--- title: Threat Signals --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [Cloudforce One](https://developers.cloudflare.com/api/python/resources/cloudforce_one) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Threat Signals Threat Signals API for managing threat intelligence feeds, articles, indicators, and AI skills in Cloudforce One. ## Prerequisites 1. **API token** — requests must use an API token with Cloudforce One permissions; write operations (creating, editing, or deleting feeds, skills, and tags) require write access. 2. **Plan limits** — access on the Free plan is limited; feed quotas and managed default skills apply. #### Threat SignalsSearch ##### [Search Threat Signals articles using AI Search](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/search/methods/search) cloudforce\_one.threat\_signals.search.search(SearchSearchParams\*\*kwargs) -> [SearchSearchResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/search ##### ModelsExpand Collapse
class SearchSearchResponse: … count: int Number of unique article candidates returned in this response. Equal to results.length. minimum0 Link to this property
results: List\[Result] article\_id: str formatuuid Link to this property dataset\_id: Optional\[str] formatuuid Link to this property event\_id: Optional\[str] formatuuid Link to this property feed\_id: str formatuuid Link to this property score: float Link to this property text: str Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.search%20%3E%20(model)%20search_search_response%20%3E%20(schema)>) #### Threat SignalsCategories ##### [List Threat Signals feed categories](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/categories/methods/list) cloudforce\_one.threat\_signals.categories.list(CategoryListParams\*\*kwargs) -> [CategoryListResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/categories ##### ModelsExpand Collapse
class CategoryListResponse: …
categories: List\[Category] id: str Wire value accepted by the feed category_id field. formatuuid Link to this property description: str Plain-language description of the category. Link to this property name: str Human-readable display label. Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>) #### Threat SignalsFeeds ##### [List Threat Signals feeds](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/list) cloudforce\_one.threat\_signals.feeds.list(FeedListParams\*\*kwargs) -> SyncV4PagePagination\[[FeedListResponse]()] GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds ##### [Create Threat Signals feed](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/create) cloudforce\_one.threat\_signals.feeds.create(FeedCreateParams\*\*kwargs) -> [FeedCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds ##### [Update Threat Signals feed](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/edit) cloudforce\_one.threat\_signals.feeds.edit(strfeed\_id, FeedEditParams\*\*kwargs) -> [FeedEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id} ##### [Delete Threat Signals feed](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/delete) cloudforce\_one.threat\_signals.feeds.delete(strfeed\_id, FeedDeleteParams\*\*kwargs) -> [FeedDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id} ##### [Trigger Threat Signals feed poll](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/poll) cloudforce\_one.threat\_signals.feeds.poll(FeedPollParams\*\*kwargs) -> [FeedPollResponse]() POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/poll ##### ModelsExpand Collapse
class FeedListResponse: … count: int Number of feeds on this page. Link to this property custom\_feed\_count: int The current count of custom feeds for the account. minimum0 Link to this property custom\_feed\_limit: int The resolved custom feed limit for the account. minimum0 Link to this property
feeds: List\[Feed] id: str formatuuid Link to this property category\_id: Optional\[str] Feed category identifier. Null when unset. Link to this property category\_name: Optional\[str] Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: str Link to this property curated\_feed\_id: Optional\[str] Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: Optional\[str] Link to this property enabled: bool Link to this property last\_polled\_at: Optional\[str] Link to this property poll\_interval\_s: int Link to this property source\_type: str custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: str Polling health: active, or error after a failed poll. Link to this property subscribed\_at: Optional\[str] Link to this property title: Optional\[str] Link to this property updated\_at: str Link to this property url: str Link to this property
Link to this property page: int Link to this property per\_page: int Link to this property total\_count: int Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_list_response%20%3E%20(schema)>)
class FeedCreateResponse: … id: str formatuuid Link to this property category\_id: Optional\[str] Feed category identifier. Null when unset. Link to this property category\_name: Optional\[str] Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: str Link to this property curated\_feed\_id: Optional\[str] Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: Optional\[str] Link to this property enabled: bool Link to this property last\_polled\_at: Optional\[str] Link to this property poll\_interval\_s: int Link to this property source\_type: str custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: str Polling health: active, or error after a failed poll. Link to this property subscribed\_at: Optional\[str] Link to this property title: Optional\[str] Link to this property updated\_at: str Link to this property url: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_create_response%20%3E%20(schema)>)
