API Reference

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Cloudforce One

Cloudforce OneBinary Storage

Retrieves a file from Binary Storage

client.cloudforceOne.binaryStorage.get(stringhash, BinaryStorageGetParams { account_id } params, RequestOptionsoptions?): void

GET/accounts/{account_id}/cloudforce-one/binary/{hash}

Posts a file to Binary Storage

client.cloudforceOne.binaryStorage.create(BinaryStorageCreateParams { account_id, file } params, RequestOptionsoptions?): BinaryStorageCreateResponse { content_type, md5, sha1, sha256 }

POST/accounts/{account_id}/cloudforce-one/binary

ModelsExpand Collapse

BinaryStorageCreateResponse { content_type, md5, sha1, sha256 }

content_type: string

md5: string

sha1: string

sha256: string

Cloudforce OneRequests

List Requests

client.cloudforceOne.requests.list(RequestListParams { account_id, page, per_page, 8 more } params, RequestOptionsoptions?): SinglePage<ListItem { id, created, priority, 9 more } >

POST/accounts/{account_id}/cloudforce-one/requests

Get a Request

client.cloudforceOne.requests.get(stringrequestID, RequestGetParams { account_id } params, RequestOptionsoptions?): Item { id, content, created, 10 more }

GET/accounts/{account_id}/cloudforce-one/requests/{request_id}

Create a New Request.

client.cloudforceOne.requests.create(RequestCreateParams { account_id, content, priority, 3 more } params, RequestOptionsoptions?): Item { id, content, created, 10 more }

POST/accounts/{account_id}/cloudforce-one/requests/new

Update a Request

client.cloudforceOne.requests.update(stringrequestID, RequestUpdateParams { account_id, content, priority, 3 more } params, RequestOptionsoptions?): Item { id, content, created, 10 more }

PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}

Delete a Request

client.cloudforceOne.requests.delete(stringrequestID, RequestDeleteParams { account_id } params, RequestOptionsoptions?): RequestDeleteResponse { errors, messages, success }

DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}

Get Request Quota

client.cloudforceOne.requests.quota(RequestQuotaParams { account_id } params, RequestOptionsoptions?): Quota { anniversary_date, quarter_anniversary_date, quota, remaining }

GET/accounts/{account_id}/cloudforce-one/requests/quota

Get Request Types

client.cloudforceOne.requests.types(RequestTypesParams { account_id } params, RequestOptionsoptions?): SinglePage<RequestTypesResponse>

GET/accounts/{account_id}/cloudforce-one/requests/types

Get Request Priority, Status, and TLP constants

client.cloudforceOne.requests.constants(RequestConstantsParams { account_id } params, RequestOptionsoptions?): RequestConstants { priority, status, tlp }

GET/accounts/{account_id}/cloudforce-one/requests/constants

ModelsExpand Collapse

Item { id, content, created, 10 more }

id: string

UUID.

maxLength36

content: string

Request content.

created: string

formatdate-time

priority: string

formatdate-time

request: string

Requested information from request.

summary: string

Brief description of the request.

tlp: "clear" | "amber" | "amber-strict" | 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

updated: string

formatdate-time

completed?: string

formatdate-time

message_tokens?: number

Tokens for the request messages.

readable_id?: string

Readable Request ID.

status?: "open" | "accepted" | "reported" | 3 more

Request Status.

One of the following:

"open"

"accepted"

"reported"

"approved"

"completed"

"declined"

tokens?: number

Tokens for the request.

ListItem { id, created, priority, 9 more }

id: string

UUID.

maxLength36

created: string

Request creation time.

formatdate-time

priority: "routine" | "high" | "urgent"

One of the following:

"routine"

"high"

"urgent"

request: string

Requested information from request.

summary: string

Brief description of the request.

tlp: "clear" | "amber" | "amber-strict" | 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

updated: string

Request last updated time.

formatdate-time

completed?: string

Request completion time.

formatdate-time

message_tokens?: number

Tokens for the request messages.

readable_id?: string

Readable Request ID.

status?: "open" | "accepted" | "reported" | 3 more

Request Status.

One of the following:

"open"

"accepted"

"reported"

"approved"

"completed"

"declined"

tokens?: number

Tokens for the request.

Quota { anniversary_date, quarter_anniversary_date, quota, remaining }

anniversary_date?: string

Anniversary date is when annual quota limit is refreshed.

formatdate-time

quarter_anniversary_date?: string

Quarter anniversary date is when quota limit is refreshed each quarter.

formatdate-time

quota?: number

Tokens for the quarter.

remaining?: number

Tokens remaining for the quarter.

RequestConstants { priority, status, tlp }

priority?: Array<"routine" | "high" | "urgent">

One of the following:

"routine"

"high"

"urgent"

status?: Array<"open" | "accepted" | "reported" | 3 more>

One of the following:

"open"

"accepted"

"reported"

"approved"

"completed"

"declined"

tlp?: Array<"clear" | "amber" | "amber-strict" | 2 more>

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

RequestTypes = Array<RequestTypesResponse>

RequestDeleteResponse { errors, messages, success }

errors: Array<Error>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

messages: Array<Message>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

success: true

Whether the API call was successful.

RequestTypesResponse = string

Request Types.

Cloudforce OneRequestsMessage

List Request Messages

client.cloudforceOne.requests.message.get(stringrequestID, MessageGetParams { account_id, page, per_page, 4 more } params, RequestOptionsoptions?): SinglePage<Message { id, author, content, 3 more } >

POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/message

Create a New Request Message

client.cloudforceOne.requests.message.create(stringrequestID, MessageCreateParams { account_id, content } params, RequestOptionsoptions?): Message { id, author, content, 3 more }

POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/new

Update a Request Message

client.cloudforceOne.requests.message.update(numbermessageID, MessageUpdateParams { account_id, request_id, content } params, RequestOptionsoptions?): Message { id, author, content, 3 more }

PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}

Delete a Request Message

client.cloudforceOne.requests.message.delete(numbermessageID, MessageDeleteParams { account_id, request_id } params, RequestOptionsoptions?): MessageDeleteResponse { errors, messages, success }

DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}

ModelsExpand Collapse

Message { id, author, content, 3 more }

id: number

Message ID.

author: string

Author of message.

content: string

Content of message.

is_follow_on_request: boolean

Whether the message is a follow-on request.

updated: string

Defines the message last updated time.

formatdate-time

created?: string

Defines the message creation time.

formatdate-time

MessageDeleteResponse { errors, messages, success }

errors: Array<Error>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

messages: Array<Message>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

success: true

Whether the API call was successful.

Cloudforce OneRequestsPriority

Get a Priority Intelligence Requirement

client.cloudforceOne.requests.priority.get(stringpriorityID, PriorityGetParams { account_id } params, RequestOptionsoptions?): Item { id, content, created, 10 more }

GET/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}

Create a New Priority Intelligence Requirement

client.cloudforceOne.requests.priority.create(PriorityCreateParams { account_id, labels, priority, 2 more } params, RequestOptionsoptions?): Priority { id, created, labels, 4 more }

POST/accounts/{account_id}/cloudforce-one/requests/priority/new

Update a Priority Intelligence Requirement

client.cloudforceOne.requests.priority.update(stringpriorityID, PriorityUpdateParams { account_id, labels, priority, 2 more } params, RequestOptionsoptions?): Item { id, content, created, 10 more }

PUT/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}

Delete a Priority Intelligence Requirement

client.cloudforceOne.requests.priority.delete(stringpriorityID, PriorityDeleteParams { account_id } params, RequestOptionsoptions?): PriorityDeleteResponse { errors, messages, success }

DELETE/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}

Get Priority Intelligence Requirement Quota

client.cloudforceOne.requests.priority.quota(PriorityQuotaParams { account_id } params, RequestOptionsoptions?): Quota { anniversary_date, quarter_anniversary_date, quota, remaining }

GET/accounts/{account_id}/cloudforce-one/requests/priority/quota

ModelsExpand Collapse

Label = string

Priority { id, created, labels, 4 more }

id: string

UUID.

maxLength36

created: string

Priority creation time.

formatdate-time

labels: Array<Label>

List of labels.

priority: number

Priority.

requirement: string

Requirement.

tlp: "clear" | "amber" | "amber-strict" | 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

updated: string

Priority last updated time.

formatdate-time

PriorityEdit { labels, priority, requirement, tlp }

labels: Array<Label>

List of labels.

priority: number

Priority.

requirement: string

Requirement.

tlp: "clear" | "amber" | "amber-strict" | 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

PriorityDeleteResponse { errors, messages, success }

errors: Array<Error>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

messages: Array<Message>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

success: true

Whether the API call was successful.

