--- title: Threat Signals --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) [Cloudforce One](https://developers.cloudflare.com/api/resources/cloudforce_one) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Threat Signals Threat Signals API for managing threat intelligence feeds, articles, indicators, and AI skills in Cloudforce One. ## Prerequisites 1. **API token** — requests must use an API token with Cloudforce One permissions; write operations (creating, editing, or deleting feeds, skills, and tags) require write access. 2. **Plan limits** — access on the Free plan is limited; feed quotas and managed default skills apply. #### Threat SignalsSearch ##### [Search Threat Signals articles using AI Search](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/search/methods/search) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/search ##### ModelsExpand Collapse

SearchSearchResponse object {count, results }

count: number Number of unique article candidates returned in this response. Equal to results.length. minimum0 Link to this property

results: array of object {article\_id, dataset\_id, event\_id, 3 more }

article\_id: string formatuuid Link to this property dataset\_id: string formatuuid Link to this property event\_id: string formatuuid Link to this property feed\_id: string formatuuid Link to this property score: number Link to this property text: string Link to this property

Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.search%20%3E%20(model)%20search_search_response%20%3E%20(schema)>) #### Threat SignalsCategories ##### [List Threat Signals feed categories](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/categories/methods/list) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/categories ##### ModelsExpand Collapse

CategoryListResponse object {categories }

categories: array of object {id, description, name }

id: string Wire value accepted by the feed category_id field. formatuuid Link to this property description: string Plain-language description of the category. Link to this property name: string Human-readable display label. Link to this property

Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>) #### Threat SignalsFeeds ##### [List Threat Signals feeds](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/list) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds ##### [Create Threat Signals feed](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/create) POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds ##### [Update Threat Signals feed](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/edit) PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id} ##### [Delete Threat Signals feed](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/delete) DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id} ##### [Trigger Threat Signals feed poll](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/methods/poll) POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/poll ##### ModelsExpand Collapse

FeedListResponse object {count, custom\_feed\_count, custom\_feed\_limit, 4 more }

count: number Number of feeds on this page. Link to this property custom\_feed\_count: number The current count of custom feeds for the account. minimum0 Link to this property custom\_feed\_limit: number The resolved custom feed limit for the account. minimum0 Link to this property

feeds: array of object {id, category\_id, category\_name, 12 more }

id: string formatuuid Link to this property category\_id: string Feed category identifier. Null when unset. Link to this property category\_name: string Display name of the feed category. Null when unset or unresolvable. Link to this property created\_at: string Link to this property curated\_feed\_id: string Curated catalog feed this subscription was created from. Null for custom feeds. Link to this property display\_name: string Link to this property enabled: boolean Link to this property last\_polled\_at: string Link to this property poll\_interval\_s: number Link to this property source\_type: string custom for a feed added by URL, curated for a curated catalog feed. Link to this property status: string Polling health: active, or error after a failed poll. Link to this property subscribed\_at: string Link to this property title: string Link to this property updated\_at: string Link to this property url: string Link to this property

Link to this property page: number Link to this property per\_page: number Link to this property total\_count: number Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_list_response%20%3E%20(schema)>)

FeedCreateResponse object {id, category\_id, category\_name, 12 more }

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_create_response%20%3E%20(schema)>)

FeedEditResponse object {id, category\_id, category\_name, 12 more }

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_edit_response%20%3E%20(schema)>)

FeedDeleteResponse object {id, category\_id, category\_name, 12 more }

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_delete_response%20%3E%20(schema)>)

FeedPollResponse object {errors, feeds, triggered }

errors: number Link to this property

feeds: array of object {feed\_id, status, workflow\_id, feed\_enabled }

feed\_id: string formatuuid Link to this property

status: "workflow\_created"or "error"

One of the following: "workflow\_created" Link to this property "error" Link to this property

Link to this property workflow\_id: string Link to this property feed\_enabled: optional boolean Link to this property

Link to this property triggered: number Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds%20%3E%20(model)%20feed_poll_response%20%3E%20(schema)>) #### Threat SignalsFeedsRaw ##### [Get Threat Signals feed XML](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/raw/methods/get) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/raw ##### ModelsExpand Collapse RawGetResponse = string [Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>) #### Threat SignalsFeedsSkills ##### [Get Threat Signals feed skills](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/skills/methods/get) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/skills ##### [Set Threat Signals feed skills](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/feeds/subresources/skills/methods/update) PUT/accounts/{account\_id}/cloudforce-one/v2/threat-signals/feeds/{feed\_id}/skills ##### ModelsExpand Collapse

