API Reference

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Cloudforce One

Cloudforce OneBinary Storage

Retrieves a file from Binary Storage

cloudforce_one.binary_storage.get(strhash, BinaryStorageGetParams**kwargs)

GET/accounts/{account_id}/cloudforce-one/binary/{hash}

Posts a file to Binary Storage

cloudforce_one.binary_storage.create(BinaryStorageCreateParams**kwargs) -> BinaryStorageCreateResponse

POST/accounts/{account_id}/cloudforce-one/binary

ModelsExpand Collapse

class BinaryStorageCreateResponse: …

content_type: str

md5: str

sha1: str

sha256: str

Cloudforce OneRequests

List Requests

cloudforce_one.requests.list(RequestListParams**kwargs) -> SyncSinglePage[ListItem]

POST/accounts/{account_id}/cloudforce-one/requests

Get a Request

cloudforce_one.requests.get(strrequest_id, RequestGetParams**kwargs) -> Item

GET/accounts/{account_id}/cloudforce-one/requests/{request_id}

Create a New Request.

cloudforce_one.requests.create(RequestCreateParams**kwargs) -> Item

POST/accounts/{account_id}/cloudforce-one/requests/new

Update a Request

cloudforce_one.requests.update(strrequest_id, RequestUpdateParams**kwargs) -> Item

PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}

Delete a Request

cloudforce_one.requests.delete(strrequest_id, RequestDeleteParams**kwargs) -> RequestDeleteResponse

DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}

Get Request Quota

cloudforce_one.requests.quota(RequestQuotaParams**kwargs) -> Quota

GET/accounts/{account_id}/cloudforce-one/requests/quota

Get Request Types

cloudforce_one.requests.types(RequestTypesParams**kwargs) -> SyncSinglePage[RequestTypesResponse]

GET/accounts/{account_id}/cloudforce-one/requests/types

Get Request Priority, Status, and TLP constants

cloudforce_one.requests.constants(RequestConstantsParams**kwargs) -> RequestConstants

GET/accounts/{account_id}/cloudforce-one/requests/constants

ModelsExpand Collapse

class Item: …

id: str

UUID.

maxLength36

content: str

Request content.

created: datetime

formatdate-time

priority: datetime

formatdate-time

request: str

Requested information from request.

summary: str

Brief description of the request.

tlp: Literal["clear", "amber", "amber-strict", 2 more]

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

updated: datetime

formatdate-time

completed: Optional[datetime]

formatdate-time

message_tokens: Optional[int]

Tokens for the request messages.

readable_id: Optional[str]

Readable Request ID.

status: Optional[Literal["open", "accepted", "reported", 3 more]]

Request Status.

One of the following:

"open"

"accepted"

"reported"

"approved"

"completed"

"declined"

tokens: Optional[int]

Tokens for the request.

class ListItem: …

id: str

UUID.

maxLength36

created: datetime

Request creation time.

formatdate-time

priority: Literal["routine", "high", "urgent"]

One of the following:

"routine"

"high"

"urgent"

request: str

Requested information from request.

summary: str

Brief description of the request.

tlp: Literal["clear", "amber", "amber-strict", 2 more]

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

updated: datetime

Request last updated time.

formatdate-time

completed: Optional[datetime]

Request completion time.

formatdate-time

message_tokens: Optional[int]

Tokens for the request messages.

readable_id: Optional[str]

Readable Request ID.

status: Optional[Literal["open", "accepted", "reported", 3 more]]

Request Status.

One of the following:

"open"

"accepted"

"reported"

"approved"

"completed"

"declined"

tokens: Optional[int]

Tokens for the request.

class Quota: …

anniversary_date: Optional[datetime]

Anniversary date is when annual quota limit is refreshed.

formatdate-time

quarter_anniversary_date: Optional[datetime]

Quarter anniversary date is when quota limit is refreshed each quarter.

formatdate-time

quota: Optional[int]

Tokens for the quarter.

remaining: Optional[int]

Tokens remaining for the quarter.

class RequestConstants: …

priority: Optional[List[Literal["routine", "high", "urgent"]]]

One of the following:

"routine"

"high"

"urgent"

status: Optional[List[Literal["open", "accepted", "reported", 3 more]]]

One of the following:

"open"

"accepted"

"reported"

"approved"

"completed"

"declined"

tlp: Optional[List[Literal["clear", "amber", "amber-strict", 2 more]]]

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

List[RequestTypesResponse]

class RequestDeleteResponse: …

errors: List[Error]

code: int

minimum1000

message: str

documentation_url: Optional[str]

source: Optional[ErrorSource]

pointer: Optional[str]

messages: List[Message]

code: int

minimum1000

message: str

documentation_url: Optional[str]

source: Optional[MessageSource]

pointer: Optional[str]

success: Literal[true]

Whether the API call was successful.

str

Request Types.

Cloudforce OneRequestsMessage

List Request Messages

cloudforce_one.requests.message.get(strrequest_id, MessageGetParams**kwargs) -> SyncSinglePage[Message]

POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/message

Create a New Request Message

cloudforce_one.requests.message.create(strrequest_id, MessageCreateParams**kwargs) -> Message

POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/new

Update a Request Message

cloudforce_one.requests.message.update(intmessage_id, MessageUpdateParams**kwargs) -> Message

PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}

Delete a Request Message

cloudforce_one.requests.message.delete(intmessage_id, MessageDeleteParams**kwargs) -> MessageDeleteResponse

DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}

ModelsExpand Collapse

class Message: …

id: int

Message ID.

author: str

Author of message.

content: str

Content of message.

is_follow_on_request: bool

Whether the message is a follow-on request.

updated: datetime

Defines the message last updated time.

formatdate-time

created: Optional[datetime]

Defines the message creation time.

formatdate-time

class MessageDeleteResponse: …

errors: List[Error]

code: int

minimum1000

message: str

documentation_url: Optional[str]

source: Optional[ErrorSource]

pointer: Optional[str]

messages: List[Message]

code: int

minimum1000

message: str

documentation_url: Optional[str]

source: Optional[MessageSource]

pointer: Optional[str]

success: Literal[true]

Whether the API call was successful.

Cloudforce OneRequestsPriority

Get a Priority Intelligence Requirement

cloudforce_one.requests.priority.get(strpriority_id, PriorityGetParams**kwargs) -> Item

GET/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}

Create a New Priority Intelligence Requirement

cloudforce_one.requests.priority.create(PriorityCreateParams**kwargs) -> Priority

POST/accounts/{account_id}/cloudforce-one/requests/priority/new

Update a Priority Intelligence Requirement

cloudforce_one.requests.priority.update(strpriority_id, PriorityUpdateParams**kwargs) -> Item

PUT/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}

Delete a Priority Intelligence Requirement

cloudforce_one.requests.priority.delete(strpriority_id, PriorityDeleteParams**kwargs) -> PriorityDeleteResponse

DELETE/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}

Get Priority Intelligence Requirement Quota

cloudforce_one.requests.priority.quota(PriorityQuotaParams**kwargs) -> Quota

GET/accounts/{account_id}/cloudforce-one/requests/priority/quota

ModelsExpand Collapse

str

class Priority: …

id: str

UUID.

maxLength36

created: datetime

Priority creation time.

formatdate-time

labels: List[Label]

List of labels.

priority: int

Priority.

requirement: str

Requirement.

tlp: Literal["clear", "amber", "amber-strict", 2 more]

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

updated: datetime

Priority last updated time.

formatdate-time

class PriorityEdit: …

labels: List[Label]

List of labels.

priority: int

Priority.

requirement: str

Requirement.

tlp: Literal["clear", "amber", "amber-strict", 2 more]

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

class PriorityDeleteResponse: …

errors: List[Error]

code: int

minimum1000

message: str

documentation_url: Optional[str]

source: Optional[ErrorSource]

pointer: Optional[str]

messages: List[Message]

code: int

minimum1000

message: str

documentation_url: Optional[str]

source: Optional[MessageSource]

pointer: Optional[str]

success: Literal[true]

Whether the API call was successful.

