediation\_type, remediation\_type\_id } List of remediation types that will be executed.

display\_name: string Display name/label of the remediation type. Link to this property remediation\_type: string The system name of the remediation type. Link to this property remediation\_type\_id: string Unique identifier for the remediation type. formatuuid Link to this property

Link to this property

webhook\_configs: array of object {display\_name, webhook\_config\_id } List of webhook configurations that will be triggered.

display\_name: string Display name/label of the webhook configuration. Link to this property webhook\_config\_id: string Unique identifier for the webhook configuration. formatuuid Link to this property

Link to this property

Link to this property applies\_to\_all\_integrations: boolean When true, the policy applies to all integrations for the account. When false, it applies only to the specified integration\_ids. Link to this property created\_at: string Timestamp when the policy was created. formatdate-time Link to this property description: string User-set description of what this policy does. Limited to 1000 characters. Link to this property display\_name: string Display name for the policy configuration. Limited to 255 characters. Link to this property enabled: boolean Whether the policy is enabled. Derived from disabled\_at (enabled when disabled\_at is unset). Link to this property finding\_type\_id: string The finding type this policy is associated with. Immutable after creation; changing it replaces the policy. formatuuid Link to this property integration\_ids: array of string The integrations this policy applies to. Link to this property updated\_at: string Timestamp when the policy was last updated. formatdate-time Link to this property disabled\_at: optional string Timestamp when the policy was disabled. Omitted from the response when the policy is enabled. formatdate-time Link to this property last\_triggered\_at: optional string Timestamp of the most recent successful policy invocation. Omitted from the response when the policy has never been successfully triggered. Only populated on GET responses; absent on responses from create/update endpoints. formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.policies%20%3E%20(model)%20policy_get_response%20%3E%20(schema)>)

PolicyUpdateResponse object {id, actions, applies\_to\_all\_integrations, 9 more } Response body for a policy configuration.

id: string Unique identifier for the policy configuration. formatuuid Link to this property

actions: object {remediation\_types, webhook\_configs } The actions configured for this policy.

remediation\_types: array of object {display\_name, remediation\_type, remediation\_type\_id } List of remediation types that will be executed.

display\_name: string Display name/label of the remediation type. Link to this property remediation\_type: string The system name of the remediation type. Link to this property remediation\_type\_id: string Unique identifier for the remediation type. formatuuid Link to this property

Link to this property

webhook\_configs: array of object {display\_name, webhook\_config\_id } List of webhook configurations that will be triggered.

display\_name: string Display name/label of the webhook configuration. Link to this property webhook\_config\_id: string Unique identifier for the webhook configuration. formatuuid Link to this property

Link to this property

Link to this property applies\_to\_all\_integrations: boolean When true, the policy applies to all integrations for the account. When false, it applies only to the specified integration\_ids. Link to this property created\_at: string Timestamp when the policy was created. formatdate-time Link to this property description: string User-set description of what this policy does. Limited to 1000 characters. Link to this property display\_name: string Display name for the policy configuration. Limited to 255 characters. Link to this property enabled: boolean Whether the policy is enabled. Derived from disabled\_at (enabled when disabled\_at is unset). Link to this property finding\_type\_id: string The finding type this policy is associated with. Immutable after creation; changing it replaces the policy. formatuuid Link to this property integration\_ids: array of string The integrations this policy applies to. Link to this property updated\_at: string Timestamp when the policy was last updated. formatdate-time Link to this property disabled\_at: optional string Timestamp when the policy was disabled. Omitted from the response when the policy is enabled. formatdate-time Link to this property last\_triggered\_at: optional string Timestamp of the most recent successful policy invocation. Omitted from the response when the policy has never been successfully triggered. Only populated on GET responses; absent on responses from create/update endpoints. formatdate-time Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.policies%20%3E%20(model)%20policy_update_response%20%3E%20(schema)>)

PolicyDeleteResponse object {id } Response from DeletePolicy operation.

id: string ID of the policy deleted. formatuuid Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.policies%20%3E%20(model)%20policy_delete_response%20%3E%20(schema)>) #### CasbPostureWebhooks ##### [List webhook configurations](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/webhooks/methods/list) GET/accounts/{account\_id}/data-security/posture/webhooks ##### [Create a new webhook configuration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/webhooks/methods/create) POST/accounts/{account\_id}/data-security/posture/webhooks ##### [Get webhook configuration by ID](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/webhooks/methods/get) GET/accounts/{account\_id}/data-security/posture/webhooks/{webhook\_id} ##### [Update an existing webhook configuration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/webhooks/methods/update) PUT/accounts/{account\_id}/data-security/posture/webhooks/{webhook\_id} ##### [Delete a webhook configuration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/webhooks/methods/delete) DELETE/accounts/{account\_id}/data-security/posture/webhooks/{webhook\_id} ##### [Test a webhook configuration before creating it](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/webhooks/methods/evaluate) POST/accounts/{account\_id}/data-security/posture/webhooks/evaluate ##### [Test an existing webhook configuration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/webhooks/methods/evaluate_existing) POST/accounts/{account\_id}/data-security/posture/webhooks/{webhook\_id}/evaluate ##### ModelsExpand Collapse

WebhookListResponse object {id, authentication\_type, created\_at, 6 more } Webhook configuration for sending finding notifications.

id: string Unique identifier for the specific webhook configuration. formatuuid Link to this property

authentication\_type: "Basic Auth"or "None"or "Bearer Auth"or 2 more Type of authentication used for the webhook.