SkillGetResponse object {feed\_id, skills }

feed\_id: string formatuuid Link to this property

skills: array of object {id, config, created\_at, 7 more }

id: string Link to this property config: string JSON-encoded skill configuration. Always null for default skills. Link to this property created\_at: string Link to this property is\_active: number 1 when active, 0 when inactive. Link to this property name: string Link to this property output\_schema: string JSON-encoded JSON Schema the skill output must satisfy. Link to this property prompt: string Link to this property

source: "default"or "custom" default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following: "default" Link to this property "custom" Link to this property

Link to this property type: string Link to this property updated\_at: string Link to this property

Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.skills%20%3E%20(model)%20skill_get_response%20%3E%20(schema)>)

SkillUpdateResponse object {feed\_id, skills }

feed\_id: string formatuuid Link to this property

skills: array of object {position, skill\_id }

position: number Zero-based pipeline position. Link to this property skill\_id: string Link to this property

Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.feeds.skills%20%3E%20(model)%20skill_update_response%20%3E%20(schema)>) #### Threat SignalsArticles ##### [List Threat Signals articles](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/list) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles ##### [Bulk update Threat Signals article read status](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/bulk_edit) PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles ##### [Get Threat Signals article](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/get) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id} ##### [Update Threat Signals article read status](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/methods/edit) PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id} ##### ModelsExpand Collapse

ArticleListResponse object {articles, has\_more, next\_cursor, 2 more }

articles: array of object {id, dataset\_id, event\_id, 12 more }

id: string formatuuid Link to this property dataset\_id: string Threat Events dataset identifier for the article redirect. Null when the account feeds dataset mapping is unavailable. Link to this property event\_id: string Threat Events event identifier associated with this article for a UI redirect. Null when no event has been linked. Link to this property feed\_display\_name: string Link to this property feed\_id: string formatuuid Link to this property fetched\_at: string Link to this property link: string Link to this property published\_at: string Link to this property read: boolean Link to this property read\_at: string Link to this property

relevance: object {band, pir\_id, pirs } Beta. The article’s relevance to the account’s active Priority Intelligence Requirements. Null when the article has not been scored against them, including when the account has no active PIRs, or has not been scored against the requested pir\_id.

band: "low"or "medium"or "high" Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property

Link to this property pir\_id: string Beta. The pir\_id requested from the article list, or otherwise the account’s most relevant active PIR for this article. formatuuid Link to this property

pirs: array of object {band, pir\_id } Beta. Every active PIR the article was scored against, most relevant first. Draft and deleted PIRs are excluded.

One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property

Link to this property pir\_id: string formatuuid Link to this property

Link to this property

severity: "informational"or "low"or "medium"or 2 more Beta. Intrinsic article severity band, from informational to critical, independent of any organisation or Priority Intelligence Requirement. Null when the account has no active Priority Intelligence Requirements, scoring has not completed, or a historic article has not entered an automatic rescore window.

One of the following: "informational" Link to this property "low" Link to this property "medium" Link to this property "high" Link to this property "critical" Link to this property

Link to this property summary: string Persisted enrichment summary. Null until enrichment produces a summary. Link to this property

tags: array of object {applied\_by, categoryId, uuid, value }

applied\_by: "ai"or "analyst"or "system"

One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property

Link to this property categoryId: string formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property

Link to this property title: string Link to this property

Link to this property has\_more: boolean Link to this property next\_cursor: string Link to this property total\_count: number Link to this property total\_count\_is\_exact: boolean Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_list_response%20%3E%20(schema)>)

ArticleBulkEditResponse object {updated\_count }

updated\_count: number Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_bulk_edit_response%20%3E%20(schema)>)

ArticleGetResponse object {id, bullet\_points, content\_r2\_key, 18 more }

id: string formatuuid Link to this property

bullet\_points: object {impact, what\_happened, who\_affected }

impact: string Link to this property what\_happened: string Link to this property who\_affected: string Link to this property

Link to this property content\_r2\_key: string Link to this property feed\_display\_name: string Link to this property feed\_id: string formatuuid Link to this property fetched\_at: string Link to this property

indicator\_extraction\_status: "in\_progress"or "complete"or "failed"or "unknown" Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded.

One of the following: "in\_progress" Link to this property "complete" Link to this property "failed" Link to this property "unknown" Link to this property

Link to this property link: string Link to this property metadata: map\[unknown] Link to this property published\_at: string Link to this property read: boolean Link to this property read\_at: string Link to this property

One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property

Link to this property pir\_id: string Beta. The pir\_id requested from the article list, or otherwise the account’s most relevant active PIR for this article. formatuuid Link to this property

pirs: array of object {band, pir\_id } Beta. Every active PIR the article was scored against, most relevant first. Draft and deleted PIRs are excluded.