Cloudforce OneRequestsAssets

Get a Request Asset

cloudforce_one.requests.assets.get(strasset_id, AssetGetParams**kwargs) -> SyncSinglePage[AssetGetResponse]

GET/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}

List Request Assets

cloudforce_one.requests.assets.create(strrequest_id, AssetCreateParams**kwargs) -> SyncSinglePage[AssetCreateResponse]

POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset

Update a Request Asset

cloudforce_one.requests.assets.update(strasset_id, AssetUpdateParams**kwargs) -> AssetUpdateResponse

PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}

Delete a Request Asset

cloudforce_one.requests.assets.delete(strasset_id, AssetDeleteParams**kwargs) -> AssetDeleteResponse

DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}

ModelsExpand Collapse

class AssetGetResponse: …

id: int

Asset ID.

name: str

Asset name.

created: Optional[datetime]

Defines the asset creation time.

formatdate-time

description: Optional[str]

Asset description.

file_type: Optional[str]

Asset file type.

class AssetCreateResponse: …

id: int

Asset ID.

name: str

Asset name.

created: Optional[datetime]

Defines the asset creation time.

formatdate-time

description: Optional[str]

Asset description.

file_type: Optional[str]

Asset file type.

class AssetUpdateResponse: …

id: int

Asset ID.

name: str

Asset name.

created: Optional[datetime]

Defines the asset creation time.

formatdate-time

description: Optional[str]

Asset description.

file_type: Optional[str]

Asset file type.

class AssetDeleteResponse: …

errors: List[Error]

code: int

minimum1000

message: str

documentation_url: Optional[str]

source: Optional[ErrorSource]

pointer: Optional[str]

messages: List[Message]

code: int

minimum1000

message: str

documentation_url: Optional[str]

source: Optional[MessageSource]

pointer: Optional[str]

success: Literal[true]

Whether the API call was successful.

Cloudforce OneScans

Cloudforce OneScansResults

Get the Latest Scan Result

cloudforce_one.scans.results.get(strconfig_id, ResultGetParams**kwargs) -> ResultGetResponse

GET/accounts/{account_id}/cloudforce-one/scans/results/{config_id}

ModelsExpand Collapse

class ScanResult: …

number: Optional[float]

proto: Optional[str]

status: Optional[str]

class ResultGetResponse: …

_1_1_1_1: List[ScanResult]

number: Optional[float]

proto: Optional[str]

status: Optional[str]

Cloudforce OneScansConfig

List Scan Configs

cloudforce_one.scans.config.list(ConfigListParams**kwargs) -> SyncSinglePage[ConfigListResponse]

GET/accounts/{account_id}/cloudforce-one/scans/config

Create a new Scan Config

cloudforce_one.scans.config.create(ConfigCreateParams**kwargs) -> ConfigCreateResponse

POST/accounts/{account_id}/cloudforce-one/scans/config

Update an existing Scan Config

cloudforce_one.scans.config.edit(strconfig_id, ConfigEditParams**kwargs) -> ConfigEditResponse

PATCH/accounts/{account_id}/cloudforce-one/scans/config/{config_id}

Delete a Scan Config

cloudforce_one.scans.config.delete(strconfig_id, ConfigDeleteParams**kwargs) -> object

DELETE/accounts/{account_id}/cloudforce-one/scans/config/{config_id}

ModelsExpand Collapse

class ConfigListResponse: …

id: str

Defines the Config ID.

account_id: str

frequency: float

Defines the number of days between each scan (0 = One-off scan).

ips: List[str]

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: List[str]

Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. [“1-80”, “443”]). “default” scans the 100 most commonly open ports.

class ConfigCreateResponse: …

id: str

Defines the Config ID.

account_id: str

frequency: float

Defines the number of days between each scan (0 = One-off scan).

ips: List[str]

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: List[str]

Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. [“1-80”, “443”]). “default” scans the 100 most commonly open ports.

class ConfigEditResponse: …

id: str

Defines the Config ID.

account_id: str

frequency: float

Defines the number of days between each scan (0 = One-off scan).

ips: List[str]

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: List[str]

Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. [“1-80”, “443”]). “default” scans the 100 most commonly open ports.

Cloudforce OneThreat Events

List events

cloudforce_one.threat_events.list(ThreatEventListParams**kwargs) -> ThreatEventListResponse

GET/accounts/{account_id}/cloudforce-one/events

Get an event (legacy)

Deprecated

cloudforce_one.threat_events.get(strevent_id, ThreatEventGetParams**kwargs) -> ThreatEventGetResponse

GET/accounts/{account_id}/cloudforce-one/events/{event_id}

Create an event

cloudforce_one.threat_events.create(ThreatEventCreateParams**kwargs) -> ThreatEventCreateResponse

POST/accounts/{account_id}/cloudforce-one/events/create

Update an event

cloudforce_one.threat_events.edit(strevent_id, ThreatEventEditParams**kwargs) -> ThreatEventEditResponse

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}

Create events in bulk

cloudforce_one.threat_events.bulk_create(ThreatEventBulkCreateParams**kwargs) -> ThreatEventBulkCreateResponse

POST/accounts/{account_id}/cloudforce-one/events/create/bulk

Create events with relationships in bulk (legacy)

Deprecated

cloudforce_one.threat_events.bulk_create_relationships(ThreatEventBulkCreateRelationshipsParams**kwargs) -> ThreatEventBulkCreateRelationshipsResponse

POST/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships

ModelsExpand Collapse

List[ThreatEventListResponseItem]

attacker: str

attacker_country: str

attacker_country_alpha3: str

category: str

dataset_id: str

date: str

event: str

has_children: bool

indicator: str

indicator_type: str

indicator_type_id: float

kill_chain: float

mitre_attack: List[str]

mitre_capec: List[str]

num_referenced: float

num_references: float

raw_id: str

referenced: List[str]

referenced_ids: List[float]

references: List[str]

references_ids: List[float]

tags: List[str]

target_country: str

target_country_alpha3: str

target_industry: str

tlp: str

uuid: str

insight: Optional[str]

releasability_id: Optional[str]

class ThreatEventGetResponse: …

attacker: str

attacker_country: str

attacker_country_alpha3: str

category: str

dataset_id: str

date: str

event: str

has_children: bool

indicator: str

indicator_type: str

indicator_type_id: float

kill_chain: float

mitre_attack: List[str]

mitre_capec: List[str]

num_referenced: float

num_references: float

raw_id: str

referenced: List[str]

referenced_ids: List[float]

references: List[str]

references_ids: List[float]

tags: List[str]

target_country: str

target_country_alpha3: str

target_industry: str

tlp: str

uuid: str

insight: Optional[str]

releasability_id: Optional[str]

class ThreatEventCreateResponse: …

attacker: str

attacker_country: str

attacker_country_alpha3: str

category: str

dataset_id: str

date: str

event: str

has_children: bool

indicator: str

indicator_type: str

indicator_type_id: float

kill_chain: float

mitre_attack: List[str]

mitre_capec: List[str]

num_referenced: float

num_references: float

raw_id: str

referenced: List[str]

referenced_ids: List[float]

references: List[str]

references_ids: List[float]

tags: List[str]

target_country: str

target_country_alpha3: str

target_industry: str

tlp: str

uuid: str

insight: Optional[str]

releasability_id: Optional[str]

class ThreatEventEditResponse: …

attacker: str

attacker_country: str

attacker_country_alpha3: str

category: str

dataset_id: str

date: str

event: str

has_children: bool

indicator: str

indicator_type: str

indicator_type_id: float

kill_chain: float

mitre_attack: List[str]

mitre_capec: List[str]

num_referenced: float

num_references: float

raw_id: str

referenced: List[str]

referenced_ids: List[float]

references: List[str]

references_ids: List[float]

tags: List[str]

target_country: str

target_country_alpha3: str

target_industry: str

tlp: str

uuid: str

insight: Optional[str]

releasability_id: Optional[str]

class ThreatEventBulkCreateResponse: …

Detailed result of bulk event creation with auto-tag management

created_events_count: float

Number of events created

created_tags_count: float

Number of new tags created in SoT

error_count: float

Number of errors encountered

queued_indicators_count: float

Number of indicators queued for async processing

create_bulk_events_request_id: Optional[str]

Correlation ID for async indicator processing

formatuuid

created_events: Optional[List[CreatedEvent]]

Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true

event_index: float

Original index in the input data array

shard_id: str

Dataset ID of the shard where the event was created

uuid: str

UUID of the created event

formatuuid

errors: Optional[List[Error]]

Array of error details

error: str

Error message

event_index: float

Index of the event that caused the error

class ThreatEventBulkCreateRelationshipsResponse: …

Result of bulk relationship creation operation

created_events_count: float

Number of events created

created_indicators_count: float

Number of indicators created

created_relationships_count: float

Number of relationships created

error_count: float

Number of errors encountered

errors: Optional[List[Error]]

Array of error details

error: str

Error message

event_index: float

Index of the event that caused the error

Cloudforce OneThreat EventsAggregate

Aggregate events

cloudforce_one.threat_events.aggregate.list(AggregateListParams**kwargs) -> AggregateListResponse

GET/accounts/{account_id}/cloudforce-one/events/aggregate

ModelsExpand Collapse

class AggregateListResponse: …

aggregate_by: str

Column(s) that were aggregated by

aggregations: List[Aggregation]

Array of aggregation results with dynamic fields based on aggregateBy columns

count: float

Number of events for this aggregation

date: Optional[str]

Date (if groupByDate is true)

total: float

Total number of events in the aggregation

date_range: Optional[DateRange]

Date range used for filtering

end_date: Optional[str]

start_date: Optional[str]

Cloudforce OneThreat EventsGraphql

Run a GraphQL aggregation over events

cloudforce_one.threat_events.graphql.create(GraphqlCreateParams**kwargs) -> GraphqlCreateResponse