class FeedEditResponse: … id: str formatuuid Link to this property category\_id: Optional\[str] Feed category identifier. Null when unset. Link to this property category\_name: Optional\[str] Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: str Link to this property curated\_feed\_id: Optional\[str] Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: Optional\[str] Link to this property enabled: bool Link to this property last\_polled\_at: Optional\[str] Link to this property poll\_interval\_s: int Link to this property source\_type: str custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: str Polling health: active, or error after a failed poll. Link to this property subscribed\_at: Optional\[str] Link to this property title: Optional\[str] Link to this property updated\_at: str Link to this property url: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_edit_response%20%3E%20(schema)>)
class FeedDeleteResponse: … id: str formatuuid Link to this property category\_id: Optional\[str] Feed category identifier. Null when unset. Link to this property category\_name: Optional\[str] Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: str Link to this property curated\_feed\_id: Optional\[str] Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: Optional\[str] Link to this property enabled: bool Link to this property last\_polled\_at: Optional\[str] Link to this property poll\_interval\_s: int Link to this property source\_type: str custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: str Polling health: active, or error after a failed poll. Link to this property subscribed\_at: Optional\[str] Link to this property title: Optional\[str] Link to this property updated\_at: str Link to this property url: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_delete_response%20%3E%20(schema)>)
class FeedPollResponse: … errors: float Link to this property
feeds: List\[Feed] feed\_id: str formatuuid Link to this property
status: Literal\["workflow\_created", "error"] One of the following: "workflow\_created" Link to this property "error" Link to this property
Link to this property workflow\_id: str Link to this property feed\_enabled: Optional\[bool] Link to this property
Link to this property triggered: float Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_poll_response%20%3E%20(schema)>) #### Threat SignalsFeedsRaw ##### [Get Threat Signals feed XML](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/raw/methods/get) cloudforce\_one.threat\_signals.feeds.raw.get(strfeed\_id, RawGetParams\*\*kwargs) -> [RawGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/raw ##### ModelsExpand Collapse str [Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>) #### Threat SignalsFeedsSkills ##### [Get Threat Signals feed skills](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/skills/methods/get) cloudforce\_one.threat\_signals.feeds.skills.get(strfeed\_id, SkillGetParams\*\*kwargs) -> [SkillGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/skills ##### [Set Threat Signals feed skills](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/skills/methods/update) cloudforce\_one.threat\_signals.feeds.skills.update(strfeed\_id, SkillUpdateParams\*\*kwargs) -> [SkillUpdateResponse]() PUT/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/skills ##### ModelsExpand Collapse
class SkillGetResponse: … feed\_id: str formatuuid Link to this property
skills: List\[Skill] id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.skills%20%3E%20(model)%20skill_get_response%20%3E%20(schema)>)
class SkillUpdateResponse: … feed\_id: str formatuuid Link to this property
skills: List\[Skill] position: int Zero-based pipeline position. Link to this property skill\_id: str Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.skills%20%3E%20(model)%20skill_update_response%20%3E%20(schema)>) #### Threat SignalsArticles ##### [List Threat Signals articles](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/list) cloudforce\_one.threat\_signals.articles.list(ArticleListParams\*\*kwargs) -> [ArticleListResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles ##### [Bulk update Threat Signals article read status](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/bulk_edit) cloudforce\_one.threat\_signals.articles.bulk\_edit(ArticleBulkEditParams\*\*kwargs) -> [ArticleBulkEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles ##### [Get Threat Signals article](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/get) cloudforce\_one.threat\_signals.articles.get(strarticle\_id, ArticleGetParams\*\*kwargs) -> [ArticleGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id} ##### [Update Threat Signals article read status](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/edit) cloudforce\_one.threat\_signals.articles.edit(strarticle\_id, ArticleEditParams\*\*kwargs) -> [ArticleEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id} ##### ModelsExpand Collapse
class ArticleListResponse: …
articles: List\[Article] id: str formatuuid Link to this property dataset\_id: Optional\[str] Threat Events dataset identifier for the article redirect. Null when the account feeds dataset mapping is unavailable. Link to this property event\_id: Optional\[str] Threat Events event identifier associated with this article for a UI redirect. Null when no event has been linked. Link to this property feed\_display\_name: Optional\[str] Link to this property feed\_id: str formatuuid Link to this property fetched\_at: str Link to this property link: Optional\[str] Link to this property published\_at: Optional\[str] Link to this property read: bool Link to this property read\_at: Optional\[str] Link to this property
relevance: Optional\[ArticleRelevance] Beta. The article’s relevance to the account’s active Priority Intelligence Requirements. Null when the article has not been scored against them, including when the account has no active PIRs, or has not been scored against the requested pir\_id.
