Skip to content
Cloudflare API
Start here
API Reference
Cloudforce One

Threat Signals

Threat Signals API for managing threat intelligence feeds, articles, indicators, and AI skills in Cloudforce One.

Prerequisites

  1. API token — requests must use an API token with Cloudforce One permissions; write operations (creating, editing, or deleting feeds, skills, and tags) require write access.
  2. Plan limits — access on the Free plan is limited; feed quotas and managed default skills apply.

Threat SignalsSearch

Search Threat Signals articles using AI Search
cloudforce_one.threat_signals.search.search(SearchSearchParams**kwargs) -> SearchSearchResponse
GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/search
ModelsExpand Collapse
class SearchSearchResponse: …
count: int

Number of unique article candidates returned in this response. Equal to results.length.

minimum0
results: List[Result]
article_id: str
formatuuid
dataset_id: Optional[str]
formatuuid
event_id: Optional[str]
formatuuid
feed_id: str
formatuuid
score: float
text: str

Threat SignalsCategories

List Threat Signals feed categories
cloudforce_one.threat_signals.categories.list(CategoryListParams**kwargs) -> CategoryListResponse
GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/categories
ModelsExpand Collapse
class CategoryListResponse: …
categories: List[Category]
id: str

Wire value accepted by the feed category_id field.

formatuuid
description: str

Plain-language description of the category.

name: str

Human-readable display label.

Threat SignalsFeeds

List Threat Signals feeds
cloudforce_one.threat_signals.feeds.list(FeedListParams**kwargs) -> SyncV4PagePagination[FeedListResponse]
GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds
Create Threat Signals feed
cloudforce_one.threat_signals.feeds.create(FeedCreateParams**kwargs) -> FeedCreateResponse
POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds
Update Threat Signals feed
cloudforce_one.threat_signals.feeds.edit(strfeed_id, FeedEditParams**kwargs) -> FeedEditResponse
PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}
Delete Threat Signals feed
cloudforce_one.threat_signals.feeds.delete(strfeed_id, FeedDeleteParams**kwargs) -> FeedDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}
Trigger Threat Signals feed poll
cloudforce_one.threat_signals.feeds.poll(FeedPollParams**kwargs) -> FeedPollResponse
POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/poll
ModelsExpand Collapse
class FeedListResponse: …
count: int

Number of feeds on this page.

custom_feed_count: int

The current count of custom feeds for the account.

minimum0
custom_feed_limit: int

The resolved custom feed limit for the account.

minimum0
feeds: List[Feed]
id: str
formatuuid
category_id: Optional[str]

Feed category identifier. Null when unset.

category_name: Optional[str]

Display name of the feed category. Null when unset or unresolvable.

created_at: str
curated_feed_id: Optional[str]

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: Optional[str]
enabled: bool
last_polled_at: Optional[str]
poll_interval_s: int
source_type: str

custom for a feed added by URL, curated for a curated catalog feed.

status: str

Polling health: active, or error after a failed poll.

subscribed_at: Optional[str]
title: Optional[str]
updated_at: str
url: str
page: int
per_page: int
total_count: int
class FeedCreateResponse: …
id: str
formatuuid
category_id: Optional[str]

Feed category identifier. Null when unset.

category_name: Optional[str]

Display name of the feed category. Null when unset or unresolvable.

created_at: str
curated_feed_id: Optional[str]

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: Optional[str]
enabled: bool
last_polled_at: Optional[str]
poll_interval_s: int
source_type: str

custom for a feed added by URL, curated for a curated catalog feed.

status: str

Polling health: active, or error after a failed poll.

subscribed_at: Optional[str]
title: Optional[str]
updated_at: str
url: str
class FeedEditResponse: …
id: str
formatuuid
category_id: Optional[str]

Feed category identifier. Null when unset.

category_name: Optional[str]

Display name of the feed category. Null when unset or unresolvable.

created_at: str
curated_feed_id: Optional[str]

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: Optional[str]
enabled: bool
last_polled_at: Optional[str]
poll_interval_s: int
source_type: str

custom for a feed added by URL, curated for a curated catalog feed.

