--- title: Cloudforce One --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/typescript) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Cloudforce One #### Cloudforce OneBinary Storage ##### [Retrieves a file from Binary Storage](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/binary_storage/methods/get) client.cloudforceOne.binaryStorage.get(stringhash, BinaryStorageGetParams {account\_id } params, RequestOptionsoptions?): void GET/accounts/{account\_id}/cloudforce-one/binary/{hash} ##### [Posts a file to Binary Storage](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/binary_storage/methods/create) client.cloudforceOne.binaryStorage.create(BinaryStorageCreateParams {account\_id, file } params, RequestOptionsoptions?): [BinaryStorageCreateResponse]() {content\_type, md5, sha1, sha256 } POST/accounts/{account\_id}/cloudforce-one/binary ##### ModelsExpand Collapse
BinaryStorageCreateResponse {content\_type, md5, sha1, sha256 } content\_type: string Link to this property md5: string Link to this property sha1: string Link to this property sha256: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.binary_storage%20%3E%20(model)%20binary_storage_create_response%20%3E%20(schema)>) #### Cloudforce OneRequests ##### [List Requests](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/methods/list) client.cloudforceOne.requests.list(RequestListParams {account\_id, page, per\_page, 8 more } params, RequestOptionsoptions?): SinglePage< [ListItem]() {id, created, priority, 9 more } > POST/accounts/{account\_id}/cloudforce-one/requests ##### [Get a Request](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/methods/get) client.cloudforceOne.requests.get(stringrequestID, RequestGetParams {account\_id } params, RequestOptionsoptions?): [Item]() {id, content, created, 10 more } GET/accounts/{account\_id}/cloudforce-one/requests/{request\_id} ##### [Create a New Request.](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/methods/create) client.cloudforceOne.requests.create(RequestCreateParams {account\_id, content, priority, 3 more } params, RequestOptionsoptions?): [Item]() {id, content, created, 10 more } POST/accounts/{account\_id}/cloudforce-one/requests/new ##### [Update a Request](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/methods/update) client.cloudforceOne.requests.update(stringrequestID, RequestUpdateParams {account\_id, content, priority, 3 more } params, RequestOptionsoptions?): [Item]() {id, content, created, 10 more } PUT/accounts/{account\_id}/cloudforce-one/requests/{request\_id} ##### [Delete a Request](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/methods/delete) client.cloudforceOne.requests.delete(stringrequestID, RequestDeleteParams {account\_id } params, RequestOptionsoptions?): [RequestDeleteResponse]() {errors, messages, success } DELETE/accounts/{account\_id}/cloudforce-one/requests/{request\_id} ##### [Get Request Quota](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/methods/quota) client.cloudforceOne.requests.quota(RequestQuotaParams {account\_id } params, RequestOptionsoptions?): [Quota]() {anniversary\_date, quarter\_anniversary\_date, quota, remaining } GET/accounts/{account\_id}/cloudforce-one/requests/quota ##### [Get Request Types](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/methods/types) client.cloudforceOne.requests.types(RequestTypesParams {account\_id } params, RequestOptionsoptions?): SinglePage< [RequestTypesResponse]()> GET/accounts/{account\_id}/cloudforce-one/requests/types ##### [Get Request Priority, Status, and TLP constants](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/methods/constants) client.cloudforceOne.requests.constants(RequestConstantsParams {account\_id } params, RequestOptionsoptions?): [RequestConstants]() {priority, status, tlp } GET/accounts/{account\_id}/cloudforce-one/requests/constants ##### ModelsExpand Collapse
Item {id, content, created, 10 more } id: string UUID. maxLength36 Link to this property content: string Request content. Link to this property created: string formatdate-time Link to this property priority: string formatdate-time Link to this property request: string Requested information from request. Link to this property summary: string Brief description of the request. Link to this property
tlp: "clear"| "amber"| "amber-strict"| 2 more The CISA defined Traffic Light Protocol (TLP). One of the following: "clear" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "red" Link to this property
Link to this property updated: string formatdate-time Link to this property completed?: string formatdate-time Link to this property message\_tokens?: number Tokens for the request messages. Link to this property readable\_id?: string Readable Request ID. Link to this property
status?: "open"| "accepted"| "reported"| 3 more Request Status. One of the following: "open" Link to this property "accepted" Link to this property "reported" Link to this property "approved" Link to this property "completed" Link to this property "declined" Link to this property
Link to this property tokens?: number Tokens for the request. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20item%20%3E%20(schema)>)
ListItem {id, created, priority, 9 more } id: string UUID. maxLength36 Link to this property created: string Request creation time. formatdate-time Link to this property
priority: "routine"| "high"| "urgent" One of the following: "routine" Link to this property "high" Link to this property "urgent" Link to this property
Link to this property request: string Requested information from request. Link to this property summary: string Brief description of the request. Link to this property
tlp: "clear"| "amber"| "amber-strict"| 2 more The CISA defined Traffic Light Protocol (TLP). One of the following: "clear" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "red" Link to this property
Link to this property updated: string Request last updated time. formatdate-time Link to this property completed?: string Request completion time. formatdate-time Link to this property message\_tokens?: number Tokens for the request messages. Link to this property readable\_id?: string Readable Request ID. Link to this property
status?: "open"| "accepted"| "reported"| 3 more Request Status. One of the following: "open" Link to this property "accepted" Link to this property "reported" Link to this property "approved" Link to this property "completed" Link to this property "declined" Link to this property
Link to this property tokens?: number Tokens for the request. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20list_item%20%3E%20(schema)>)
Quota {anniversary\_date, quarter\_anniversary\_date, quota, remaining } anniversary\_date?: string Anniversary date is when annual quota limit is refreshed. formatdate-time Link to this property quarter\_anniversary\_date?: string Quarter anniversary date is when quota limit is refreshed each quarter. formatdate-time Link to this property quota?: number Tokens for the quarter. Link to this property remaining?: number Tokens remaining for the quarter. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20quota%20%3E%20(schema)>)
RequestConstants {priority, status, tlp }
priority?: Array<"routine"| "high"| "urgent"> One of the following: "routine" Link to this property "high" Link to this property "urgent" Link to this property
Link to this property
status?: Array<"open"| "accepted"| "reported"| 3 more> One of the following: "open" Link to this property "accepted" Link to this property "reported" Link to this property "approved" Link to this property "completed" Link to this property "declined" Link to this property
Link to this property
tlp?: Array<"clear"| "amber"| "amber-strict"| 2 more> One of the following: "clear" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "red" Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20request_constants%20%3E%20(schema)>) RequestTypes = Array< [RequestTypesResponse]()> [Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20request_types%20%3E%20(schema)>)
RequestDeleteResponse {errors, messages, success }
errors: Array<Error> code: number minimum1000 Link to this property message: string Link to this property documentation\_url?: string Link to this property
source?: Source {pointer } pointer?: string Link to this property
Link to this property
Link to this property
messages: Array<Message> code: number minimum1000 Link to this property message: string Link to this property documentation\_url?: string Link to this property
source?: Source {pointer } pointer?: string Link to this property
Link to this property
Link to this property success: true Whether the API call was successful. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20request_delete_response%20%3E%20(schema)>) RequestTypesResponse = string Request Types. [Link to this property](<#(resource)%20cloudforce_one.requests%20%3E%20(model)%20request_types_response%20%3E%20(schema)>) #### Cloudforce OneRequestsMessage ##### [List Request Messages](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/subresources/message/methods/get) client.cloudforceOne.requests.message.get(stringrequestID, MessageGetParams {account\_id, page, per\_page, 4 more } params, RequestOptionsoptions?): SinglePage< [Message]() {id, author, content, 3 more } > POST/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/message ##### [Create a New Request Message](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/subresources/message/methods/create) client.cloudforceOne.requests.message.create(stringrequestID, MessageCreateParams {account\_id, content } params, RequestOptionsoptions?): [Message]() {id, author, content, 3 more } POST/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/message/new ##### [Update a Request Message](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/subresources/message/methods/update) client.cloudforceOne.requests.message.update(numbermessageID, MessageUpdateParams {account\_id, request\_id, content } params, RequestOptionsoptions?): [Message]() {id, author, content, 3 more } PUT/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/message/{message\_id} ##### [Delete a Request Message](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/subresources/message/methods/delete) client.cloudforceOne.requests.message.delete(numbermessageID, MessageDeleteParams {account\_id, request\_id } params, RequestOptionsoptions?): [MessageDeleteResponse]() {errors, messages, success } DELETE/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/message/{message\_id} ##### ModelsExpand Collapse
Message {id, author, content, 3 more } id: number Message ID. Link to this property author: string Author of message. Link to this property content: string Content of message. Link to this property is\_follow\_on\_request: boolean Whether the message is a follow-on request. Link to this property updated: string Defines the message last updated time. formatdate-time Link to this property created?: string Defines the message creation time. formatdate-time Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.message%20%3E%20(model)%20message%20%3E%20(schema)>)
MessageDeleteResponse {errors, messages, success }
errors: Array<Error> code: number minimum1000 Link to this property message: string Link to this property documentation\_url?: string Link to this property
source?: Source {pointer } pointer?: string Link to this property
Link to this property
Link to this property
messages: Array<Message> code: number minimum1000 Link to this property message: string Link to this property documentation\_url?: string Link to this property
source?: Source {pointer } pointer?: string Link to this property
Link to this property
Link to this property success: true Whether the API call was successful. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.message%20%3E%20(model)%20message_delete_response%20%3E%20(schema)>) #### Cloudforce OneRequestsPriority ##### [Get a Priority Intelligence Requirement](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/subresources/priority/methods/get) client.cloudforceOne.requests.priority.get(stringpriorityID, PriorityGetParams {account\_id } params, RequestOptionsoptions?): [Item]() {id, content, created, 10 more } GET/accounts/{account\_id}/cloudforce-one/requests/priority/{priority\_id} ##### [Create a New Priority Intelligence Requirement](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/subresources/priority/methods/create) client.cloudforceOne.requests.priority.create(PriorityCreateParams {account\_id, labels, priority, 2 more } params, RequestOptionsoptions?): [Priority]() {id, created, labels, 4 more } POST/accounts/{account\_id}/cloudforce-one/requests/priority/new ##### [Update a Priority Intelligence Requirement](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/subresources/priority/methods/update) client.cloudforceOne.requests.priority.update(stringpriorityID, PriorityUpdateParams {account\_id, labels, priority, 2 more } params, RequestOptionsoptions?): [Item]() {id, content, created, 10 more } PUT/accounts/{account\_id}/cloudforce-one/requests/priority/{priority\_id} ##### [Delete a Priority Intelligence Requirement](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/subresources/priority/methods/delete) client.cloudforceOne.requests.priority.delete(stringpriorityID, PriorityDeleteParams {account\_id } params, RequestOptionsoptions?): [PriorityDeleteResponse]() {errors, messages, success } DELETE/accounts/{account\_id}/cloudforce-one/requests/priority/{priority\_id} ##### [Get Priority Intelligence Requirement Quota](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/subresources/priority/methods/quota) client.cloudforceOne.requests.priority.quota(PriorityQuotaParams {account\_id } params, RequestOptionsoptions?): [Quota]() {anniversary\_date, quarter\_anniversary\_date, quota, remaining } GET/accounts/{account\_id}/cloudforce-one/requests/priority/quota ##### ModelsExpand Collapse Label = string [Link to this property](<#(resource)%20cloudforce_one.requests.priority%20%3E%20(model)%20label%20%3E%20(schema)>)
Priority {id, created, labels, 4 more } id: string UUID. maxLength36 Link to this property created: string Priority creation time. formatdate-time Link to this property labels: Array<Label> List of labels. Link to this property priority: number Priority. Link to this property requirement: string Requirement. Link to this property
tlp: "clear"| "amber"| "amber-strict"| 2 more The CISA defined Traffic Light Protocol (TLP). One of the following: "clear" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "red" Link to this property
Link to this property updated: string Priority last updated time. formatdate-time Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.priority%20%3E%20(model)%20priority%20%3E%20(schema)>)
PriorityEdit {labels, priority, requirement, tlp } labels: Array<Label> List of labels. Link to this property priority: number Priority. Link to this property requirement: string Requirement. Link to this property
tlp: "clear"| "amber"| "amber-strict"| 2 more The CISA defined Traffic Light Protocol (TLP). One of the following: "clear" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "red" Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.priority%20%3E%20(model)%20priority_edit%20%3E%20(schema)>)
PriorityDeleteResponse {errors, messages, success }
errors: Array<Error> code: number minimum1000 Link to this property message: string Link to this property documentation\_url?: string Link to this property
source?: Source {pointer } pointer?: string Link to this property
Link to this property
Link to this property
messages: Array<Message> code: number minimum1000 Link to this property message: string Link to this property documentation\_url?: string Link to this property
source?: Source {pointer } pointer?: string Link to this property
Link to this property