band: Literal\["low", "medium", "high"] Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property
Link to this property pir\_id: str Beta. The pir\_id requested from the article list, or otherwise the account’s most relevant active PIR for this article. formatuuid Link to this property
pirs: List\[ArticleRelevancePir] Beta. Every active PIR the article was scored against, most relevant first. Draft and deleted PIRs are excluded.
band: Literal\["low", "medium", "high"] Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property
Link to this property pir\_id: str formatuuid Link to this property
Link to this property
Link to this property
severity: Optional\[Literal\["informational", "low", "medium", 2 more]] Beta. Intrinsic article severity band, from informational to critical, independent of any organisation or Priority Intelligence Requirement. Null when the account has no active Priority Intelligence Requirements, scoring has not completed, or a historic article has not entered an automatic rescore window. One of the following: "informational" Link to this property "low" Link to this property "medium" Link to this property "high" Link to this property "critical" Link to this property
Link to this property summary: Optional\[str] Persisted enrichment summary. Null until enrichment produces a summary. Link to this property
tags: List\[ArticleTag]
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
Link to this property title: Optional\[str] Link to this property
Link to this property has\_more: bool Link to this property next\_cursor: Optional\[str] Link to this property total\_count: Optional\[float] Link to this property total\_count\_is\_exact: bool Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_list_response%20%3E%20(schema)>)
class ArticleBulkEditResponse: … updated\_count: float Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_bulk_edit_response%20%3E%20(schema)>)
class ArticleGetResponse: … id: str formatuuid Link to this property
bullet\_points: Optional\[BulletPoints] impact: str Link to this property what\_happened: str Link to this property who\_affected: str Link to this property
Link to this property content\_r2\_key: Optional\[str] Link to this property feed\_display\_name: Optional\[str] Link to this property feed\_id: str formatuuid Link to this property fetched\_at: str Link to this property
indicator\_extraction\_status: Literal\["in\_progress", "complete", "failed", "unknown"] Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded. One of the following: "in\_progress" Link to this property "complete" Link to this property "failed" Link to this property "unknown" Link to this property
Link to this property link: Optional\[str] Link to this property metadata: Optional\[Dict\[str, object]] Link to this property published\_at: Optional\[str] Link to this property read: bool Link to this property read\_at: Optional\[str] Link to this property
relevance: Optional\[Relevance] Beta. The article’s relevance to the account’s active Priority Intelligence Requirements. Null when the article has not been scored against them, including when the account has no active PIRs, or has not been scored against the requested pir\_id.
band: Literal\["low", "medium", "high"] Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property
Link to this property pir\_id: str Beta. The pir\_id requested from the article list, or otherwise the account’s most relevant active PIR for this article. formatuuid Link to this property
pirs: List\[RelevancePir] Beta. Every active PIR the article was scored against, most relevant first. Draft and deleted PIRs are excluded.
band: Literal\["low", "medium", "high"] Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated. One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property
Link to this property pir\_id: str formatuuid Link to this property
Link to this property
Link to this property
severity: Optional\[Literal\["informational", "low", "medium", 2 more]] Beta. Intrinsic article severity band, from informational to critical, independent of any organisation or Priority Intelligence Requirement. Null when the account has no active Priority Intelligence Requirements, scoring has not completed, or a historic article has not entered an automatic rescore window. One of the following: "informational" Link to this property "low" Link to this property "medium" Link to this property "high" Link to this property "critical" Link to this property
Link to this property source\_count: float Link to this property summary: Optional\[str] Persisted enrichment summary. Null until enrichment produces a summary. Link to this property summary\_r2\_key: Optional\[str] Link to this property
tags: List\[Tag]
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
Link to this property title: Optional\[str] Link to this property skill\_version: Optional\[str] Link to this property tag\_skill\_version: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_get_response%20%3E%20(schema)>)
class ArticleEditResponse: … id: str formatuuid Link to this property
bullet\_points: Optional\[BulletPoints] impact: str Link to this property what\_happened: str Link to this property who\_affected: str Link to this property
Link to this property content\_r2\_key: Optional\[str] Link to this property feed\_display\_name: Optional\[str] Link to this property feed\_id: str formatuuid Link to this property fetched\_at: str Link to this property
indicator\_extraction\_status: Literal\["in\_progress", "complete", "failed", "unknown"] Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded. One of the following: "in\_progress" Link to this property "complete" Link to this property "failed" Link to this property "unknown" Link to this property