Cloudforce OneRequestsAssets

Get a Request Asset

client.cloudforceOne.requests.assets.get(stringassetID, AssetGetParams { account_id, request_id } params, RequestOptionsoptions?): SinglePage<AssetGetResponse { id, name, created, 2 more } >

GET/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}

List Request Assets

client.cloudforceOne.requests.assets.create(stringrequestID, AssetCreateParams { account_id, page, per_page } params, RequestOptionsoptions?): SinglePage<AssetCreateResponse { id, name, created, 2 more } >

POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset

Update a Request Asset

client.cloudforceOne.requests.assets.update(stringassetID, AssetUpdateParams { account_id, request_id, source } params, RequestOptionsoptions?): AssetUpdateResponse { id, name, created, 2 more }

PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}

Delete a Request Asset

client.cloudforceOne.requests.assets.delete(stringassetID, AssetDeleteParams { account_id, request_id } params, RequestOptionsoptions?): AssetDeleteResponse { errors, messages, success }

DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}

ModelsExpand Collapse

AssetGetResponse { id, name, created, 2 more }

id: number

Asset ID.

name: string

Asset name.

created?: string

Defines the asset creation time.

formatdate-time

description?: string

Asset description.

file_type?: string

Asset file type.

AssetCreateResponse { id, name, created, 2 more }

id: number

Asset ID.

name: string

Asset name.

created?: string

Defines the asset creation time.

formatdate-time

description?: string

Asset description.

file_type?: string

Asset file type.

AssetUpdateResponse { id, name, created, 2 more }

id: number

Asset ID.

name: string

Asset name.

created?: string

Defines the asset creation time.

formatdate-time

description?: string

Asset description.

file_type?: string

Asset file type.

AssetDeleteResponse { errors, messages, success }

errors: Array<Error>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

messages: Array<Message>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

success: true

Whether the API call was successful.

Cloudforce OneScans

Cloudforce OneScansResults

Get the Latest Scan Result

client.cloudforceOne.scans.results.get(stringconfigID, ResultGetParams { account_id } params, RequestOptionsoptions?): ResultGetResponse { 1.1.1.1 }

GET/accounts/{account_id}/cloudforce-one/scans/results/{config_id}

ModelsExpand Collapse

ScanResult { number, proto, status }

number?: number

proto?: string

status?: string

ResultGetResponse { 1.1.1.1 }

"1.1.1.1": Array<ScanResult { number, proto, status } >

number?: number

proto?: string

status?: string

Cloudforce OneScansConfig

List Scan Configs

client.cloudforceOne.scans.config.list(ConfigListParams { account_id } params, RequestOptionsoptions?): SinglePage<ConfigListResponse { id, account_id, frequency, 2 more } >

GET/accounts/{account_id}/cloudforce-one/scans/config

Create a new Scan Config

client.cloudforceOne.scans.config.create(ConfigCreateParams { account_id, ips, frequency, ports } params, RequestOptionsoptions?): ConfigCreateResponse { id, account_id, frequency, 2 more }

POST/accounts/{account_id}/cloudforce-one/scans/config

Update an existing Scan Config

client.cloudforceOne.scans.config.edit(stringconfigID, ConfigEditParams { account_id, frequency, ips, ports } params, RequestOptionsoptions?): ConfigEditResponse { id, account_id, frequency, 2 more }

PATCH/accounts/{account_id}/cloudforce-one/scans/config/{config_id}

Delete a Scan Config

client.cloudforceOne.scans.config.delete(stringconfigID, ConfigDeleteParams { account_id } params, RequestOptionsoptions?): ConfigDeleteResponse

DELETE/accounts/{account_id}/cloudforce-one/scans/config/{config_id}

ModelsExpand Collapse

ConfigListResponse { id, account_id, frequency, 2 more }

id: string

Defines the Config ID.

account_id: string

frequency: number

Defines the number of days between each scan (0 = One-off scan).

ips: Array<string>

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: Array<string>

Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. [“1-80”, “443”]). “default” scans the 100 most commonly open ports.

ConfigCreateResponse { id, account_id, frequency, 2 more }

id: string

Defines the Config ID.

account_id: string

frequency: number

Defines the number of days between each scan (0 = One-off scan).

ips: Array<string>

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: Array<string>

Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. [“1-80”, “443”]). “default” scans the 100 most commonly open ports.

ConfigEditResponse { id, account_id, frequency, 2 more }

id: string

Defines the Config ID.

account_id: string

frequency: number

Defines the number of days between each scan (0 = One-off scan).

ips: Array<string>

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: Array<string>

Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. [“1-80”, “443”]). “default” scans the 100 most commonly open ports.

ConfigDeleteResponse = unknown

Cloudforce OneThreat Events

List events

client.cloudforceOne.threatEvents.list(ThreatEventListParams { account_id, cache, cursor, 9 more } params, RequestOptionsoptions?): ThreatEventListResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

GET/accounts/{account_id}/cloudforce-one/events

Get an event (legacy)

Deprecated

client.cloudforceOne.threatEvents.get(stringeventID, ThreatEventGetParams { account_id } params, RequestOptionsoptions?): ThreatEventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

GET/accounts/{account_id}/cloudforce-one/events/{event_id}

Create an event

client.cloudforceOne.threatEvents.create(ThreatEventCreateParams { account_id, category, date, 15 more } params, RequestOptionsoptions?): ThreatEventCreateResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

POST/accounts/{account_id}/cloudforce-one/events/create

Update an event

client.cloudforceOne.threatEvents.edit(stringeventID, ThreatEventEditParams { account_id, datasetId, attacker, 12 more } params, RequestOptionsoptions?): ThreatEventEditResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}

Create events in bulk

client.cloudforceOne.threatEvents.bulkCreate(ThreatEventBulkCreateParams { account_id, data, datasetId, includeCreatedEvents } params, RequestOptionsoptions?): ThreatEventBulkCreateResponse { createdEventsCount, createdTagsCount, errorCount, 4 more }

POST/accounts/{account_id}/cloudforce-one/events/create/bulk

Create events with relationships in bulk (legacy)

Deprecated

client.cloudforceOne.threatEvents.bulkCreateRelationships(ThreatEventBulkCreateRelationshipsParams { account_id, data, datasetId } params, RequestOptionsoptions?): ThreatEventBulkCreateRelationshipsResponse { createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more }

POST/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships

ModelsExpand Collapse

ThreatEventListResponse = Array<ThreatEventListResponseItem>

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

ThreatEventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

ThreatEventCreateResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

ThreatEventEditResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

ThreatEventBulkCreateResponse { createdEventsCount, createdTagsCount, errorCount, 4 more }

Detailed result of bulk event creation with auto-tag management

createdEventsCount: number

Number of events created

createdTagsCount: number

Number of new tags created in SoT

errorCount: number

Number of errors encountered

queuedIndicatorsCount: number

Number of indicators queued for async processing

createBulkEventsRequestId?: string

Correlation ID for async indicator processing

formatuuid

createdEvents?: Array<CreatedEvent>

Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true

eventIndex: number

Original index in the input data array

shardId: string

Dataset ID of the shard where the event was created

uuid: string

UUID of the created event

formatuuid

errors?: Array<Error>

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

ThreatEventBulkCreateRelationshipsResponse { createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more }

Result of bulk relationship creation operation

createdEventsCount: number

Number of events created

createdIndicatorsCount: number

Number of indicators created

createdRelationshipsCount: number

Number of relationships created

errorCount: number

Number of errors encountered

errors?: Array<Error>

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

Cloudforce OneThreat EventsAggregate

Aggregate events

client.cloudforceOne.threatEvents.aggregate.list(AggregateListParams { account_id, aggregateBy, datasetId, 4 more } params, RequestOptionsoptions?): AggregateListResponse { aggregateBy, aggregations, total, dateRange }

GET/accounts/{account_id}/cloudforce-one/events/aggregate

ModelsExpand Collapse

AggregateListResponse { aggregateBy, aggregations, total, dateRange }

aggregateBy: string

Column(s) that were aggregated by

aggregations: Array<Aggregation>

Array of aggregation results with dynamic fields based on aggregateBy columns

count: number

Number of events for this aggregation

date?: string

Date (if groupByDate is true)

total: number

Total number of events in the aggregation

dateRange?: DateRange { endDate, startDate }

Date range used for filtering

endDate?: string

startDate?: string

Cloudforce OneThreat EventsGraphql

Run a GraphQL aggregation over events

client.cloudforceOne.threatEvents.graphql.create(GraphqlCreateParams { account_id } params, RequestOptionsoptions?): GraphqlCreateResponse { data, errors }