Link to this property success: true Whether the API call was successful. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.priority%20%3E%20(model)%20priority_delete_response%20%3E%20(schema)>) #### Cloudforce OneRequestsAssets ##### [Get a Request Asset](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/subresources/assets/methods/get) client.cloudforceOne.requests.assets.get(stringassetID, AssetGetParams {account\_id, request\_id } params, RequestOptionsoptions?): SinglePage< [AssetGetResponse]() {id, name, created, 2 more } > GET/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/asset/{asset\_id} ##### [List Request Assets](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/subresources/assets/methods/create) client.cloudforceOne.requests.assets.create(stringrequestID, AssetCreateParams {account\_id, page, per\_page } params, RequestOptionsoptions?): SinglePage< [AssetCreateResponse]() {id, name, created, 2 more } > POST/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/asset ##### [Update a Request Asset](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/subresources/assets/methods/update) client.cloudforceOne.requests.assets.update(stringassetID, AssetUpdateParams {account\_id, request\_id, source } params, RequestOptionsoptions?): [AssetUpdateResponse]() {id, name, created, 2 more } PUT/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/asset/{asset\_id} ##### [Delete a Request Asset](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/requests/subresources/assets/methods/delete) client.cloudforceOne.requests.assets.delete(stringassetID, AssetDeleteParams {account\_id, request\_id } params, RequestOptionsoptions?): [AssetDeleteResponse]() {errors, messages, success } DELETE/accounts/{account\_id}/cloudforce-one/requests/{request\_id}/asset/{asset\_id} ##### ModelsExpand Collapse
AssetGetResponse {id, name, created, 2 more } id: number Asset ID. Link to this property name: string Asset name. Link to this property created?: string Defines the asset creation time. formatdate-time Link to this property description?: string Asset description. Link to this property file\_type?: string Asset file type. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.assets%20%3E%20(model)%20asset_get_response%20%3E%20(schema)>)
AssetCreateResponse {id, name, created, 2 more } id: number Asset ID. Link to this property name: string Asset name. Link to this property created?: string Defines the asset creation time. formatdate-time Link to this property description?: string Asset description. Link to this property file\_type?: string Asset file type. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.assets%20%3E%20(model)%20asset_create_response%20%3E%20(schema)>)
AssetUpdateResponse {id, name, created, 2 more } id: number Asset ID. Link to this property name: string Asset name. Link to this property created?: string Defines the asset creation time. formatdate-time Link to this property description?: string Asset description. Link to this property file\_type?: string Asset file type. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.assets%20%3E%20(model)%20asset_update_response%20%3E%20(schema)>)
AssetDeleteResponse {errors, messages, success }
errors: Array<Error> code: number minimum1000 Link to this property message: string Link to this property documentation\_url?: string Link to this property
source?: Source {pointer } pointer?: string Link to this property
Link to this property
Link to this property
messages: Array<Message> code: number minimum1000 Link to this property message: string Link to this property documentation\_url?: string Link to this property
source?: Source {pointer } pointer?: string Link to this property
Link to this property
Link to this property success: true Whether the API call was successful. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.requests.assets%20%3E%20(model)%20asset_delete_response%20%3E%20(schema)>) #### Cloudforce OneScans #### Cloudforce OneScansResults ##### [Get the Latest Scan Result](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/scans/subresources/results/methods/get) client.cloudforceOne.scans.results.get(stringconfigID, ResultGetParams {account\_id } params, RequestOptionsoptions?): [ResultGetResponse]() {1.1.1.1 } GET/accounts/{account\_id}/cloudforce-one/scans/results/{config\_id} ##### ModelsExpand Collapse
ScanResult {number, proto, status } number?: number Link to this property proto?: string Link to this property status?: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.scans.results%20%3E%20(model)%20scan_result%20%3E%20(schema)>)
ResultGetResponse {1.1.1.1 }
"1.1.1.1": Array<ScanResult {number, proto, status } > number?: number Link to this property proto?: string Link to this property status?: string Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.scans.results%20%3E%20(model)%20result_get_response%20%3E%20(schema)>) #### Cloudforce OneScansConfig ##### [List Scan Configs](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/scans/subresources/config/methods/list) client.cloudforceOne.scans.config.list(ConfigListParams {account\_id } params, RequestOptionsoptions?): SinglePage< [ConfigListResponse]() {id, account\_id, frequency, 2 more } > GET/accounts/{account\_id}/cloudforce-one/scans/config ##### [Create a new Scan Config](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/scans/subresources/config/methods/create) client.cloudforceOne.scans.config.create(ConfigCreateParams {account\_id, ips, frequency, ports } params, RequestOptionsoptions?): [ConfigCreateResponse]() {id, account\_id, frequency, 2 more } POST/accounts/{account\_id}/cloudforce-one/scans/config ##### [Update an existing Scan Config](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/scans/subresources/config/methods/edit) client.cloudforceOne.scans.config.edit(stringconfigID, ConfigEditParams {account\_id, frequency, ips, ports } params, RequestOptionsoptions?): [ConfigEditResponse]() {id, account\_id, frequency, 2 more } PATCH/accounts/{account\_id}/cloudforce-one/scans/config/{config\_id} ##### [Delete a Scan Config](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/scans/subresources/config/methods/delete) client.cloudforceOne.scans.config.delete(stringconfigID, ConfigDeleteParams {account\_id } params, RequestOptionsoptions?): [ConfigDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/scans/config/{config\_id} ##### ModelsExpand Collapse
ConfigListResponse {id, account\_id, frequency, 2 more } id: string Defines the Config ID. Link to this property account\_id: string Link to this property frequency: number Defines the number of days between each scan (0 = One-off scan). Link to this property ips: Array<string> Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000. Link to this property ports: Array<string> Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. \[“1-80”, “443”]). “default” scans the 100 most commonly open ports. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.scans.config%20%3E%20(model)%20config_list_response%20%3E%20(schema)>)
ConfigCreateResponse {id, account\_id, frequency, 2 more } id: string Defines the Config ID. Link to this property account\_id: string Link to this property frequency: number Defines the number of days between each scan (0 = One-off scan). Link to this property ips: Array<string> Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000. Link to this property ports: Array<string> Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. \[“1-80”, “443”]). “default” scans the 100 most commonly open ports. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.scans.config%20%3E%20(model)%20config_create_response%20%3E%20(schema)>)
ConfigEditResponse {id, account\_id, frequency, 2 more } id: string Defines the Config ID. Link to this property account\_id: string Link to this property frequency: number Defines the number of days between each scan (0 = One-off scan). Link to this property ips: Array<string> Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000. Link to this property ports: Array<string> Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. \[“1-80”, “443”]). “default” scans the 100 most commonly open ports. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.scans.config%20%3E%20(model)%20config_edit_response%20%3E%20(schema)>) ConfigDeleteResponse = unknown [Link to this property](<#(resource)%20cloudforce_one.scans.config%20%3E%20(model)%20config_delete_response%20%3E%20(schema)>) #### Cloudforce OneThreat Events ##### [Filter and list events](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/methods/list) client.cloudforceOne.threatEvents.list(ThreatEventListParams {account\_id, cache, cursor, 9 more } params, RequestOptionsoptions?): [ThreatEventListResponse]() {attacker, attackerCountry, attackerCountryAlpha3, 26 more } GET/accounts/{account\_id}/cloudforce-one/events ##### [Reads an event](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/methods/get) Deprecated client.cloudforceOne.threatEvents.get(stringeventID, ThreatEventGetParams {account\_id } params, RequestOptionsoptions?): [ThreatEventGetResponse]() {attacker, attackerCountry, attackerCountryAlpha3, 26 more } GET/accounts/{account\_id}/cloudforce-one/events/{event\_id} ##### [Creates a new event](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/methods/create) client.cloudforceOne.threatEvents.create(ThreatEventCreateParams {account\_id, category, date, 15 more } params, RequestOptionsoptions?): [ThreatEventCreateResponse]() {attacker, attackerCountry, attackerCountryAlpha3, 26 more } POST/accounts/{account\_id}/cloudforce-one/events/create ##### [Updates an event](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/methods/edit) client.cloudforceOne.threatEvents.edit(stringeventID, ThreatEventEditParams {account\_id, datasetId, attacker, 12 more } params, RequestOptionsoptions?): [ThreatEventEditResponse]() {attacker, attackerCountry, attackerCountryAlpha3, 26 more } PATCH/accounts/{account\_id}/cloudforce-one/events/{event\_id} ##### [Creates bulk events](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/methods/bulk_create) client.cloudforceOne.threatEvents.bulkCreate(ThreatEventBulkCreateParams {account\_id, data, datasetId, includeCreatedEvents } params, RequestOptionsoptions?): [ThreatEventBulkCreateResponse]() {createdEventsCount, createdTagsCount, errorCount, 4 more } POST/accounts/{account\_id}/cloudforce-one/events/create/bulk ##### [Creates bulk DOS event with relationships and indicators](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/methods/bulk_create_relationships) Deprecated client.cloudforceOne.threatEvents.bulkCreateRelationships(ThreatEventBulkCreateRelationshipsParams {account\_id, data, datasetId } params, RequestOptionsoptions?): [ThreatEventBulkCreateRelationshipsResponse]() {createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more } POST/accounts/{account\_id}/cloudforce-one/events/create/bulk/relationships ##### ModelsExpand Collapse
ThreatEventListResponse = Array<ThreatEventListResponseItem> attacker: string Link to this property attackerCountry: string Link to this property attackerCountryAlpha3: string Link to this property category: string Link to this property datasetId: string Link to this property date: string Link to this property event: string Link to this property hasChildren: boolean Link to this property indicator: string Link to this property indicatorType: string Link to this property indicatorTypeId: number Link to this property killChain: number Link to this property mitreAttack: Array<string> Link to this property mitreCapec: Array<string> Link to this property numReferenced: number Link to this property numReferences: number Link to this property rawId: string Link to this property referenced: Array<string> Link to this property referencedIds: Array<number> Link to this property references: Array<string> Link to this property referencesIds: Array<number> Link to this property tags: Array<string> Link to this property targetCountry: string Link to this property targetCountryAlpha3: string Link to this property targetIndustry: string Link to this property tlp: string Link to this property uuid: string Link to this property insight?: string Link to this property releasabilityId?: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_list_response%20%3E%20(schema)>)
ThreatEventGetResponse {attacker, attackerCountry, attackerCountryAlpha3, 26 more } attacker: string Link to this property attackerCountry: string Link to this property attackerCountryAlpha3: string Link to this property category: string Link to this property datasetId: string Link to this property date: string Link to this property event: string Link to this property hasChildren: boolean Link to this property indicator: string Link to this property indicatorType: string Link to this property indicatorTypeId: number Link to this property killChain: number Link to this property mitreAttack: Array<string> Link to this property mitreCapec: Array<string> Link to this property numReferenced: number Link to this property numReferences: number Link to this property rawId: string Link to this property referenced: Array<string> Link to this property referencedIds: Array<number> Link to this property references: Array<string> Link to this property referencesIds: Array<number> Link to this property tags: Array<string> Link to this property targetCountry: string Link to this property targetCountryAlpha3: string Link to this property targetIndustry: string Link to this property tlp: string Link to this property uuid: string Link to this property insight?: string Link to this property releasabilityId?: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_get_response%20%3E%20(schema)>)
ThreatEventCreateResponse {attacker, attackerCountry, attackerCountryAlpha3, 26 more } attacker: string Link to this property attackerCountry: string Link to this property attackerCountryAlpha3: string Link to this property category: string Link to this property datasetId: string Link to this property date: string Link to this property event: string Link to this property hasChildren: boolean Link to this property indicator: string Link to this property indicatorType: string Link to this property indicatorTypeId: number Link to this property killChain: number Link to this property mitreAttack: Array<string> Link to this property mitreCapec: Array<string> Link to this property numReferenced: number Link to this property numReferences: number Link to this property rawId: string Link to this property referenced: Array<string> Link to this property referencedIds: Array<number> Link to this property references: Array<string> Link to this property referencesIds: Array<number> Link to this property tags: Array<string> Link to this property targetCountry: string Link to this property targetCountryAlpha3: string Link to this property targetIndustry: string Link to this property tlp: string Link to this property uuid: string Link to this property insight?: string Link to this property releasabilityId?: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_create_response%20%3E%20(schema)>)
ThreatEventEditResponse {attacker, attackerCountry, attackerCountryAlpha3, 26 more } attacker: string Link to this property attackerCountry: string Link to this property attackerCountryAlpha3: string Link to this property category: string Link to this property datasetId: string Link to this property date: string Link to this property event: string Link to this property hasChildren: boolean Link to this property indicator: string Link to this property indicatorType: string Link to this property indicatorTypeId: number Link to this property killChain: number Link to this property mitreAttack: Array<string> Link to this property mitreCapec: Array<string> Link to this property numReferenced: number Link to this property numReferences: number Link to this property rawId: string Link to this property referenced: Array<string> Link to this property referencedIds: Array<number> Link to this property references: Array<string> Link to this property referencesIds: Array<number> Link to this property tags: Array<string> Link to this property targetCountry: string Link to this property targetCountryAlpha3: string Link to this property targetIndustry: string Link to this property tlp: string Link to this property uuid: string Link to this property insight?: string Link to this property releasabilityId?: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_edit_response%20%3E%20(schema)>)