One of the following: "Basic Auth" Link to this property "None" Link to this property "Bearer Auth" Link to this property "Static Headers" Link to this property "HMAC-Signing" Link to this property

Link to this property created\_at: string Timestamp when the webhook configuration was created. formatdate-time Link to this property destination\_url: string Target URL for the webhook configuration. Where resulting data will be sent. formaturi Link to this property label: string Account-specified display label for the webhook configuration. Link to this property

status: "enabled"or "disabled" Current status of the webhook configuration. If disabled, data cannot be sent through this configuration.

One of the following: "enabled" Link to this property "disabled" Link to this property

Link to this property updated\_at: string Timestamp when the webhook configuration was last updated. formatdate-time Link to this property version: number Version number of the configuration. formatuint32 Link to this property

headers: optional array of object {key, value } List of header keys configured for this webhook. Values are not included for security reasons.

key: optional string Header key name (lowercase). Link to this property value: optional string Header value. This field is never returned in API responses for security reasons. Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.webhooks%20%3E%20(model)%20webhook_list_response%20%3E%20(schema)>)

WebhookCreateResponse object {id, authentication\_type, created\_at, 6 more } Webhook configuration for sending finding notifications.

id: string Unique identifier for the specific webhook configuration. formatuuid Link to this property

authentication\_type: "Basic Auth"or "None"or "Bearer Auth"or 2 more Type of authentication used for the webhook.

One of the following: "Basic Auth" Link to this property "None" Link to this property "Bearer Auth" Link to this property "Static Headers" Link to this property "HMAC-Signing" Link to this property

Link to this property created\_at: string Timestamp when the webhook configuration was created. formatdate-time Link to this property destination\_url: string Target URL for the webhook configuration. Where resulting data will be sent. formaturi Link to this property label: string Account-specified display label for the webhook configuration. Link to this property

status: "enabled"or "disabled" Current status of the webhook configuration. If disabled, data cannot be sent through this configuration.

One of the following: "enabled" Link to this property "disabled" Link to this property

Link to this property updated\_at: string Timestamp when the webhook configuration was last updated. formatdate-time Link to this property version: number Version number of the configuration. formatuint32 Link to this property

headers: optional array of object {key, value } List of header keys configured for this webhook. Values are not included for security reasons.

key: optional string Header key name (lowercase). Link to this property value: optional string Header value. This field is never returned in API responses for security reasons. Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.webhooks%20%3E%20(model)%20webhook_create_response%20%3E%20(schema)>)

WebhookGetResponse object {id, authentication\_type, created\_at, 6 more } Webhook configuration for sending finding notifications.

id: string Unique identifier for the specific webhook configuration. formatuuid Link to this property

authentication\_type: "Basic Auth"or "None"or "Bearer Auth"or 2 more Type of authentication used for the webhook.

One of the following: "Basic Auth" Link to this property "None" Link to this property "Bearer Auth" Link to this property "Static Headers" Link to this property "HMAC-Signing" Link to this property

Link to this property created\_at: string Timestamp when the webhook configuration was created. formatdate-time Link to this property destination\_url: string Target URL for the webhook configuration. Where resulting data will be sent. formaturi Link to this property label: string Account-specified display label for the webhook configuration. Link to this property

status: "enabled"or "disabled" Current status of the webhook configuration. If disabled, data cannot be sent through this configuration.

One of the following: "enabled" Link to this property "disabled" Link to this property

Link to this property updated\_at: string Timestamp when the webhook configuration was last updated. formatdate-time Link to this property version: number Version number of the configuration. formatuint32 Link to this property

headers: optional array of object {key, value } List of header keys configured for this webhook. Values are not included for security reasons.

key: optional string Header key name (lowercase). Link to this property value: optional string Header value. This field is never returned in API responses for security reasons. Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.webhooks%20%3E%20(model)%20webhook_get_response%20%3E%20(schema)>)

WebhookUpdateResponse object {id, authentication\_type, created\_at, 6 more } Webhook configuration for sending finding notifications.

id: string Unique identifier for the specific webhook configuration. formatuuid Link to this property

authentication\_type: "Basic Auth"or "None"or "Bearer Auth"or 2 more Type of authentication used for the webhook.