POST/accounts/{account_id}/cloudforce-one/events/graphql

ModelsExpand Collapse

GraphqlCreateResponse { data, errors }

data?: unknown

errors?: Array<unknown> | null

Cloudforce OneThreat EventsGraph

Query graph neighborhood from R2 Data Catalog

client.cloudforceOne.threatEvents.graph.list(GraphListParams { account_id, cursor, datasetIds, 7 more } params, RequestOptionsoptions?): GraphListResponse { edges, node, nodes }

GET/accounts/{account_id}/cloudforce-one/events/graph

ModelsExpand Collapse

GraphListResponse { edges, node, nodes }

edges: Array<Edge>

id: string

Deterministic composite edge id (source→target:relationshipType)

relationshipType: string

source: string

Compact id of the source node (type:uuid)

sourceId: string

sourceType: string

target: string

Compact id of the target node (type:uuid)

targetId: string

targetType: string

node: Record<string, unknown> | null

Focal node object (legacy single-seed). Null when unavailable.

nodes: Array<Record<string, unknown>>

Cloudforce OneThreat EventsQueries

List saved event queries

client.cloudforceOne.threatEvents.queries.list(QueryListParams { account_id } params, RequestOptionsoptions?): QueryListResponse { id, account_id, alert_enabled, 10 more }

GET/accounts/{account_id}/cloudforce-one/events/queries

Create a saved event query

client.cloudforceOne.threatEvents.queries.create(QueryCreateParams { account_id, name, query_json, 4 more } params, RequestOptionsoptions?): QueryCreateResponse { id, account_id, alert_enabled, 10 more }

POST/accounts/{account_id}/cloudforce-one/events/queries/create

Get a saved event query

client.cloudforceOne.threatEvents.queries.get(numberqueryID, QueryGetParams { account_id } params, RequestOptionsoptions?): QueryGetResponse { id, account_id, alert_enabled, 10 more }

GET/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Update a saved event query

client.cloudforceOne.threatEvents.queries.edit(numberqueryID, QueryEditParams { account_id, alert_enabled, alert_rollup_enabled, 4 more } params, RequestOptionsoptions?): QueryEditResponse { id, account_id, alert_enabled, 10 more }

PATCH/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Delete a saved event query

client.cloudforceOne.threatEvents.queries.delete(numberqueryID, QueryDeleteParams { account_id } params, RequestOptionsoptions?): void

DELETE/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

ModelsExpand Collapse

QueryListResponse = Array<QueryListResponseItem>

id: number

Unique identifier for the saved query

account_id: number

Account ID

Deprecatedalert_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

Deprecatedrule_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

Deprecatedcustom_threat_feed_id?: number | null

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id?: string

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope?: string

Deprecated: saved-query alerting and rules were removed. Always null.

QueryCreateResponse { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

Deprecatedalert_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

Deprecatedrule_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

Deprecatedcustom_threat_feed_id?: number | null

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id?: string

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope?: string

Deprecated: saved-query alerting and rules were removed. Always null.

QueryGetResponse { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

Deprecatedalert_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

Deprecatedrule_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

Deprecatedcustom_threat_feed_id?: number | null

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id?: string

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope?: string

Deprecated: saved-query alerting and rules were removed. Always null.

QueryEditResponse { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

Deprecatedalert_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

Deprecatedrule_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

Deprecatedcustom_threat_feed_id?: number | null

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id?: string

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope?: string

Deprecated: saved-query alerting and rules were removed. Always null.

Cloudforce OneThreat EventsRelationships

List related events (legacy)

Deprecated

client.cloudforceOne.threatEvents.relationships.list(stringeventID, RelationshipListParams { account_id, datasetId, direction, 6 more } params, RequestOptionsoptions?): RelationshipListResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships

ModelsExpand Collapse

RelationshipListResponse = Array<RelationshipListResponseItem>

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

Cloudforce OneThreat EventsIndicators

List indicators

client.cloudforceOne.threatEvents.indicators.list(IndicatorListParams { account_id, cache, createdAfter, 15 more } params, RequestOptionsoptions?): IndicatorListResponse { properties, type }

GET/accounts/{account_id}/cloudforce-one/events/indicators

ModelsExpand Collapse

IndicatorListResponse { properties, type }

properties: Properties { completeness, indicators, pagination }

completeness: Completeness { properties, type }

properties: Properties { complete, failedDatasets, failedShards, warnings }

complete: Complete { type }

type: string

failedDatasets: FailedDatasets { items, type }

items: Items { type }

type: string

type: string

failedShards: FailedShards { items, type }

items: Items { properties, type }

properties: Properties { datasetId, shardId }

datasetId: DatasetID { type }

type: string

shardId: ShardID { type }

type: string

type: string

type: string

warnings: Warnings { items, type }

items: Items { type }

type: string

type: string

type: string

indicators: Indicators { items, type }

items: Items { createdAt, indicatorType, sources, 8 more }

createdAt: string

formatdate-time

indicatorType: string

sources: Array<Source>

RSS article sources from which this indicator was extracted.

resourceId: string

formatuuid

resourceType: "article"

system: "threat-signals"

title: string | null

Threat Signals article title; null for historical provenance without a stored title.

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

datasetId: string

eventId: string

eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

relatedEventsHasMore?: boolean

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags?: Array<Tag>

categoryId?: string | null

The UUID of the tag category, or null when the tag is uncategorized.

categoryName?: string

uuid?: string

value?: string

tlp?: string | null

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

type: string

pagination: Pagination { properties, type }

properties: Properties { count, cursor, has_more, 4 more }

count: Count { type }

type: string

cursor: Cursor { description, nullable, type }

description: string

nullable: boolean

type: string

has_more: HasMore { description, type }

description: string

type: string

page: Page { type }

type: string

per_page: PerPage { type }

type: string

total_count: TotalCount { description, nullable, type }

description: string

nullable: boolean

type: string

total_count_is_exact: TotalCountIsExact { description, type }

description: string

type: string

type: string

type: string

Cloudforce OneThreat EventsIndicatorsAggregate

Aggregate indicators by column(s)

client.cloudforceOne.threatEvents.indicators.aggregate.list(AggregateListParams { account_id, aggregateBy, createdAfter, 7 more } params, RequestOptionsoptions?): AggregateListResponse { aggregateBy, aggregations, failedDatasets, total }

GET/accounts/{account_id}/cloudforce-one/events/indicators/aggregate

ModelsExpand Collapse

AggregateListResponse { aggregateBy, aggregations, failedDatasets, total }

aggregateBy: string

Column(s) that were aggregated by

aggregations: Array<Aggregation>

Array of aggregation results with dynamic fields based on aggregateBy columns

count: number

Number of indicators for this aggregation

failedDatasets: number

Number of datasets whose aggregation failed and were excluded from the result

total: number

Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships

Cloudforce OneThreat EventsIndicatorsTypes

List indicator types

client.cloudforceOne.threatEvents.indicators.types.list(TypeListParams { account_id, datasetIds } params, RequestOptionsoptions?): TypeListResponse { items, type }

GET/accounts/{account_id}/cloudforce-one/events/indicator-types

ModelsExpand Collapse

TypeListResponse { items, type }

items: Items { type }

type: string

type: string

Cloudforce OneThreat EventsIndicatorsBy Dataset

List indicators in a dataset (legacy)

Deprecated

client.cloudforceOne.threatEvents.indicators.byDataset.list(stringdatasetID, ByDatasetListParams { account_id, indicatorType, name, 3 more } params, RequestOptionsoptions?): ByDatasetListResponse { indicators, pagination }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators

Get an indicator

client.cloudforceOne.threatEvents.indicators.byDataset.get(stringindicatorID, ByDatasetGetParams { account_id, dataset_id } params, RequestOptionsoptions?): ByDatasetGetResponse { createdAt, indicatorType, updatedAt, 7 more }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}

ModelsExpand Collapse

ByDatasetListResponse { indicators, pagination }

indicators: Array<Indicator>

createdAt: string

formatdate-time

indicatorType: string

sources: Array<Source>

RSS article sources from which this indicator was extracted.

resourceId: string

formatuuid

resourceType: "article"

system: "threat-signals"

title: string | null

Threat Signals article title; null for historical provenance without a stored title.

