API Reference

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Cloudflare Managed Defense

Cloudflare Managed DefenseVulnerability Discovery

Cloudflare Managed DefenseVulnerability DiscoveryRepositories

List repositories

GET/accounts/{account_id}/managed-defense/vulnerability-discovery/repos

Create repository

POST/accounts/{account_id}/managed-defense/vulnerability-discovery/repos

Get repository

GET/accounts/{account_id}/managed-defense/vulnerability-discovery/repos/{repo_id}

ModelsExpand Collapse

RepositoryListResponse object { id, created_at, name, 3 more }

id: string

formatuuid

created_at: string

formatdate-time

name: string

maxLength255

minLength1

readiness: "awaiting_source" or "processing" or "ready" or "failed"

Source state. awaiting_source: the upload repository’s default branch has no commits yet. processing: an import is in progress. ready: source is available. failed: the Worker import failed or could not be verified.

One of the following:

"awaiting_source"

"processing"

"ready"

"failed"

source: "upload" or "worker"

One of the following:

"upload"

"worker"

import_error: optional object { code, message }

code: "worker_import_failed"

message: "Worker import failed."

RepositoryCreateResponse = object { repository, upload } or object { repository }

One of the following:

object { repository, upload }

repository: object { id, name, readiness, 2 more }

id: string

formatuuid

name: string

maxLength255

minLength1

readiness: "awaiting_source" or "processing" or "ready" or "failed"

Source state. awaiting_source: the upload repository’s default branch has no commits yet. processing: an import is in progress. ready: source is available. failed: the Worker import failed or could not be verified.

One of the following:

"awaiting_source"

"processing"

"ready"

"failed"

source: "upload" or "worker"

One of the following:

"upload"

"worker"

import_error: optional object { code, message }

code: "worker_import_failed"

message: "Worker import failed."

upload: object { token, expires_in, remote }

token: string

maxLength8192

minLength1

expires_in: 3600

remote: string

formaturi

maxLength2048

Repository object { repository }

repository: object { id, name, readiness, 2 more }

id: string

formatuuid

name: string

maxLength255

minLength1

readiness: "awaiting_source" or "processing" or "ready" or "failed"

Source state. awaiting_source: the upload repository’s default branch has no commits yet. processing: an import is in progress. ready: source is available. failed: the Worker import failed or could not be verified.

One of the following:

"awaiting_source"

"processing"

"ready"

"failed"

source: "upload" or "worker"

One of the following:

"upload"

"worker"

import_error: optional object { code, message }

code: "worker_import_failed"

message: "Worker import failed."

RepositoryGetResponse object { repository, scans }

repository: object { id, created_at, name, 3 more }

id: string

formatuuid

created_at: string

formatdate-time

name: string

maxLength255

minLength1

readiness: "awaiting_source" or "processing" or "ready" or "failed"

Source state. awaiting_source: the upload repository’s default branch has no commits yet. processing: an import is in progress. ready: source is available. failed: the Worker import failed or could not be verified.

One of the following:

"awaiting_source"

"processing"

"ready"

"failed"

source: "upload" or "worker"

One of the following:

"upload"

"worker"

import_error: optional object { code, message }

code: "worker_import_failed"

message: "Worker import failed."

scans: array of object { id, completed_at, message, 6 more }

id: string

formatuuid

completed_at: string

formatdate-time

message: string

maxLength1024

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

repositories: array of object { id, name, phase, 2 more }

id: string

formatuuid

name: string

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

report_status: "not_ready" or "pending_review" or "published" or "withdrawn"

One of the following:

"not_ready"

"pending_review"

"published"

"withdrawn"

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

started_at: string

formatdate-time

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

submitted_at: string

formatdate-time

telemetry_window: optional object { end, start }

UTC ISO-8601 interval. Start is inclusive, end is exclusive, and the interval must be positive and at most seven days.