POST/accounts/{account_id}/cloudforce-one/events/graphql

ModelsExpand Collapse

class GraphqlCreateResponse: …

data: Optional[object]

errors: Optional[List[object]]

Cloudforce OneThreat EventsGraph

Query graph neighborhood from R2 Data Catalog

cloudforce_one.threat_events.graph.list(GraphListParams**kwargs) -> GraphListResponse

GET/accounts/{account_id}/cloudforce-one/events/graph

ModelsExpand Collapse

class GraphListResponse: …

edges: List[Edge]

id: str

Deterministic composite edge id (source→target:relationshipType)

relationship_type: str

source: str

Compact id of the source node (type:uuid)

source_id: str

source_type: str

target: str

Compact id of the target node (type:uuid)

target_id: str

target_type: str

node: Optional[Dict[str, object]]

Focal node object (legacy single-seed). Null when unavailable.

nodes: List[Dict[str, object]]

Cloudforce OneThreat EventsQueries

List saved event queries

cloudforce_one.threat_events.queries.list(QueryListParams**kwargs) -> QueryListResponse

GET/accounts/{account_id}/cloudforce-one/events/queries

Create a saved event query

cloudforce_one.threat_events.queries.create(QueryCreateParams**kwargs) -> QueryCreateResponse

POST/accounts/{account_id}/cloudforce-one/events/queries/create

Get a saved event query

cloudforce_one.threat_events.queries.get(intquery_id, QueryGetParams**kwargs) -> QueryGetResponse

GET/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Update a saved event query

cloudforce_one.threat_events.queries.edit(intquery_id, QueryEditParams**kwargs) -> QueryEditResponse

PATCH/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Delete a saved event query

cloudforce_one.threat_events.queries.delete(intquery_id, QueryDeleteParams**kwargs)

DELETE/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

ModelsExpand Collapse

List[QueryListResponseItem]

id: int

Unique identifier for the saved query

account_id: int

Account ID

Deprecatedalert_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: str

Creation timestamp

name: str

Name of the saved query

query_json: str

JSON string containing the query parameters

Deprecatedrule_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: str

Last update timestamp

user_email: str

Email of the user who created the query

Deprecatedcustom_threat_feed_id: Optional[int]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

class QueryCreateResponse: …

id: int

Unique identifier for the saved query

account_id: int

Account ID

Deprecatedalert_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: str

Creation timestamp

name: str

Name of the saved query

query_json: str

JSON string containing the query parameters

Deprecatedrule_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: str

Last update timestamp

user_email: str

Email of the user who created the query

Deprecatedcustom_threat_feed_id: Optional[int]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

class QueryGetResponse: …

id: int

Unique identifier for the saved query

account_id: int

Account ID

Deprecatedalert_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: str

Creation timestamp

name: str

Name of the saved query

query_json: str

JSON string containing the query parameters

Deprecatedrule_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: str

Last update timestamp

user_email: str

Email of the user who created the query

Deprecatedcustom_threat_feed_id: Optional[int]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

class QueryEditResponse: …

id: int

Unique identifier for the saved query

account_id: int

Account ID

Deprecatedalert_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: str

Creation timestamp

name: str

Name of the saved query

query_json: str

JSON string containing the query parameters

Deprecatedrule_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: str

Last update timestamp

user_email: str

Email of the user who created the query

Deprecatedcustom_threat_feed_id: Optional[int]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

Cloudforce OneThreat EventsRelationships

List related events (legacy)

Deprecated

cloudforce_one.threat_events.relationships.list(strevent_id, RelationshipListParams**kwargs) -> RelationshipListResponse

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships

ModelsExpand Collapse

List[RelationshipListResponseItem]

attacker: str

attacker_country: str

attacker_country_alpha3: str

category: str

dataset_id: str

date: str

event: str

has_children: bool

indicator: str

indicator_type: str

indicator_type_id: float

kill_chain: float

mitre_attack: List[str]

mitre_capec: List[str]

num_referenced: float

num_references: float

raw_id: str

referenced: List[str]

referenced_ids: List[float]

references: List[str]

references_ids: List[float]

tags: List[str]

target_country: str

target_country_alpha3: str

target_industry: str

tlp: str

uuid: str

insight: Optional[str]

releasability_id: Optional[str]

Cloudforce OneThreat EventsIndicators

List indicators

cloudforce_one.threat_events.indicators.list(IndicatorListParams**kwargs) -> IndicatorListResponse

GET/accounts/{account_id}/cloudforce-one/events/indicators

ModelsExpand Collapse

class IndicatorListResponse: …

properties: Properties

completeness: PropertiesCompleteness

properties: PropertiesCompletenessProperties

complete: PropertiesCompletenessPropertiesComplete

type: str

failed_datasets: PropertiesCompletenessPropertiesFailedDatasets

items: PropertiesCompletenessPropertiesFailedDatasetsItems

type: str

type: str

failed_shards: PropertiesCompletenessPropertiesFailedShards

items: PropertiesCompletenessPropertiesFailedShardsItems

properties: PropertiesCompletenessPropertiesFailedShardsItemsProperties

dataset_id: PropertiesCompletenessPropertiesFailedShardsItemsPropertiesDatasetID

type: str

shard_id: PropertiesCompletenessPropertiesFailedShardsItemsPropertiesShardID

type: str

type: str

type: str

warnings: PropertiesCompletenessPropertiesWarnings

items: PropertiesCompletenessPropertiesWarningsItems

type: str

type: str

type: str

indicators: PropertiesIndicators

items: PropertiesIndicatorsItems

created_at: datetime

formatdate-time

indicator_type: str

sources: List[PropertiesIndicatorsItemsSource]

RSS article sources from which this indicator was extracted.

resource_id: str

formatuuid

resource_type: Literal["article"]

system: Literal["threat-signals"]

title: Optional[str]

Threat Signals article title; null for historical provenance without a stored title.

updated_at: datetime

formatdate-time

uuid: str

value: str

dataset_id: Optional[str]

The dataset ID this indicator belongs to. Included in list responses.

related_events: Optional[List[PropertiesIndicatorsItemsRelatedEvent]]

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

dataset_id: str

event_id: str

event_date: Optional[str]

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

related_events_has_more: Optional[bool]

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags: Optional[List[PropertiesIndicatorsItemsTag]]

category_id: Optional[str]

The UUID of the tag category, or null when the tag is uncategorized.

category_name: Optional[str]

uuid: Optional[str]

value: Optional[str]

tlp: Optional[str]

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

type: str

pagination: PropertiesPagination

properties: PropertiesPaginationProperties

count: PropertiesPaginationPropertiesCount

type: str

cursor: PropertiesPaginationPropertiesCursor

description: str

nullable: bool

type: str

has_more: PropertiesPaginationPropertiesHasMore

description: str

type: str

page: PropertiesPaginationPropertiesPage

type: str

per_page: PropertiesPaginationPropertiesPerPage

type: str

total_count: PropertiesPaginationPropertiesTotalCount

description: str

nullable: bool

type: str

total_count_is_exact: PropertiesPaginationPropertiesTotalCountIsExact

description: str

type: str

type: str

type: str

Cloudforce OneThreat EventsIndicatorsAggregate

Aggregate indicators by column(s)

cloudforce_one.threat_events.indicators.aggregate.list(AggregateListParams**kwargs) -> AggregateListResponse

GET/accounts/{account_id}/cloudforce-one/events/indicators/aggregate

ModelsExpand Collapse

class AggregateListResponse: …

aggregate_by: str

Column(s) that were aggregated by

aggregations: List[Aggregation]

Array of aggregation results with dynamic fields based on aggregateBy columns

count: float

Number of indicators for this aggregation

failed_datasets: float

Number of datasets whose aggregation failed and were excluded from the result

total: float

Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships

Cloudforce OneThreat EventsIndicatorsTypes

List indicator types

cloudforce_one.threat_events.indicators.types.list(TypeListParams**kwargs) -> TypeListResponse

GET/accounts/{account_id}/cloudforce-one/events/indicator-types

ModelsExpand Collapse

class TypeListResponse: …

items: Items

type: str

type: str

Cloudforce OneThreat EventsIndicatorsBy Dataset

List indicators in a dataset (legacy)

Deprecated

cloudforce_one.threat_events.indicators.by_dataset.list(strdataset_id, ByDatasetListParams**kwargs) -> ByDatasetListResponse

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators

Get an indicator

cloudforce_one.threat_events.indicators.by_dataset.get(strindicator_id, ByDatasetGetParams**kwargs) -> ByDatasetGetResponse

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}

ModelsExpand Collapse

class ByDatasetListResponse: …

indicators: List[Indicator]

created_at: datetime

formatdate-time

indicator_type: str

sources: List[IndicatorSource]

RSS article sources from which this indicator was extracted.