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

datasetId: string

eventId: string

eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

relatedEventsHasMore?: boolean

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags?: Array<Tag>

categoryId?: string | null

The UUID of the tag category, or null when the tag is uncategorized.

categoryName?: string

uuid?: string

value?: string

tlp?: string | null

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: Pagination { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

ByDatasetGetResponse { createdAt, indicatorType, updatedAt, 7 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

datasetId: string

eventId: string

eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

relatedEventsHasMore?: boolean

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags?: Array<Tag>

categoryId?: string | null

The UUID of the tag category, or null when the tag is uncategorized.

categoryName?: string

uuid?: string

value?: string

tlp?: string | null

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

Cloudforce OneThreat EventsIndicatorsBy DatasetTags

List tags on a dataset's indicators

client.cloudforceOne.threatEvents.indicators.byDataset.tags.list(stringdatasetID, TagListParams { account_id } params, RequestOptionsoptions?): TagListResponse

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags

ModelsExpand Collapse

TagListResponse = Array<unknown>

Array of mirror tag rows

Cloudforce OneThreat EventsAttackers

List attackers

client.cloudforceOne.threatEvents.attackers.list(AttackerListParams { account_id, datasetIds } params, RequestOptionsoptions?): AttackerListResponse { items, type }

GET/accounts/{account_id}/cloudforce-one/events/attackers

ModelsExpand Collapse

AttackerListResponse { items, type }

items: Items { type }

type: string

type: string

Cloudforce OneThreat EventsCategories

List event categories used in datasets

client.cloudforceOne.threatEvents.categories.list(CategoryListParams { account_id, datasetIds } params, RequestOptionsoptions?): CategoryListResponse { killChain, name, uuid, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/categories

Get an event category (legacy)

Deprecated

client.cloudforceOne.threatEvents.categories.get(stringcategoryID, CategoryGetParams { account_id } params, RequestOptionsoptions?): CategoryGetResponse { killChain, name, uuid, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Create an event category

client.cloudforceOne.threatEvents.categories.create(CategoryCreateParams { account_id, killChain, name, 3 more } params, RequestOptionsoptions?): CategoryCreateResponse { killChain, name, uuid, 3 more }

POST/accounts/{account_id}/cloudforce-one/events/categories/create

Update an event category (legacy)

Deprecated

client.cloudforceOne.threatEvents.categories.edit(stringcategoryID, CategoryEditParams { account_id, killChain, mitreAttack, 3 more } params, RequestOptionsoptions?): CategoryEditResponse { killChain, name, uuid, 3 more }

PATCH/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Delete an event category (legacy)

Deprecated

client.cloudforceOne.threatEvents.categories.delete(stringcategoryID, CategoryDeleteParams { account_id } params, RequestOptionsoptions?): CategoryDeleteResponse { uuid }

DELETE/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

ModelsExpand Collapse

CategoryListResponse = Array<CategoryListResponseItem>

killChain: number

name: string

uuid: string

mitreAttack?: Array<string>

mitreCapec?: Array<string>

shortname?: string

CategoryGetResponse { killChain, name, uuid, 3 more }

killChain: number

name: string

uuid: string

mitreAttack?: Array<string>

mitreCapec?: Array<string>

shortname?: string

CategoryCreateResponse { killChain, name, uuid, 3 more }

killChain: number

name: string

uuid: string

mitreAttack?: Array<string>

mitreCapec?: Array<string>

shortname?: string

CategoryEditResponse { killChain, name, uuid, 3 more }

killChain: number

name: string

uuid: string

mitreAttack?: Array<string>

mitreCapec?: Array<string>

shortname?: string

CategoryDeleteResponse { uuid }

uuid: string

Cloudforce OneThreat EventsCategoriesCatalog

List all event categories

client.cloudforceOne.threatEvents.categories.catalog.list(CatalogListParams { account_id } params, RequestOptionsoptions?): CatalogListResponse { killChain, name, uuid, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/categories/catalog

ModelsExpand Collapse

CatalogListResponse = Array<CatalogListResponseItem>

killChain: number

name: string

uuid: string

mitreAttack?: Array<string>

mitreCapec?: Array<string>

shortname?: string

Cloudforce OneThreat EventsCountries

List countries

client.cloudforceOne.threatEvents.countries.list(CountryListParams { account_id } params, RequestOptionsoptions?): CountryListResponse { result, success }

GET/accounts/{account_id}/cloudforce-one/events/countries

ModelsExpand Collapse

CountryListResponse = Array<CountryListResponseItem>

result: Array<Result>

alpha2: string

alpha3: string

name: string

success: string

Cloudforce OneThreat EventsCrons

Cloudforce OneThreat EventsDatasets

List datasets

client.cloudforceOne.threatEvents.datasets.list(DatasetListParams { account_id, includeDeleted } params, RequestOptionsoptions?): DatasetListResponse { indicatorWriteMode, isAnalytics, isPublic, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/dataset

Get a dataset

client.cloudforceOne.threatEvents.datasets.get(stringdatasetID, DatasetGetParams { account_id } params, RequestOptionsoptions?): DatasetGetResponse { isAnalytics, isPublic, name, uuid }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Create a dataset

client.cloudforceOne.threatEvents.datasets.create(DatasetCreateParams { account_id, isPublic, name } params, RequestOptionsoptions?): DatasetCreateResponse { isAnalytics, isPublic, name, uuid }

POST/accounts/{account_id}/cloudforce-one/events/dataset/create

Update a dataset

client.cloudforceOne.threatEvents.datasets.edit(stringdatasetID, DatasetEditParams { account_id, isPublic, name } params, RequestOptionsoptions?): DatasetEditResponse { isAnalytics, isPublic, name, uuid }

PATCH/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Delete a dataset

client.cloudforceOne.threatEvents.datasets.delete(stringdatasetID, DatasetDeleteParams { account_id } params, RequestOptionsoptions?): DatasetDeleteResponse { name, uuid }

DELETE/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Get raw data for an event (legacy)

Deprecated

client.cloudforceOne.threatEvents.datasets.raw(stringeventID, DatasetRawParams { account_id, dataset_id } params, RequestOptionsoptions?): DatasetRawResponse { id, accountId, created, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}

ModelsExpand Collapse

DatasetListResponse = Array<DatasetListResponseItem>

indicatorWriteMode: "read_only" | "create_only" | "full"

Effective indicator mutation capability after account/dataset authorization and dataset storage capability are applied. API Gateway method permissions are separate and must also allow the requested operation.

One of the following:

"read_only"

"create_only"

"full"

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

deletedAt?: string

DatasetGetResponse { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

DatasetCreateResponse { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

DatasetEditResponse { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

DatasetDeleteResponse { name, uuid }

name: string

uuid: string

DatasetRawResponse { id, accountId, created, 3 more }

id: number

accountId: number

created: string

data: string

source: string

tlp: string

Cloudforce OneThreat EventsDatasetsHealth

Cloudforce OneThreat EventsDatasetsEvents

Get an event

client.cloudforceOne.threatEvents.datasets.events.get(stringeventID, EventGetParams { account_id, dataset_id } params, RequestOptionsoptions?): EventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}

ModelsExpand Collapse

EventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

Cloudforce OneThreat EventsRaw

Get raw event data by raw ID (legacy)

client.cloudforceOne.threatEvents.raw.get(stringrawID, RawGetParams { account_id, event_id } params, RequestOptionsoptions?): RawGetResponse { id, accountId, created, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

Update raw event data by raw ID (legacy)

client.cloudforceOne.threatEvents.raw.edit(stringrawID, RawEditParams { account_id, event_id, data, 2 more } params, RequestOptionsoptions?): RawEditResponse { id, data }

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

ModelsExpand Collapse

RawGetResponse { id, accountId, created, 3 more }

id: string

accountId: number

created: string

data: unknown

source: string

tlp: string

RawEditResponse { id, data }

id: string

data: unknown

Cloudforce OneThreat EventsRelate

Remove event references (legacy)

client.cloudforceOne.threatEvents.relate.delete(stringeventID, RelateDeleteParams { account_id } params, RequestOptionsoptions?): RelateDeleteResponse { success }