end: string

formatdate-time

start: string

formatdate-time

Cloudflare Managed DefenseVulnerability DiscoveryScans

List scans

GET/accounts/{account_id}/managed-defense/vulnerability-discovery/scans

Create scan

POST/accounts/{account_id}/managed-defense/vulnerability-discovery/scans

Get scan

GET/accounts/{account_id}/managed-defense/vulnerability-discovery/scans/{scan_id}

Get reviewed vulnerability report

GET/accounts/{account_id}/managed-defense/vulnerability-discovery/scans/{scan_id}/report

ModelsExpand Collapse

ScanListResponse object { id, completed_at, message, 6 more }

id: string

formatuuid

completed_at: string

formatdate-time

message: string

maxLength1024

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

repositories: array of object { id, name, phase, 2 more }

id: string

formatuuid

name: string

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

report_status: "not_ready" or "pending_review" or "published" or "withdrawn"

One of the following:

"not_ready"

"pending_review"

"published"

"withdrawn"

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

started_at: string

formatdate-time

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

submitted_at: string

formatdate-time

telemetry_window: optional object { end, start }

UTC ISO-8601 interval. Start is inclusive, end is exclusive, and the interval must be positive and at most seven days.

end: string

formatdate-time

start: string

formatdate-time

ScanCreateResponse object { id, completed_at, message, 6 more }

id: string

formatuuid

completed_at: string

formatdate-time

message: string

maxLength1024

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

repositories: array of object { id, name, phase, 2 more }

id: string

formatuuid

name: string

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

report_status: "not_ready" or "pending_review" or "published" or "withdrawn"

One of the following:

"not_ready"

"pending_review"

"published"

"withdrawn"

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

started_at: string

formatdate-time

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

submitted_at: string

formatdate-time

telemetry_window: optional object { end, start }

UTC ISO-8601 interval. Start is inclusive, end is exclusive, and the interval must be positive and at most seven days.

end: string

formatdate-time

start: string

formatdate-time

ScanGetResponse object { id, completed_at, message, 6 more }

id: string

formatuuid

completed_at: string

formatdate-time

message: string

maxLength1024

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

repositories: array of object { id, name, phase, 2 more }

id: string

formatuuid

name: string

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

report_status: "not_ready" or "pending_review" or "published" or "withdrawn"

One of the following:

"not_ready"

"pending_review"

"published"

"withdrawn"

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

started_at: string

formatdate-time

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

submitted_at: string

formatdate-time

telemetry_window: optional object { end, start }

UTC ISO-8601 interval. Start is inclusive, end is exclusive, and the interval must be positive and at most seven days.

end: string

formatdate-time

start: string

formatdate-time

ScanGetReportResponse object { publication, report, repositories, scan_id }

publication: object { published_at, revision_id, version }

published_at: string

formatdate-time

revision_id: string

formatuuid

version: number

minimum1

report: object { executive_summary, generated_at, overall_severity, 3 more }

executive_summary: string

maxLength10000

minLength1

generated_at: string

Revision requests must echo the existing generation timestamp unchanged.

formatdate-time

overall_severity: "critical" or "high" or "medium" or 2 more

One of the following:

"critical"

"high"

"medium"

"low"

"info"

repositories: array of object { findings, overall_severity, repository_id, 5 more }

findings: array of object { id, conditions, cwe, 19 more }

id: string

maxLength128

minLength1

conditions: array of string

cwe: string

minLength1

impact: string

maxLength4000

minLength1

location: object { file, line, route }

file: string

minLength1

line: number

minimum1

route: string

reachability: array of object { consumer, reachable, via }

consumer: string

minLength1

reachable: boolean

via: string

remediation: object { code_changes, strategy }

code_changes: string

strategy: string

minLength1

root_cause: string

maxLength4000

minLength1

severity: "critical" or "high" or "medium" or 2 more

One of the following:

"critical"

"high"

"medium"

"low"

"info"

severity_basis: string

minLength1

summary: string

maxLength4000

minLength1

telemetry: object { references, state }

references: array of string

state: "no_route" or "no_telemetry" or "no_match" or "matched"