ThreatEventBulkCreateResponse {createdEventsCount, createdTagsCount, errorCount, 4 more } Detailed result of bulk event creation with auto-tag management createdEventsCount: number Number of events created Link to this property createdTagsCount: number Number of new tags created in SoT Link to this property errorCount: number Number of errors encountered Link to this property queuedIndicatorsCount: number Number of indicators queued for async processing Link to this property createBulkEventsRequestId?: string Correlation ID for async indicator processing formatuuid Link to this property
createdEvents?: Array<CreatedEvent> Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true eventIndex: number Original index in the input data array Link to this property shardId: string Dataset ID of the shard where the event was created Link to this property uuid: string UUID of the created event formatuuid Link to this property
Link to this property
errors?: Array<Error> Array of error details error: string Error message Link to this property eventIndex: number Index of the event that caused the error Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_response%20%3E%20(schema)>)
ThreatEventBulkCreateRelationshipsResponse {createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more } Result of bulk relationship creation operation createdEventsCount: number Number of events created Link to this property createdIndicatorsCount: number Number of indicators created Link to this property createdRelationshipsCount: number Number of relationships created Link to this property errorCount: number Number of errors encountered Link to this property
errors?: Array<Error> Array of error details error: string Error message Link to this property eventIndex: number Index of the event that caused the error Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_relationships_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsAggregate ##### [Aggregate events by single or multiple columns with optional date filtering](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/aggregate/methods/list) client.cloudforceOne.threatEvents.aggregate.list(AggregateListParams {account\_id, aggregateBy, datasetId, 4 more } params, RequestOptionsoptions?): [AggregateListResponse]() {aggregateBy, aggregations, total, dateRange } GET/accounts/{account\_id}/cloudforce-one/events/aggregate ##### ModelsExpand Collapse
AggregateListResponse {aggregateBy, aggregations, total, dateRange } aggregateBy: string Column(s) that were aggregated by Link to this property
aggregations: Array<Aggregation> Array of aggregation results with dynamic fields based on aggregateBy columns count: number Number of events for this aggregation Link to this property date?: string Date (if groupByDate is true) Link to this property
Link to this property total: number Total number of events in the aggregation Link to this property
dateRange?: DateRange {endDate, startDate } Date range used for filtering endDate?: string Link to this property startDate?: string Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.aggregate%20%3E%20(model)%20aggregate_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsGraphql ##### [GraphQL endpoint for event aggregation](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/graphql/methods/create) client.cloudforceOne.threatEvents.graphql.create(GraphqlCreateParams {account\_id } params, RequestOptionsoptions?): [GraphqlCreateResponse]() {data, errors } POST/accounts/{account\_id}/cloudforce-one/events/graphql ##### ModelsExpand Collapse
GraphqlCreateResponse {data, errors } data?: unknown Link to this property errors?: Array<unknown>| null Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.graphql%20%3E%20(model)%20graphql_create_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsGraph ##### [Query graph neighborhood from R2 Data Catalog](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/graph/methods/list) client.cloudforceOne.threatEvents.graph.list(GraphListParams {account\_id, cursor, datasetIds, 7 more } params, RequestOptionsoptions?): [GraphListResponse]() {edges, node, nodes } GET/accounts/{account\_id}/cloudforce-one/events/graph ##### ModelsExpand Collapse
GraphListResponse {edges, node, nodes }
edges: Array<Edge> id: string Deterministic composite edge id (source→target:relationshipType) Link to this property relationshipType: string Link to this property source: string Compact id of the source node (type:uuid) Link to this property sourceId: string Link to this property sourceType: string Link to this property target: string Compact id of the target node (type:uuid) Link to this property targetId: string Link to this property targetType: string Link to this property
Link to this property node: Record<string, unknown>| null Focal node object (legacy single-seed). Null when unavailable. Link to this property nodes: Array<Record<string, unknown>> Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.graph%20%3E%20(model)%20graph_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsQueries ##### [List all saved event queries](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/list) client.cloudforceOne.threatEvents.queries.list(QueryListParams {account\_id } params, RequestOptionsoptions?): [QueryListResponse]() {id, account\_id, alert\_enabled, 10 more } GET/accounts/{account\_id}/cloudforce-one/events/queries ##### [Create a saved event query](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/create) client.cloudforceOne.threatEvents.queries.create(QueryCreateParams {account\_id, alert\_enabled, alert\_rollup\_enabled, 4 more } params, RequestOptionsoptions?): [QueryCreateResponse]() {id, account\_id, alert\_enabled, 10 more } POST/accounts/{account\_id}/cloudforce-one/events/queries/create ##### [Read a saved event query](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/get) client.cloudforceOne.threatEvents.queries.get(numberqueryID, QueryGetParams {account\_id } params, RequestOptionsoptions?): [QueryGetResponse]() {id, account\_id, alert\_enabled, 10 more } GET/accounts/{account\_id}/cloudforce-one/events/queries/{query\_id} ##### [Update a saved event query](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/edit) client.cloudforceOne.threatEvents.queries.edit(numberqueryID, QueryEditParams {account\_id, alert\_enabled, alert\_rollup\_enabled, 4 more } params, RequestOptionsoptions?): [QueryEditResponse]() {id, account\_id, alert\_enabled, 10 more } PATCH/accounts/{account\_id}/cloudforce-one/events/queries/{query\_id} ##### [Delete a saved event query](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/delete) client.cloudforceOne.threatEvents.queries.delete(numberqueryID, QueryDeleteParams {account\_id } params, RequestOptionsoptions?): void DELETE/accounts/{account\_id}/cloudforce-one/events/queries/{query\_id} ##### ModelsExpand Collapse
QueryListResponse = Array<QueryListResponseItem> id: number Unique identifier for the saved query Link to this property account\_id: number Account ID Link to this property alert\_enabled: boolean Whether alerts are enabled Link to this property alert\_rollup\_enabled: boolean Whether alert rollup is enabled Link to this property created\_at: string Creation timestamp Link to this property name: string Name of the saved query Link to this property query\_json: string JSON string containing the query parameters Link to this property rule\_enabled: boolean Whether rule is enabled Link to this property updated\_at: string Last update timestamp Link to this property user\_email: string Email of the user who created the query Link to this property custom\_threat\_feed\_id?: number| null Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id?: string WAF rules list ID for blocking Link to this property rule\_scope?: string Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_list_response%20%3E%20(schema)>)
QueryCreateResponse {id, account\_id, alert\_enabled, 10 more } id: number Unique identifier for the saved query Link to this property account\_id: number Account ID Link to this property alert\_enabled: boolean Whether alerts are enabled Link to this property alert\_rollup\_enabled: boolean Whether alert rollup is enabled Link to this property created\_at: string Creation timestamp Link to this property name: string Name of the saved query Link to this property query\_json: string JSON string containing the query parameters Link to this property rule\_enabled: boolean Whether rule is enabled Link to this property updated\_at: string Last update timestamp Link to this property user\_email: string Email of the user who created the query Link to this property custom\_threat\_feed\_id?: number| null Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id?: string WAF rules list ID for blocking Link to this property rule\_scope?: string Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_create_response%20%3E%20(schema)>)
QueryGetResponse {id, account\_id, alert\_enabled, 10 more } id: number Unique identifier for the saved query Link to this property account\_id: number Account ID Link to this property alert\_enabled: boolean Whether alerts are enabled Link to this property alert\_rollup\_enabled: boolean Whether alert rollup is enabled Link to this property created\_at: string Creation timestamp Link to this property name: string Name of the saved query Link to this property query\_json: string JSON string containing the query parameters Link to this property rule\_enabled: boolean Whether rule is enabled Link to this property updated\_at: string Last update timestamp Link to this property user\_email: string Email of the user who created the query Link to this property custom\_threat\_feed\_id?: number| null Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id?: string WAF rules list ID for blocking Link to this property rule\_scope?: string Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_get_response%20%3E%20(schema)>)
QueryEditResponse {id, account\_id, alert\_enabled, 10 more } id: number Unique identifier for the saved query Link to this property account\_id: number Account ID Link to this property alert\_enabled: boolean Whether alerts are enabled Link to this property alert\_rollup\_enabled: boolean Whether alert rollup is enabled Link to this property created\_at: string Creation timestamp Link to this property name: string Name of the saved query Link to this property query\_json: string JSON string containing the query parameters Link to this property rule\_enabled: boolean Whether rule is enabled Link to this property updated\_at: string Last update timestamp Link to this property user\_email: string Email of the user who created the query Link to this property custom\_threat\_feed\_id?: number| null Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id?: string WAF rules list ID for blocking Link to this property rule\_scope?: string Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_edit_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsRelationships ##### [Filter and list events related to specific event](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/relationships/methods/list) Deprecated client.cloudforceOne.threatEvents.relationships.list(stringeventID, RelationshipListParams {account\_id, datasetId, direction, 6 more } params, RequestOptionsoptions?): [RelationshipListResponse]() {attacker, attackerCountry, attackerCountryAlpha3, 26 more } GET/accounts/{account\_id}/cloudforce-one/events/{event\_id}/relationships ##### ModelsExpand Collapse
RelationshipListResponse = Array<RelationshipListResponseItem> attacker: string Link to this property attackerCountry: string Link to this property attackerCountryAlpha3: string Link to this property category: string Link to this property datasetId: string Link to this property date: string Link to this property event: string Link to this property hasChildren: boolean Link to this property indicator: string Link to this property indicatorType: string Link to this property indicatorTypeId: number Link to this property killChain: number Link to this property mitreAttack: Array<string> Link to this property mitreCapec: Array<string> Link to this property numReferenced: number Link to this property numReferences: number Link to this property rawId: string Link to this property referenced: Array<string> Link to this property referencedIds: Array<number> Link to this property references: Array<string> Link to this property referencesIds: Array<number> Link to this property tags: Array<string> Link to this property targetCountry: string Link to this property targetCountryAlpha3: string Link to this property targetIndustry: string Link to this property tlp: string Link to this property uuid: string Link to this property insight?: string Link to this property releasabilityId?: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.relationships%20%3E%20(model)%20relationship_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsIndicators ##### [Lists indicators across multiple datasets](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/indicators/methods/list) client.cloudforceOne.threatEvents.indicators.list(IndicatorListParams {account\_id, cache, createdAfter, 15 more } params, RequestOptionsoptions?): [IndicatorListResponse]() {properties, type } GET/accounts/{account\_id}/cloudforce-one/events/indicators ##### ModelsExpand Collapse
IndicatorListResponse {properties, type }
properties: Properties {completeness, indicators, pagination }
completeness: Completeness {properties, type }
properties: Properties {complete, failedDatasets, failedShards, warnings }
complete: Complete {type } type: string Link to this property
Link to this property
failedDatasets: FailedDatasets {items, type }
items: Items {type } type: string Link to this property
Link to this property type: string Link to this property
Link to this property
failedShards: FailedShards {items, type }
items: Items {properties, type }
properties: Properties {datasetId, shardId }
datasetId: DatasetID {type } type: string Link to this property
Link to this property
shardId: ShardID {type } type: string Link to this property
Link to this property
Link to this property type: string Link to this property
Link to this property type: string Link to this property
Link to this property
warnings: Warnings {items, type }
items: Items {type } type: string Link to this property
Link to this property type: string Link to this property
Link to this property
Link to this property type: string Link to this property
Link to this property
indicators: Indicators {items, type }
items: Items {createdAt, indicatorType, sources, 8 more } createdAt: string formatdate-time Link to this property indicatorType: string Link to this property
sources: Array<Source> RSS article sources from which this indicator was extracted. resourceId: string formatuuid Link to this property resourceType: "article" Link to this property system: "threat-signals" Link to this property title: string| null Threat Signals article title; null for historical provenance without a stored title. Link to this property
Link to this property updatedAt: string formatdate-time Link to this property uuid: string Link to this property value: string Link to this property datasetId?: string The dataset ID this indicator belongs to. Included in list responses. Link to this property