Link to this property link: Optional\[str] Link to this property metadata: Optional\[Dict\[str, object]] Link to this property published\_at: Optional\[str] Link to this property read: bool Link to this property read\_at: Optional\[str] Link to this property
severity: Optional\[Literal\["informational", "low", "medium", 2 more]] Beta. Intrinsic article severity band, from informational to critical, independent of any organisation or Priority Intelligence Requirement. Null when the account has no active Priority Intelligence Requirements, scoring has not completed, or a historic article has not entered an automatic rescore window. One of the following: "informational" Link to this property "low" Link to this property "medium" Link to this property "high" Link to this property "critical" Link to this property
Link to this property source\_count: float Link to this property summary: Optional\[str] Persisted enrichment summary. Null until enrichment produces a summary. Link to this property summary\_r2\_key: Optional\[str] Link to this property
tags: List\[Tag]
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
Link to this property title: Optional\[str] Link to this property skill\_version: Optional\[str] Link to this property tag\_skill\_version: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_edit_response%20%3E%20(schema)>) #### Threat SignalsArticlesContent ##### [Get Threat Signals article content](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/content/methods/get) cloudforce\_one.threat\_signals.articles.content.get(strarticle\_id, ContentGetParams\*\*kwargs) -> [ContentGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/content ##### ModelsExpand Collapse str [Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.content%20%3E%20(model)%20content_get_response%20%3E%20(schema)>) #### Threat SignalsArticlesTags ##### [Add tag to Threat Signals article](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/create) cloudforce\_one.threat\_signals.articles.tags.create(strarticle\_id, TagCreateParams\*\*kwargs) -> [TagCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tags ##### [Remove tag from Threat Signals article](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/delete) cloudforce\_one.threat\_signals.articles.tags.delete(strtag\_id, TagDeleteParams\*\*kwargs) -> [TagDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tags/{tag\_id} ##### [Generate Threat Signals article AI tags](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/generate) cloudforce\_one.threat\_signals.articles.tags.generate(strarticle\_id, TagGenerateParams\*\*kwargs) -> [TagGenerateResponse]() POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tag ##### ModelsExpand Collapse
class TagCreateResponse: …
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_create_response%20%3E%20(schema)>)
class TagDeleteResponse: …
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_delete_response%20%3E%20(schema)>)
class TagGenerateResponse: … tag\_skill\_version: str Link to this property
tags: List\[Tag] Final hydrated assignment set; may be empty when no applicable tags are selected.
applied\_by: Literal\["ai", "analyst", "system"] One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property
Link to this property category\_id: Optional\[str] formatuuid Link to this property uuid: str formatuuid Link to this property value: str Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_generate_response%20%3E%20(schema)>) #### Threat SignalsArticlesSkill Outputs ##### [Get Threat Signals article skill output](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/skill_outputs/methods/get) cloudforce\_one.threat\_signals.articles.skill\_outputs.get(strskill\_id, SkillOutputGetParams\*\*kwargs) -> [SkillOutputGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/skills/{skill\_id}/output ##### ModelsExpand Collapse
class SkillOutputGetResponse: … article\_id: str Article UUID that received the skill output. formatuuid Link to this property
custom\_output: Union\[str, float, bool, 2 more] Untrusted model output: parsed JSON when the stored completion text is valid JSON, otherwise raw text. Consumers must safely render or escape it. One of the following: str Link to this property float Link to this property bool Link to this property Dict\[str, object] Link to this property
List\[Union\[str, float, bool, Dict\[str, object]]] One of the following: str Link to this property float Link to this property bool Link to this property Dict\[str, object] Link to this property
Link to this property
Link to this property
custom\_output\_parse\_status: Literal\["parsed", "invalid\_json"] Whether custom\_output was parsed from the stored completion text. One of the following: "parsed" Link to this property "invalid\_json" Link to this property
Link to this property
custom\_output\_validation\_status: Literal\["valid", "invalid\_json", "schema\_invalid", "unknown"] Non-blocking validation classification for untrusted model output. unknown is retained only for historical rows. One of the following: "valid" Link to this property "invalid\_json" Link to this property "schema\_invalid" Link to this property "unknown" Link to this property
Link to this property custom\_skill\_version: Optional\[str] Custom Skill version that produced the output. Null when historical metadata is unavailable. Link to this property output\_schema: Optional\[str] JSON-encoded output schema. Null when historical skill metadata is unavailable. Link to this property skill\_id: str Custom Skill UUID that produced the output. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.skill_outputs%20%3E%20(model)%20skill_output_get_response%20%3E%20(schema)>) #### Threat SignalsIndicators ##### [List Threat Signals article indicators](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/indicators/methods/list) cloudforce\_one.threat\_signals.indicators.list(IndicatorListParams\*\*kwargs) -> [IndicatorListResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/indicators ##### ModelsExpand Collapse
