Skip to content
Cloudflare API
Start here
API Reference

Abuse Reports

Submit an abuse report
client.abuseReports.create(stringreportParam, AbuseReportCreateParamsparams, RequestOptionsoptions?): AbuseReportCreateResponse
POST/accounts/{account_id}/abuse-reports/{report_param}
Get an abuse report against the account
client.abuseReports.get(stringreportParam, AbuseReportGetParams { account_id } params, RequestOptionsoptions?): AbuseReportGetResponse { id, cdate, domain, 7 more }
GET/accounts/{account_id}/abuse-reports/{report_param}
List abuse reports against the account
client.abuseReports.list(AbuseReportListParams { account_id, created_after, created_before, 7 more } params, RequestOptionsoptions?): V4PagePagination<AbuseReportListResponse { reports } >
GET/accounts/{account_id}/abuse-reports
ModelsExpand Collapse
AbuseReportCreateResponse = string

The result should be ‘success’ for successful response

AbuseReportGetResponse { id, cdate, domain, 7 more }
id: string

Public facing ID of abuse report, aka abuse_rand.

cdate: string

Creation date of report. Time in RFC 3339 format (https://www.rfc-editor.org/rfc/rfc3339.html)

domain: string

Domain that relates to the report.

mitigation_summary: MitigationSummary { accepted_url_count, active_count, external_host_notified, 2 more }

A summary of the mitigations related to this report.

accepted_url_count: number

How many of the reported URLs were confirmed as abusive.

active_count: number

How many mitigations are active.

external_host_notified: boolean

Whether the report has been forwarded to an external hosting provider.

in_review_count: number

How many mitigations are under review.

pending_count: number

How many mitigations are pending their effective date.

status: "accepted" | "in_review"

An enum value that represents the status of an abuse record

One of the following:
"accepted"
"in_review"
type: "PHISH" | "GEN" | "THREAT" | 6 more

The abuse report type

One of the following:
"PHISH"
"GEN"
"THREAT"
"DMCA"
"EMER"
"TM"
"REG_WHO"
"NCSEI"
"NETWORK"
justification?: string

Justification for the report.

original_work?: string

Original work / Targeted brand in the alleged abuse.

submitter?: Submitter { company, email, name, telephone }

Information about the submitter of the report.

company?: string
email?: string
name?: string
telephone?: string
urls?: Array<string>
AbuseReportListResponse { reports }
reports: Array<Report>
id: string

Public facing ID of abuse report, aka abuse_rand.

cdate: string

Creation date of report. Time in RFC 3339 format (https://www.rfc-editor.org/rfc/rfc3339.html)

domain: string

Domain that relates to the report.

mitigation_summary: MitigationSummary { accepted_url_count, active_count, external_host_notified, 2 more }

A summary of the mitigations related to this report.

accepted_url_count: number

How many of the reported URLs were confirmed as abusive.

active_count: number

How many mitigations are active.

external_host_notified: boolean

Whether the report has been forwarded to an external hosting provider.

in_review_count: number

How many mitigations are under review.

pending_count: number

How many mitigations are pending their effective date.

status: "accepted" | "in_review"

An enum value that represents the status of an abuse record

One of the following:
"accepted"
"in_review"
type: "PHISH" | "GEN" | "THREAT" | 6 more

The abuse report type

One of the following:
"PHISH"
"GEN"
"THREAT"
"DMCA"
"EMER"
"TM"
"REG_WHO"
"NCSEI"
"NETWORK"
justification?: string

Justification for the report.

original_work?: string

Original work / Targeted brand in the alleged abuse.

submitter?: Submitter { company, email, name, telephone }

Information about the submitter of the report.

company?: string
email?: string
name?: string
telephone?: string
urls?: Array<string>

Abuse ReportsSubmitted

List submitted abuse reports
client.abuseReports.submitted.list(SubmittedListParams { account_id, id, created_after, 7 more } params, RequestOptionsoptions?): V4PagePagination<SubmittedListResponse { reports } >
GET/accounts/{account_id}/abuse-reports/submitted
Get a submitted abuse report
client.abuseReports.submitted.get(stringreportID, SubmittedGetParams { account_id } params, RequestOptionsoptions?): SubmittedGetResponse { id, cdate, denial_reason, 25 more }
GET/accounts/{account_id}/abuse-reports/submitted/{report_id}
ModelsExpand Collapse
SubmittedListResponse { reports }
reports: Array<Report>
id: string

Public report code.

cdate: string

Time the report was submitted.

formatdate-time
denial_reason: "unable_to_confirm" | "incomplete_report" | "not_on_cloudflare" | 10 more | null

Submitter-safe reason for a denied report. Null when unavailable.