status: str

Polling health: active, or error after a failed poll.

subscribed_at: Optional[str]
title: Optional[str]
updated_at: str
url: str
class FeedDeleteResponse: …
id: str
formatuuid
category_id: Optional[str]

Feed category identifier. Null when unset.

category_name: Optional[str]

Display name of the feed category. Null when unset or unresolvable.

created_at: str
curated_feed_id: Optional[str]

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: Optional[str]
enabled: bool
last_polled_at: Optional[str]
poll_interval_s: int
source_type: str

custom for a feed added by URL, curated for a curated catalog feed.

status: str

Polling health: active, or error after a failed poll.

subscribed_at: Optional[str]
title: Optional[str]
updated_at: str
url: str
class FeedPollResponse: …
errors: float
feeds: List[Feed]
feed_id: str
formatuuid
status: Literal["workflow_created", "error"]
One of the following:
"workflow_created"
"error"
workflow_id: str
feed_enabled: Optional[bool]
triggered: float

Threat SignalsFeedsRaw

Get Threat Signals feed XML
cloudforce_one.threat_signals.feeds.raw.get(strfeed_id, RawGetParams**kwargs) -> RawGetResponse
GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/raw
ModelsExpand Collapse
str

Threat SignalsFeedsSkills

Get Threat Signals feed skills
cloudforce_one.threat_signals.feeds.skills.get(strfeed_id, SkillGetParams**kwargs) -> SkillGetResponse
GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/skills
Set Threat Signals feed skills
cloudforce_one.threat_signals.feeds.skills.update(strfeed_id, SkillUpdateParams**kwargs) -> SkillUpdateResponse
PUT/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/skills
ModelsExpand Collapse
class SkillGetResponse: …
feed_id: str
formatuuid
skills: List[Skill]
id: str
config: Optional[str]

JSON-encoded skill configuration. Always null for default skills.

created_at: str
is_active: int

1 when active, 0 when inactive.

name: str
output_schema: Optional[str]

JSON-encoded JSON Schema the skill output must satisfy.

prompt: str
source: Literal["default", "custom"]

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:
"default"
"custom"
type: str
updated_at: str
class SkillUpdateResponse: …
feed_id: str
formatuuid
skills: List[Skill]
position: int

Zero-based pipeline position.

skill_id: str

Threat SignalsArticles

List Threat Signals articles
cloudforce_one.threat_signals.articles.list(ArticleListParams**kwargs) -> ArticleListResponse
GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles
Bulk update Threat Signals article read status
cloudforce_one.threat_signals.articles.bulk_edit(ArticleBulkEditParams**kwargs) -> ArticleBulkEditResponse
PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles
Get Threat Signals article
cloudforce_one.threat_signals.articles.get(strarticle_id, ArticleGetParams**kwargs) -> ArticleGetResponse
GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}
Update Threat Signals article read status
cloudforce_one.threat_signals.articles.edit(strarticle_id, ArticleEditParams**kwargs) -> ArticleEditResponse
PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}
ModelsExpand Collapse
class ArticleListResponse: …
articles: List[Article]
id: str
formatuuid
dataset_id: Optional[str]

Threat Events dataset identifier for the article redirect. Null when the account feeds dataset mapping is unavailable.

event_id: Optional[str]

Threat Events event identifier associated with this article for a UI redirect. Null when no event has been linked.

feed_display_name: Optional[str]
feed_id: str
formatuuid
fetched_at: str
link: Optional[str]
published_at: Optional[str]
read: bool
read_at: Optional[str]
relevance: Optional[ArticleRelevance]

Beta. The article’s relevance to the account’s active Priority Intelligence Requirements. Null when the article has not been scored against them, including when the account has no active PIRs, or has not been scored against the requested pir_id.

band: Literal["low", "medium", "high"]

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:
"low"
"medium"
"high"
pir_id: str

Beta. The pir_id requested from the article list, or otherwise the account’s most relevant active PIR for this article.

formatuuid
pirs: List[ArticleRelevancePir]

Beta. Every active PIR the article was scored against, most relevant first. Draft and deleted PIRs are excluded.

band: Literal["low", "medium", "high"]

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:
"low"
"medium"
"high"
pir_id: str
formatuuid
severity: Optional[Literal["informational", "low", "medium", 2 more]]

Beta. Intrinsic article severity band, from informational to critical, independent of any organisation or Priority Intelligence Requirement. Null when the account has no active Priority Intelligence Requirements, scoring has not completed, or a historic article has not entered an automatic rescore window.