class IndicatorListResponse: …
indicators: List\[Indicator] id: str formatuuid Link to this property article\_id: str formatuuid Link to this property article\_title: Optional\[str] Link to this property dataset\_id: Optional\[str] Threat Events dataset identifier for navigating from this indicator. Null when the account feeds dataset mapping is unavailable. Link to this property feed\_display\_name: Optional\[str] Link to this property feed\_id: str formatuuid Link to this property type: str Link to this property value: str Link to this property
Link to this property
pagination: Pagination count: int minimum0 Link to this property cursor: Optional\[str] Link to this property has\_more: bool Link to this property page: int Ordinal of this cursor page; not a total-results offset. minimum1 Link to this property per\_page: int maximum100 minimum1 Link to this property total\_count: Optional\[int] minimum0 Link to this property total\_count\_is\_exact: bool Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>) #### Threat SignalsSkills ##### [List Threat Signals skills](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/list) cloudforce\_one.threat\_signals.skills.list(SkillListParams\*\*kwargs) -> SyncV4PagePagination\[[SkillListResponse]()] GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills ##### [Create Threat Signals skill](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/create) cloudforce\_one.threat\_signals.skills.create(SkillCreateParams\*\*kwargs) -> [SkillCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills ##### [Get Threat Signals skill](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/get) cloudforce\_one.threat\_signals.skills.get(strskill\_id, SkillGetParams\*\*kwargs) -> [SkillGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### [Update Threat Signals skill](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/edit) cloudforce\_one.threat\_signals.skills.edit(strskill\_id, SkillEditParams\*\*kwargs) -> [SkillEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### [Delete Threat Signals skill](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/delete) cloudforce\_one.threat\_signals.skills.delete(strskill\_id, SkillDeleteParams\*\*kwargs) -> [SkillDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### ModelsExpand Collapse
class SkillListResponse: … count: int Number of skills on this page. Link to this property custom\_skills\_available: bool Whether Custom Skills are available to the account. False for Free Threat Signals accounts, which receive managed default skills only. Link to this property page: int Link to this property per\_page: int Link to this property
skills: List\[Skill] id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
Link to this property total\_count: int Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_list_response%20%3E%20(schema)>)
class SkillCreateResponse: … id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_create_response%20%3E%20(schema)>)
class SkillGetResponse: … id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_get_response%20%3E%20(schema)>)
class SkillEditResponse: … id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_edit_response%20%3E%20(schema)>)
class SkillDeleteResponse: … id: str Link to this property config: Optional\[str] JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: str Link to this property is\_active: int 1 when active, 0 when inactive. Link to this property name: str Link to this property output\_schema: Optional\[str] JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: str Link to this property
source: Literal\["default", "custom"] default for Cloudforce One managed skills (read-only), custom for account skills. One of the following: "default" Link to this property "custom" Link to this property
Link to this property type: str Link to this property updated\_at: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_delete_response%20%3E%20(schema)>) #### Threat SignalsSkillsTag Categories ##### [Get Threat Signals skill tag categories](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/subresources/tag_categories/methods/get) cloudforce\_one.threat\_signals.skills.tag\_categories.get(Literal\["default-tagging-skill"]skill\_id, TagCategoryGetParams\*\*kwargs) -> [TagCategoryGetResponse]() GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}/tag-categories ##### [Replace Threat Signals skill tag categories](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_signals/subresources/skills/subresources/tag_categories/methods/update) cloudforce\_one.threat\_signals.skills.tag\_categories.update(Literal\["default-tagging-skill"]skill\_id, TagCategoryUpdateParams\*\*kwargs) -> [TagCategoryUpdateResponse]() PUT/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}/tag-categories ##### ModelsExpand Collapse
class TagCategoryGetResponse: … category\_uuids: List\[str] Link to this property skill\_id: Literal\["default-tagging-skill"] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills.tag_categories%20%3E%20(model)%20tag_category_get_response%20%3E%20(schema)>)
class TagCategoryUpdateResponse: … category\_uuids: List\[str] Link to this property skill\_id: Literal\["default-tagging-skill"] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills.tag_categories%20%3E%20(model)%20tag_category_update_response%20%3E%20(schema)>)