One of the following: "low" Link to this property "medium" Link to this property "high" Link to this property

Link to this property pir\_id: string formatuuid Link to this property

Link to this property

One of the following: "informational" Link to this property "low" Link to this property "medium" Link to this property "high" Link to this property "critical" Link to this property

Link to this property source\_count: number Link to this property summary: string Persisted enrichment summary. Null until enrichment produces a summary. Link to this property summary\_r2\_key: string Link to this property

tags: array of object {applied\_by, categoryId, uuid, value }

applied\_by: "ai"or "analyst"or "system"

One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property

Link to this property categoryId: string formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property

Link to this property title: string Link to this property skill\_version: optional string Link to this property tag\_skill\_version: optional string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_get_response%20%3E%20(schema)>)

ArticleEditResponse object {id, bullet\_points, content\_r2\_key, 17 more }

id: string formatuuid Link to this property

bullet\_points: object {impact, what\_happened, who\_affected }

impact: string Link to this property what\_happened: string Link to this property who\_affected: string Link to this property

One of the following: "in\_progress" Link to this property "complete" Link to this property "failed" Link to this property "unknown" Link to this property

One of the following: "informational" Link to this property "low" Link to this property "medium" Link to this property "high" Link to this property "critical" Link to this property

tags: array of object {applied\_by, categoryId, uuid, value }

applied\_by: "ai"or "analyst"or "system"

One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property

Link to this property categoryId: string formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property

Link to this property title: string Link to this property skill\_version: optional string Link to this property tag\_skill\_version: optional string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles%20%3E%20(model)%20article_edit_response%20%3E%20(schema)>) #### Threat SignalsArticlesContent ##### [Get Threat Signals article content](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/content/methods/get) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/content ##### ModelsExpand Collapse ContentGetResponse = string [Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.content%20%3E%20(model)%20content_get_response%20%3E%20(schema)>) #### Threat SignalsArticlesTags ##### [Add tag to Threat Signals article](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/create) POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tags ##### [Remove tag from Threat Signals article](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/delete) DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tags/{tag\_id} ##### [Generate Threat Signals article AI tags](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/tags/methods/generate) POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/tag ##### ModelsExpand Collapse

TagCreateResponse object {applied\_by, categoryId, uuid, value }

applied\_by: "ai"or "analyst"or "system"

One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property

Link to this property categoryId: string formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_create_response%20%3E%20(schema)>)

TagDeleteResponse object {applied\_by, categoryId, uuid, value }

applied\_by: "ai"or "analyst"or "system"

One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property

Link to this property categoryId: string formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_delete_response%20%3E%20(schema)>)

TagGenerateResponse object {tag\_skill\_version, tags }

tag\_skill\_version: string Link to this property

tags: array of object {applied\_by, categoryId, uuid, value } Final hydrated assignment set; may be empty when no applicable tags are selected.

applied\_by: "ai"or "analyst"or "system"

One of the following: "ai" Link to this property "analyst" Link to this property "system" Link to this property

Link to this property categoryId: string formatuuid Link to this property uuid: string formatuuid Link to this property value: string Link to this property

Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.tags%20%3E%20(model)%20tag_generate_response%20%3E%20(schema)>) #### Threat SignalsArticlesSkill Outputs ##### [Get Threat Signals article skill output](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/articles/subresources/skill_outputs/methods/get) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/articles/{article\_id}/skills/{skill\_id}/output ##### ModelsExpand Collapse

SkillOutputGetResponse object {article\_id, custom\_output, custom\_output\_parse\_status, 4 more }

article\_id: string Article UUID that received the skill output. formatuuid Link to this property

custom\_output: stringor numberor booleanor 2 more Untrusted model output: parsed JSON when the stored completion text is valid JSON, otherwise raw text. Consumers must safely render or escape it.

One of the following: string Link to this property number Link to this property boolean Link to this property map\[unknown] Link to this property

array of stringor numberor booleanor map\[unknown]

One of the following: string Link to this property number Link to this property boolean Link to this property map\[unknown] Link to this property

Link to this property

custom\_output\_parse\_status: "parsed"or "invalid\_json" Whether custom\_output was parsed from the stored completion text.

One of the following: "parsed" Link to this property "invalid\_json" Link to this property

Link to this property

custom\_output\_validation\_status: "valid"or "invalid\_json"or "schema\_invalid"or "unknown" Non-blocking validation classification for untrusted model output. unknown is retained only for historical rows.