One of the following:
"informational"
"low"
"medium"
"high"
"critical"
summary: Optional[str]

Persisted enrichment summary. Null until enrichment produces a summary.

tags: List[ArticleTag]
applied_by: Literal["ai", "analyst", "system"]
One of the following:
"ai"
"analyst"
"system"
category_id: Optional[str]
formatuuid
uuid: str
formatuuid
value: str
title: Optional[str]
has_more: bool
next_cursor: Optional[str]
total_count: Optional[float]
total_count_is_exact: bool
class ArticleBulkEditResponse: …
updated_count: float
class ArticleGetResponse: …
id: str
formatuuid
bullet_points: Optional[BulletPoints]
impact: str
what_happened: str
who_affected: str
content_r2_key: Optional[str]
feed_display_name: Optional[str]
feed_id: str
formatuuid
fetched_at: str
indicator_extraction_status: Literal["in_progress", "complete", "failed", "unknown"]

Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded.

One of the following:
"in_progress"
"complete"
"failed"
"unknown"
link: Optional[str]
metadata: Optional[Dict[str, object]]
published_at: Optional[str]
read: bool
read_at: Optional[str]
relevance: Optional[Relevance]

Beta. The article’s relevance to the account’s active Priority Intelligence Requirements. Null when the article has not been scored against them, including when the account has no active PIRs, or has not been scored against the requested pir_id.

band: Literal["low", "medium", "high"]

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:
"low"
"medium"
"high"
pir_id: str

Beta. The pir_id requested from the article list, or otherwise the account’s most relevant active PIR for this article.

formatuuid
pirs: List[RelevancePir]

Beta. Every active PIR the article was scored against, most relevant first. Draft and deleted PIRs are excluded.

band: Literal["low", "medium", "high"]

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:
"low"
"medium"
"high"
pir_id: str
formatuuid
severity: Optional[Literal["informational", "low", "medium", 2 more]]

Beta. Intrinsic article severity band, from informational to critical, independent of any organisation or Priority Intelligence Requirement. Null when the account has no active Priority Intelligence Requirements, scoring has not completed, or a historic article has not entered an automatic rescore window.

One of the following:
"informational"
"low"
"medium"
"high"
"critical"
source_count: float
summary: Optional[str]

Persisted enrichment summary. Null until enrichment produces a summary.

summary_r2_key: Optional[str]
tags: List[Tag]
applied_by: Literal["ai", "analyst", "system"]
One of the following:
"ai"
"analyst"
"system"
category_id: Optional[str]
formatuuid
uuid: str
formatuuid
value: str
title: Optional[str]
skill_version: Optional[str]
tag_skill_version: Optional[str]
class ArticleEditResponse: …
id: str
formatuuid
bullet_points: Optional[BulletPoints]
impact: str
what_happened: str
who_affected: str
content_r2_key: Optional[str]
feed_display_name: Optional[str]
feed_id: str
formatuuid
fetched_at: str
indicator_extraction_status: Literal["in_progress", "complete", "failed", "unknown"]

Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded.

One of the following:
"in_progress"
"complete"
"failed"
"unknown"
link: Optional[str]
metadata: Optional[Dict[str, object]]
published_at: Optional[str]
read: bool
read_at: Optional[str]
severity: Optional[Literal["informational", "low", "medium", 2 more]]

Beta. Intrinsic article severity band, from informational to critical, independent of any organisation or Priority Intelligence Requirement. Null when the account has no active Priority Intelligence Requirements, scoring has not completed, or a historic article has not entered an automatic rescore window.