DELETE/accounts/{account_id}/cloudforce-one/events/relate/{event_id}

ModelsExpand Collapse

RelateDeleteResponse { success }

success: boolean

Cloudforce OneThreat EventsTags

List tags

client.cloudforceOne.threatEvents.tags.list(TagListParams { account_id, cache, categoryUuid, 4 more } params, RequestOptionsoptions?): TagListResponse { pagination, tags }

GET/accounts/{account_id}/cloudforce-one/events/tags

Create a tag

client.cloudforceOne.threatEvents.tags.create(TagCreateParams { account_id, value, activeDuration, 21 more } params, RequestOptionsoptions?): TagCreateResponse { uuid, value, activeDuration, 34 more }

POST/accounts/{account_id}/cloudforce-one/events/tags/create

Update a tag

client.cloudforceOne.threatEvents.tags.edit(stringtagUUID, TagEditParams { account_id, activeDuration, actorCategory, 21 more } params, RequestOptionsoptions?): TagEditResponse { uuid, value, activeDuration, 34 more }

PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

Delete a tag

client.cloudforceOne.threatEvents.tags.delete(stringtagUUID, TagDeleteParams { account_id } params, RequestOptionsoptions?): TagDeleteResponse { uuid }

DELETE/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

ModelsExpand Collapse

TagListResponse { pagination, tags }

pagination: Pagination { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

tags: Array<Tag>

uuid: string

value: string

activeDuration?: string

activeDuration_annotated?: ActiveDurationAnnotated | null

value: string

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory?: string

actorCategory_annotated?: ActorCategoryAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames?: Array<string>

aliasGroupNamesInternal?: Array<string>

attributionOrganization?: string

attributionOrganization_annotated?: AttributionOrganizationAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName?: string

categoryUuid?: string

confidence?: number | null

Overall tag confidence (1-10).

maximum10

minimum1

createdAt?: string

dateOfDiscovery?: string

description?: string

externalReferenceLinks?: Array<string>

externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description?: string | null

externalReferences_annotated?: Array<ExternalReferencesAnnotated> | null

value: string

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases?: Array<InternalAlias>

Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription?: string

lastSeen?: string

motive?: string

motive_annotated?: MotiveAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel?: string

opsecLevel_annotated?: OpsecLevelAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO?: string | null

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated?: OriginCountryISOAnnotated | null

value: string | null

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority?: number

priority_annotated?: PriorityAnnotated | null

value: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties?: Record<string, unknown> | null

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel?: string

sophisticationLevel_annotated?: SophisticationLevelAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt?: string

version?: number

TagCreateResponse { uuid, value, activeDuration, 34 more }

uuid: string

value: string

activeDuration?: string

activeDuration_annotated?: ActiveDurationAnnotated | null

value: string

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory?: string

actorCategory_annotated?: ActorCategoryAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames?: Array<string>

aliasGroupNamesInternal?: Array<string>

attributionOrganization?: string

attributionOrganization_annotated?: AttributionOrganizationAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName?: string

categoryUuid?: string

confidence?: number | null

Overall tag confidence (1-10).

maximum10

minimum1

createdAt?: string

dateOfDiscovery?: string

description?: string

externalReferenceLinks?: Array<string>

externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description?: string | null

externalReferences_annotated?: Array<ExternalReferencesAnnotated> | null

value: string

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases?: Array<InternalAlias>

Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription?: string

lastSeen?: string

motive?: string

motive_annotated?: MotiveAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel?: string

opsecLevel_annotated?: OpsecLevelAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO?: string | null

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated?: OriginCountryISOAnnotated | null

value: string | null

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority?: number

priority_annotated?: PriorityAnnotated | null

value: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties?: Record<string, unknown> | null

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel?: string

sophisticationLevel_annotated?: SophisticationLevelAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt?: string

version?: number

TagEditResponse { uuid, value, activeDuration, 34 more }

uuid: string

value: string

activeDuration?: string

activeDuration_annotated?: ActiveDurationAnnotated | null

value: string

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory?: string

actorCategory_annotated?: ActorCategoryAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames?: Array<string>

aliasGroupNamesInternal?: Array<string>

attributionOrganization?: string

attributionOrganization_annotated?: AttributionOrganizationAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName?: string

categoryUuid?: string

confidence?: number | null

Overall tag confidence (1-10).

maximum10

minimum1

createdAt?: string

dateOfDiscovery?: string

description?: string

externalReferenceLinks?: Array<string>

externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description?: string | null

externalReferences_annotated?: Array<ExternalReferencesAnnotated> | null

value: string

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases?: Array<InternalAlias>

Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription?: string

lastSeen?: string

motive?: string

motive_annotated?: MotiveAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel?: string

opsecLevel_annotated?: OpsecLevelAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO?: string | null

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated?: OriginCountryISOAnnotated | null

value: string | null

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority?: number

priority_annotated?: PriorityAnnotated | null

value: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties?: Record<string, unknown> | null

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel?: string

sophisticationLevel_annotated?: SophisticationLevelAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt?: string

version?: number

TagDeleteResponse { uuid }

uuid: string

Cloudforce OneThreat EventsTagsCategories

List tag categories

client.cloudforceOne.threatEvents.tags.categories.list(CategoryListParams { account_id, search } params, RequestOptionsoptions?): CategoryListResponse { categories }

GET/accounts/{account_id}/cloudforce-one/events/tags/categories

Create a tag category

client.cloudforceOne.threatEvents.tags.categories.create(CategoryCreateParams { account_id, name, description, schema } params, RequestOptionsoptions?): CategoryCreateResponse { name, uuid, createdAt, 3 more }

POST/accounts/{account_id}/cloudforce-one/events/tags/categories/create

Update a tag category (legacy)

Deprecated

client.cloudforceOne.threatEvents.tags.categories.edit(stringcategoryUUID, CategoryEditParams { account_id, description, name, schema } params, RequestOptionsoptions?): CategoryEditResponse { name, uuid, createdAt, 3 more }

PATCH/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

Delete a tag category (legacy)

Deprecated

client.cloudforceOne.threatEvents.tags.categories.delete(stringcategoryUUID, CategoryDeleteParams { account_id } params, RequestOptionsoptions?): CategoryDeleteResponse { uuid }

DELETE/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

ModelsExpand Collapse

CategoryListResponse { categories }

categories: Array<Category>

name: string

uuid: string

createdAt?: string

description?: string

schema?: Array<Schema> | null

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string

kind: "string" | "number" | "enum" | 3 more

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowedValues?: Array<string>

annotations?: Annotations { confidence, tlp }

confidence?: boolean

tlp?: boolean

deprecated?: boolean

Marks a field as unavailable for new values while retaining its definition for historical values.

deprecatedValues?: Array<string>

Enum values unavailable for new writes but retained in allowedValues for historical display.

element?: unknown

enforcement?: "error" | "warn" | "off"

One of the following:

"error"

"warn"

"off"

format?: "date" | "url" | "duration" | "country"

One of the following:

"date"

"url"

"duration"

"country"

label?: string

maxLength128

minLength1

maxLength?: number

exclusiveMinimum

minimum0

numberConstraint?: NumberConstraint { integer, max, min }

integer?: boolean

max?: number

min?: number

properties?: Record<string, unknown>

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required?: boolean

updatedAt?: string

CategoryCreateResponse { name, uuid, createdAt, 3 more }

name: string

uuid: string

createdAt?: string

description?: string

schema?: Array<Schema> | null

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string

kind: "string" | "number" | "enum" | 3 more

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowedValues?: Array<string>

annotations?: Annotations { confidence, tlp }

confidence?: boolean

tlp?: boolean

deprecated?: boolean

Marks a field as unavailable for new values while retaining its definition for historical values.

deprecatedValues?: Array<string>

Enum values unavailable for new writes but retained in allowedValues for historical display.

element?: unknown

enforcement?: "error" | "warn" | "off"

One of the following:

"error"

"warn"

"off"

format?: "date" | "url" | "duration" | "country"

One of the following:

"date"

"url"

"duration"

"country"

label?: string

maxLength128

minLength1

maxLength?: number

exclusiveMinimum

minimum0

numberConstraint?: NumberConstraint { integer, max, min }

integer?: boolean

max?: number

min?: number

properties?: Record<string, unknown>

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required?: boolean

updatedAt?: string

CategoryEditResponse { name, uuid, createdAt, 3 more }

name: string

uuid: string

createdAt?: string

description?: string

schema?: Array<Schema> | null

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string

kind: "string" | "number" | "enum" | 3 more

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowedValues?: Array<string>

annotations?: Annotations { confidence, tlp }

confidence?: boolean

tlp?: boolean

deprecated?: boolean

Marks a field as unavailable for new values while retaining its definition for historical values.