One of the following: "valid" Link to this property "invalid\_json" Link to this property "schema\_invalid" Link to this property "unknown" Link to this property

Link to this property custom\_skill\_version: string Custom Skill version that produced the output. Null when historical metadata is unavailable. Link to this property output\_schema: string JSON-encoded output schema. Null when historical skill metadata is unavailable. Link to this property skill\_id: string Custom Skill UUID that produced the output. Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.articles.skill_outputs%20%3E%20(model)%20skill_output_get_response%20%3E%20(schema)>) #### Threat SignalsIndicators ##### [List Threat Signals article indicators](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/indicators/methods/list) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/indicators ##### ModelsExpand Collapse

IndicatorListResponse object {indicators, pagination }

indicators: array of object {id, article\_id, article\_title, 5 more }

id: string formatuuid Link to this property article\_id: string formatuuid Link to this property article\_title: string Link to this property dataset\_id: string Threat Events dataset identifier for navigating from this indicator. Null when the account feeds dataset mapping is unavailable. Link to this property feed\_display\_name: string Link to this property feed\_id: string formatuuid Link to this property type: string Link to this property value: string Link to this property

Link to this property

pagination: object {count, cursor, has\_more, 4 more }

count: number minimum0 Link to this property cursor: string Link to this property has\_more: boolean Link to this property page: number Ordinal of this cursor page; not a total-results offset. minimum1 Link to this property per\_page: number maximum100 minimum1 Link to this property total\_count: number minimum0 Link to this property total\_count\_is\_exact: boolean Link to this property

Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>) #### Threat SignalsSkills ##### [List Threat Signals skills](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/list) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills ##### [Create Threat Signals skill](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/create) POST/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills ##### [Get Threat Signals skill](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/get) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### [Update Threat Signals skill](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/edit) PATCH/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### [Delete Threat Signals skill](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/methods/delete) DELETE/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id} ##### ModelsExpand Collapse

SkillListResponse object {count, custom\_skills\_available, page, 3 more }

count: number Number of skills on this page. Link to this property custom\_skills\_available: boolean Whether Custom Skills are available to the account. False for Free Threat Signals accounts, which receive managed default skills only. Link to this property page: number Link to this property per\_page: number Link to this property

skills: array of object {id, config, created\_at, 7 more }

source: "default"or "custom" default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following: "default" Link to this property "custom" Link to this property

Link to this property type: string Link to this property updated\_at: string Link to this property

Link to this property total\_count: number Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_list_response%20%3E%20(schema)>)

SkillCreateResponse object {id, config, created\_at, 7 more }

source: "default"or "custom" default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following: "default" Link to this property "custom" Link to this property

Link to this property type: string Link to this property updated\_at: string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_create_response%20%3E%20(schema)>)

SkillGetResponse object {id, config, created\_at, 7 more }

source: "default"or "custom" default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following: "default" Link to this property "custom" Link to this property

Link to this property type: string Link to this property updated\_at: string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_get_response%20%3E%20(schema)>)

SkillEditResponse object {id, config, created\_at, 7 more }

source: "default"or "custom" default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following: "default" Link to this property "custom" Link to this property

Link to this property type: string Link to this property updated\_at: string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_edit_response%20%3E%20(schema)>)

SkillDeleteResponse object {id, config, created\_at, 7 more }

source: "default"or "custom" default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following: "default" Link to this property "custom" Link to this property

Link to this property type: string Link to this property updated\_at: string Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills%20%3E%20(model)%20skill_delete_response%20%3E%20(schema)>) #### Threat SignalsSkillsTag Categories ##### [Get Threat Signals skill tag categories](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/subresources/tag_categories/methods/get) GET/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}/tag-categories ##### [Replace Threat Signals skill tag categories](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/subresources/skills/subresources/tag_categories/methods/update) PUT/accounts/{account\_id}/cloudforce-one/v2/threat-signals/skills/{skill\_id}/tag-categories ##### ModelsExpand Collapse

TagCategoryGetResponse object {category\_uuids, skill\_id }

category\_uuids: array of string Link to this property skill\_id: "default-tagging-skill" Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills.tag_categories%20%3E%20(model)%20tag_category_get_response%20%3E%20(schema)>)

TagCategoryUpdateResponse object {category\_uuids, skill\_id }

category\_uuids: array of string Link to this property skill\_id: "default-tagging-skill" Link to this property

[Link to this property](<#(resource)%20cloudforce_one.threat_signals.skills.tag_categories%20%3E%20(model)%20tag_category_update_response%20%3E%20(schema)>)