One of the following:
"informational"
"low"
"medium"
"high"
"critical"
source_count: float
summary: Optional[str]

Persisted enrichment summary. Null until enrichment produces a summary.

summary_r2_key: Optional[str]
tags: List[Tag]
applied_by: Literal["ai", "analyst", "system"]
One of the following:
"ai"
"analyst"
"system"
category_id: Optional[str]
formatuuid
uuid: str
formatuuid
value: str
title: Optional[str]
skill_version: Optional[str]
tag_skill_version: Optional[str]

Threat SignalsArticlesContent

Get Threat Signals article content
cloudforce_one.threat_signals.articles.content.get(strarticle_id, ContentGetParams**kwargs) -> ContentGetResponse
GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/content
ModelsExpand Collapse
str

Threat SignalsArticlesTags

Add tag to Threat Signals article
cloudforce_one.threat_signals.articles.tags.create(strarticle_id, TagCreateParams**kwargs) -> TagCreateResponse
POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tags
Remove tag from Threat Signals article
cloudforce_one.threat_signals.articles.tags.delete(strtag_id, TagDeleteParams**kwargs) -> TagDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tags/{tag_id}
Generate Threat Signals article AI tags
cloudforce_one.threat_signals.articles.tags.generate(strarticle_id, TagGenerateParams**kwargs) -> TagGenerateResponse
POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tag
ModelsExpand Collapse
class TagCreateResponse: …
applied_by: Literal["ai", "analyst", "system"]
One of the following:
"ai"
"analyst"
"system"
category_id: Optional[str]
formatuuid
uuid: str
formatuuid
value: str
class TagDeleteResponse: …
applied_by: Literal["ai", "analyst", "system"]
One of the following:
"ai"
"analyst"
"system"
category_id: Optional[str]
formatuuid
uuid: str
formatuuid
value: str
class TagGenerateResponse: …
tag_skill_version: str
tags: List[Tag]

Final hydrated assignment set; may be empty when no applicable tags are selected.

applied_by: Literal["ai", "analyst", "system"]
One of the following:
"ai"
"analyst"
"system"
category_id: Optional[str]
formatuuid
uuid: str
formatuuid
value: str

Threat SignalsArticlesSkill Outputs

Get Threat Signals article skill output
cloudforce_one.threat_signals.articles.skill_outputs.get(strskill_id, SkillOutputGetParams**kwargs) -> SkillOutputGetResponse
GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/skills/{skill_id}/output
ModelsExpand Collapse
class SkillOutputGetResponse: …
article_id: str

Article UUID that received the skill output.

formatuuid
custom_output: Union[str, float, bool, 2 more]

Untrusted model output: parsed JSON when the stored completion text is valid JSON, otherwise raw text. Consumers must safely render or escape it.

One of the following:
str
float
bool
Dict[str, object]
List[Union[str, float, bool, Dict[str, object]]]
One of the following:
str
float
bool
Dict[str, object]
custom_output_parse_status: Literal["parsed", "invalid_json"]

Whether custom_output was parsed from the stored completion text.

One of the following:
"parsed"
"invalid_json"
custom_output_validation_status: Literal["valid", "invalid_json", "schema_invalid", "unknown"]

Non-blocking validation classification for untrusted model output. unknown is retained only for historical rows.

One of the following:
"valid"
"invalid_json"
"schema_invalid"
"unknown"
custom_skill_version: Optional[str]

Custom Skill version that produced the output. Null when historical metadata is unavailable.

output_schema: Optional[str]

JSON-encoded output schema. Null when historical skill metadata is unavailable.

skill_id: str

Custom Skill UUID that produced the output.

