# Indicator Feeds ## Get indicator feeds owned by this account `intel.indicator_feeds.list(IndicatorFeedListParams**kwargs) -> SyncSinglePage[IndicatorFeedListResponse]` **get** `/accounts/{account_id}/intel/indicator-feeds` Retrieves details for all accessible custom threat indicator feeds. ### Parameters - `account_id: str` Identifier ### Returns - `class IndicatorFeedListResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) page = client.intel.indicator_feeds.list( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": [ { "id": 1, "created_on": "2023-05-12T12:21:56.777653Z", "description": "user specified description 1", "is_attributable": false, "is_downloadable": false, "is_public": false, "modified_on": "2023-06-18T03:13:34.123321Z", "name": "user_specified_name_1" }, { "id": 2, "created_on": "2023-05-21T21:43:52.867525Z", "description": "User specified description 2", "is_attributable": false, "is_downloadable": false, "is_public": false, "modified_on": "2023-06-28T18:46:18.764425Z", "name": "user_specified_name_2" } ] } ``` ## Get indicator feed metadata `intel.indicator_feeds.get(intfeed_id, IndicatorFeedGetParams**kwargs) -> IndicatorFeedGetResponse` **get** `/accounts/{account_id}/intel/indicator-feeds/{feed_id}` Retrieves details for a specific custom threat indicator feed. ### Parameters - `account_id: str` Identifier - `feed_id: int` Indicator feed ID ### Returns - `class IndicatorFeedGetResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `last_upload_summary: Optional[LastUploadSummary]` Summary of indicator counts from the last successful upload to this feed. Populated by the custom-threat-feeds loader at the end of each successful load. Absent (omitted) when no upload has completed successfully or the upload errored before the summary write. Surfaces silent-failure paths so operators can see when their indicators were dropped (popularity allowlist, expired valid_until, etc.) without reading loader logs. - `persisted: Optional[LastUploadSummaryPersisted]` Net delta applied to feed indicators by this upload. Snapshot uploads emit both *_added and *_removed; delta-add emits only \*_added; delta-remove emits only *_removed. - `domains_added: Optional[int]` - `domains_removed: Optional[int]` - `ips_added: Optional[int]` - `ips_removed: Optional[int]` - `urls_added: Optional[int]` - `urls_removed: Optional[int]` - `skipped: Optional[LastUploadSummarySkipped]` Counts of indicators that were uploaded but did not reach QuickSilver, broken down by reason. - `allowlisted_domains: Optional[int]` Domains filtered by the global popularity allowlist at QS provisioning time. Popular domains (bing.com, naver.com, etc.) are protected from custom-threat-feed enforcement. - `expired_indicators: Optional[int]` Indicators in the upload whose valid_until is already in the past. These are not added to QS; the expiration cron handles cleanup. - `invalid_indicators: Optional[int]` Reserved for future use. Currently always 0 — the unifier aborts the entire upload on a single bad indicator. - `uploaded: Optional[LastUploadSummaryUploaded]` Indicator counts from the unified file the loader received - `domains: Optional[int]` Number of domain indicators in the upload - `ips: Optional[int]` Number of IP indicators in the upload - `urls: Optional[int]` Number of URL indicators in the upload - `latest_upload_status: Optional[Literal["Mirroring", "Unifying", "Loading", 3 more]]` Status of the latest snapshot uploaded - `"Mirroring"` - `"Unifying"` - `"Loading"` - `"Provisioning"` - `"Complete"` - `"Error"` - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed - `provider_id: Optional[int]` The unique identifier for the provider - `provider_name: Optional[str]` The provider of the indicator feed ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) indicator_feed = client.intel.indicator_feeds.get( feed_id=12, account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(indicator_feed.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": 1, "created_on": "2023-05-12T12:21:56.777653Z", "description": "example feed description", "is_attributable": false, "is_downloadable": false, "is_public": false, "last_upload_summary": { "persisted": { "domains_added": 2, "domains_removed": 1, "ips_added": 0, "ips_removed": 0, "urls_added": 0, "urls_removed": 0 }, "skipped": { "allowlisted_domains": 1, "expired_indicators": 0, "invalid_indicators": 0 }, "uploaded": { "domains": 3, "ips": 0, "urls": 0 } }, "latest_upload_status": "Complete", "modified_on": "2023-06-18T03:13:34.123321Z", "name": "example_feed_1", "provider_id": 1, "provider_name": "provider_name" } } ``` ## Create new indicator feed `intel.indicator_feeds.create(IndicatorFeedCreateParams**kwargs) -> IndicatorFeedCreateResponse` **post** `/accounts/{account_id}/intel/indicator-feeds` Creates a new custom threat indicator feed for sharing threat intelligence data. ### Parameters - `account_id: str` Identifier - `description: Optional[str]` The description of the example test - `name: Optional[str]` The name of the indicator feed ### Returns - `class IndicatorFeedCreateResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) indicator_feed = client.intel.indicator_feeds.create( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(indicator_feed.