One of the following:
"unable_to_confirm"
"incomplete_report"
"not_on_cloudflare"
"duplicate_report"
"content_removed"
"report_details_mismatch"
"no_abuse_found"
"missing_original_work"
"direct_url_required"
"wrong_report_category"
"content_unavailable"
"law_enforcement_referral_required"
"domain_dispute_process_required"
domain: string

Domain identified in the report.

status: "submitted" | "accepted" | "denied"

Status visible to the account that submitted the report.

One of the following:
"submitted"
"accepted"
"denied"
type: "PHISH" | "GEN" | "THREAT" | 6 more

The abuse report type

One of the following:
"PHISH"
"GEN"
"THREAT"
"DMCA"
"EMER"
"TM"
"REG_WHO"
"NCSEI"
"NETWORK"
submitter?: Submitter { company, email, name, telephone }

Information about the submitter of the report.

company?: string
email?: string
name?: string
telephone?: string
SubmittedGetResponse { id, cdate, denial_reason, 25 more }
id: string

Public report code.

cdate: string

Time the report was submitted.

formatdate-time
denial_reason: "unable_to_confirm" | "incomplete_report" | "not_on_cloudflare" | 10 more | null

Submitter-safe reason for a denied report. Null when unavailable.

One of the following:
"unable_to_confirm"
"incomplete_report"
"not_on_cloudflare"
"duplicate_report"
"content_removed"
"report_details_mismatch"
"no_abuse_found"
"missing_original_work"
"direct_url_required"
"wrong_report_category"
"content_unavailable"
"law_enforcement_referral_required"
"domain_dispute_process_required"
domain: string

Domain identified in the report.

dsa_attestation: boolean

Whether the submitter provided the Digital Services Act attestation.

status: "submitted" | "accepted" | "denied"

Status visible to the account that submitted the report.

One of the following:
"submitted"
"accepted"
"denied"
type: "PHISH" | "GEN" | "THREAT" | 6 more

The abuse report type

One of the following:
"PHISH"
"GEN"
"THREAT"
"DMCA"
"EMER"
"TM"
"REG_WHO"
"NCSEI"
"NETWORK"
urls: Array<string>

URLs supplied with the report.

agent_name?: string

Authorized agent name supplied with the report.

comments?: string

Additional comments supplied with the report.

court?: string

The string “on” when a court proceeding applies to the report; otherwise omitted.

destination_ips?: Array<string>

Destination IP addresses supplied with a network abuse report.

host_notification?: string

Submitter preference for notifying the hosting provider.

justification?: string

Evidence supplied with the report.

ncmec_notification?: string

Submitter preference for notifying NCMEC.

ncsei_subject_representation?: boolean

Representation supplied for an NCSEI report.

original_work?: string

Original work or targeted brand supplied with the report.

owner_notification?: string

Submitter preference for notifying the content owner.

ports_protocols?: Array<string>

Ports and protocols supplied with a network abuse report.

reg_who_request?: RegWhoRequest { reg_who_good_faith_affirmation, reg_who_lawful_processing_agreement, reg_who_legal_basis, 4 more }

RDP-mandated fields for registrar WHOIS data disclosure requests.

reg_who_good_faith_affirmation: boolean

Affirmation that the request is made in good faith per RDP 10.2.4. Must be true.

reg_who_lawful_processing_agreement: boolean

Agreement to process data lawfully per RDP 10.2.5. Must be true.

reg_who_request_type: "disclosure" | "invalid_whois"

The type of WHOIS data request per RDP procedure.

One of the following:
"disclosure"
"invalid_whois"
reg_who_requested_data_elements: Array<"registrant_name" | "registrant_organization" | "registrant_email" | 14 more>

The specific WHOIS data elements being requested per RDP 10.2.2. Required for all WHOIS requests.