Threat SignalsIndicators

List Threat Signals article indicators
cloudforce_one.threat_signals.indicators.list(IndicatorListParams**kwargs) -> IndicatorListResponse
GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/indicators
ModelsExpand Collapse
class IndicatorListResponse: …
indicators: List[Indicator]
id: str
formatuuid
article_id: str
formatuuid
article_title: Optional[str]
dataset_id: Optional[str]

Threat Events dataset identifier for navigating from this indicator. Null when the account feeds dataset mapping is unavailable.

feed_display_name: Optional[str]
feed_id: str
formatuuid
type: str
value: str

Threat SignalsSkills

List Threat Signals skills
cloudforce_one.threat_signals.skills.list(SkillListParams**kwargs) -> SyncV4PagePagination[SkillListResponse]
GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills
Create Threat Signals skill
cloudforce_one.threat_signals.skills.create(SkillCreateParams**kwargs) -> SkillCreateResponse
POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills
Get Threat Signals skill
cloudforce_one.threat_signals.skills.get(strskill_id, SkillGetParams**kwargs) -> SkillGetResponse
GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}
Update Threat Signals skill
cloudforce_one.threat_signals.skills.edit(strskill_id, SkillEditParams**kwargs) -> SkillEditResponse
PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}
Delete Threat Signals skill
cloudforce_one.threat_signals.skills.delete(strskill_id, SkillDeleteParams**kwargs) -> SkillDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}
ModelsExpand Collapse
class SkillListResponse: …
count: int

Number of skills on this page.

custom_skills_available: bool

Whether Custom Skills are available to the account. False for Free Threat Signals accounts, which receive managed default skills only.

page: int
per_page: int
skills: List[Skill]
id: str
config: Optional[str]

JSON-encoded skill configuration. Always null for default skills.

created_at: str
is_active: int

1 when active, 0 when inactive.

name: str
output_schema: Optional[str]

JSON-encoded JSON Schema the skill output must satisfy.

prompt: str
source: Literal["default", "custom"]

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:
"default"
"custom"
type: str
updated_at: str
total_count: int
class SkillCreateResponse: …
id: str
config: Optional[str]

JSON-encoded skill configuration. Always null for default skills.

created_at: str
is_active: int

1 when active, 0 when inactive.

name: str
output_schema: Optional[str]

JSON-encoded JSON Schema the skill output must satisfy.

prompt: str
source: Literal["default", "custom"]

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:
"default"
"custom"
type: str
updated_at: str
class SkillGetResponse: …
id: str
config: Optional[str]

JSON-encoded skill configuration. Always null for default skills.

created_at: str
is_active: int

1 when active, 0 when inactive.

name: str
output_schema: Optional[str]

JSON-encoded JSON Schema the skill output must satisfy.

prompt: str
source: Literal["default", "custom"]

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:
"default"
"custom"
type: str
updated_at: str
class SkillEditResponse: …
id: str
config: Optional[str]

JSON-encoded skill configuration. Always null for default skills.

created_at: str
is_active: int

1 when active, 0 when inactive.

name: str
output_schema: Optional[str]

JSON-encoded JSON Schema the skill output must satisfy.

prompt: str
source: Literal["default", "custom"]

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:
"default"
"custom"
type: str
updated_at: str
class SkillDeleteResponse: …
id: str
config: Optional[str]

JSON-encoded skill configuration. Always null for default skills.

created_at: str
is_active: int

1 when active, 0 when inactive.

name: str
output_schema: Optional[str]

JSON-encoded JSON Schema the skill output must satisfy.

prompt: str
source: Literal["default", "custom"]

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:
"default"
"custom"
type: str
updated_at: str

Threat SignalsSkillsTag Categories

Get Threat Signals skill tag categories
cloudforce_one.threat_signals.skills.tag_categories.get(Literal["default-tagging-skill"]skill_id, TagCategoryGetParams**kwargs) -> TagCategoryGetResponse
GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}/tag-categories
Replace Threat Signals skill tag categories
cloudforce_one.threat_signals.skills.tag_categories.update(Literal["default-tagging-skill"]skill_id, TagCategoryUpdateParams**kwargs) -> TagCategoryUpdateResponse
PUT/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}/tag-categories
ModelsExpand Collapse
class TagCategoryGetResponse: …
category_uuids: List[str]
skill_id: Literal["default-tagging-skill"]
class TagCategoryUpdateResponse: …
category_uuids: List[str]
skill_id: Literal["default-tagging-skill"]