resource_id: str

formatuuid

resource_type: Literal["article"]

system: Literal["threat-signals"]

title: Optional[str]

Threat Signals article title; null for historical provenance without a stored title.

updated_at: datetime

formatdate-time

uuid: str

value: str

dataset_id: Optional[str]

The dataset ID this indicator belongs to. Included in list responses.

related_events: Optional[List[IndicatorRelatedEvent]]

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

dataset_id: str

event_id: str

event_date: Optional[str]

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

related_events_has_more: Optional[bool]

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags: Optional[List[IndicatorTag]]

category_id: Optional[str]

The UUID of the tag category, or null when the tag is uncategorized.

category_name: Optional[str]

uuid: Optional[str]

value: Optional[str]

tlp: Optional[str]

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: Pagination

page: float

page_size: float

total_count: float

total_pages: float

class ByDatasetGetResponse: …

created_at: datetime

formatdate-time

indicator_type: str

updated_at: datetime

formatdate-time

uuid: str

value: str

dataset_id: Optional[str]

The dataset ID this indicator belongs to. Included in list responses.

related_events: Optional[List[RelatedEvent]]

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

dataset_id: str

event_id: str

event_date: Optional[str]

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

related_events_has_more: Optional[bool]

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags: Optional[List[Tag]]

category_id: Optional[str]

The UUID of the tag category, or null when the tag is uncategorized.

category_name: Optional[str]

uuid: Optional[str]

value: Optional[str]

tlp: Optional[str]

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

Cloudforce OneThreat EventsIndicatorsBy DatasetTags

List tags on a dataset's indicators

cloudforce_one.threat_events.indicators.by_dataset.tags.list(strdataset_id, TagListParams**kwargs) -> TagListResponse

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags

ModelsExpand Collapse

List[object]

Array of mirror tag rows

Cloudforce OneThreat EventsAttackers

List attackers

cloudforce_one.threat_events.attackers.list(AttackerListParams**kwargs) -> AttackerListResponse

GET/accounts/{account_id}/cloudforce-one/events/attackers

ModelsExpand Collapse

class AttackerListResponse: …

items: Items

type: str

type: str

Cloudforce OneThreat EventsCategories

List event categories used in datasets

cloudforce_one.threat_events.categories.list(CategoryListParams**kwargs) -> CategoryListResponse

GET/accounts/{account_id}/cloudforce-one/events/categories

Get an event category (legacy)

Deprecated

cloudforce_one.threat_events.categories.get(strcategory_id, CategoryGetParams**kwargs) -> CategoryGetResponse

GET/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Create an event category

cloudforce_one.threat_events.categories.create(CategoryCreateParams**kwargs) -> CategoryCreateResponse

POST/accounts/{account_id}/cloudforce-one/events/categories/create

Update an event category (legacy)

Deprecated

cloudforce_one.threat_events.categories.edit(strcategory_id, CategoryEditParams**kwargs) -> CategoryEditResponse

PATCH/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Delete an event category (legacy)

Deprecated

cloudforce_one.threat_events.categories.delete(strcategory_id, CategoryDeleteParams**kwargs) -> CategoryDeleteResponse

DELETE/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

ModelsExpand Collapse

List[CategoryListResponseItem]

kill_chain: float

name: str

uuid: str

mitre_attack: Optional[List[str]]

mitre_capec: Optional[List[str]]

shortname: Optional[str]

class CategoryGetResponse: …

kill_chain: float

name: str

uuid: str

mitre_attack: Optional[List[str]]

mitre_capec: Optional[List[str]]

shortname: Optional[str]

class CategoryCreateResponse: …

kill_chain: float

name: str

uuid: str

mitre_attack: Optional[List[str]]

mitre_capec: Optional[List[str]]

shortname: Optional[str]

class CategoryEditResponse: …

kill_chain: float

name: str

uuid: str

mitre_attack: Optional[List[str]]

mitre_capec: Optional[List[str]]

shortname: Optional[str]

class CategoryDeleteResponse: …

uuid: str

Cloudforce OneThreat EventsCategoriesCatalog

List all event categories

cloudforce_one.threat_events.categories.catalog.list(CatalogListParams**kwargs) -> CatalogListResponse

GET/accounts/{account_id}/cloudforce-one/events/categories/catalog

ModelsExpand Collapse

List[CatalogListResponseItem]

kill_chain: float

name: str

uuid: str

mitre_attack: Optional[List[str]]

mitre_capec: Optional[List[str]]

shortname: Optional[str]

Cloudforce OneThreat EventsCountries

List countries

cloudforce_one.threat_events.countries.list(CountryListParams**kwargs) -> CountryListResponse

GET/accounts/{account_id}/cloudforce-one/events/countries

ModelsExpand Collapse

List[CountryListResponseItem]

result: List[CountryListResponseItemResult]

alpha2: str

alpha3: str

name: str

success: str

Cloudforce OneThreat EventsCrons

Cloudforce OneThreat EventsDatasets

List datasets

cloudforce_one.threat_events.datasets.list(DatasetListParams**kwargs) -> DatasetListResponse

GET/accounts/{account_id}/cloudforce-one/events/dataset

Get a dataset

cloudforce_one.threat_events.datasets.get(strdataset_id, DatasetGetParams**kwargs) -> DatasetGetResponse

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Create a dataset

cloudforce_one.threat_events.datasets.create(DatasetCreateParams**kwargs) -> DatasetCreateResponse

POST/accounts/{account_id}/cloudforce-one/events/dataset/create

Update a dataset

cloudforce_one.threat_events.datasets.edit(strdataset_id, DatasetEditParams**kwargs) -> DatasetEditResponse

PATCH/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Delete a dataset

cloudforce_one.threat_events.datasets.delete(strdataset_id, DatasetDeleteParams**kwargs) -> DatasetDeleteResponse

DELETE/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Get raw data for an event (legacy)

Deprecated

cloudforce_one.threat_events.datasets.raw(strevent_id, DatasetRawParams**kwargs) -> DatasetRawResponse

GET/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}

ModelsExpand Collapse

List[DatasetListResponseItem]

indicator_write_mode: Literal["read_only", "create_only", "full"]

Effective indicator mutation capability after account/dataset authorization and dataset storage capability are applied. API Gateway method permissions are separate and must also allow the requested operation.

One of the following:

"read_only"

"create_only"

"full"

is_analytics: bool

is_public: bool

name: str

uuid: str

deleted_at: Optional[str]

class DatasetGetResponse: …

is_analytics: bool

is_public: bool

name: str

uuid: str

class DatasetCreateResponse: …

is_analytics: bool

is_public: bool

name: str

uuid: str

class DatasetEditResponse: …

is_analytics: bool

is_public: bool

name: str

uuid: str

class DatasetDeleteResponse: …

name: str

uuid: str

class DatasetRawResponse: …

id: float

account_id: float

created: str

data: str

source: str

tlp: str

Cloudforce OneThreat EventsDatasetsHealth

Cloudforce OneThreat EventsDatasetsEvents

Get an event

cloudforce_one.threat_events.datasets.events.get(strevent_id, EventGetParams**kwargs) -> EventGetResponse

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}

ModelsExpand Collapse

class EventGetResponse: …

attacker: str

attacker_country: str

attacker_country_alpha3: str

category: str

dataset_id: str

date: str

event: str

has_children: bool

indicator: str

indicator_type: str

indicator_type_id: float

kill_chain: float

mitre_attack: List[str]

mitre_capec: List[str]

num_referenced: float

num_references: float

raw_id: str

referenced: List[str]

referenced_ids: List[float]

references: List[str]

references_ids: List[float]

tags: List[str]

target_country: str

target_country_alpha3: str

target_industry: str

tlp: str

uuid: str

insight: Optional[str]

releasability_id: Optional[str]

Cloudforce OneThreat EventsRaw

Get raw event data by raw ID (legacy)

cloudforce_one.threat_events.raw.get(strraw_id, RawGetParams**kwargs) -> RawGetResponse

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

Update raw event data by raw ID (legacy)

cloudforce_one.threat_events.raw.edit(strraw_id, RawEditParams**kwargs) -> RawEditResponse

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

ModelsExpand Collapse

class RawGetResponse: …

id: str

account_id: float

created: str

data: object

source: str

tlp: str

class RawEditResponse: …

id: str

data: object

Cloudforce OneThreat EventsRelate

Remove event references (legacy)

cloudforce_one.threat_events.relate.delete(strevent_id, RelateDeleteParams**kwargs) -> RelateDeleteResponse

DELETE/accounts/{account_id}/cloudforce-one/events/relate/{event_id}

ModelsExpand Collapse

class RelateDeleteResponse: …

success: bool

Cloudforce OneThreat EventsTags

List tags

cloudforce_one.threat_events.tags.list(TagListParams**kwargs) -> TagListResponse

GET/accounts/{account_id}/cloudforce-one/events/tags

Create a tag

cloudforce_one.threat_events.tags.create(TagCreateParams**kwargs) -> TagCreateResponse