relatedEvents?: Array<RelatedEvent> Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. datasetId: string Link to this property eventId: string Link to this property eventDate?: string| null ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property relatedEventsHasMore?: boolean True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags?: Array<Tag> categoryId?: string| null The UUID of the tag category, or null when the tag is uncategorized. Link to this property categoryName?: string Link to this property uuid?: string Link to this property value?: string Link to this property
Link to this property tlp?: string| null Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property type: string Link to this property
Link to this property
pagination: Pagination {properties, type }
properties: Properties {count, cursor, has\_more, 4 more }
count: Count {type } type: string Link to this property
Link to this property
cursor: Cursor {description, nullable, type } description: string Link to this property nullable: boolean Link to this property type: string Link to this property
Link to this property
has\_more: HasMore {description, type } description: string Link to this property type: string Link to this property
Link to this property
page: Page {type } type: string Link to this property
Link to this property
per\_page: PerPage {type } type: string Link to this property
Link to this property
total\_count: TotalCount {description, nullable, type } description: string Link to this property nullable: boolean Link to this property type: string Link to this property
Link to this property
total\_count\_is\_exact: TotalCountIsExact {description, type } description: string Link to this property type: string Link to this property
Link to this property
Link to this property type: string Link to this property
Link to this property
Link to this property type: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsIndicatorsAggregate ##### [Aggregate indicators by column(s)](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/aggregate/methods/list) client.cloudforceOne.threatEvents.indicators.aggregate.list(AggregateListParams {account\_id, aggregateBy, createdAfter, 7 more } params, RequestOptionsoptions?): [AggregateListResponse]() {aggregateBy, aggregations, failedDatasets, total } GET/accounts/{account\_id}/cloudforce-one/events/indicators/aggregate ##### ModelsExpand Collapse
AggregateListResponse {aggregateBy, aggregations, failedDatasets, total } aggregateBy: string Column(s) that were aggregated by Link to this property
aggregations: Array<Aggregation> Array of aggregation results with dynamic fields based on aggregateBy columns count: number Number of indicators for this aggregation Link to this property
Link to this property failedDatasets: number Number of datasets whose aggregation failed and were excluded from the result Link to this property total: number Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.aggregate%20%3E%20(model)%20aggregate_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsIndicatorsTypes ##### [Lists indicator types across multiple datasets](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/types/methods/list) client.cloudforceOne.threatEvents.indicators.types.list(TypeListParams {account\_id, datasetIds } params, RequestOptionsoptions?): [TypeListResponse]() {items, type } GET/accounts/{account\_id}/cloudforce-one/events/indicator-types ##### ModelsExpand Collapse
TypeListResponse {items, type }
items: Items {type } type: string Link to this property
Link to this property type: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.types%20%3E%20(model)%20type_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsIndicatorsBy Dataset ##### [Lists indicators](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/by_dataset/methods/list) Deprecated client.cloudforceOne.threatEvents.indicators.byDataset.list(stringdatasetID, ByDatasetListParams {account\_id, indicatorType, name, 3 more } params, RequestOptionsoptions?): [ByDatasetListResponse]() {indicators, pagination } GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/indicators ##### [Reads an indicator](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/by_dataset/methods/get) client.cloudforceOne.threatEvents.indicators.byDataset.get(stringindicatorID, ByDatasetGetParams {account\_id, dataset\_id } params, RequestOptionsoptions?): [ByDatasetGetResponse]() {createdAt, indicatorType, updatedAt, 7 more } GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/indicators/{indicator\_id} ##### ModelsExpand Collapse
ByDatasetListResponse {indicators, pagination }
indicators: Array<Indicator> createdAt: string formatdate-time Link to this property indicatorType: string Link to this property
sources: Array<Source> RSS article sources from which this indicator was extracted. resourceId: string formatuuid Link to this property resourceType: "article" Link to this property system: "threat-signals" Link to this property title: string| null Threat Signals article title; null for historical provenance without a stored title. Link to this property
Link to this property updatedAt: string formatdate-time Link to this property uuid: string Link to this property value: string Link to this property datasetId?: string The dataset ID this indicator belongs to. Included in list responses. Link to this property
relatedEvents?: Array<RelatedEvent> Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. datasetId: string Link to this property eventId: string Link to this property eventDate?: string| null ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property relatedEventsHasMore?: boolean True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags?: Array<Tag> categoryId?: string| null The UUID of the tag category, or null when the tag is uncategorized. Link to this property categoryName?: string Link to this property uuid?: string Link to this property value?: string Link to this property
Link to this property tlp?: string| null Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property
pagination: Pagination {page, pageSize, totalCount, totalPages } page: number Link to this property pageSize: number Link to this property totalCount: number Link to this property totalPages: number Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.by_dataset%20%3E%20(model)%20by_dataset_list_response%20%3E%20(schema)>)
ByDatasetGetResponse {createdAt, indicatorType, updatedAt, 7 more } createdAt: string formatdate-time Link to this property indicatorType: string Link to this property updatedAt: string formatdate-time Link to this property uuid: string Link to this property value: string Link to this property datasetId?: string The dataset ID this indicator belongs to. Included in list responses. Link to this property
relatedEvents?: Array<RelatedEvent> Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. datasetId: string Link to this property eventId: string Link to this property eventDate?: string| null ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property relatedEventsHasMore?: boolean True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags?: Array<Tag> categoryId?: string| null The UUID of the tag category, or null when the tag is uncategorized. Link to this property categoryName?: string Link to this property uuid?: string Link to this property value?: string Link to this property
Link to this property tlp?: string| null Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.by_dataset%20%3E%20(model)%20by_dataset_get_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsIndicatorsBy DatasetTags ##### [List mirrored tags for an indicator dataset](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/by_dataset/subresources/tags/methods/list) client.cloudforceOne.threatEvents.indicators.byDataset.tags.list(stringdatasetID, TagListParams {account\_id } params, RequestOptionsoptions?): [TagListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/indicators/tags ##### ModelsExpand Collapse TagListResponse = Array Array of mirror tag rows [Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.by_dataset.tags%20%3E%20(model)%20tag_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsAttackers ##### [Lists attackers across multiple datasets](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/attackers/methods/list) client.cloudforceOne.threatEvents.attackers.list(AttackerListParams {account\_id, datasetIds } params, RequestOptionsoptions?): [AttackerListResponse]() {items, type } GET/accounts/{account\_id}/cloudforce-one/events/attackers ##### ModelsExpand Collapse
AttackerListResponse {items, type }
items: Items {type } type: string Link to this property
Link to this property type: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.attackers%20%3E%20(model)%20attacker_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsCategories ##### [Lists categories across multiple datasets](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/list) client.cloudforceOne.threatEvents.categories.list(CategoryListParams {account\_id, datasetIds } params, RequestOptionsoptions?): [CategoryListResponse]() {killChain, name, uuid, 3 more } GET/accounts/{account\_id}/cloudforce-one/events/categories ##### [Reads a category](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/get) Deprecated client.cloudforceOne.threatEvents.categories.get(stringcategoryID, CategoryGetParams {account\_id } params, RequestOptionsoptions?): [CategoryGetResponse]() {killChain, name, uuid, 3 more } GET/accounts/{account\_id}/cloudforce-one/events/categories/{category\_id} ##### [Creates a new category](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/create) client.cloudforceOne.threatEvents.categories.create(CategoryCreateParams {account\_id, killChain, name, 3 more } params, RequestOptionsoptions?): [CategoryCreateResponse]() {killChain, name, uuid, 3 more } POST/accounts/{account\_id}/cloudforce-one/events/categories/create ##### [Updates a category](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/edit) Deprecated client.cloudforceOne.threatEvents.categories.edit(stringcategoryID, CategoryEditParams {account\_id, killChain, mitreAttack, 3 more } params, RequestOptionsoptions?): [CategoryEditResponse]() {killChain, name, uuid, 3 more } PATCH/accounts/{account\_id}/cloudforce-one/events/categories/{category\_id} ##### [Deletes a category](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/delete) Deprecated client.cloudforceOne.threatEvents.categories.delete(stringcategoryID, CategoryDeleteParams {account\_id } params, RequestOptionsoptions?): [CategoryDeleteResponse]() {uuid } DELETE/accounts/{account\_id}/cloudforce-one/events/categories/{category\_id} ##### ModelsExpand Collapse
CategoryListResponse = Array<CategoryListResponseItem> killChain: number Link to this property name: string Link to this property uuid: string Link to this property mitreAttack?: Array<string> Link to this property mitreCapec?: Array<string> Link to this property shortname?: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>)
CategoryGetResponse {killChain, name, uuid, 3 more } killChain: number Link to this property name: string Link to this property uuid: string Link to this property mitreAttack?: Array<string> Link to this property mitreCapec?: Array<string> Link to this property shortname?: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_get_response%20%3E%20(schema)>)
CategoryCreateResponse {killChain, name, uuid, 3 more } killChain: number Link to this property name: string Link to this property uuid: string Link to this property mitreAttack?: Array<string> Link to this property mitreCapec?: Array<string> Link to this property shortname?: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_create_response%20%3E%20(schema)>)
CategoryEditResponse {killChain, name, uuid, 3 more } killChain: number Link to this property name: string Link to this property uuid: string Link to this property mitreAttack?: Array<string> Link to this property mitreCapec?: Array<string> Link to this property shortname?: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_edit_response%20%3E%20(schema)>)
CategoryDeleteResponse {uuid } uuid: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_delete_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsCategoriesCatalog ##### [Lists categories](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/categories/subresources/catalog/methods/list) client.cloudforceOne.threatEvents.categories.catalog.list(CatalogListParams {account\_id } params, RequestOptionsoptions?): [CatalogListResponse]() {killChain, name, uuid, 3 more } GET/accounts/{account\_id}/cloudforce-one/events/categories/catalog ##### ModelsExpand Collapse
CatalogListResponse = Array<CatalogListResponseItem> killChain: number Link to this property name: string Link to this property uuid: string Link to this property mitreAttack?: Array<string> Link to this property mitreCapec?: Array<string> Link to this property shortname?: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories.catalog%20%3E%20(model)%20catalog_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsCountries ##### [Retrieves countries information for all countries](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/countries/methods/list) client.cloudforceOne.threatEvents.countries.list(CountryListParams {account\_id } params, RequestOptionsoptions?): [CountryListResponse]() {result, success } GET/accounts/{account\_id}/cloudforce-one/events/countries ##### ModelsExpand Collapse
CountryListResponse = Array<CountryListResponseItem>
result: Array<Result> alpha2: string Link to this property alpha3: string Link to this property name: string Link to this property
Link to this property success: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.countries%20%3E%20(model)%20country_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsCrons #### Cloudforce OneThreat EventsDatasets ##### [Lists all datasets in an account](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list) client.cloudforceOne.threatEvents.datasets.list(DatasetListParams {account\_id, includeDeleted } params, RequestOptionsoptions?): [DatasetListResponse]() {indicatorWriteMode, isAnalytics, isPublic, 3 more } GET/accounts/{account\_id}/cloudforce-one/events/dataset ##### [Reads a dataset](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/get) client.cloudforceOne.threatEvents.datasets.get(stringdatasetID, DatasetGetParams {account\_id } params, RequestOptionsoptions?): [DatasetGetResponse]() {isAnalytics, isPublic, name, uuid } GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id} ##### [Creates a dataset](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create) client.cloudforceOne.threatEvents.datasets.create(DatasetCreateParams {account\_id, isPublic, name } params, RequestOptionsoptions?): [DatasetCreateResponse]() {isAnalytics, isPublic, name, uuid } POST/accounts/{account\_id}/cloudforce-one/events/dataset/create ##### [Updates an existing dataset](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/edit) client.cloudforceOne.threatEvents.datasets.edit(stringdatasetID, DatasetEditParams {account\_id, isPublic, name } params, RequestOptionsoptions?): [DatasetEditResponse]() {isAnalytics, isPublic, name, uuid } PATCH/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id} ##### [Delete a dataset](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/delete) client.cloudforceOne.threatEvents.datasets.delete(stringdatasetID, DatasetDeleteParams {account\_id } params, RequestOptionsoptions?): [DatasetDeleteResponse]() {name, uuid } DELETE/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id} ##### [Reads raw data for an event by UUID](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/raw) Deprecated client.cloudforceOne.threatEvents.datasets.raw(stringeventID, DatasetRawParams {account\_id, dataset\_id } params, RequestOptionsoptions?): [DatasetRawResponse]() {id, accountId, created, 3 more } GET/accounts/{account\_id}/cloudforce-one/events/raw/{dataset\_id}/{event\_id} ##### ModelsExpand Collapse