One of the following: "Basic Auth" Link to this property "None" Link to this property "Bearer Auth" Link to this property "Static Headers" Link to this property "HMAC-Signing" Link to this property

Link to this property created\_at: string Timestamp when the webhook configuration was created. formatdate-time Link to this property destination\_url: string Target URL for the webhook configuration. Where resulting data will be sent. formaturi Link to this property label: string Account-specified display label for the webhook configuration. Link to this property

status: "enabled"or "disabled" Current status of the webhook configuration. If disabled, data cannot be sent through this configuration.

One of the following: "enabled" Link to this property "disabled" Link to this property

Link to this property updated\_at: string Timestamp when the webhook configuration was last updated. formatdate-time Link to this property version: number Version number of the configuration. formatuint32 Link to this property

headers: optional array of object {key, value } List of header keys configured for this webhook. Values are not included for security reasons.

key: optional string Header key name (lowercase). Link to this property value: optional string Header value. This field is never returned in API responses for security reasons. Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.webhooks%20%3E%20(model)%20webhook_update_response%20%3E%20(schema)>)

WebhookDeleteResponse object {errors, messages, success } Common response structure for all API endpoints.

errors: array of object {code, message, documentation\_url, source }

code: number Error or message code. minimum1000 Link to this property message: string Human-readable message. Link to this property documentation\_url: optional string Link to relevant documentation. formaturi Link to this property

source: optional object {pointer }

pointer: optional string JSON pointer to the source of the error. Link to this property

Link to this property

Link to this property

messages: array of object {code, message, documentation\_url, source }

code: number Error or message code. minimum1000 Link to this property message: string Human-readable message. Link to this property documentation\_url: optional string Link to relevant documentation. formaturi Link to this property

source: optional object {pointer }

pointer: optional string JSON pointer to the source of the error. Link to this property

Link to this property

Link to this property success: boolean Whether the API call was successful. Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.webhooks%20%3E%20(model)%20webhook_delete_response%20%3E%20(schema)>)

WebhookEvaluateResponse object {message, status\_code, success } Response body for webhook evaluation test results.

message: string Human-readable message describing the test result. Link to this property status\_code: number HTTP status code returned by the webhook endpoint. 0 if connection failed. Link to this property success: boolean Whether the webhook test was successful (received 2xx response). Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.webhooks%20%3E%20(model)%20webhook_evaluate_response%20%3E%20(schema)>)

WebhookEvaluateExistingResponse object {message, status\_code, success } Response body for webhook evaluation test results.

message: string Human-readable message describing the test result. Link to this property status\_code: number HTTP status code returned by the webhook endpoint. 0 if connection failed. Link to this property success: boolean Whether the webhook test was successful (received 2xx response). Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.webhooks%20%3E%20(model)%20webhook_evaluate_existing_response%20%3E%20(schema)>) #### CasbPostureWebhooksJobs ##### [Create webhook jobs](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/webhooks/subresources/jobs/methods/create) POST/accounts/{account\_id}/data-security/posture/webhooks/jobs ##### ModelsExpand Collapse

JobCreateResponse object {created, failed }

created: array of object {id, asset\_data, created\_at, 9 more } Successfully created webhook jobs.

id: string Unique identifier for the webhook job. formatuuid Link to this property asset\_data: map\[unknown] Asset data associated with this webhook job. Link to this property created\_at: string When the webhook job was created. formatdate-time Link to this property integration\_id: string ID of the integration. formatuuid Link to this property last\_updated\_at: string When the webhook job was last updated. formatdate-time Link to this property

parameters: object {finding\_instance\_id } Parameters for a webhook job.

finding\_instance\_id: string ID of the finding instance. formatuuid Link to this property

Link to this property

status: "pending"or "processing"or "completed"or "failed" Status of a webhook job.

One of the following: "pending" Link to this property "processing" Link to this property "completed" Link to this property "failed" Link to this property

Link to this property

triggered\_by\_actor: "user"or "account\_token" Type of actor that triggered the webhook job.

One of the following: "user" Link to this property "account\_token" Link to this property

Link to this property triggered\_by\_id: string ID of the actor that triggered the job. Link to this property webhook\_id: string ID of the webhook configuration. formatuuid Link to this property failure\_details: optional map\[unknown] Additional details about the failure. Link to this property

failure\_reason: optional "Permission Denied"or "Integration Unavailable"or "Service Temporarily Unavailable"or "System Error" Reason for webhook job failure.

One of the following: "Permission Denied" Link to this property "Integration Unavailable" Link to this property "Service Temporarily Unavailable" Link to this property "System Error" Link to this property

Link to this property

Link to this property

failed: array of object {error, finding\_instance\_id, webhook\_id } Failed webhook job creation attempts.

error: string Error message describing the failure. Link to this property finding\_instance\_id: string ID of the finding instance that failed to create a webhook job. formatuuid Link to this property webhook\_id: string ID of the webhook configuration. formatuuid Link to this property

Link to this property

[Link to this property](<#(resource)%20zero_trust.casb.posture.webhooks.jobs%20%3E%20(model)%20job_create_response%20%3E%20(schema)>)