POST/accounts/{account_id}/cloudforce-one/events/tags/create

Update a tag

cloudforce_one.threat_events.tags.edit(strtag_uuid, TagEditParams**kwargs) -> TagEditResponse

PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

Delete a tag

cloudforce_one.threat_events.tags.delete(strtag_uuid, TagDeleteParams**kwargs) -> TagDeleteResponse

DELETE/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

ModelsExpand Collapse

class TagListResponse: …

pagination: Pagination

page: float

page_size: float

total_count: float

total_pages: float

tags: List[Tag]

uuid: str

value: str

active_duration: Optional[str]

active_duration_annotated: Optional[TagActiveDurationAnnotated]

value: str

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actor_category: Optional[str]

actor_category_annotated: Optional[TagActorCategoryAnnotated]

value: str

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases: Optional[List[TagAlias]]

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: str

confidence: Optional[int]

maximum10

minimum1

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

alias_group_names: Optional[List[str]]

alias_group_names_internal: Optional[List[str]]

attribution_organization: Optional[str]

attribution_organization_annotated: Optional[TagAttributionOrganizationAnnotated]

value: str

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

category_name: Optional[str]

category_uuid: Optional[str]

confidence: Optional[int]

Overall tag confidence (1-10).

maximum10

minimum1

created_at: Optional[str]

date_of_discovery: Optional[str]

description: Optional[str]

external_reference_links: Optional[List[str]]

external_references: Optional[List[TagExternalReference]]

Structured external references ({ url, description }). Public: returned to all accounts.

url: str

description: Optional[str]

external_references_annotated: Optional[List[TagExternalReferencesAnnotated]]

value: str

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internal_aliases: Optional[List[TagInternalAlias]]

Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.

value: str

confidence: Optional[int]

maximum10

minimum1

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internal_description: Optional[str]

last_seen: Optional[str]

motive: Optional[str]

motive_annotated: Optional[TagMotiveAnnotated]

value: str

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsec_level: Optional[str]

opsec_level_annotated: Optional[TagOpsecLevelAnnotated]

value: str

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

origin_country_iso: Optional[str]

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

origin_country_iso_annotated: Optional[TagOriginCountryISOAnnotated]

value: Optional[str]

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority: Optional[float]

priority_annotated: Optional[TagPriorityAnnotated]

value: float

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties: Optional[Dict[str, object]]

Parsed custom field values. Null when the tag has no custom fields.

sophistication_level: Optional[str]

sophistication_level_annotated: Optional[TagSophisticationLevelAnnotated]

value: str

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updated_at: Optional[str]

version: Optional[float]

class TagCreateResponse: …

uuid: str

value: str

active_duration: Optional[str]

active_duration_annotated: Optional[ActiveDurationAnnotated]

value: str

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actor_category: Optional[str]

actor_category_annotated: Optional[ActorCategoryAnnotated]

value: str

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases: Optional[List[Alias]]

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: str

confidence: Optional[int]

maximum10

minimum1

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

alias_group_names: Optional[List[str]]

alias_group_names_internal: Optional[List[str]]

attribution_organization: Optional[str]

attribution_organization_annotated: Optional[AttributionOrganizationAnnotated]

value: str

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

category_name: Optional[str]

category_uuid: Optional[str]

confidence: Optional[int]

Overall tag confidence (1-10).

maximum10

minimum1

created_at: Optional[str]

date_of_discovery: Optional[str]

description: Optional[str]

external_reference_links: Optional[List[str]]

external_references: Optional[List[ExternalReference]]

Structured external references ({ url, description }). Public: returned to all accounts.

url: str

description: Optional[str]

external_references_annotated: Optional[List[ExternalReferencesAnnotated]]

value: str

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internal_aliases: Optional[List[InternalAlias]]

Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.

value: str

confidence: Optional[int]

maximum10

minimum1

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internal_description: Optional[str]

last_seen: Optional[str]

motive: Optional[str]

motive_annotated: Optional[MotiveAnnotated]

value: str

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsec_level: Optional[str]

opsec_level_annotated: Optional[OpsecLevelAnnotated]

value: str

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

origin_country_iso: Optional[str]

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

origin_country_iso_annotated: Optional[OriginCountryISOAnnotated]

value: Optional[str]

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority: Optional[float]

priority_annotated: Optional[PriorityAnnotated]

value: float

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties: Optional[Dict[str, object]]

Parsed custom field values. Null when the tag has no custom fields.

sophistication_level: Optional[str]

sophistication_level_annotated: Optional[SophisticationLevelAnnotated]

value: str

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updated_at: Optional[str]

version: Optional[float]

class TagEditResponse: …

uuid: str

value: str

active_duration: Optional[str]

active_duration_annotated: Optional[ActiveDurationAnnotated]

value: str

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actor_category: Optional[str]

actor_category_annotated: Optional[ActorCategoryAnnotated]

value: str

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases: Optional[List[Alias]]

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: str

confidence: Optional[int]

maximum10

minimum1

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

alias_group_names: Optional[List[str]]

alias_group_names_internal: Optional[List[str]]

attribution_organization: Optional[str]

attribution_organization_annotated: Optional[AttributionOrganizationAnnotated]

value: str

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

category_name: Optional[str]

category_uuid: Optional[str]

confidence: Optional[int]

Overall tag confidence (1-10).

maximum10

minimum1

created_at: Optional[str]

date_of_discovery: Optional[str]

description: Optional[str]

external_reference_links: Optional[List[str]]

external_references: Optional[List[ExternalReference]]

Structured external references ({ url, description }). Public: returned to all accounts.

url: str

description: Optional[str]

external_references_annotated: Optional[List[ExternalReferencesAnnotated]]

value: str

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internal_aliases: Optional[List[InternalAlias]]

Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.

value: str

confidence: Optional[int]

maximum10

minimum1

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internal_description: Optional[str]

last_seen: Optional[str]

motive: Optional[str]

motive_annotated: Optional[MotiveAnnotated]

value: str

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsec_level: Optional[str]

opsec_level_annotated: Optional[OpsecLevelAnnotated]

value: str

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

origin_country_iso: Optional[str]

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

origin_country_iso_annotated: Optional[OriginCountryISOAnnotated]

value: Optional[str]

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority: Optional[float]

priority_annotated: Optional[PriorityAnnotated]

value: float

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties: Optional[Dict[str, object]]

Parsed custom field values. Null when the tag has no custom fields.

sophistication_level: Optional[str]

sophistication_level_annotated: Optional[SophisticationLevelAnnotated]

value: str

confidence: Optional[float]

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updated_at: Optional[str]

version: Optional[float]

class TagDeleteResponse: …

uuid: str

Cloudforce OneThreat EventsTagsCategories

List tag categories

cloudforce_one.threat_events.tags.categories.list(CategoryListParams**kwargs) -> CategoryListResponse

GET/accounts/{account_id}/cloudforce-one/events/tags/categories

Create a tag category

cloudforce_one.threat_events.tags.categories.create(CategoryCreateParams**kwargs) -> CategoryCreateResponse

POST/accounts/{account_id}/cloudforce-one/events/tags/categories/create

Update a tag category (legacy)

Deprecated

cloudforce_one.threat_events.tags.categories.edit(strcategory_uuid, CategoryEditParams**kwargs) -> CategoryEditResponse

PATCH/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

Delete a tag category (legacy)

Deprecated

cloudforce_one.threat_events.tags.categories.delete(strcategory_uuid, CategoryDeleteParams**kwargs) -> CategoryDeleteResponse

DELETE/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

ModelsExpand Collapse

class CategoryListResponse: …

categories: List[Category]

name: str

uuid: str

created_at: Optional[str]

description: Optional[str]

schema: Optional[List[CategorySchema]]

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: str

kind: Literal["string", "number", "enum", 3 more]

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowed_values: Optional[List[str]]

annotations: Optional[CategorySchemaAnnotations]

confidence: Optional[bool]

tlp: Optional[bool]

deprecated: Optional[bool]

Marks a field as unavailable for new values while retaining its definition for historical values.

deprecated_values: Optional[List[str]]

Enum values unavailable for new writes but retained in allowedValues for historical display.

element: Optional[object]

enforcement: Optional[Literal["error", "warn", "off"]]

One of the following:

"error"

"warn"

"off"

format: Optional[Literal["date", "url", "duration", "country"]]

One of the following:

"date"

"url"

"duration"

"country"

label: Optional[str]

maxLength128

minLength1

max_length: Optional[int]

exclusiveMinimum

minimum0

number_constraint: Optional[CategorySchemaNumberConstraint]

integer: Optional[bool]

max: Optional[float]

min: Optional[float]

properties: Optional[Dict[str, object]]

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required: Optional[bool]

updated_at: Optional[str]

class CategoryCreateResponse: …

name: str

uuid: str

created_at: Optional[str]

description: Optional[str]

schema: Optional[List[Schema]]