DatasetListResponse = Array<DatasetListResponseItem>
indicatorWriteMode: "read\_only"| "create\_only"| "full" Effective indicator mutation capability after account/dataset authorization and dataset storage capability are applied. API Gateway method permissions are separate and must also allow the requested operation. One of the following: "read\_only" Link to this property "create\_only" Link to this property "full" Link to this property
Link to this property isAnalytics: boolean Link to this property isPublic: boolean Link to this property name: string Link to this property uuid: string Link to this property deletedAt?: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_list_response%20%3E%20(schema)>)
DatasetGetResponse {isAnalytics, isPublic, name, uuid } isAnalytics: boolean Link to this property isPublic: boolean Link to this property name: string Link to this property uuid: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_get_response%20%3E%20(schema)>)
DatasetCreateResponse {isAnalytics, isPublic, name, uuid } isAnalytics: boolean Link to this property isPublic: boolean Link to this property name: string Link to this property uuid: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_create_response%20%3E%20(schema)>)
DatasetEditResponse {isAnalytics, isPublic, name, uuid } isAnalytics: boolean Link to this property isPublic: boolean Link to this property name: string Link to this property uuid: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_edit_response%20%3E%20(schema)>)
DatasetDeleteResponse {name, uuid } name: string Link to this property uuid: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_delete_response%20%3E%20(schema)>)
DatasetRawResponse {id, accountId, created, 3 more } id: number Link to this property accountId: number Link to this property created: string Link to this property data: string Link to this property source: string Link to this property tlp: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_raw_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsDatasetsHealth #### Cloudforce OneThreat EventsDatasetsEvents ##### [Reads an event](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/datasets/subresources/events/methods/get) client.cloudforceOne.threatEvents.datasets.events.get(stringeventID, EventGetParams {account\_id, dataset\_id } params, RequestOptionsoptions?): [EventGetResponse]() {attacker, attackerCountry, attackerCountryAlpha3, 26 more } GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/events/{event\_id} ##### ModelsExpand Collapse
EventGetResponse {attacker, attackerCountry, attackerCountryAlpha3, 26 more } attacker: string Link to this property attackerCountry: string Link to this property attackerCountryAlpha3: string Link to this property category: string Link to this property datasetId: string Link to this property date: string Link to this property event: string Link to this property hasChildren: boolean Link to this property indicator: string Link to this property indicatorType: string Link to this property indicatorTypeId: number Link to this property killChain: number Link to this property mitreAttack: Array<string> Link to this property mitreCapec: Array<string> Link to this property numReferenced: number Link to this property numReferences: number Link to this property rawId: string Link to this property referenced: Array<string> Link to this property referencedIds: Array<number> Link to this property references: Array<string> Link to this property referencesIds: Array<number> Link to this property tags: Array<string> Link to this property targetCountry: string Link to this property targetCountryAlpha3: string Link to this property targetIndustry: string Link to this property tlp: string Link to this property uuid: string Link to this property insight?: string Link to this property releasabilityId?: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets.events%20%3E%20(model)%20event_get_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsRaw ##### [Reads data for a raw event](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/raw/methods/get) client.cloudforceOne.threatEvents.raw.get(stringrawID, RawGetParams {account\_id, event\_id } params, RequestOptionsoptions?): [RawGetResponse]() {id, accountId, created, 3 more } GET/accounts/{account\_id}/cloudforce-one/events/{event\_id}/raw/{raw\_id} ##### [Updates a raw event](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/raw/methods/edit) client.cloudforceOne.threatEvents.raw.edit(stringrawID, RawEditParams {account\_id, event\_id, data, 2 more } params, RequestOptionsoptions?): [RawEditResponse]() {id, data } PATCH/accounts/{account\_id}/cloudforce-one/events/{event\_id}/raw/{raw\_id} ##### ModelsExpand Collapse
RawGetResponse {id, accountId, created, 3 more } id: string Link to this property accountId: number Link to this property created: string Link to this property data: unknown Link to this property source: string Link to this property tlp: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>)
RawEditResponse {id, data } id: string Link to this property data: unknown Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.raw%20%3E%20(model)%20raw_edit_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsRelate ##### [Removes an event reference](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/relate/methods/delete) client.cloudforceOne.threatEvents.relate.delete(stringeventID, RelateDeleteParams {account\_id } params, RequestOptionsoptions?): [RelateDeleteResponse]() {success } DELETE/accounts/{account\_id}/cloudforce-one/events/relate/{event\_id} ##### ModelsExpand Collapse
RelateDeleteResponse {success } success: boolean Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.relate%20%3E%20(model)%20relate_delete_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsTags ##### [Lists all tags (SoT)](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/list) client.cloudforceOne.threatEvents.tags.list(TagListParams {account\_id, cache, categoryUuid, 4 more } params, RequestOptionsoptions?): [TagListResponse]() {pagination, tags } GET/accounts/{account\_id}/cloudforce-one/events/tags ##### [Creates a new tag](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/create) client.cloudforceOne.threatEvents.tags.create(TagCreateParams {account\_id, value, activeDuration, 21 more } params, RequestOptionsoptions?): [TagCreateResponse]() {uuid, value, activeDuration, 34 more } POST/accounts/{account\_id}/cloudforce-one/events/tags/create ##### [Updates a tag (SoT)](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/edit) client.cloudforceOne.threatEvents.tags.edit(stringtagUUID, TagEditParams {account\_id, activeDuration, actorCategory, 21 more } params, RequestOptionsoptions?): [TagEditResponse]() {uuid, value, activeDuration, 34 more } PATCH/accounts/{account\_id}/cloudforce-one/events/tags/{tag\_uuid} ##### [Deletes a tag (SoT)](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/delete) client.cloudforceOne.threatEvents.tags.delete(stringtagUUID, TagDeleteParams {account\_id } params, RequestOptionsoptions?): [TagDeleteResponse]() {uuid } DELETE/accounts/{account\_id}/cloudforce-one/events/tags/{tag\_uuid} ##### ModelsExpand Collapse
TagListResponse {pagination, tags }
pagination: Pagination {page, pageSize, totalCount, totalPages } page: number Link to this property pageSize: number Link to this property totalCount: number Link to this property totalPages: number Link to this property
Link to this property
tags: Array<Tag> uuid: string Link to this property value: string Link to this property activeDuration?: string Link to this property
activeDuration\_annotated?: ActiveDurationAnnotated| null value: string Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property actorCategory?: string Link to this property
actorCategory\_annotated?: ActorCategoryAnnotated| null value: string Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
aliases?: Array<Alias> Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts). value: string Link to this property confidence?: number| null maximum10 minimum1 Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more| null One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property aliasGroupNames?: Array<string> Link to this property aliasGroupNamesInternal?: Array<string> Link to this property attributionOrganization?: string Link to this property
attributionOrganization\_annotated?: AttributionOrganizationAnnotated| null value: string Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property categoryName?: string Link to this property categoryUuid?: string Link to this property confidence?: number| null Overall tag confidence (1-10). maximum10 minimum1 Link to this property createdAt?: string Link to this property dateOfDiscovery?: string Link to this property description?: string Link to this property externalReferenceLinks?: Array<string> Link to this property
externalReferences?: Array<ExternalReference> Structured external references ({ url, description }). Public: returned to all accounts. url: string Link to this property description?: string| null Link to this property
Link to this property
externalReferences\_annotated?: Array<ExternalReferencesAnnotated>| null value: string Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
internalAliases?: Array<InternalAlias> Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses. value: string Link to this property confidence?: number| null maximum10 minimum1 Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more| null One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property internalDescription?: string Link to this property lastSeen?: string Link to this property motive?: string Link to this property
motive\_annotated?: MotiveAnnotated| null value: string Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property opsecLevel?: string Link to this property
opsecLevel\_annotated?: OpsecLevelAnnotated| null value: string Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property originCountryISO?: string| null ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace. Link to this property
originCountryISO\_annotated?: OriginCountryISOAnnotated| null value: string| null Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property priority?: number Link to this property
priority\_annotated?: PriorityAnnotated| null value: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property properties?: Record<string, unknown>| null Parsed custom field values. Null when the tag has no custom fields. Link to this property sophisticationLevel?: string Link to this property
sophisticationLevel\_annotated?: SophisticationLevelAnnotated| null value: string Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more| null Tag-level TLP handling marking. One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property updatedAt?: string Link to this property version?: number Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_list_response%20%3E%20(schema)>)
TagCreateResponse {uuid, value, activeDuration, 34 more } uuid: string Link to this property value: string Link to this property activeDuration?: string Link to this property
activeDuration\_annotated?: ActiveDurationAnnotated| null value: string Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property actorCategory?: string Link to this property
actorCategory\_annotated?: ActorCategoryAnnotated| null value: string Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
aliases?: Array<Alias> Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts). value: string Link to this property confidence?: number| null maximum10 minimum1 Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more| null One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property aliasGroupNames?: Array<string> Link to this property aliasGroupNamesInternal?: Array<string> Link to this property attributionOrganization?: string Link to this property
attributionOrganization\_annotated?: AttributionOrganizationAnnotated| null value: string Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property categoryName?: string Link to this property categoryUuid?: string Link to this property confidence?: number| null Overall tag confidence (1-10). maximum10 minimum1 Link to this property createdAt?: string Link to this property dateOfDiscovery?: string Link to this property description?: string Link to this property externalReferenceLinks?: Array<string> Link to this property
externalReferences?: Array<ExternalReference> Structured external references ({ url, description }). Public: returned to all accounts. url: string Link to this property description?: string| null Link to this property
Link to this property
externalReferences\_annotated?: Array<ExternalReferencesAnnotated>| null value: string Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
internalAliases?: Array<InternalAlias> Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses. value: string Link to this property confidence?: number| null maximum10 minimum1 Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more| null One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property internalDescription?: string Link to this property lastSeen?: string Link to this property motive?: string Link to this property
motive\_annotated?: MotiveAnnotated| null value: string Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property opsecLevel?: string Link to this property
opsecLevel\_annotated?: OpsecLevelAnnotated| null value: string Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property originCountryISO?: string| null ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace. Link to this property
originCountryISO\_annotated?: OriginCountryISOAnnotated| null value: string| null Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property priority?: number Link to this property
priority\_annotated?: PriorityAnnotated| null value: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property properties?: Record<string, unknown>| null Parsed custom field values. Null when the tag has no custom fields. Link to this property sophisticationLevel?: string Link to this property
sophisticationLevel\_annotated?: SophisticationLevelAnnotated| null value: string Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more| null Tag-level TLP handling marking. One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property updatedAt?: string Link to this property version?: number Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_create_response%20%3E%20(schema)>)
TagEditResponse {uuid, value, activeDuration, 34 more } uuid: string Link to this property value: string Link to this property activeDuration?: string Link to this property
activeDuration\_annotated?: ActiveDurationAnnotated| null value: string Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property actorCategory?: string Link to this property
actorCategory\_annotated?: ActorCategoryAnnotated| null value: string Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
aliases?: Array<Alias> Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts). value: string Link to this property confidence?: number| null maximum10 minimum1 Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more| null One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property aliasGroupNames?: Array<string> Link to this property aliasGroupNamesInternal?: Array<string> Link to this property attributionOrganization?: string Link to this property
attributionOrganization\_annotated?: AttributionOrganizationAnnotated| null value: string Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property categoryName?: string Link to this property categoryUuid?: string Link to this property confidence?: number| null Overall tag confidence (1-10). maximum10 minimum1 Link to this property createdAt?: string Link to this property dateOfDiscovery?: string Link to this property description?: string Link to this property externalReferenceLinks?: Array<string> Link to this property