deprecatedValues?: Array<string>

Enum values unavailable for new writes but retained in allowedValues for historical display.

element?: unknown

enforcement?: "error" | "warn" | "off"

One of the following:

"error"

"warn"

"off"

format?: "date" | "url" | "duration" | "country"

One of the following:

"date"

"url"

"duration"

"country"

label?: string

maxLength128

minLength1

maxLength?: number

exclusiveMinimum

minimum0

numberConstraint?: NumberConstraint { integer, max, min }

integer?: boolean

max?: number

min?: number

properties?: Record<string, unknown>

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required?: boolean

updatedAt?: string

CategoryDeleteResponse { uuid }

uuid: string

Cloudforce OneThreat EventsTagsIndicators

List a tag's indicators

client.cloudforceOne.threatEvents.tags.indicators.list(stringtagUUID, IndicatorListParams { account_id, datasetIds, indicatorType, 4 more } params, RequestOptionsoptions?): IndicatorListResponse { indicators, pagination, failedShardCount, partialResults }

GET/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators

ModelsExpand Collapse

IndicatorListResponse { indicators, pagination, failedShardCount, partialResults }

indicators: Array<Indicator>

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

datasetId: string

eventId: string

eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

relatedEventsHasMore?: boolean

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags?: Array<Tag>

categoryId?: string | null

The UUID of the tag category, or null when the tag is uncategorized.

categoryName?: string

uuid?: string

value?: string

tlp?: string | null

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: Pagination { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

failedShardCount?: number

Number of shards that failed or timed out. Present only with partialResults.

partialResults?: boolean

Present and true when one or more shards failed or timed out. Indicators from those shards may be missing from this page and from totalCount.

Cloudforce OneThreat EventsTagsIndicatorsBy Dataset

List indicators related to a tag within a dataset (deprecated)

Deprecated

client.cloudforceOne.threatEvents.tags.indicators.byDataset.list(stringtagUUID, ByDatasetListParams { account_id, dataset_id, indicatorType, 4 more } params, RequestOptionsoptions?): ByDatasetListResponse { indicators, pagination, failedShardCount, partialResults }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators

ModelsExpand Collapse

ByDatasetListResponse { indicators, pagination, failedShardCount, partialResults }

indicators: Array<Indicator>

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

datasetId: string

eventId: string

eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

relatedEventsHasMore?: boolean

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags?: Array<Tag>

categoryId?: string | null

The UUID of the tag category, or null when the tag is uncategorized.

categoryName?: string

uuid?: string

value?: string

tlp?: string | null

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: Pagination { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

failedShardCount?: number

Number of shards that failed or timed out. Present only with partialResults.

partialResults?: boolean

Present and true when one or more shards failed or timed out. Indicators from those shards may be missing from this page and from totalCount.

Cloudforce OneThreat EventsEvent Tags

Add tags to an event (legacy)

client.cloudforceOne.threatEvents.eventTags.create(stringeventID, EventTagCreateParams { account_id, tags } params, RequestOptionsoptions?): EventTagCreateResponse { success }

POST/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create

Remove tags from an event (legacy)

client.cloudforceOne.threatEvents.eventTags.delete(stringeventID, EventTagDeleteParams { account_id } params, RequestOptionsoptions?): EventTagDeleteResponse { success }

DELETE/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}

ModelsExpand Collapse

EventTagCreateResponse { success }

success: boolean

EventTagDeleteResponse { success }

success: boolean

Cloudforce OneThreat EventsTarget Industries

List target industries used in datasets

client.cloudforceOne.threatEvents.targetIndustries.list(TargetIndustryListParams { account_id, datasetIds } params, RequestOptionsoptions?): TargetIndustryListResponse { items, type }

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries

ModelsExpand Collapse

TargetIndustryListResponse { items, type }

items: Items { type }

type: string

type: string

Cloudforce OneThreat EventsTarget IndustriesBy Dataset

List target industries in a dataset (legacy)

client.cloudforceOne.threatEvents.targetIndustries.byDataset.list(stringdatasetID, ByDatasetListParams { account_id } params, RequestOptionsoptions?): ByDatasetListResponse { items, type }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries

ModelsExpand Collapse

ByDatasetListResponse { items, type }

items: Items { type }

type: string

type: string

Cloudforce OneThreat EventsTarget IndustriesCatalog

List all target industries

client.cloudforceOne.threatEvents.targetIndustries.catalog.list(CatalogListParams { account_id } params, RequestOptionsoptions?): CatalogListResponse { items, type }

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog

ModelsExpand Collapse

CatalogListResponse { items, type }

items: Items { type }

type: string

type: string

Cloudforce OneThreat EventsInsights

Cloudforce OneThreat Signals

Threat Signals API for managing threat intelligence feeds, articles, indicators, and AI skills in Cloudforce One.

Prerequisites

1. API token — requests must use an API token with Cloudforce One permissions; write operations (creating, editing, or deleting feeds, skills, and tags) require write access.
2. Plan limits — access on the Free plan is limited; feed quotas and managed default skills apply.

Cloudforce OneThreat SignalsSearch

Search Threat Signals articles using AI Search

client.cloudforceOne.threatSignals.search.search(SearchSearchParams { account_id, query, feed_id, max_results } params, RequestOptionsoptions?): SearchSearchResponse { count, results }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/search

ModelsExpand Collapse

SearchSearchResponse { count, results }

count: number

Number of unique article candidates returned in this response. Equal to results.length.

minimum0

results: Array<Result>

article_id: string

formatuuid

dataset_id: string | null

formatuuid

event_id: string | null

formatuuid

feed_id: string

formatuuid

score: number

text: string

Cloudforce OneThreat SignalsCategories

List Threat Signals feed categories

client.cloudforceOne.threatSignals.categories.list(CategoryListParams { account_id } params, RequestOptionsoptions?): CategoryListResponse { categories }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/categories

ModelsExpand Collapse

CategoryListResponse { categories }

categories: Array<Category>

id: string

Wire value accepted by the feed category_id field.

formatuuid

description: string

Plain-language description of the category.

name: string

Human-readable display label.

Cloudforce OneThreat SignalsFeeds

List Threat Signals feeds

client.cloudforceOne.threatSignals.feeds.list(FeedListParams { account_id, category, enabled, 6 more } params, RequestOptionsoptions?): V4PagePagination<FeedListResponse { count, custom_feed_count, custom_feed_limit, 4 more } >

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds

Create Threat Signals feed

client.cloudforceOne.threatSignals.feeds.create(FeedCreateParams { account_id, category_id, curated_feed_id, 5 more } params, RequestOptionsoptions?): FeedCreateResponse { id, category_id, category_name, 12 more }

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds

Update Threat Signals feed

client.cloudforceOne.threatSignals.feeds.edit(stringfeedID, FeedEditParams { account_id, category_id, display_name, 3 more } params, RequestOptionsoptions?): FeedEditResponse { id, category_id, category_name, 12 more }

PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}

Delete Threat Signals feed

client.cloudforceOne.threatSignals.feeds.delete(stringfeedID, FeedDeleteParams { account_id } params, RequestOptionsoptions?): FeedDeleteResponse { id, category_id, category_name, 12 more }

DELETE/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}

Trigger Threat Signals feed poll

client.cloudforceOne.threatSignals.feeds.poll(FeedPollParams { account_id, feed_id } params, RequestOptionsoptions?): FeedPollResponse { errors, feeds, triggered }

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/poll

ModelsExpand Collapse

FeedListResponse { count, custom_feed_count, custom_feed_limit, 4 more }

count: number

Number of feeds on this page.

custom_feed_count: number

The current count of custom feeds for the account.

minimum0

custom_feed_limit: number

The resolved custom feed limit for the account.

minimum0

feeds: Array<Feed>

id: string

formatuuid

category_id: string | null

Feed category identifier. Null when unset.

category_name: string | null

Display name of the feed category. Null when unset or unresolvable.

created_at: string

curated_feed_id: string | null

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: string | null

enabled: boolean

last_polled_at: string | null

poll_interval_s: number

source_type: string

custom for a feed added by URL, curated for a curated catalog feed.

status: string

Polling health: active, or error after a failed poll.