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: str

kind: Literal["string", "number", "enum", 3 more]

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowed_values: Optional[List[str]]

annotations: Optional[SchemaAnnotations]

confidence: Optional[bool]

tlp: Optional[bool]

deprecated: Optional[bool]

Marks a field as unavailable for new values while retaining its definition for historical values.

deprecated_values: Optional[List[str]]

Enum values unavailable for new writes but retained in allowedValues for historical display.

element: Optional[object]

enforcement: Optional[Literal["error", "warn", "off"]]

One of the following:

"error"

"warn"

"off"

format: Optional[Literal["date", "url", "duration", "country"]]

One of the following:

"date"

"url"

"duration"

"country"

label: Optional[str]

maxLength128

minLength1

max_length: Optional[int]

exclusiveMinimum

minimum0

number_constraint: Optional[SchemaNumberConstraint]

integer: Optional[bool]

max: Optional[float]

min: Optional[float]

properties: Optional[Dict[str, object]]

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required: Optional[bool]

updated_at: Optional[str]

class CategoryEditResponse: …

name: str

uuid: str

created_at: Optional[str]

description: Optional[str]

schema: Optional[List[Schema]]

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: str

kind: Literal["string", "number", "enum", 3 more]

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowed_values: Optional[List[str]]

annotations: Optional[SchemaAnnotations]

confidence: Optional[bool]

tlp: Optional[bool]

deprecated: Optional[bool]

Marks a field as unavailable for new values while retaining its definition for historical values.

deprecated_values: Optional[List[str]]

Enum values unavailable for new writes but retained in allowedValues for historical display.

element: Optional[object]

enforcement: Optional[Literal["error", "warn", "off"]]

One of the following:

"error"

"warn"

"off"

format: Optional[Literal["date", "url", "duration", "country"]]

One of the following:

"date"

"url"

"duration"

"country"

label: Optional[str]

maxLength128

minLength1

max_length: Optional[int]

exclusiveMinimum

minimum0

number_constraint: Optional[SchemaNumberConstraint]

integer: Optional[bool]

max: Optional[float]

min: Optional[float]

properties: Optional[Dict[str, object]]

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required: Optional[bool]

updated_at: Optional[str]

class CategoryDeleteResponse: …

uuid: str

Cloudforce OneThreat EventsTagsIndicators

List a tag's indicators

cloudforce_one.threat_events.tags.indicators.list(strtag_uuid, IndicatorListParams**kwargs) -> IndicatorListResponse

GET/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators

ModelsExpand Collapse

class IndicatorListResponse: …

indicators: List[Indicator]

created_at: datetime

formatdate-time

indicator_type: str

updated_at: datetime

formatdate-time

uuid: str

value: str

dataset_id: Optional[str]

The dataset ID this indicator belongs to. Included in list responses.

related_events: Optional[List[IndicatorRelatedEvent]]

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

dataset_id: str

event_id: str

event_date: Optional[str]

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

related_events_has_more: Optional[bool]

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags: Optional[List[IndicatorTag]]

category_id: Optional[str]

The UUID of the tag category, or null when the tag is uncategorized.

category_name: Optional[str]

uuid: Optional[str]

value: Optional[str]

tlp: Optional[str]

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: Pagination

page: float

page_size: float

total_count: float

total_pages: float

failed_shard_count: Optional[float]

Number of shards that failed or timed out. Present only with partialResults.

partial_results: Optional[bool]

Present and true when one or more shards failed or timed out. Indicators from those shards may be missing from this page and from totalCount.

Cloudforce OneThreat EventsTagsIndicatorsBy Dataset

List indicators related to a tag within a dataset (deprecated)

Deprecated

cloudforce_one.threat_events.tags.indicators.by_dataset.list(strtag_uuid, ByDatasetListParams**kwargs) -> ByDatasetListResponse

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators

ModelsExpand Collapse

class ByDatasetListResponse: …

indicators: List[Indicator]

created_at: datetime

formatdate-time

indicator_type: str

updated_at: datetime

formatdate-time

uuid: str

value: str

dataset_id: Optional[str]

The dataset ID this indicator belongs to. Included in list responses.

related_events: Optional[List[IndicatorRelatedEvent]]

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

dataset_id: str

event_id: str

event_date: Optional[str]

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

related_events_has_more: Optional[bool]

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags: Optional[List[IndicatorTag]]

category_id: Optional[str]

The UUID of the tag category, or null when the tag is uncategorized.

category_name: Optional[str]

uuid: Optional[str]

value: Optional[str]

tlp: Optional[str]

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: Pagination

page: float

page_size: float

total_count: float

total_pages: float

failed_shard_count: Optional[float]

Number of shards that failed or timed out. Present only with partialResults.

partial_results: Optional[bool]

Present and true when one or more shards failed or timed out. Indicators from those shards may be missing from this page and from totalCount.

Cloudforce OneThreat EventsEvent Tags

Add tags to an event (legacy)

cloudforce_one.threat_events.event_tags.create(strevent_id, EventTagCreateParams**kwargs) -> EventTagCreateResponse

POST/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create

Remove tags from an event (legacy)

cloudforce_one.threat_events.event_tags.delete(strevent_id, EventTagDeleteParams**kwargs) -> EventTagDeleteResponse

DELETE/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}

ModelsExpand Collapse

class EventTagCreateResponse: …

success: bool

class EventTagDeleteResponse: …

success: bool

Cloudforce OneThreat EventsTarget Industries

List target industries used in datasets

cloudforce_one.threat_events.target_industries.list(TargetIndustryListParams**kwargs) -> TargetIndustryListResponse

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries

ModelsExpand Collapse

class TargetIndustryListResponse: …

items: Items

type: str

type: str

Cloudforce OneThreat EventsTarget IndustriesBy Dataset

List target industries in a dataset (legacy)

cloudforce_one.threat_events.target_industries.by_dataset.list(strdataset_id, ByDatasetListParams**kwargs) -> ByDatasetListResponse

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries

ModelsExpand Collapse

class ByDatasetListResponse: …

items: Items

type: str

type: str

Cloudforce OneThreat EventsTarget IndustriesCatalog

List all target industries

cloudforce_one.threat_events.target_industries.catalog.list(CatalogListParams**kwargs) -> CatalogListResponse

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog

ModelsExpand Collapse

class CatalogListResponse: …

items: Items

type: str

type: str

Cloudforce OneThreat EventsInsights

Cloudforce OneThreat Signals

Threat Signals API for managing threat intelligence feeds, articles, indicators, and AI skills in Cloudforce One.

Prerequisites

1. API token — requests must use an API token with Cloudforce One permissions; write operations (creating, editing, or deleting feeds, skills, and tags) require write access.
2. Plan limits — access on the Free plan is limited; feed quotas and managed default skills apply.

Cloudforce OneThreat SignalsSearch

Search Threat Signals articles using AI Search

cloudforce_one.threat_signals.search.search(SearchSearchParams**kwargs) -> SearchSearchResponse

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/search

ModelsExpand Collapse

class SearchSearchResponse: …

count: int

Number of unique article candidates returned in this response. Equal to results.length.

minimum0

results: List[Result]

article_id: str

formatuuid

dataset_id: Optional[str]

formatuuid

event_id: Optional[str]

formatuuid

feed_id: str

formatuuid

score: float

text: str

Cloudforce OneThreat SignalsCategories

List Threat Signals feed categories

cloudforce_one.threat_signals.categories.list(CategoryListParams**kwargs) -> CategoryListResponse

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/categories

ModelsExpand Collapse

class CategoryListResponse: …

categories: List[Category]

id: str

Wire value accepted by the feed category_id field.

formatuuid

description: str

Plain-language description of the category.

name: str

Human-readable display label.