externalReferences?: Array<ExternalReference> Structured external references ({ url, description }). Public: returned to all accounts. url: string Link to this property description?: string| null Link to this property
Link to this property
externalReferences\_annotated?: Array<ExternalReferencesAnnotated>| null value: string Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
internalAliases?: Array<InternalAlias> Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses. value: string Link to this property confidence?: number| null maximum10 minimum1 Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more| null One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property internalDescription?: string Link to this property lastSeen?: string Link to this property motive?: string Link to this property
motive\_annotated?: MotiveAnnotated| null value: string Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property opsecLevel?: string Link to this property
opsecLevel\_annotated?: OpsecLevelAnnotated| null value: string Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property originCountryISO?: string| null ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace. Link to this property
originCountryISO\_annotated?: OriginCountryISOAnnotated| null value: string| null Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property priority?: number Link to this property
priority\_annotated?: PriorityAnnotated| null value: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property properties?: Record<string, unknown>| null Parsed custom field values. Null when the tag has no custom fields. Link to this property sophisticationLevel?: string Link to this property
sophisticationLevel\_annotated?: SophisticationLevelAnnotated| null value: string Link to this property confidence?: number Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
tlp?: "red"| "amber"| "amber-strict"| 4 more| null Tag-level TLP handling marking. One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property updatedAt?: string Link to this property version?: number Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_edit_response%20%3E%20(schema)>)
TagDeleteResponse {uuid } uuid: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_delete_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsTagsCategories ##### [Lists all tag categories (SoT)](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/list) client.cloudforceOne.threatEvents.tags.categories.list(CategoryListParams {account\_id, search } params, RequestOptionsoptions?): [CategoryListResponse]() {categories } GET/accounts/{account\_id}/cloudforce-one/events/tags/categories ##### [Creates a new tag category (SoT)](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/create) client.cloudforceOne.threatEvents.tags.categories.create(CategoryCreateParams {account\_id, name, description, schema } params, RequestOptionsoptions?): [CategoryCreateResponse]() {name, uuid, createdAt, 3 more } POST/accounts/{account\_id}/cloudforce-one/events/tags/categories/create ##### [Updates a tag category (SoT)](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/edit) Deprecated client.cloudforceOne.threatEvents.tags.categories.edit(stringcategoryUUID, CategoryEditParams {account\_id, description, name, schema } params, RequestOptionsoptions?): [CategoryEditResponse]() {name, uuid, createdAt, 3 more } PATCH/accounts/{account\_id}/cloudforce-one/events/tags/categories/{category\_uuid} ##### [Deletes a tag category (SoT)](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/delete) Deprecated client.cloudforceOne.threatEvents.tags.categories.delete(stringcategoryUUID, CategoryDeleteParams {account\_id } params, RequestOptionsoptions?): [CategoryDeleteResponse]() {uuid } DELETE/accounts/{account\_id}/cloudforce-one/events/tags/categories/{category\_uuid} ##### ModelsExpand Collapse
CategoryListResponse {categories }
categories: Array<Category> name: string Link to this property uuid: string Link to this property createdAt?: string Link to this property description?: string Link to this property
schema?: Array<Schema>| null Parsed FieldDefinition\[] defining custom fields for this category, or null if none. key: string Link to this property
kind: "string"| "number"| "enum"| 3 more One of the following: "string" Link to this property "number" Link to this property "enum" Link to this property "date" Link to this property "array" Link to this property "object" Link to this property
Link to this property allowedValues?: Array<string> Link to this property
annotations?: Annotations {confidence, tlp } confidence?: boolean Link to this property tlp?: boolean Link to this property
Link to this property deprecated?: boolean Marks a field as unavailable for new values while retaining its definition for historical values. Link to this property deprecatedValues?: Array<string> Enum values unavailable for new writes but retained in allowedValues for historical display. Link to this property element?: unknown Link to this property
enforcement?: "error"| "warn"| "off" One of the following: "error" Link to this property "warn" Link to this property "off" Link to this property
Link to this property
format?: "date"| "url"| "duration"| "country" One of the following: "date" Link to this property "url" Link to this property "duration" Link to this property "country" Link to this property
Link to this property label?: string maxLength128 minLength1 Link to this property maxLength?: number exclusiveMinimum minimum0 Link to this property
numberConstraint?: NumberConstraint {integer, max, min } integer?: boolean Link to this property max?: number Link to this property min?: number Link to this property
Link to this property properties?: Record<string, unknown> Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive). Link to this property required?: boolean Link to this property
Link to this property updatedAt?: string Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>)
CategoryCreateResponse {name, uuid, createdAt, 3 more } name: string Link to this property uuid: string Link to this property createdAt?: string Link to this property description?: string Link to this property
schema?: Array<Schema>| null Parsed FieldDefinition\[] defining custom fields for this category, or null if none. key: string Link to this property
kind: "string"| "number"| "enum"| 3 more One of the following: "string" Link to this property "number" Link to this property "enum" Link to this property "date" Link to this property "array" Link to this property "object" Link to this property
Link to this property allowedValues?: Array<string> Link to this property
annotations?: Annotations {confidence, tlp } confidence?: boolean Link to this property tlp?: boolean Link to this property
Link to this property deprecated?: boolean Marks a field as unavailable for new values while retaining its definition for historical values. Link to this property deprecatedValues?: Array<string> Enum values unavailable for new writes but retained in allowedValues for historical display. Link to this property element?: unknown Link to this property
enforcement?: "error"| "warn"| "off" One of the following: "error" Link to this property "warn" Link to this property "off" Link to this property
Link to this property
format?: "date"| "url"| "duration"| "country" One of the following: "date" Link to this property "url" Link to this property "duration" Link to this property "country" Link to this property
Link to this property label?: string maxLength128 minLength1 Link to this property maxLength?: number exclusiveMinimum minimum0 Link to this property
numberConstraint?: NumberConstraint {integer, max, min } integer?: boolean Link to this property max?: number Link to this property min?: number Link to this property
Link to this property properties?: Record<string, unknown> Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive). Link to this property required?: boolean Link to this property
Link to this property updatedAt?: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_create_response%20%3E%20(schema)>)
CategoryEditResponse {name, uuid, createdAt, 3 more } name: string Link to this property uuid: string Link to this property createdAt?: string Link to this property description?: string Link to this property
schema?: Array<Schema>| null Parsed FieldDefinition\[] defining custom fields for this category, or null if none. key: string Link to this property
kind: "string"| "number"| "enum"| 3 more One of the following: "string" Link to this property "number" Link to this property "enum" Link to this property "date" Link to this property "array" Link to this property "object" Link to this property
Link to this property allowedValues?: Array<string> Link to this property
annotations?: Annotations {confidence, tlp } confidence?: boolean Link to this property tlp?: boolean Link to this property
Link to this property deprecated?: boolean Marks a field as unavailable for new values while retaining its definition for historical values. Link to this property deprecatedValues?: Array<string> Enum values unavailable for new writes but retained in allowedValues for historical display. Link to this property element?: unknown Link to this property
enforcement?: "error"| "warn"| "off" One of the following: "error" Link to this property "warn" Link to this property "off" Link to this property
Link to this property
format?: "date"| "url"| "duration"| "country" One of the following: "date" Link to this property "url" Link to this property "duration" Link to this property "country" Link to this property
Link to this property label?: string maxLength128 minLength1 Link to this property maxLength?: number exclusiveMinimum minimum0 Link to this property
numberConstraint?: NumberConstraint {integer, max, min } integer?: boolean Link to this property max?: number Link to this property min?: number Link to this property
Link to this property properties?: Record<string, unknown> Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive). Link to this property required?: boolean Link to this property
Link to this property updatedAt?: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_edit_response%20%3E%20(schema)>)
CategoryDeleteResponse {uuid } uuid: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_delete_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsTagsIndicators ##### [List indicators related to a tag](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/indicators/methods/list) client.cloudforceOne.threatEvents.tags.indicators.list(stringtagUUID, IndicatorListParams {account\_id, datasetIds, indicatorType, 4 more } params, RequestOptionsoptions?): [IndicatorListResponse]() {indicators, pagination } GET/accounts/{account\_id}/cloudforce-one/events/tags/{tag\_uuid}/indicators ##### ModelsExpand Collapse
IndicatorListResponse {indicators, pagination }
indicators: Array<Indicator> createdAt: string formatdate-time Link to this property indicatorType: string Link to this property updatedAt: string formatdate-time Link to this property uuid: string Link to this property value: string Link to this property datasetId?: string The dataset ID this indicator belongs to. Included in list responses. Link to this property
relatedEvents?: Array<RelatedEvent> Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. datasetId: string Link to this property eventId: string Link to this property eventDate?: string| null ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property relatedEventsHasMore?: boolean True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags?: Array<Tag> categoryId?: string| null The UUID of the tag category, or null when the tag is uncategorized. Link to this property categoryName?: string Link to this property uuid?: string Link to this property value?: string Link to this property
Link to this property tlp?: string| null Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property
pagination: Pagination {page, pageSize, totalCount, totalPages } page: number Link to this property pageSize: number Link to this property totalCount: number Link to this property totalPages: number Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsTagsIndicatorsBy Dataset ##### [List indicators related to a tag within a dataset (deprecated)](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/indicators/subresources/by_dataset/methods/list) Deprecated client.cloudforceOne.threatEvents.tags.indicators.byDataset.list(stringtagUUID, ByDatasetListParams {account\_id, dataset\_id, indicatorType, 4 more } params, RequestOptionsoptions?): [ByDatasetListResponse]() {indicators, pagination } GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/tags/{tag\_uuid}/indicators ##### ModelsExpand Collapse
ByDatasetListResponse {indicators, pagination }
indicators: Array<Indicator> createdAt: string formatdate-time Link to this property indicatorType: string Link to this property updatedAt: string formatdate-time Link to this property uuid: string Link to this property value: string Link to this property datasetId?: string The dataset ID this indicator belongs to. Included in list responses. Link to this property
relatedEvents?: Array<RelatedEvent> Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. datasetId: string Link to this property eventId: string Link to this property eventDate?: string| null ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property relatedEventsHasMore?: boolean True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags?: Array<Tag> categoryId?: string| null The UUID of the tag category, or null when the tag is uncategorized. Link to this property categoryName?: string Link to this property uuid?: string Link to this property value?: string Link to this property
Link to this property tlp?: string| null Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property
pagination: Pagination {page, pageSize, totalCount, totalPages } page: number Link to this property pageSize: number Link to this property totalCount: number Link to this property totalPages: number Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.indicators.by_dataset%20%3E%20(model)%20by_dataset_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsEvent Tags ##### [Adds a tag to an event](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/event_tags/methods/create) client.cloudforceOne.threatEvents.eventTags.create(stringeventID, EventTagCreateParams {account\_id, tags } params, RequestOptionsoptions?): [EventTagCreateResponse]() {success } POST/accounts/{account\_id}/cloudforce-one/events/event\_tag/{event\_id}/create ##### [Removes a tag from an event](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/event_tags/methods/delete) client.cloudforceOne.threatEvents.eventTags.delete(stringeventID, EventTagDeleteParams {account\_id } params, RequestOptionsoptions?): [EventTagDeleteResponse]() {success } DELETE/accounts/{account\_id}/cloudforce-one/events/event\_tag/{event\_id} ##### ModelsExpand Collapse
EventTagCreateResponse {success } success: boolean Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.event_tags%20%3E%20(model)%20event_tag_create_response%20%3E%20(schema)>)
EventTagDeleteResponse {success } success: boolean Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.event_tags%20%3E%20(model)%20event_tag_delete_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsTarget Industries ##### [Lists target industries across multiple datasets](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/target_industries/methods/list) client.cloudforceOne.threatEvents.targetIndustries.list(TargetIndustryListParams {account\_id, datasetIds } params, RequestOptionsoptions?): [TargetIndustryListResponse]() {items, type } GET/accounts/{account\_id}/cloudforce-one/events/targetIndustries ##### ModelsExpand Collapse