subscribed_at: string | null

title: string | null

updated_at: string

url: string

page: number

per_page: number

total_count: number

FeedCreateResponse { id, category_id, category_name, 12 more }

id: string

formatuuid

category_id: string | null

Feed category identifier. Null when unset.

category_name: string | null

Display name of the feed category. Null when unset or unresolvable.

created_at: string

curated_feed_id: string | null

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: string | null

enabled: boolean

last_polled_at: string | null

poll_interval_s: number

source_type: string

custom for a feed added by URL, curated for a curated catalog feed.

status: string

Polling health: active, or error after a failed poll.

subscribed_at: string | null

title: string | null

updated_at: string

url: string

FeedEditResponse { id, category_id, category_name, 12 more }

id: string

formatuuid

category_id: string | null

Feed category identifier. Null when unset.

category_name: string | null

Display name of the feed category. Null when unset or unresolvable.

created_at: string

curated_feed_id: string | null

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: string | null

enabled: boolean

last_polled_at: string | null

poll_interval_s: number

source_type: string

custom for a feed added by URL, curated for a curated catalog feed.

status: string

Polling health: active, or error after a failed poll.

subscribed_at: string | null

title: string | null

updated_at: string

url: string

FeedDeleteResponse { id, category_id, category_name, 12 more }

id: string

formatuuid

category_id: string | null

Feed category identifier. Null when unset.

category_name: string | null

Display name of the feed category. Null when unset or unresolvable.

created_at: string

curated_feed_id: string | null

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: string | null

enabled: boolean

last_polled_at: string | null

poll_interval_s: number

source_type: string

custom for a feed added by URL, curated for a curated catalog feed.

status: string

Polling health: active, or error after a failed poll.

subscribed_at: string | null

title: string | null

updated_at: string

url: string

FeedPollResponse { errors, feeds, triggered }

errors: number

feeds: Array<Feed>

feed_id: string

formatuuid

status: "workflow_created" | "error"

One of the following:

"workflow_created"

"error"

workflow_id: string

feed_enabled?: boolean

triggered: number

Cloudforce OneThreat SignalsFeedsRaw

Get Threat Signals feed XML

client.cloudforceOne.threatSignals.feeds.raw.get(stringfeedID, RawGetParams { account_id, format } params, RequestOptionsoptions?): RawGetResponse

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/raw

ModelsExpand Collapse

RawGetResponse = string

Cloudforce OneThreat SignalsFeedsSkills

Get Threat Signals feed skills

client.cloudforceOne.threatSignals.feeds.skills.get(stringfeedID, SkillGetParams { account_id } params, RequestOptionsoptions?): SkillGetResponse { feed_id, skills }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/skills

Set Threat Signals feed skills

client.cloudforceOne.threatSignals.feeds.skills.update(stringfeedID, SkillUpdateParams { account_id, skill_ids } params, RequestOptionsoptions?): SkillUpdateResponse { feed_id, skills }

PUT/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/skills

ModelsExpand Collapse

SkillGetResponse { feed_id, skills }

feed_id: string

formatuuid

skills: Array<Skill>

id: string

config: string | null

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

name: string

output_schema: string | null

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" | "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

SkillUpdateResponse { feed_id, skills }

feed_id: string

formatuuid

skills: Array<Skill>

position: number

Zero-based pipeline position.

skill_id: string

Cloudforce OneThreat SignalsArticles

List Threat Signals articles

client.cloudforceOne.threatSignals.articles.list(ArticleListParams { account_id, article_id, cursor, 20 more } params, RequestOptionsoptions?): ArticleListResponse { articles, has_more, next_cursor, 2 more }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles

Bulk update Threat Signals article read status

client.cloudforceOne.threatSignals.articles.bulkEdit(ArticleBulkEditParams { account_id, article_ids, read } params, RequestOptionsoptions?): ArticleBulkEditResponse { updated_count }

PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles

Get Threat Signals article

client.cloudforceOne.threatSignals.articles.get(stringarticleID, ArticleGetParams { account_id } params, RequestOptionsoptions?): ArticleGetResponse { id, bullet_points, content_r2_key, 18 more }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}

Update Threat Signals article read status

client.cloudforceOne.threatSignals.articles.edit(stringarticleID, ArticleEditParams { account_id, read } params, RequestOptionsoptions?): ArticleEditResponse { id, bullet_points, content_r2_key, 17 more }

PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}

ModelsExpand Collapse

ArticleListResponse { articles, has_more, next_cursor, 2 more }

articles: Array<Article>

id: string

formatuuid

dataset_id: string | null

Threat Events dataset identifier for the article redirect. Null when the account feeds dataset mapping is unavailable.

event_id: string | null

Threat Events event identifier associated with this article for a UI redirect. Null when no event has been linked.

feed_display_name: string | null

feed_id: string

formatuuid

fetched_at: string

link: string | null

published_at: string | null

read: boolean

read_at: string | null

relevance: Relevance | null

Beta. The article’s relevance to the account’s active Priority Intelligence Requirements. Null when the article has not been scored against them, including when the account has no active PIRs, or has not been scored against the requested pir_id.

band: "low" | "medium" | "high"

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:

"low"

"medium"

"high"

pir_id: string

Beta. The pir_id requested from the article list, or otherwise the account’s most relevant active PIR for this article.

formatuuid

pirs: Array<Pir>

Beta. Every active PIR the article was scored against, most relevant first. Draft and deleted PIRs are excluded.

band: "low" | "medium" | "high"

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:

"low"

"medium"

"high"

pir_id: string

formatuuid

severity: "informational" | "low" | "medium" | 2 more | null

Beta. Intrinsic article severity band, from informational to critical, independent of any organisation or Priority Intelligence Requirement. Null when the account has no active Priority Intelligence Requirements, scoring has not completed, or a historic article has not entered an automatic rescore window.

One of the following:

"informational"

"low"

"medium"

"high"

"critical"

summary: string | null

Persisted enrichment summary. Null until enrichment produces a summary.

tags: Array<Tag>

applied_by: "ai" | "analyst" | "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string | null

formatuuid

uuid: string

formatuuid

value: string

title: string | null

has_more: boolean

next_cursor: string | null

total_count: number | null

total_count_is_exact: boolean

ArticleBulkEditResponse { updated_count }

updated_count: number

ArticleGetResponse { id, bullet_points, content_r2_key, 18 more }

id: string

formatuuid

bullet_points: BulletPoints | null

impact: string

what_happened: string

who_affected: string

content_r2_key: string | null

feed_display_name: string | null

feed_id: string

formatuuid

fetched_at: string

indicator_extraction_status: "in_progress" | "complete" | "failed" | "unknown"

Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded.

One of the following:

"in_progress"

"complete"

"failed"

"unknown"

link: string | null

metadata: Record<string, unknown> | null

published_at: string | null

read: boolean

read_at: string | null

relevance: Relevance | null

Beta. The article’s relevance to the account’s active Priority Intelligence Requirements. Null when the article has not been scored against them, including when the account has no active PIRs, or has not been scored against the requested pir_id.

band: "low" | "medium" | "high"

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:

"low"

"medium"

"high"

pir_id: string

Beta. The pir_id requested from the article list, or otherwise the account’s most relevant active PIR for this article.

formatuuid

pirs: Array<Pir>

Beta. Every active PIR the article was scored against, most relevant first. Draft and deleted PIRs are excluded.

band: "low" | "medium" | "high"

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:

"low"

"medium"

"high"

pir_id: string

formatuuid

severity: "informational" | "low" | "medium" | 2 more | null

Beta. Intrinsic article severity band, from informational to critical, independent of any organisation or Priority Intelligence Requirement. Null when the account has no active Priority Intelligence Requirements, scoring has not completed, or a historic article has not entered an automatic rescore window.

One of the following:

"informational"

"low"

"medium"

"high"

"critical"

source_count: number

summary: string | null

Persisted enrichment summary. Null until enrichment produces a summary.

summary_r2_key: string | null

tags: Array<Tag>

applied_by: "ai" | "analyst" | "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string | null

formatuuid

uuid: string

formatuuid

value: string

title: string | null

skill_version?: string | null

tag_skill_version?: string | null

ArticleEditResponse { id, bullet_points, content_r2_key, 17 more }

id: string

formatuuid

bullet_points: BulletPoints | null

impact: string

what_happened: string

who_affected: string

content_r2_key: string | null

feed_display_name: string | null

feed_id: string

formatuuid

fetched_at: string

indicator_extraction_status: "in_progress" | "complete" | "failed" | "unknown"

Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded.