Cloudforce OneThreat SignalsFeeds

List Threat Signals feeds

cloudforce_one.threat_signals.feeds.list(FeedListParams**kwargs) -> SyncV4PagePagination[FeedListResponse]

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds

Create Threat Signals feed

cloudforce_one.threat_signals.feeds.create(FeedCreateParams**kwargs) -> FeedCreateResponse

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds

Update Threat Signals feed

cloudforce_one.threat_signals.feeds.edit(strfeed_id, FeedEditParams**kwargs) -> FeedEditResponse

PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}

Delete Threat Signals feed

cloudforce_one.threat_signals.feeds.delete(strfeed_id, FeedDeleteParams**kwargs) -> FeedDeleteResponse

DELETE/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}

Trigger Threat Signals feed poll

cloudforce_one.threat_signals.feeds.poll(FeedPollParams**kwargs) -> FeedPollResponse

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/poll

ModelsExpand Collapse

class FeedListResponse: …

count: int

Number of feeds on this page.

custom_feed_count: int

The current count of custom feeds for the account.

minimum0

custom_feed_limit: int

The resolved custom feed limit for the account.

minimum0

feeds: List[Feed]

id: str

formatuuid

category_id: Optional[str]

Feed category identifier. Null when unset.

category_name: Optional[str]

Display name of the feed category. Null when unset or unresolvable.

created_at: str

curated_feed_id: Optional[str]

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: Optional[str]

enabled: bool

last_polled_at: Optional[str]

poll_interval_s: int

source_type: str

custom for a feed added by URL, curated for a curated catalog feed.

status: str

Polling health: active, or error after a failed poll.

subscribed_at: Optional[str]

title: Optional[str]

updated_at: str

url: str

page: int

per_page: int

total_count: int

class FeedCreateResponse: …

id: str

formatuuid

category_id: Optional[str]

Feed category identifier. Null when unset.

category_name: Optional[str]

Display name of the feed category. Null when unset or unresolvable.

created_at: str

curated_feed_id: Optional[str]

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: Optional[str]

enabled: bool

last_polled_at: Optional[str]

poll_interval_s: int

source_type: str

custom for a feed added by URL, curated for a curated catalog feed.

status: str

Polling health: active, or error after a failed poll.

subscribed_at: Optional[str]

title: Optional[str]

updated_at: str

url: str

class FeedEditResponse: …

id: str

formatuuid

category_id: Optional[str]

Feed category identifier. Null when unset.

category_name: Optional[str]

Display name of the feed category. Null when unset or unresolvable.

created_at: str

curated_feed_id: Optional[str]

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: Optional[str]

enabled: bool

last_polled_at: Optional[str]

poll_interval_s: int

source_type: str

custom for a feed added by URL, curated for a curated catalog feed.

status: str

Polling health: active, or error after a failed poll.

subscribed_at: Optional[str]

title: Optional[str]

updated_at: str

url: str

class FeedDeleteResponse: …

id: str

formatuuid

category_id: Optional[str]

Feed category identifier. Null when unset.

category_name: Optional[str]

Display name of the feed category. Null when unset or unresolvable.

created_at: str

curated_feed_id: Optional[str]

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: Optional[str]

enabled: bool

last_polled_at: Optional[str]

poll_interval_s: int

source_type: str

custom for a feed added by URL, curated for a curated catalog feed.

status: str

Polling health: active, or error after a failed poll.

subscribed_at: Optional[str]

title: Optional[str]

updated_at: str

url: str

class FeedPollResponse: …

errors: float

feeds: List[Feed]

feed_id: str

formatuuid

status: Literal["workflow_created", "error"]

One of the following:

"workflow_created"

"error"

workflow_id: str

feed_enabled: Optional[bool]

triggered: float

Cloudforce OneThreat SignalsFeedsRaw

Get Threat Signals feed XML

cloudforce_one.threat_signals.feeds.raw.get(strfeed_id, RawGetParams**kwargs) -> RawGetResponse

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/raw

ModelsExpand Collapse

str

Cloudforce OneThreat SignalsFeedsSkills

Get Threat Signals feed skills

cloudforce_one.threat_signals.feeds.skills.get(strfeed_id, SkillGetParams**kwargs) -> SkillGetResponse

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/skills

Set Threat Signals feed skills

cloudforce_one.threat_signals.feeds.skills.update(strfeed_id, SkillUpdateParams**kwargs) -> SkillUpdateResponse

PUT/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/skills

ModelsExpand Collapse

class SkillGetResponse: …

feed_id: str

formatuuid

skills: List[Skill]

id: str

config: Optional[str]

JSON-encoded skill configuration. Always null for default skills.

created_at: str

is_active: int

1 when active, 0 when inactive.

name: str

output_schema: Optional[str]

JSON-encoded JSON Schema the skill output must satisfy.

prompt: str

source: Literal["default", "custom"]

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: str

updated_at: str

class SkillUpdateResponse: …

feed_id: str

formatuuid

skills: List[Skill]

position: int

Zero-based pipeline position.

skill_id: str

Cloudforce OneThreat SignalsArticles

List Threat Signals articles

cloudforce_one.threat_signals.articles.list(ArticleListParams**kwargs) -> ArticleListResponse

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles

Bulk update Threat Signals article read status

cloudforce_one.threat_signals.articles.bulk_edit(ArticleBulkEditParams**kwargs) -> ArticleBulkEditResponse

PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles

Get Threat Signals article

cloudforce_one.threat_signals.articles.get(strarticle_id, ArticleGetParams**kwargs) -> ArticleGetResponse

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}

Update Threat Signals article read status

cloudforce_one.threat_signals.articles.edit(strarticle_id, ArticleEditParams**kwargs) -> ArticleEditResponse

PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}

ModelsExpand Collapse

class ArticleListResponse: …

articles: List[Article]

id: str

formatuuid

dataset_id: Optional[str]

Threat Events dataset identifier for the article redirect. Null when the account feeds dataset mapping is unavailable.

event_id: Optional[str]

Threat Events event identifier associated with this article for a UI redirect. Null when no event has been linked.

feed_display_name: Optional[str]

feed_id: str

formatuuid

fetched_at: str

link: Optional[str]

published_at: Optional[str]

read: bool

read_at: Optional[str]

relevance: Optional[ArticleRelevance]

Beta. The article’s relevance to the account’s active Priority Intelligence Requirements. Null when the article has not been scored against them, including when the account has no active PIRs, or has not been scored against the requested pir_id.

band: Literal["low", "medium", "high"]

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:

"low"

"medium"

"high"

pir_id: str

Beta. The pir_id requested from the article list, or otherwise the account’s most relevant active PIR for this article.

formatuuid

pirs: List[ArticleRelevancePir]

Beta. Every active PIR the article was scored against, most relevant first. Draft and deleted PIRs are excluded.

band: Literal["low", "medium", "high"]

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:

"low"

"medium"

"high"

pir_id: str

formatuuid

severity: Optional[Literal["informational", "low", "medium", 2 more]]

Beta. Intrinsic article severity band, from informational to critical, independent of any organisation or Priority Intelligence Requirement. Null when the account has no active Priority Intelligence Requirements, scoring has not completed, or a historic article has not entered an automatic rescore window.

One of the following:

"informational"

"low"

"medium"

"high"

"critical"

summary: Optional[str]

Persisted enrichment summary. Null until enrichment produces a summary.

tags: List[ArticleTag]

applied_by: Literal["ai", "analyst", "system"]

One of the following:

"ai"

"analyst"

"system"

category_id: Optional[str]

formatuuid

uuid: str

formatuuid

value: str

title: Optional[str]

has_more: bool

next_cursor: Optional[str]

total_count: Optional[float]

total_count_is_exact: bool

class ArticleBulkEditResponse: …

updated_count: float

class ArticleGetResponse: …

id: str

formatuuid

bullet_points: Optional[BulletPoints]

impact: str

what_happened: str

who_affected: str

content_r2_key: Optional[str]

feed_display_name: Optional[str]

feed_id: str

formatuuid

fetched_at: str

indicator_extraction_status: Literal["in_progress", "complete", "failed", "unknown"]

Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded.

One of the following:

"in_progress"

"complete"

"failed"

"unknown"

link: Optional[str]

metadata: Optional[Dict[str, object]]

published_at: Optional[str]

read: bool

read_at: Optional[str]

relevance: Optional[Relevance]

Beta. The article’s relevance to the account’s active Priority Intelligence Requirements. Null when the article has not been scored against them, including when the account has no active PIRs, or has not been scored against the requested pir_id.

band: Literal["low", "medium", "high"]

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:

"low"

"medium"

"high"

pir_id: str

Beta. The pir_id requested from the article list, or otherwise the account’s most relevant active PIR for this article.

formatuuid

pirs: List[RelevancePir]

Beta. Every active PIR the article was scored against, most relevant first. Draft and deleted PIRs are excluded.

band: Literal["low", "medium", "high"]

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:

"low"

"medium"

"high"

pir_id: str

formatuuid

severity: Optional[Literal["informational", "low", "medium", 2 more]]

Beta. Intrinsic article severity band, from informational to critical, independent of any organisation or Priority Intelligence Requirement. Null when the account has no active Priority Intelligence Requirements, scoring has not completed, or a historic article has not entered an automatic rescore window.

One of the following:

"informational"

"low"

"medium"

"high"

"critical"

source_count: float

summary: Optional[str]

Persisted enrichment summary. Null until enrichment produces a summary.

summary_r2_key: Optional[str]

tags: List[Tag]

applied_by: Literal["ai", "analyst", "system"]

One of the following:

"ai"

"analyst"

"system"

category_id: Optional[str]

formatuuid

uuid: str

formatuuid

value: str

title: Optional[str]

skill_version: Optional[str]

tag_skill_version: Optional[str]

class ArticleEditResponse: …

id: str

formatuuid

bullet_points: Optional[BulletPoints]

impact: str

what_happened: str

who_affected: str

content_r2_key: Optional[str]

feed_display_name: Optional[str]

feed_id: str

formatuuid

fetched_at: str

indicator_extraction_status: Literal["in_progress", "complete", "failed", "unknown"]

Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded.