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": 1, "created_on": "2023-05-12T12:21:56.777653Z", "description": "example feed description", "is_attributable": false, "is_downloadable": false, "is_public": false, "modified_on": "2023-06-18T03:13:34.123321Z", "name": "example_feed_1" } } ``` ## Update indicator feed metadata `intel.indicator_feeds.update(intfeed_id, IndicatorFeedUpdateParams**kwargs) -> IndicatorFeedUpdateResponse` **put** `/accounts/{account_id}/intel/indicator-feeds/{feed_id}` Revises details for a specific custom threat indicator feed. ### Parameters - `account_id: str` Identifier - `feed_id: int` Indicator feed ID - `description: Optional[str]` The new description of the feed - `is_attributable: Optional[bool]` The new is_attributable value of the feed - `is_downloadable: Optional[bool]` The new is_downloadable value of the feed - `is_public: Optional[bool]` The new is_public value of the feed - `name: Optional[str]` The new name of the feed ### Returns - `class IndicatorFeedUpdateResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) indicator_feed = client.intel.indicator_feeds.update( feed_id=12, account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(indicator_feed.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": 1, "created_on": "2023-05-12T12:21:56.777653Z", "description": "example feed description", "is_attributable": false, "is_downloadable": false, "is_public": false, "modified_on": "2023-06-18T03:13:34.123321Z", "name": "example_feed_1" } } ``` ## Get indicator feed data `intel.indicator_feeds.data(intfeed_id, IndicatorFeedDataParams**kwargs) -> IndicatorFeedDataResponse` **get** `/accounts/{account_id}/intel/indicator-feeds/{feed_id}/data` Retrieves the raw data entries in a custom threat indicator feed. ### Parameters - `account_id: str` Identifier - `feed_id: int` Indicator feed ID ### Returns - `str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) response = client.intel.indicator_feeds.data( feed_id=12, account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(response) ``` ## Domain Types ### Indicator Feed List Response - `class IndicatorFeedListResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed ### Indicator Feed Get Response - `class IndicatorFeedGetResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `last_upload_summary: Optional[LastUploadSummary]` Summary of indicator counts from the last successful upload to this feed. Populated by the custom-threat-feeds loader at the end of each successful load. Absent (omitted) when no upload has completed successfully or the upload errored before the summary write. Surfaces silent-failure paths so operators can see when their indicators were dropped (popularity allowlist, expired valid_until, etc.) without reading loader logs. - `persisted: Optional[LastUploadSummaryPersisted]` Net delta applied to feed indicators by this upload. Snapshot uploads emit both *_added and *_removed; delta-add emits only \*_added; delta-remove emits only *_removed. - `domains_added: Optional[int]` - `domains_removed: Optional[int]` - `ips_added: Optional[int]` - `ips_removed: Optional[int]` - `urls_added: Optional[int]` - `urls_removed: Optional[int]` - `skipped: Optional[LastUploadSummarySkipped]` Counts of indicators that were uploaded but did not reach QuickSilver, broken down by reason. - `allowlisted_domains: Optional[int]` Domains filtered by the global popularity allowlist at QS provisioning time. Popular domains (bing.com, naver.com, etc.) are protected from custom-threat-feed enforcement. - `expired_indicators: Optional[int]` Indicators in the upload whose valid_until is already in the past. These are not added to QS; the expiration cron handles cleanup. - `invalid_indicators: Optional[int]` Reserved for future use. Currently always 0 — the unifier aborts the entire upload on a single bad indicator. - `uploaded: Optional[LastUploadSummaryUploaded]` Indicator counts from the unified file the loader received - `domains: Optional[int]` Number of domain indicators in the upload - `ips: Optional[int]` Number of IP indicators in the upload - `urls: Optional[int]` Number of URL indicators in the upload - `latest_upload_status: Optional[Literal["Mirroring", "Unifying", "Loading", 3 more]]` Status of the latest snapshot uploaded - `"Mirroring"` - `"Unifying"` - `"Loading"` - `"Provisioning"` - `"Complete"` - `"Error"` - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed - `provider_id: Optional[int]` The unique identifier for the provider - `provider_name: Optional[str]` The provider of the indicator