TargetIndustryListResponse {items, type }
items: Items {type } type: string Link to this property
Link to this property type: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.target_industries%20%3E%20(model)%20target_industry_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsTarget IndustriesBy Dataset ##### [Lists all target industries for a specific dataset](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/target_industries/subresources/by_dataset/methods/list) client.cloudforceOne.threatEvents.targetIndustries.byDataset.list(stringdatasetID, ByDatasetListParams {account\_id } params, RequestOptionsoptions?): [ByDatasetListResponse]() {items, type } GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/targetIndustries ##### ModelsExpand Collapse
ByDatasetListResponse {items, type }
items: Items {type } type: string Link to this property
Link to this property type: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.target_industries.by_dataset%20%3E%20(model)%20by_dataset_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsTarget IndustriesCatalog ##### [Lists all target industries from industry map catalog](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_events/subresources/target_industries/subresources/catalog/methods/list) client.cloudforceOne.threatEvents.targetIndustries.catalog.list(CatalogListParams {account\_id } params, RequestOptionsoptions?): [CatalogListResponse]() {items, type } GET/accounts/{account\_id}/cloudforce-one/events/targetIndustries/catalog ##### ModelsExpand Collapse
CatalogListResponse {items, type }
items: Items {type } type: string Link to this property
Link to this property type: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.target_industries.catalog%20%3E%20(model)%20catalog_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat EventsInsights #### Cloudforce OneThreat Signals Threat Signals API for managing threat intelligence feeds, articles, indicators, and AI skills in Cloudforce One. ## Prerequisites 1. **API token** — requests must use an API token with Cloudforce One permissions; write operations (creating, editing, or deleting feeds, skills, and tags) require write access. 2. **Plan limits** — access on the Free plan is limited; feed quotas and managed default skills apply. #### Cloudforce OneThreat SignalsSearch ##### [Search Threat Signals articles using AI Search](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/search/methods/search) client.cloudforceOne.threatSignals.search.search(SearchSearchParams {account\_id, query, feed\_id, max\_results } params, RequestOptionsoptions?): [SearchSearchResponse]() {count, results } GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/search ##### ModelsExpand Collapse
SearchSearchResponse {count, results } count: number Number of unique article candidates returned in this response. Equal to results.length. minimum0 Link to this property
results: Array<Result> article\_id: string formatuuid Link to this property dataset\_id: string| null formatuuid Link to this property event\_id: string| null formatuuid Link to this property feed\_id: string formatuuid Link to this property score: number Link to this property text: string Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.search%20%3E%20(model)%20search_search_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsCategories ##### [List Threat Signals feed categories](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/categories/methods/list) client.cloudforceOne.threatSignals.categories.list(CategoryListParams {account\_id } params, RequestOptionsoptions?): [CategoryListResponse]() {categories } GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/categories ##### ModelsExpand Collapse
CategoryListResponse {categories }
categories: Array<Category> id: string Wire value accepted by the feed category_id field. formatuuid Link to this property description: string Plain-language description of the category. Link to this property name: string Human-readable display label. Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsFeeds ##### [List Threat Signals feeds](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/list) client.cloudforceOne.threatSignals.feeds.list(FeedListParams {account\_id, category, enabled, 6 more } params, RequestOptionsoptions?): V4PagePagination< [FeedListResponse]() {count, feeds, page, 2 more } > GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds ##### [Create Threat Signals feed](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/create) client.cloudforceOne.threatSignals.feeds.create(FeedCreateParams {account\_id, category\_id, curated\_feed\_id, 5 more } params, RequestOptionsoptions?): [FeedCreateResponse]() {id, category\_id, category\_name, 12 more } POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds ##### [Update Threat Signals feed](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/edit) client.cloudforceOne.threatSignals.feeds.edit(stringfeedID, FeedEditParams {account\_id, category\_id, display\_name, 3 more } params, RequestOptionsoptions?): [FeedEditResponse]() {id, category\_id, category\_name, 12 more } PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id} ##### [Delete Threat Signals feed](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/delete) client.cloudforceOne.threatSignals.feeds.delete(stringfeedID, FeedDeleteParams {account\_id } params, RequestOptionsoptions?): [FeedDeleteResponse]() {id, category\_id, category\_name, 12 more } DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id} ##### [Trigger Threat Signals feed poll](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/poll) client.cloudforceOne.threatSignals.feeds.poll(FeedPollParams {account\_id, feed\_id } params, RequestOptionsoptions?): [FeedPollResponse]() {errors, feeds, triggered } POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/poll ##### ModelsExpand Collapse
FeedListResponse {count, feeds, page, 2 more } count: number Number of feeds on this page. Link to this property
feeds: Array<Feed> id: string formatuuid Link to this property category\_id: string| null Feed category identifier. Null when unset. Link to this property category\_name: string| null Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: string Link to this property curated\_feed\_id: string| null Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: string| null Link to this property enabled: boolean Link to this property last\_polled\_at: string| null Link to this property poll\_interval\_s: number Link to this property source\_type: string custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: string Polling health: active, or error after a failed poll. Link to this property subscribed\_at: string| null Link to this property title: string| null Link to this property updated\_at: string Link to this property url: string Link to this property
Link to this property page: number Link to this property per\_page: number Link to this property total\_count: number Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_list_response%20%3E%20(schema)>)
FeedCreateResponse {id, category\_id, category\_name, 12 more } id: string formatuuid Link to this property category\_id: string| null Feed category identifier. Null when unset. Link to this property category\_name: string| null Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: string Link to this property curated\_feed\_id: string| null Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: string| null Link to this property enabled: boolean Link to this property last\_polled\_at: string| null Link to this property poll\_interval\_s: number Link to this property source\_type: string custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: string Polling health: active, or error after a failed poll. Link to this property subscribed\_at: string| null Link to this property title: string| null Link to this property updated\_at: string Link to this property url: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_create_response%20%3E%20(schema)>)
FeedEditResponse {id, category\_id, category\_name, 12 more } id: string formatuuid Link to this property category\_id: string| null Feed category identifier. Null when unset. Link to this property category\_name: string| null Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: string Link to this property curated\_feed\_id: string| null Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: string| null Link to this property enabled: boolean Link to this property last\_polled\_at: string| null Link to this property poll\_interval\_s: number Link to this property source\_type: string custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: string Polling health: active, or error after a failed poll. Link to this property subscribed\_at: string| null Link to this property title: string| null Link to this property updated\_at: string Link to this property url: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_edit_response%20%3E%20(schema)>)
FeedDeleteResponse {id, category\_id, category\_name, 12 more } id: string formatuuid Link to this property category\_id: string| null Feed category identifier. Null when unset. Link to this property category\_name: string| null Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: string Link to this property curated\_feed\_id: string| null Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: string| null Link to this property enabled: boolean Link to this property last\_polled\_at: string| null Link to this property poll\_interval\_s: number Link to this property source\_type: string custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: string Polling health: active, or error after a failed poll. Link to this property subscribed\_at: string| null Link to this property title: string| null Link to this property updated\_at: string Link to this property url: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_delete_response%20%3E%20(schema)>)
FeedPollResponse {errors, feeds, triggered } errors: number Link to this property
feeds: Array<Feed> feed\_id: string formatuuid Link to this property
status: "workflow\_created"| "error" One of the following: "workflow\_created" Link to this property "error" Link to this property
Link to this property workflow\_id: string Link to this property feed\_enabled?: boolean Link to this property
Link to this property triggered: number Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_poll_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsFeedsRaw ##### [Get Threat Signals feed XML](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/raw/methods/get) client.cloudforceOne.threatSignals.feeds.raw.get(stringfeedID, RawGetParams {account\_id, format } params, RequestOptionsoptions?): [RawGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/raw ##### ModelsExpand Collapse RawGetResponse = string [Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsFeedsSkills ##### [Get Threat Signals feed skills](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/skills/methods/get) client.cloudforceOne.threatSignals.feeds.skills.get(stringfeedID, SkillGetParams {account\_id } params, RequestOptionsoptions?): [SkillGetResponse]() {feed\_id, skills } GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/skills ##### [Set Threat Signals feed skills](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/skills/methods/update) client.cloudforceOne.threatSignals.feeds.skills.update(stringfeedID, SkillUpdateParams {account\_id, skill\_ids } params, RequestOptionsoptions?): [SkillUpdateResponse]() {feed\_id, skills } PUT/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/skills ##### ModelsExpand Collapse
SkillGetResponse {feed\_id, skills } feed\_id: string formatuuid Link to this property
skills: Array<Skill> id: string Link to this property config: string| null JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: string Link to this property is\_active: number 1 when active, 0 when inactive. Link to this property name: string Link to this property output\_schema: string| null JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: string Link to this property
source: "default"| "custom" default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: string Link to this property updated\_at: string Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.skills%20%3E%20(model)%20skill_get_response%20%3E%20(schema)>)
SkillUpdateResponse {feed\_id, skills } feed\_id: string formatuuid Link to this property
skills: Array<Skill> position: number Zero-based pipeline position. Link to this property skill\_id: string Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.skills%20%3E%20(model)%20skill_update_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsArticles ##### [List Threat Signals articles](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/list) client.cloudforceOne.threatSignals.articles.list(ArticleListParams {account\_id, article\_id, cursor, 17 more } params, RequestOptionsoptions?): [ArticleListResponse]() {articles, has\_more, next\_cursor, 2 more } GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles ##### [Bulk update Threat Signals article read status](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/bulk_edit) client.cloudforceOne.threatSignals.articles.bulkEdit(ArticleBulkEditParams {account\_id, article\_ids, read } params, RequestOptionsoptions?): [ArticleBulkEditResponse]() {updated\_count } PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles ##### [Get Threat Signals article](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/get) client.cloudforceOne.threatSignals.articles.get(stringarticleID, ArticleGetParams {account\_id } params, RequestOptionsoptions?): [ArticleGetResponse]() {id, bullet\_points, content\_r2\_key, 16 more } GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id} ##### [Update Threat Signals article read status](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/edit) client.cloudforceOne.threatSignals.articles.edit(stringarticleID, ArticleEditParams {account\_id, read } params, RequestOptionsoptions?): [ArticleEditResponse]() {id, bullet\_points, content\_r2\_key, 16 more } PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id} ##### ModelsExpand Collapse
ArticleListResponse {articles, has\_more, next\_cursor, 2 more }
articles: Array<Article> id: string formatuuid Link to this property dataset\_id: string| null Threat Events dataset identifier for the article redirect. Null when the account feeds dataset mapping is unavailable. Link to this property event\_id: string| null Threat Events event identifier associated with this article for a UI redirect. Null when no event has been linked. Link to this property feed\_display\_name: string| null Link to this property feed\_id: string formatuuid Link to this property fetched\_at: string Link to this property link: string| null Link to this property published\_at: string| null Link to this property read: boolean Link to this property read\_at: string| null Link to this property summary: string| null Persisted enrichment summary. Null until enrichment produces a summary. Link to this property
tags: Array<Tag>
applied\_by: "ai"| "analyst"| "system" One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property categoryId: string| null formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property
Link to this property title: string| null Link to this property
Link to this property has\_more: boolean Link to this property next\_cursor: string| null Link to this property total\_count: number| null Link to this property total\_count\_is\_exact: boolean Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_list_response%20%3E%20(schema)>)
ArticleBulkEditResponse {updated\_count } updated\_count: number Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_bulk_edit_response%20%3E%20(schema)>)