One of the following:

"in_progress"

"complete"

"failed"

"unknown"

link: Optional[str]

metadata: Optional[Dict[str, object]]

published_at: Optional[str]

read: bool

read_at: Optional[str]

severity: Optional[Literal["informational", "low", "medium", 2 more]]

Beta. Intrinsic article severity band, from informational to critical, independent of any organisation or Priority Intelligence Requirement. Null when the account has no active Priority Intelligence Requirements, scoring has not completed, or a historic article has not entered an automatic rescore window.

One of the following:

"informational"

"low"

"medium"

"high"

"critical"

source_count: float

summary: Optional[str]

Persisted enrichment summary. Null until enrichment produces a summary.

summary_r2_key: Optional[str]

tags: List[Tag]

applied_by: Literal["ai", "analyst", "system"]

One of the following:

"ai"

"analyst"

"system"

category_id: Optional[str]

formatuuid

uuid: str

formatuuid

value: str

title: Optional[str]

skill_version: Optional[str]

tag_skill_version: Optional[str]

Cloudforce OneThreat SignalsArticlesContent

Get Threat Signals article content

cloudforce_one.threat_signals.articles.content.get(strarticle_id, ContentGetParams**kwargs) -> ContentGetResponse

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/content

ModelsExpand Collapse

str

Cloudforce OneThreat SignalsArticlesTags

Add tag to Threat Signals article

cloudforce_one.threat_signals.articles.tags.create(strarticle_id, TagCreateParams**kwargs) -> TagCreateResponse

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tags

Remove tag from Threat Signals article

cloudforce_one.threat_signals.articles.tags.delete(strtag_id, TagDeleteParams**kwargs) -> TagDeleteResponse

DELETE/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tags/{tag_id}

Generate Threat Signals article AI tags

cloudforce_one.threat_signals.articles.tags.generate(strarticle_id, TagGenerateParams**kwargs) -> TagGenerateResponse

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tag

ModelsExpand Collapse

class TagCreateResponse: …

applied_by: Literal["ai", "analyst", "system"]

One of the following:

"ai"

"analyst"

"system"

category_id: Optional[str]

formatuuid

uuid: str

formatuuid

value: str

class TagDeleteResponse: …

applied_by: Literal["ai", "analyst", "system"]

One of the following:

"ai"

"analyst"

"system"

category_id: Optional[str]

formatuuid

uuid: str

formatuuid

value: str

class TagGenerateResponse: …

tag_skill_version: str

tags: List[Tag]

Final hydrated assignment set; may be empty when no applicable tags are selected.

applied_by: Literal["ai", "analyst", "system"]

One of the following:

"ai"

"analyst"

"system"

category_id: Optional[str]

formatuuid

uuid: str

formatuuid

value: str

Cloudforce OneThreat SignalsArticlesSkill Outputs

Get Threat Signals article skill output

cloudforce_one.threat_signals.articles.skill_outputs.get(strskill_id, SkillOutputGetParams**kwargs) -> SkillOutputGetResponse

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/skills/{skill_id}/output

ModelsExpand Collapse

class SkillOutputGetResponse: …

article_id: str

Article UUID that received the skill output.

formatuuid

custom_output: Union[str, float, bool, 2 more]

Untrusted model output: parsed JSON when the stored completion text is valid JSON, otherwise raw text. Consumers must safely render or escape it.

One of the following:

str

float

bool

Dict[str, object]

List[Union[str, float, bool, Dict[str, object]]]

One of the following:

str

float

bool

Dict[str, object]

custom_output_parse_status: Literal["parsed", "invalid_json"]

Whether custom_output was parsed from the stored completion text.

One of the following:

"parsed"

"invalid_json"

custom_output_validation_status: Literal["valid", "invalid_json", "schema_invalid", "unknown"]

Non-blocking validation classification for untrusted model output. unknown is retained only for historical rows.

One of the following:

"valid"

"invalid_json"

"schema_invalid"

"unknown"

custom_skill_version: Optional[str]

Custom Skill version that produced the output. Null when historical metadata is unavailable.

output_schema: Optional[str]

JSON-encoded output schema. Null when historical skill metadata is unavailable.

skill_id: str

Custom Skill UUID that produced the output.

Cloudforce OneThreat SignalsIndicators

List Threat Signals article indicators

cloudforce_one.threat_signals.indicators.list(IndicatorListParams**kwargs) -> IndicatorListResponse

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/indicators

ModelsExpand Collapse

class IndicatorListResponse: …

indicators: List[Indicator]

id: str

formatuuid

article_id: str

formatuuid

article_title: Optional[str]

dataset_id: Optional[str]

Threat Events dataset identifier for navigating from this indicator. Null when the account feeds dataset mapping is unavailable.

feed_display_name: Optional[str]

feed_id: str

formatuuid

type: str

value: str

pagination: Pagination

count: int

minimum0

cursor: Optional[str]

has_more: bool

page: int

Ordinal of this cursor page; not a total-results offset.

minimum1

per_page: int

maximum100

minimum1

total_count: Optional[int]

minimum0

total_count_is_exact: bool

Cloudforce OneThreat SignalsSkills

List Threat Signals skills

cloudforce_one.threat_signals.skills.list(SkillListParams**kwargs) -> SyncV4PagePagination[SkillListResponse]

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills

Create Threat Signals skill

cloudforce_one.threat_signals.skills.create(SkillCreateParams**kwargs) -> SkillCreateResponse

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills

Get Threat Signals skill

cloudforce_one.threat_signals.skills.get(strskill_id, SkillGetParams**kwargs) -> SkillGetResponse

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}

Update Threat Signals skill

cloudforce_one.threat_signals.skills.edit(strskill_id, SkillEditParams**kwargs) -> SkillEditResponse

PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}

Delete Threat Signals skill

cloudforce_one.threat_signals.skills.delete(strskill_id, SkillDeleteParams**kwargs) -> SkillDeleteResponse

DELETE/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}

ModelsExpand Collapse

class SkillListResponse: …

count: int

Number of skills on this page.

custom_skills_available: bool

Whether Custom Skills are available to the account. False for Free Threat Signals accounts, which receive managed default skills only.

page: int

per_page: int

skills: List[Skill]

id: str

config: Optional[str]

JSON-encoded skill configuration. Always null for default skills.

created_at: str

is_active: int

1 when active, 0 when inactive.

name: str

output_schema: Optional[str]

JSON-encoded JSON Schema the skill output must satisfy.

prompt: str

source: Literal["default", "custom"]

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: str

updated_at: str

total_count: int

class SkillCreateResponse: …

id: str

config: Optional[str]

JSON-encoded skill configuration. Always null for default skills.

created_at: str

is_active: int

1 when active, 0 when inactive.

name: str

output_schema: Optional[str]

JSON-encoded JSON Schema the skill output must satisfy.

prompt: str

source: Literal["default", "custom"]

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: str

updated_at: str

class SkillGetResponse: …

id: str

config: Optional[str]

JSON-encoded skill configuration. Always null for default skills.

created_at: str

is_active: int

1 when active, 0 when inactive.

name: str

output_schema: Optional[str]

JSON-encoded JSON Schema the skill output must satisfy.

prompt: str

source: Literal["default", "custom"]

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: str

updated_at: str

class SkillEditResponse: …

id: str

config: Optional[str]

JSON-encoded skill configuration. Always null for default skills.

created_at: str

is_active: int

1 when active, 0 when inactive.

name: str

output_schema: Optional[str]

JSON-encoded JSON Schema the skill output must satisfy.

prompt: str

source: Literal["default", "custom"]

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: str

updated_at: str

class SkillDeleteResponse: …

id: str

config: Optional[str]

JSON-encoded skill configuration. Always null for default skills.

created_at: str

is_active: int

1 when active, 0 when inactive.

name: str

output_schema: Optional[str]

JSON-encoded JSON Schema the skill output must satisfy.

prompt: str

source: Literal["default", "custom"]

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: str

updated_at: str

Cloudforce OneThreat SignalsSkillsTag Categories

Get Threat Signals skill tag categories

cloudforce_one.threat_signals.skills.tag_categories.get(Literal["default-tagging-skill"]skill_id, TagCategoryGetParams**kwargs) -> TagCategoryGetResponse

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}/tag-categories

Replace Threat Signals skill tag categories

cloudforce_one.threat_signals.skills.tag_categories.update(Literal["default-tagging-skill"]skill_id, TagCategoryUpdateParams**kwargs) -> TagCategoryUpdateResponse

PUT/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}/tag-categories

ModelsExpand Collapse

class TagCategoryGetResponse: …

category_uuids: List[str]

skill_id: Literal["default-tagging-skill"]

class TagCategoryUpdateResponse: …

category_uuids: List[str]

skill_id: Literal["default-tagging-skill"]