One of the following:

"no_route"

"no_telemetry"

"no_match"

"matched"

title: string

maxLength200

minLength1

trace: array of object { line, path, scope, 2 more }

line: number

minimum1

path: string

minLength1

scope: string

why: string

repo: optional string

Repository the step is in, present only when it is not the finding’s repository (a library or consumer of the same report). path is then relative to that repository.

formatuuid

waf_rules: object { broad, targeted }

broad: object { action, confidence, description, 4 more }

action: "block" or "managed_challenge" or "js_challenge" or "log"

One of the following:

"block"

"managed_challenge"

"js_challenge"

"log"

confidence: "low" or "medium" or "high"

One of the following:

"low"

"medium"

"high"

description: string

minLength1

expression: string

maxLength4096

minLength1

false_positive_risk: string

minLength1

name: string

maxLength25

minLength1

rationale: string

minLength1

targeted: object { action, confidence, description, 4 more }

action: "block" or "managed_challenge" or "js_challenge" or "log"

One of the following:

"block"

"managed_challenge"

"js_challenge"

"log"

confidence: "low" or "medium" or "high"

One of the following:

"low"

"medium"

"high"

description: string

minLength1

expression: string

maxLength4096

minLength1

false_positive_risk: string

minLength1

name: string

maxLength25

minLength1

rationale: string

minLength1

attacker_position: optional "external" or "authenticated" or "internal" or "post_compromise"

Least-privileged position required to trigger the finding. Optional on legacy report revisions.

One of the following:

"external"

"authenticated"

"internal"

"post_compromise"

external_links: optional array of object { title, url }

title: string

maxLength200

minLength1

url: string

formaturi

maxLength2048

impact_ids: optional array of string

Accepted settled impact-charter premises cited by the finding. Optional on legacy report revisions.

open_question: optional string

One bounded unresolved proof question. Optional on legacy report revisions.

maxLength500

proof_method: optional "structural" or "experimental" or "acquired_source" or 2 more

Method used or needed to close the proof. Optional on legacy report revisions.

One of the following:

"structural"

"experimental"

"acquired_source"

"public_knowledge"

"team_question"

proof_state: optional "closed" or "pending_source" or "pending_public" or 2 more

Current proof lifecycle state. Optional on legacy report revisions.

One of the following:

"closed"

"pending_source"

"pending_public"

"pending_experiment"

"pending_team"

threat_ids: optional array of string

Accepted settled threat-model premises cited by the finding. Optional on legacy report revisions.

overall_severity: "critical" or "high" or "medium" or 2 more

One of the following:

"critical"

"high"

"medium"

"low"

"info"

repository_id: string

formatuuid

repository_name: string

minLength1

summary: string

maxLength4000

minLength1

traffic_context: object { http, target, waf, web_assets }

http: object { error_paths, hot_paths, request_volume }

error_paths: array of object { id, hits, host, 2 more }

id: string

minLength1

hits: number

minimum0

host: string

minLength1

path: string

minLength1

status: number

maximum599

minimum100

hot_paths: array of object { id, hits, host, 2 more }

id: string

minLength1

hits: number

minimum0

host: string

minLength1

path: string

minLength1

top_status: number

maximum599

minimum100

request_volume: number

minimum0

target: object { hosts, kind, telemetry_window }

hosts: array of string

kind: "worker" or "origin"

One of the following:

"worker"

"origin"

telemetry_window: optional object { end, start }

UTC ISO-8601 interval. Start is inclusive, end is exclusive, and the interval must be positive and at most seven days.

