Skip to content
Cloudflare API
Start here
API Reference
Intel

Indicator Feeds

Get indicator feeds owned by this account
client.intel.indicatorFeeds.list(IndicatorFeedListParams { account_id } params, RequestOptionsoptions?): SinglePage<IndicatorFeedListResponse { id, created_on, description, 5 more } >
GET/accounts/{account_id}/intel/indicator-feeds
Get indicator feed metadata
client.intel.indicatorFeeds.get(numberfeedId, IndicatorFeedGetParams { account_id } params, RequestOptionsoptions?): IndicatorFeedGetResponse { id, created_on, description, 9 more }
GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}
Create new indicator feed
client.intel.indicatorFeeds.create(IndicatorFeedCreateParams { account_id, description, name } params, RequestOptionsoptions?): IndicatorFeedCreateResponse { id, created_on, description, 5 more }
POST/accounts/{account_id}/intel/indicator-feeds
Update indicator feed metadata
client.intel.indicatorFeeds.update(numberfeedId, IndicatorFeedUpdateParams { account_id, description, is_attributable, 3 more } params, RequestOptionsoptions?): IndicatorFeedUpdateResponse { id, created_on, description, 5 more }
PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}
Get indicator feed data
client.intel.indicatorFeeds.data(numberfeedId, IndicatorFeedDataParams { account_id } params, RequestOptionsoptions?): IndicatorFeedDataResponse
GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}/data
ModelsExpand Collapse
IndicatorFeedListResponse { id, created_on, description, 5 more }
id?: number

The unique identifier for the indicator feed

created_on?: string

The date and time when the data entry was created

formatdate-time
description?: string

The description of the example test

is_attributable?: boolean

Whether the indicator feed can be attributed to a provider

is_downloadable?: boolean

Whether the indicator feed can be downloaded

is_public?: boolean

Whether the indicator feed is exposed to customers

modified_on?: string

The date and time when the data entry was last modified

formatdate-time
name?: string

The name of the indicator feed

IndicatorFeedGetResponse { id, created_on, description, 9 more }
id?: number

The unique identifier for the indicator feed

created_on?: string

The date and time when the data entry was created

formatdate-time
description?: string

The description of the example test

is_attributable?: boolean

Whether the indicator feed can be attributed to a provider

is_downloadable?: boolean

Whether the indicator feed can be downloaded

is_public?: boolean

Whether the indicator feed is exposed to customers

last_upload_summary?: LastUploadSummary { persisted, skipped, uploaded }

Summary of indicator counts from the last successful upload to this feed. Populated by the custom-threat-feeds loader at the end of each successful load. Absent (omitted) when no upload has completed successfully or the upload errored before the summary write. Surfaces silent-failure paths so operators can see when their indicators were dropped (popularity allowlist, expired valid_until, etc.) without reading loader logs.

persisted?: Persisted { domains_added, domains_removed, ips_added, 3 more }

Net delta applied to feed indicators by this upload. Snapshot uploads emit both *_added and *_removed; delta-add emits only *_added; delta-remove emits only *_removed.

domains_added?: number
domains_removed?: number
ips_added?: number
ips_removed?: number
urls_added?: number
urls_removed?: number
skipped?: Skipped { allowlisted_domains, expired_indicators, invalid_indicators }

Counts of indicators that were uploaded but did not reach QuickSilver, broken down by reason.

allowlisted_domains?: number

Domains filtered by the global popularity allowlist at QS provisioning time. Popular domains (bing.com, naver.com, etc.) are protected from custom-threat-feed enforcement.

expired_indicators?: number

Indicators in the upload whose valid_until is already in the past. These are not added to QS; the expiration cron handles cleanup.

invalid_indicators?: number

Reserved for future use. Currently always 0 — the unifier aborts the entire upload on a single bad indicator.

uploaded?: Uploaded { domains, ips, urls }

Indicator counts from the unified file the loader received

domains?: number

Number of domain indicators in the upload

ips?: number

Number of IP indicators in the upload

urls?: number

Number of URL indicators in the upload

latest_upload_status?: "Mirroring" | "Unifying" | "Loading" | 3 more

Status of the latest snapshot uploaded

One of the following:
"Mirroring"
"Unifying"
"Loading"
"Provisioning"
"Complete"
"Error"
modified_on?: string

The date and time when the data entry was last modified

formatdate-time
name?: string

The name of the indicator feed

provider_id?: number

The unique identifier for the provider

provider_name?: string

The provider of the indicator feed

IndicatorFeedCreateResponse { id, created_on, description, 5 more }
id?: number

The unique identifier for the indicator feed

created_on?: string

The date and time when the data entry was created

formatdate-time
description?: string

The description of the example test

is_attributable?: boolean

Whether the indicator feed can be attributed to a provider

is_downloadable?: boolean

Whether the indicator feed can be downloaded

is_public?: boolean

Whether the indicator feed is exposed to customers

modified_on?: string

The date and time when the data entry was last modified

formatdate-time
name?: string

The name of the indicator feed

IndicatorFeedUpdateResponse { id, created_on, description, 5 more }
id?: number

The unique identifier for the indicator feed

created_on?: string

The date and time when the data entry was created

formatdate-time
description?: string

The description of the example test

is_attributable?: boolean

Whether the indicator feed can be attributed to a provider

is_downloadable?: boolean

Whether the indicator feed can be downloaded

is_public?: boolean

Whether the indicator feed is exposed to customers

modified_on?: string

The date and time when the data entry was last modified

formatdate-time
name?: string

The name of the indicator feed

IndicatorFeedDataResponse = string

Indicator FeedsSnapshots

Update indicator feed data
client.intel.indicatorFeeds.snapshots.update(numberfeedId, SnapshotUpdateParams { account_id, source } params, RequestOptionsoptions?): SnapshotUpdateResponse { file_id, filename, status }
PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}/snapshot
ModelsExpand Collapse
SnapshotUpdateResponse { file_id, filename, status }
file_id?: number

Feed id

filename?: string

Name of the file unified in our system

status?: string

Current status of upload, should be unified

Indicator FeedsPermissions

List indicator feed permissions
client.intel.indicatorFeeds.permissions.list(PermissionListParams { account_id } params, RequestOptionsoptions?): PermissionListResponse { id, description, is_attributable, 3 more }
GET/accounts/{account_id}/intel/indicator-feeds/permissions/view
Grant permission to indicator feed
client.intel.indicatorFeeds.permissions.create(PermissionCreateParams { account_id, account_tag, feed_id } params, RequestOptionsoptions?): PermissionCreateResponse { success }
PUT/accounts/{account_id}/intel/indicator-feeds/permissions/add
Revoke permission to indicator feed
client.intel.indicatorFeeds.permissions.delete(PermissionDeleteParams { account_id, account_tag, feed_id } params, RequestOptionsoptions?): PermissionDeleteResponse { success }
PUT/accounts/{account_id}/intel/indicator-feeds/permissions/remove
ModelsExpand Collapse
PermissionListResponse = Array<PermissionListResponseItem>
id?: number

The unique identifier for the indicator feed

description?: string

The description of the example test

is_attributable?: boolean

Whether the indicator feed can be attributed to a provider

is_downloadable?: boolean

Whether the indicator feed can be downloaded

is_public?: boolean

Whether the indicator feed is exposed to customers

name?: string

The name of the indicator feed

PermissionCreateResponse { success }
success?: boolean

Whether the update succeeded or not

PermissionDeleteResponse { success }
success?: boolean

Whether the update succeeded or not

Indicator FeedsDownloads