One of the following:
"registrant_name"
"registrant_organization"
"registrant_email"
"registrant_phone"
"registrant_address"
"registrant_address_country"
"registrant_address_postal_code"
"admin_name"
"admin_organization"
"admin_email"
"admin_phone"
"admin_address"
"tech_name"
"tech_organization"
"tech_email"
"tech_phone"
"tech_address"
reg_who_authorization_statement?: string

Optional authorization statement or power of attorney per RDP 10.2.1.3.

maxLength5000
reg_who_requestor_type?: "government" | "corporation" | "individual"

The nature of the requestor per RDP 10.2.1.2.

One of the following:
"government"
"corporation"
"individual"
reported_country?: string

Country associated with the reported activity.

reported_user_agent?: string

User agent associated with the reported activity.

source_ips?: Array<string>

Source IP addresses supplied with a network abuse report.

submitter?: Submitter { company, email, name, telephone }

Information about the submitter of the report.

company?: string
email?: string
name?: string
telephone?: string
subtypes?: Array<string>

Additional abuse classifications supplied with the report.

title?: string

Title supplied with the report.

udrp?: string

The string “on” when a UDRP proceeding applies to the report; otherwise omitted.

urs?: string

The string “on” when a URS proceeding applies to the report; otherwise omitted.

Abuse ReportsSubmittedEmails

List emails sent to an abuse report submitter
client.abuseReports.submitted.emails.list(stringreportID, EmailListParams { account_id, page, per_page } params, RequestOptionsoptions?): V4PagePagination<EmailListResponse { emails } >
GET/accounts/{account_id}/abuse-reports/submitted/{report_id}/emails
ModelsExpand Collapse
EmailListResponse { emails }
emails: Array<Email>
id: string

Unique identifier of the email.

body: string

Body content of the email.

recipient: string

Email address of the recipient.

sent_at: string

When the email was sent. Time in RFC 3339 format (https://www.rfc-editor.org/rfc/rfc3339.html)

subject: string

Subject line of the email.

Abuse ReportsMitigations

List abuse report mitigations
client.abuseReports.mitigations.list(stringreportID, MitigationListParams { account_id, effective_after, effective_before, 6 more } params, RequestOptionsoptions?): V4PagePagination<MitigationListResponse { mitigations } >
GET/accounts/{account_id}/abuse-reports/{report_id}/mitigations
Request review on mitigations
client.abuseReports.mitigations.review(stringreportID, MitigationReviewParams { account_id, appeals, data, type } params, RequestOptionsoptions?): SinglePage<MitigationReviewResponse { id, effective_date, entity_id, 3 more } >
POST/accounts/{account_id}/abuse-reports/{report_id}/mitigations/appeal
ModelsExpand Collapse
MitigationListResponse { mitigations }
mitigations: Array<Mitigation>
id: string

ID of remediation.

effective_date: string

Date when the mitigation will become active. Time in RFC 3339 format (https://www.rfc-editor.org/rfc/rfc3339.html)

entity_id: string
entity_type: "url_pattern" | "account" | "zone" | "custom_expression"

The type of entity targeted by a mitigation.

One of the following:
"url_pattern"
"account"
"zone"
"custom_expression"
status: "pending" | "active" | "in_review" | 2 more

The status of a mitigation

One of the following:
"pending"
"active"
"in_review"
"cancelled"
"removed"
type: string

The type of mitigation applied to a reported entity.

MitigationReviewResponse { id, effective_date, entity_id, 3 more }
id: string

ID of remediation.

effective_date: string

Date when the mitigation will become active. Time in RFC 3339 format (https://www.rfc-editor.org/rfc/rfc3339.html)

entity_id: string
entity_type: "url_pattern" | "account" | "zone" | "custom_expression"

The type of entity targeted by a mitigation.

One of the following:
"url_pattern"
"account"
"zone"
"custom_expression"
status: "pending" | "active" | "in_review" | 2 more

The status of a mitigation

One of the following:
"pending"
"active"
"in_review"
"cancelled"
"removed"
type: string

The type of mitigation applied to a reported entity.