feed ### Indicator Feed Create Response - `class IndicatorFeedCreateResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed ### Indicator Feed Update Response - `class IndicatorFeedUpdateResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed ### Indicator Feed Data Response - `str` # Snapshots ## Update indicator feed data `intel.indicator_feeds.snapshots.update(intfeed_id, SnapshotUpdateParams**kwargs) -> SnapshotUpdateResponse` **put** `/accounts/{account_id}/intel/indicator-feeds/{feed_id}/snapshot` Revises the raw data entries in a custom threat indicator feed. ### Parameters - `account_id: str` Identifier - `feed_id: int` Indicator feed ID - `source: Optional[str]` The file to upload ### Returns - `class SnapshotUpdateResponse: …` - `file_id: Optional[int]` Feed id - `filename: Optional[str]` Name of the file unified in our system - `status: Optional[str]` Current status of upload, should be unified ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) snapshot = client.intel.indicator_feeds.snapshots.update( feed_id=12, account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(snapshot.file_id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "file_id": 1, "filename": "snapshot_file.unified", "status": "unified" } } ``` ## Domain Types ### Snapshot Update Response - `class SnapshotUpdateResponse: …` - `file_id: Optional[int]` Feed id - `filename: Optional[str]` Name of the file unified in our system - `status: Optional[str]` Current status of upload, should be unified # Permissions ## List indicator feed permissions `intel.indicator_feeds.permissions.list(PermissionListParams**kwargs) -> PermissionListResponse` **get** `/accounts/{account_id}/intel/indicator-feeds/permissions/view` Lists current access permissions for custom threat indicator feeds. ### Parameters - `account_id: str` Identifier ### Returns - `List[PermissionListResponseItem]` - `id: Optional[int]` The unique identifier for the indicator feed - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `name: Optional[str]` The name of the indicator feed ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) permissions = client.intel.indicator_feeds.permissions.list( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(permissions) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": [ { "id": 1, "description": "An important indicator list", "is_attributable": false, "is_downloadable": false, "is_public": false, "name": "indicator_list_1" }, { "id": 2, "description": "An even more important indicator list", "is_attributable": true, "is_downloadable": false, "is_public": true, "name": "indicator_list_2" } ] } ``` ## Grant permission to indicator feed `intel.indicator_feeds.permissions.create(PermissionCreateParams**kwargs) -> PermissionCreateResponse` **put** `/accounts/{account_id}/intel/indicator-feeds/permissions/add` Grants access permissions for a custom threat indicator feed to other accounts. ### Parameters - `account_id: str` Identifier - `account_tag: Optional[str]` The Cloudflare account tag of the account to change permissions on - `feed_id: Optional[int]` The ID of the feed to add/remove permissions on ### Returns - `class PermissionCreateResponse: …` - `success: Optional[bool]` Whether the update succeeded or not ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) permission = client.intel.indicator_feeds.permissions.create( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(permission.success) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "success": true } } ``` ## Revoke permission to indicator feed `intel.indicator_feeds.permissions.delete(PermissionDeleteParams**kwargs) -> PermissionDeleteResponse` **put** `/accounts/{account_id}/intel/indicator-feeds/permissions/remove` Revokes access permissions for a custom threat indicator feed. ### Parameters - `account_id: str` Identifier - `account_tag: Optional[str]` The Cloudflare account tag of the account to change permissions on - `feed_id: Optional[int]` The ID of the feed to add/remove permissions on ### Returns - `class PermissionDeleteResponse: …` - `success: Optional[bool]` Whether the update succeeded or not ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) permission = client.intel.indicator_feeds.permissions.delete( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(permission.success) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "success": true } } ``` ## Domain Types ### Permission List Response - `List[PermissionListResponseItem]` - `id: Optional[int]` The unique identifier for the indicator feed - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `name: Optional[str]` The name of the indicator feed ### Permission Create Response - `class PermissionCreateResponse: …` - `success: Optional[bool]` Whether the update succeeded or not ### Permission Delete Response - `class PermissionDeleteResponse: …` - `success: Optional[bool]` Whether the update succeeded or not # Downloads