ArticleGetResponse {id, bullet\_points, content\_r2\_key, 16 more } id: string formatuuid Link to this property
bullet\_points: BulletPoints| null impact: string Link to this property what\_happened: string Link to this property who\_affected: string Link to this property
Link to this property content\_r2\_key: string| null Link to this property feed\_display\_name: string| null Link to this property feed\_id: string formatuuid Link to this property fetched\_at: string Link to this property
indicator\_extraction\_status: "in\_progress"| "complete"| "failed"| "unknown" Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded. One of the following: "in\_progress" Link to this property "complete" Link to this property "failed" Link to this property "unknown" Link to this property
Link to this property link: string| null Link to this property metadata: Record<string, unknown>| null Link to this property published\_at: string| null Link to this property read: boolean Link to this property read\_at: string| null Link to this property source\_count: number Link to this property summary: string| null Persisted enrichment summary. Null until enrichment produces a summary. Link to this property summary\_r2\_key: string| null Link to this property
tags: Array<Tag>
applied\_by: "ai"| "analyst"| "system" One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property categoryId: string| null formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property
Link to this property title: string| null Link to this property skill\_version?: string| null Link to this property tag\_skill\_version?: string| null Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_get_response%20%3E%20(schema)>)
ArticleEditResponse {id, bullet\_points, content\_r2\_key, 16 more } id: string formatuuid Link to this property
bullet\_points: BulletPoints| null impact: string Link to this property what\_happened: string Link to this property who\_affected: string Link to this property
Link to this property content\_r2\_key: string| null Link to this property feed\_display\_name: string| null Link to this property feed\_id: string formatuuid Link to this property fetched\_at: string Link to this property
indicator\_extraction\_status: "in\_progress"| "complete"| "failed"| "unknown" Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded. One of the following: "in\_progress" Link to this property "complete" Link to this property "failed" Link to this property "unknown" Link to this property
Link to this property link: string| null Link to this property metadata: Record<string, unknown>| null Link to this property published\_at: string| null Link to this property read: boolean Link to this property read\_at: string| null Link to this property source\_count: number Link to this property summary: string| null Persisted enrichment summary. Null until enrichment produces a summary. Link to this property summary\_r2\_key: string| null Link to this property
tags: Array<Tag>
applied\_by: "ai"| "analyst"| "system" One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property categoryId: string| null formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property
Link to this property title: string| null Link to this property skill\_version?: string| null Link to this property tag\_skill\_version?: string| null Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_edit_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsArticlesContent ##### [Get Threat Signals article content](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/content/methods/get) client.cloudforceOne.threatSignals.articles.content.get(stringarticleID, ContentGetParams {account\_id, format } params, RequestOptionsoptions?): [ContentGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/content ##### ModelsExpand Collapse ContentGetResponse = string [Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.content%20%3E%20(model)%20content_get_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsArticlesTags ##### [Add tag to Threat Signals article](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/create) client.cloudforceOne.threatSignals.articles.tags.create(stringarticleID, TagCreateParams {account\_id, tag\_id } params, RequestOptionsoptions?): [TagCreateResponse]() {applied\_by, categoryId, uuid, value } POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tags ##### [Remove tag from Threat Signals article](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/delete) client.cloudforceOne.threatSignals.articles.tags.delete(stringtagID, TagDeleteParams {account\_id, article\_id } params, RequestOptionsoptions?): [TagDeleteResponse]() {applied\_by, categoryId, uuid, value } DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tags/{tag\_id} ##### [Generate Threat Signals article AI tags](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/generate) client.cloudforceOne.threatSignals.articles.tags.generate(stringarticleID, TagGenerateParams {account\_id } params, RequestOptionsoptions?): [TagGenerateResponse]() {tag\_skill\_version, tags } POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tag ##### ModelsExpand Collapse
TagCreateResponse {applied\_by, categoryId, uuid, value }
applied\_by: "ai"| "analyst"| "system" One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property categoryId: string| null formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_create_response%20%3E%20(schema)>)
TagDeleteResponse {applied\_by, categoryId, uuid, value }
applied\_by: "ai"| "analyst"| "system" One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property categoryId: string| null formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_delete_response%20%3E%20(schema)>)
TagGenerateResponse {tag\_skill\_version, tags } tag\_skill\_version: string Link to this property
tags: Array<Tag> Final hydrated assignment set; may be empty when no applicable tags are selected.
applied\_by: "ai"| "analyst"| "system" One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property categoryId: string| null formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_generate_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsArticlesSkill Outputs ##### [Get Threat Signals article skill output](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/skill_outputs/methods/get) client.cloudforceOne.threatSignals.articles.skillOutputs.get(stringskillID, SkillOutputGetParams {account\_id, article\_id } params, RequestOptionsoptions?): [SkillOutputGetResponse]() {article\_id, custom\_skill\_version, output\_schema, 2 more } GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/skills/{skill\_id}/output ##### ModelsExpand Collapse
SkillOutputGetResponse {article\_id, custom\_skill\_version, output\_schema, 2 more } article\_id: string formatuuid Link to this property custom\_skill\_version: string| null Link to this property output\_schema: string| null JSON-encoded output schema of the skill. Null when the skill no longer exists. Link to this property skill\_id: string Link to this property custom\_output?: unknown Skill output. Parsed JSON when the stored output is valid JSON, otherwise the raw string. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.skill_outputs%20%3E%20(model)%20skill_output_get_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsIndicators ##### [List Threat Signals article indicators](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/indicators/methods/list) client.cloudforceOne.threatSignals.indicators.list(IndicatorListParams {account\_id, article\_id, cursor, 5 more } params, RequestOptionsoptions?): [IndicatorListResponse]() {indicators, pagination } GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/indicators ##### ModelsExpand Collapse
IndicatorListResponse {indicators, pagination }
indicators: Array<Indicator> id: string formatuuid Link to this property article\_id: string formatuuid Link to this property article\_title: string| null Link to this property dataset\_id: string| null Threat Events dataset identifier for navigating from this indicator. Null when the account feeds dataset mapping is unavailable. Link to this property feed\_display\_name: string| null Link to this property feed\_id: string formatuuid Link to this property type: string Link to this property value: string Link to this property
Link to this property
pagination: Pagination {count, cursor, has\_more, 4 more } count: number minimum0 Link to this property cursor: string| null Link to this property has\_more: boolean Link to this property page: number Ordinal of this cursor page; not a total-results offset. minimum1 Link to this property per\_page: number maximum100 minimum1 Link to this property total\_count: number| null minimum0 Link to this property total\_count\_is\_exact: boolean Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsSkills ##### [List Threat Signals skills](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/list) client.cloudforceOne.threatSignals.skills.list(SkillListParams {account\_id, page, per\_page } params, RequestOptionsoptions?): V4PagePagination< [SkillListResponse]() {count, custom\_skills\_available, page, 3 more } > GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills ##### [Create Threat Signals skill](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/create) client.cloudforceOne.threatSignals.skills.create(SkillCreateParams {account\_id, name, output\_schema, 2 more } params, RequestOptionsoptions?): [SkillCreateResponse]() {id, config, created\_at, 7 more } POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills ##### [Get Threat Signals skill](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/get) client.cloudforceOne.threatSignals.skills.get(stringskillID, SkillGetParams {account\_id } params, RequestOptionsoptions?): [SkillGetResponse]() {id, config, created\_at, 7 more } GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### [Update Threat Signals skill](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/edit) client.cloudforceOne.threatSignals.skills.edit(stringskillID, SkillEditParams {account\_id, config, is\_active, 3 more } params, RequestOptionsoptions?): [SkillEditResponse]() {id, config, created\_at, 7 more } PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### [Delete Threat Signals skill](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/delete) client.cloudforceOne.threatSignals.skills.delete(stringskillID, SkillDeleteParams {account\_id } params, RequestOptionsoptions?): [SkillDeleteResponse]() {id, config, created\_at, 7 more } DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### ModelsExpand Collapse
SkillListResponse {count, custom\_skills\_available, page, 3 more } count: number Number of skills on this page. Link to this property custom\_skills\_available: boolean Whether the authenticated account may access custom-skill capabilities under Stakeout’s Threat Signals access-mode policy. This is a policy availability indicator, not a row-existence indicator. False for threat\_signals\_only mode; true for entitled, allowlisted, cfone\_internal, and service modes. Link to this property page: number Link to this property per\_page: number Link to this property
skills: Array<Skill> id: string Link to this property config: string| null JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: string Link to this property is\_active: number 1 when active, 0 when inactive. Link to this property name: string Link to this property output\_schema: string| null JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: string Link to this property
source: "default"| "custom" default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: string Link to this property updated\_at: string Link to this property
Link to this property total\_count: number Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_list_response%20%3E%20(schema)>)
SkillCreateResponse {id, config, created\_at, 7 more } id: string Link to this property config: string| null JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: string Link to this property is\_active: number 1 when active, 0 when inactive. Link to this property name: string Link to this property output\_schema: string| null JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: string Link to this property
source: "default"| "custom" default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: string Link to this property updated\_at: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_create_response%20%3E%20(schema)>)
SkillGetResponse {id, config, created\_at, 7 more } id: string Link to this property config: string| null JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: string Link to this property is\_active: number 1 when active, 0 when inactive. Link to this property name: string Link to this property output\_schema: string| null JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: string Link to this property
source: "default"| "custom" default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: string Link to this property updated\_at: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_get_response%20%3E%20(schema)>)
SkillEditResponse {id, config, created\_at, 7 more } id: string Link to this property config: string| null JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: string Link to this property is\_active: number 1 when active, 0 when inactive. Link to this property name: string Link to this property output\_schema: string| null JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: string Link to this property
source: "default"| "custom" default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: string Link to this property updated\_at: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_edit_response%20%3E%20(schema)>)
SkillDeleteResponse {id, config, created\_at, 7 more } id: string Link to this property config: string| null JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: string Link to this property is\_active: number 1 when active, 0 when inactive. Link to this property name: string Link to this property output\_schema: string| null JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: string Link to this property
source: "default"| "custom" default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: string Link to this property updated\_at: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_delete_response%20%3E%20(schema)>) #### Cloudforce OneThreat SignalsSkillsTag Categories ##### [Get Threat Signals skill tag categories](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/skills/subresources/tag_categories/methods/get) client.cloudforceOne.threatSignals.skills.tagCategories.get("default-tagging-skill"skillID, TagCategoryGetParams {account\_id } params, RequestOptionsoptions?): [TagCategoryGetResponse]() {category\_uuids, skill\_id } GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}/tag-categories ##### [Replace Threat Signals skill tag categories](https://developers.cloudflare.com/api/typescript/resources/cloudforce_one/subresources/threat_signals/subresources/skills/subresources/tag_categories/methods/update) client.cloudforceOne.threatSignals.skills.tagCategories.update("default-tagging-skill"skillID, TagCategoryUpdateParams {account\_id, category\_uuids } params, RequestOptionsoptions?): [TagCategoryUpdateResponse]() {category\_uuids, skill\_id } PUT/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}/tag-categories ##### ModelsExpand Collapse
TagCategoryGetResponse {category\_uuids, skill\_id } category\_uuids: Array<string> Link to this property skill\_id: "default-tagging-skill" Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills.tag_categories%20%3E%20(model)%20tag_category_get_response%20%3E%20(schema)>)
TagCategoryUpdateResponse {category\_uuids, skill\_id } category\_uuids: Array<string> Link to this property skill\_id: "default-tagging-skill" Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills.tag_categories%20%3E%20(model)%20tag_category_update_response%20%3E%20(schema)>)