One of the following:

"in_progress"

"complete"

"failed"

"unknown"

link: string | null

metadata: Record<string, unknown> | null

published_at: string | null

read: boolean

read_at: string | null

severity: "informational" | "low" | "medium" | 2 more | null

Beta. Intrinsic article severity band, from informational to critical, independent of any organisation or Priority Intelligence Requirement. Null when the account has no active Priority Intelligence Requirements, scoring has not completed, or a historic article has not entered an automatic rescore window.

One of the following:

"informational"

"low"

"medium"

"high"

"critical"

source_count: number

summary: string | null

Persisted enrichment summary. Null until enrichment produces a summary.

summary_r2_key: string | null

tags: Array<Tag>

applied_by: "ai" | "analyst" | "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string | null

formatuuid

uuid: string

formatuuid

value: string

title: string | null

skill_version?: string | null

tag_skill_version?: string | null

Cloudforce OneThreat SignalsArticlesContent

Get Threat Signals article content

client.cloudforceOne.threatSignals.articles.content.get(stringarticleID, ContentGetParams { account_id, format } params, RequestOptionsoptions?): ContentGetResponse

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/content

ModelsExpand Collapse

ContentGetResponse = string

Cloudforce OneThreat SignalsArticlesTags

Add tag to Threat Signals article

client.cloudforceOne.threatSignals.articles.tags.create(stringarticleID, TagCreateParams { account_id, tag_id } params, RequestOptionsoptions?): TagCreateResponse { applied_by, categoryId, uuid, value }

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tags

Remove tag from Threat Signals article

client.cloudforceOne.threatSignals.articles.tags.delete(stringtagID, TagDeleteParams { account_id, article_id } params, RequestOptionsoptions?): TagDeleteResponse { applied_by, categoryId, uuid, value }

DELETE/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tags/{tag_id}

Generate Threat Signals article AI tags

client.cloudforceOne.threatSignals.articles.tags.generate(stringarticleID, TagGenerateParams { account_id } params, RequestOptionsoptions?): TagGenerateResponse { tag_skill_version, tags }

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tag

ModelsExpand Collapse

TagCreateResponse { applied_by, categoryId, uuid, value }

applied_by: "ai" | "analyst" | "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string | null

formatuuid

uuid: string

formatuuid

value: string

TagDeleteResponse { applied_by, categoryId, uuid, value }

applied_by: "ai" | "analyst" | "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string | null

formatuuid

uuid: string

formatuuid

value: string

TagGenerateResponse { tag_skill_version, tags }

tag_skill_version: string

tags: Array<Tag>

Final hydrated assignment set; may be empty when no applicable tags are selected.

applied_by: "ai" | "analyst" | "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string | null

formatuuid

uuid: string

formatuuid

value: string

Cloudforce OneThreat SignalsArticlesSkill Outputs

Get Threat Signals article skill output

client.cloudforceOne.threatSignals.articles.skillOutputs.get(stringskillID, SkillOutputGetParams { account_id, article_id } params, RequestOptionsoptions?): SkillOutputGetResponse { article_id, custom_output, custom_output_parse_status, 4 more }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/skills/{skill_id}/output

ModelsExpand Collapse

SkillOutputGetResponse { article_id, custom_output, custom_output_parse_status, 4 more }

article_id: string

Article UUID that received the skill output.

formatuuid

custom_output: string | number | boolean | 2 more

Untrusted model output: parsed JSON when the stored completion text is valid JSON, otherwise raw text. Consumers must safely render or escape it.

One of the following:

string

number

boolean

Record<string, unknown>

Array<string | number | boolean | Record<string, unknown>>

string

number

boolean

Record<string, unknown>

custom_output_parse_status: "parsed" | "invalid_json"

Whether custom_output was parsed from the stored completion text.

One of the following:

"parsed"

"invalid_json"

custom_output_validation_status: "valid" | "invalid_json" | "schema_invalid" | "unknown"

Non-blocking validation classification for untrusted model output. unknown is retained only for historical rows.

One of the following:

"valid"

"invalid_json"

"schema_invalid"

"unknown"

custom_skill_version: string | null

Custom Skill version that produced the output. Null when historical metadata is unavailable.

output_schema: string | null

JSON-encoded output schema. Null when historical skill metadata is unavailable.

skill_id: string

Custom Skill UUID that produced the output.

Cloudforce OneThreat SignalsIndicators

List Threat Signals article indicators

client.cloudforceOne.threatSignals.indicators.list(IndicatorListParams { account_id, article_id, cursor, 5 more } params, RequestOptionsoptions?): IndicatorListResponse { indicators, pagination }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/indicators

ModelsExpand Collapse

IndicatorListResponse { indicators, pagination }

indicators: Array<Indicator>

id: string

formatuuid

article_id: string

formatuuid

article_title: string | null

dataset_id: string | null

Threat Events dataset identifier for navigating from this indicator. Null when the account feeds dataset mapping is unavailable.

feed_display_name: string | null

feed_id: string

formatuuid

type: string

value: string

pagination: Pagination { count, cursor, has_more, 4 more }

count: number

minimum0

cursor: string | null

has_more: boolean

page: number

Ordinal of this cursor page; not a total-results offset.

minimum1

per_page: number

maximum100

minimum1

total_count: number | null

minimum0

total_count_is_exact: boolean

Cloudforce OneThreat SignalsSkills

List Threat Signals skills

client.cloudforceOne.threatSignals.skills.list(SkillListParams { account_id, page, per_page } params, RequestOptionsoptions?): V4PagePagination<SkillListResponse { count, custom_skills_available, page, 3 more } >

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills

Create Threat Signals skill

client.cloudforceOne.threatSignals.skills.create(SkillCreateParams { account_id, name, output_schema, 2 more } params, RequestOptionsoptions?): SkillCreateResponse { id, config, created_at, 7 more }

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills

Get Threat Signals skill

client.cloudforceOne.threatSignals.skills.get(stringskillID, SkillGetParams { account_id } params, RequestOptionsoptions?): SkillGetResponse { id, config, created_at, 7 more }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}

Update Threat Signals skill

client.cloudforceOne.threatSignals.skills.edit(stringskillID, SkillEditParams { account_id, config, is_active, 3 more } params, RequestOptionsoptions?): SkillEditResponse { id, config, created_at, 7 more }

PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}

Delete Threat Signals skill

client.cloudforceOne.threatSignals.skills.delete(stringskillID, SkillDeleteParams { account_id } params, RequestOptionsoptions?): SkillDeleteResponse { id, config, created_at, 7 more }

DELETE/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}

ModelsExpand Collapse

SkillListResponse { count, custom_skills_available, page, 3 more }

count: number

Number of skills on this page.

custom_skills_available: boolean

Whether Custom Skills are available to the account. False for Free Threat Signals accounts, which receive managed default skills only.

page: number

per_page: number

skills: Array<Skill>

id: string

config: string | null

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

name: string

output_schema: string | null

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" | "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

total_count: number

SkillCreateResponse { id, config, created_at, 7 more }

id: string

config: string | null

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

name: string

output_schema: string | null

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" | "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

SkillGetResponse { id, config, created_at, 7 more }

id: string

config: string | null

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

name: string

output_schema: string | null

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" | "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

SkillEditResponse { id, config, created_at, 7 more }

id: string

config: string | null

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

name: string

output_schema: string | null

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" | "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

SkillDeleteResponse { id, config, created_at, 7 more }

id: string

config: string | null

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

name: string

output_schema: string | null

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" | "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

Cloudforce OneThreat SignalsSkillsTag Categories

Get Threat Signals skill tag categories

client.cloudforceOne.threatSignals.skills.tagCategories.get("default-tagging-skill"skillID, TagCategoryGetParams { account_id } params, RequestOptionsoptions?): TagCategoryGetResponse { category_uuids, skill_id }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}/tag-categories

Replace Threat Signals skill tag categories

client.cloudforceOne.threatSignals.skills.tagCategories.update("default-tagging-skill"skillID, TagCategoryUpdateParams { account_id, category_uuids } params, RequestOptionsoptions?): TagCategoryUpdateResponse { category_uuids, skill_id }

PUT/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}/tag-categories

ModelsExpand Collapse

TagCategoryGetResponse { category_uuids, skill_id }

category_uuids: Array<string>

skill_id: "default-tagging-skill"

TagCategoryUpdateResponse { category_uuids, skill_id }

category_uuids: Array<string>

skill_id: "default-tagging-skill"