end: string

formatdate-time

start: string

formatdate-time

waf: object { hit_volume, rules }

hit_volume: number

minimum0

rules: array of object { id, hit_volume, paths, 2 more }

id: string

minLength1

hit_volume: number

minimum0

paths: array of object { id, hit_volume, host, path }

id: string

minLength1

hit_volume: number

minimum0

host: string

minLength1

path: string

minLength1

rule_id: string

minLength1

rule_version: number

minimum0

web_assets: object { operations, paths, risk_types }

operations: array of object { id, endpoint, host, 3 more }

id: string

minLength1

endpoint: string

minLength1

host: string

minLength1

method: string

minLength1

risk_labels: array of object { description, name }

description: string

name: string

minLength1

performance: optional object { avg_origin_latency_ms, error_rate, estimated_requests }

avg_origin_latency_ms: number

minimum0

error_rate: number

maximum1

minimum0

estimated_requests: number

minimum0

paths: array of object { id, avg_origin_latency_ms, error_rate, 3 more }

id: string

minLength1

avg_origin_latency_ms: number

minimum0

error_rate: number

maximum1

minimum0

estimated_requests: number

minimum0

host: string

minLength1

path: string

minLength1

risk_types: array of object { description, name, operation_count }

description: string

name: string

minLength1

operation_count: number

minimum0

external_links: optional array of object { title, url }

title: string

maxLength200

minLength1

url: string

formaturi

maxLength2048

limitations: optional array of string

schema_version: 2

title: string

maxLength200

minLength1

repositories: array of object { id, name, report_status, scan_status }

id: string

formatuuid

name: string

report_status: "not_ready" or "pending_review" or "published" or "withdrawn"

One of the following:

"not_ready"

"pending_review"

"published"

"withdrawn"

scan_status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

scan_id: string

formatuuid

Cloudflare Managed DefenseVulnerability DiscoveryReports

Get reviewed vulnerability report

GET/accounts/{account_id}/managed-defense/vulnerability-discovery/repos/{repo_id}/scans/{scan_id}/report

ModelsExpand Collapse

ReportGetResponse object { publication, report, repository_id, scan_id }

publication: object { published_at, revision_id, version }

published_at: string

formatdate-time

revision_id: string

formatuuid

version: number

minimum1

report: object { findings, overall_severity, repository_id, 5 more }

findings: array of object { id, conditions, cwe, 19 more }

id: string

maxLength128

minLength1

conditions: array of string

cwe: string

minLength1

impact: string

maxLength4000

minLength1

location: object { file, line, route }

file: string

minLength1

line: number

minimum1

route: string

reachability: array of object { consumer, reachable, via }

consumer: string

minLength1

reachable: boolean

via: string

remediation: object { code_changes, strategy }

code_changes: string

strategy: string

minLength1

root_cause: string

maxLength4000

minLength1

severity: "critical" or "high" or "medium" or 2 more

One of the following:

"critical"

"high"

"medium"

"low"

"info"

severity_basis: string

minLength1

summary: string

maxLength4000

minLength1

telemetry: object { references, state }

references: array of string

state: "no_route" or "no_telemetry" or "no_match" or "matched"

One of the following:

"no_route"

"no_telemetry"

"no_match"

"matched"

title: string

maxLength200

minLength1

trace: array of object { line, path, scope, 2 more }

line: number

minimum1

path: string

minLength1

scope: string

why: string

repo: optional string

Repository the step is in, present only when it is not the finding’s repository (a library or consumer of the same report). path is then relative to that repository.

formatuuid

waf_rules: object { broad, targeted }

broad: object { action, confidence, description, 4 more }

action: "block" or "managed_challenge" or "js_challenge" or "log"

One of the following:

"block"

"managed_challenge"

"js_challenge"

"log"

confidence: "low" or "medium" or "high"

One of the following:

"low"

"medium"

"high"

description: string

minLength1

expression: string

maxLength4096

minLength1

false_positive_risk: string

minLength1

name: string

maxLength25

minLength1

rationale: string

minLength1

targeted: object { action, confidence, description, 4 more }

action: "block" or "managed_challenge" or "js_challenge" or "log"

One of the following:

"block"

"managed_challenge"

"js_challenge"

"log"

confidence: "low" or "medium" or "high"

One of the following:

"low"

"medium"

"high"

description: string

minLength1

expression: string

maxLength4096

minLength1

false_positive_risk: string

minLength1

name: string

maxLength25

minLength1

rationale: string

minLength1

attacker_position: optional "external" or "authenticated" or "internal" or "post_compromise"

Least-privileged position required to trigger the finding. Optional on legacy report revisions.

One of the following:

"external"

"authenticated"

"internal"

"post_compromise"

external_links: optional array of object { title, url }

title: string

maxLength200

minLength1

url: string

formaturi

maxLength2048

impact_ids: optional array of string

Accepted settled impact-charter premises cited by the finding. Optional on legacy report revisions.

open_question: optional string

One bounded unresolved proof question. Optional on legacy report revisions.

maxLength500

proof_method: optional "structural" or "experimental" or "acquired_source" or 2 more

Method used or needed to close the proof. Optional on legacy report revisions.

One of the following:

"structural"

"experimental"

"acquired_source"

"public_knowledge"

"team_question"

proof_state: optional "closed" or "pending_source" or "pending_public" or 2 more

Current proof lifecycle state. Optional on legacy report revisions.

One of the following:

"closed"

"pending_source"

"pending_public"

"pending_experiment"

"pending_team"

threat_ids: optional array of string

Accepted settled threat-model premises cited by the finding. Optional on legacy report revisions.

overall_severity: "critical" or "high" or "medium" or 2 more

One of the following:

"critical"

"high"

"medium"

"low"

"info"

repository_id: string

formatuuid

repository_name: string

minLength1

summary: string

maxLength4000

minLength1

traffic_context: object { http, target, waf, web_assets }

http: object { error_paths, hot_paths, request_volume }

error_paths: array of object { id, hits, host, 2 more }

id: string

minLength1

hits: number

minimum0

host: string

minLength1

path: string

minLength1

status: number

maximum599

minimum100

hot_paths: array of object { id, hits, host, 2 more }

id: string

minLength1

hits: number

minimum0

host: string

minLength1

path: string

minLength1

top_status: number

maximum599

minimum100

request_volume: number

minimum0

target: object { hosts, kind, telemetry_window }

hosts: array of string

kind: "worker" or "origin"

One of the following:

"worker"

"origin"

telemetry_window: optional object { end, start }

UTC ISO-8601 interval. Start is inclusive, end is exclusive, and the interval must be positive and at most seven days.

end: string

formatdate-time

start: string

formatdate-time

waf: object { hit_volume, rules }

hit_volume: number

minimum0

rules: array of object { id, hit_volume, paths, 2 more }

id: string

minLength1

hit_volume: number

minimum0

paths: array of object { id, hit_volume, host, path }

id: string

minLength1

hit_volume: number

minimum0

host: string

minLength1

path: string

minLength1

rule_id: string

minLength1

rule_version: number

minimum0

web_assets: object { operations, paths, risk_types }

operations: array of object { id, endpoint, host, 3 more }

id: string

minLength1

endpoint: string

minLength1

host: string

minLength1

method: string

minLength1

risk_labels: array of object { description, name }

description: string

name: string

minLength1

performance: optional object { avg_origin_latency_ms, error_rate, estimated_requests }

avg_origin_latency_ms: number

minimum0

error_rate: number

maximum1

minimum0

estimated_requests: number

minimum0

paths: array of object { id, avg_origin_latency_ms, error_rate, 3 more }

id: string

minLength1

avg_origin_latency_ms: number

minimum0

error_rate: number

maximum1

minimum0

estimated_requests: number

minimum0

host: string

minLength1

path: string

minLength1

risk_types: array of object { description, name, operation_count }

description: string

name: string

minLength1

operation_count: number

minimum0

external_links: optional array of object { title, url }

title: string

maxLength200

minLength1

url: string

formaturi

maxLength2048

limitations: optional array of string

repository_id: string

formatuuid

scan_id: string

maxLength128

minLength1