# Indicator Feeds

## Get indicator feeds owned by this account

`client.Intel.IndicatorFeeds.List(ctx, query) (*SinglePage[IndicatorFeedListResponse], error)`

**get** `/accounts/{account_id}/intel/indicator-feeds`

Retrieves details for all accessible custom threat indicator feeds.

### Parameters

- `query IndicatorFeedListParams`

  - `AccountID param.Field[string]`

    Identifier

### Returns

- `type IndicatorFeedListResponse struct{…}`

  - `ID int64`

    The unique identifier for the indicator feed

  - `CreatedOn Time`

    The date and time when the data entry was created

  - `Description string`

    The description of the example test

  - `IsAttributable bool`

    Whether the indicator feed can be attributed to a provider

  - `IsDownloadable bool`

    Whether the indicator feed can be downloaded

  - `IsPublic bool`

    Whether the indicator feed is exposed to customers

  - `ModifiedOn Time`

    The date and time when the data entry was last modified

  - `Name string`

    The name of the indicator feed

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/intel"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  page, err := client.Intel.IndicatorFeeds.List(context.TODO(), intel.IndicatorFeedListParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": 1,
      "created_on": "2023-05-12T12:21:56.777653Z",
      "description": "user specified description 1",
      "is_attributable": false,
      "is_downloadable": false,
      "is_public": false,
      "modified_on": "2023-06-18T03:13:34.123321Z",
      "name": "user_specified_name_1"
    },
    {
      "id": 2,
      "created_on": "2023-05-21T21:43:52.867525Z",
      "description": "User specified description 2",
      "is_attributable": false,
      "is_downloadable": false,
      "is_public": false,
      "modified_on": "2023-06-28T18:46:18.764425Z",
      "name": "user_specified_name_2"
    }
  ]
}
```

## Get indicator feed metadata

`client.Intel.IndicatorFeeds.Get(ctx, feedID, query) (*IndicatorFeedGetResponse, error)`

**get** `/accounts/{account_id}/intel/indicator-feeds/{feed_id}`

Retrieves details for a specific custom threat indicator feed.

### Parameters

- `feedID int64`

  Indicator feed ID

- `query IndicatorFeedGetParams`

  - `AccountID param.Field[string]`

    Identifier

### Returns

- `type IndicatorFeedGetResponse struct{…}`

  - `ID int64`

    The unique identifier for the indicator feed

  - `CreatedOn Time`

    The date and time when the data entry was created

  - `Description string`

    The description of the example test

  - `IsAttributable bool`

    Whether the indicator feed can be attributed to a provider

  - `IsDownloadable bool`

    Whether the indicator feed can be downloaded

  - `IsPublic bool`

    Whether the indicator feed is exposed to customers

  - `LatestUploadStatus IndicatorFeedGetResponseLatestUploadStatus`

    Status of the latest snapshot uploaded

    - `const IndicatorFeedGetResponseLatestUploadStatusMirroring IndicatorFeedGetResponseLatestUploadStatus = "Mirroring"`

    - `const IndicatorFeedGetResponseLatestUploadStatusUnifying IndicatorFeedGetResponseLatestUploadStatus = "Unifying"`

    - `const IndicatorFeedGetResponseLatestUploadStatusLoading IndicatorFeedGetResponseLatestUploadStatus = "Loading"`

    - `const IndicatorFeedGetResponseLatestUploadStatusProvisioning IndicatorFeedGetResponseLatestUploadStatus = "Provisioning"`

    - `const IndicatorFeedGetResponseLatestUploadStatusComplete IndicatorFeedGetResponseLatestUploadStatus = "Complete"`

    - `const IndicatorFeedGetResponseLatestUploadStatusError IndicatorFeedGetResponseLatestUploadStatus = "Error"`

  - `ModifiedOn Time`

    The date and time when the data entry was last modified

  - `Name string`

    The name of the indicator feed

  - `ProviderID string`

    The unique identifier for the provider

  - `ProviderName string`

    The provider of the indicator feed

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/intel"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  indicatorFeed, err := client.Intel.IndicatorFeeds.Get(
    context.TODO(),
    int64(12),
    intel.IndicatorFeedGetParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", indicatorFeed.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": 1,
    "created_on": "2023-05-12T12:21:56.777653Z",
    "description": "example feed description",
    "is_attributable": false,
    "is_downloadable": false,
    "is_public": false,
    "latest_upload_status": "Complete",
    "modified_on": "2023-06-18T03:13:34.123321Z",
    "name": "example_feed_1",
    "provider_id": "provider_id",
    "provider_name": "provider_name"
  }
}
```

## Create new indicator feed

`client.Intel.IndicatorFeeds.New(ctx, params) (*IndicatorFeedNewResponse, error)`

**post** `/accounts/{account_id}/intel/indicator-feeds`

Creates a new custom threat indicator feed for sharing threat intelligence data.

### Parameters

- `params IndicatorFeedNewParams`

  - `AccountID param.Field[string]`

    Path param: Identifier

  - `Description param.Field[string]`

    Body param: The description of the example test

  - `Name param.Field[string]`

    Body param: The name of the indicator feed

### Returns

- `type IndicatorFeedNewResponse struct{…}`

  - `ID int64`

    The unique identifier for the indicator feed

  - `CreatedOn Time`

    The date and time when the data entry was created

  - `Description string`

    The description of the example test

  - `IsAttributable bool`

    Whether the indicator feed can be attributed to a provider

  - `IsDownloadable bool`

    Whether the indicator feed can be downloaded

  - `IsPublic bool`

    Whether the indicator feed is exposed to customers

  - `ModifiedOn Time`

    The date and time when the data entry was last modified

  - `Name string`

    The name of the indicator feed

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/intel"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  indicatorFeed, err := client.Intel.IndicatorFeeds.New(context.TODO(), intel.IndicatorFeedNewParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", indicatorFeed.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": 1,
    "created_on": "2023-05-12T12:21:56.777653Z",
    "description": "example feed description",
    "is_attributable": false,
    "is_downloadable": false,
    "is_public": false,
    "modified_on": "2023-06-18T03:13:34.123321Z",
    "name": "example_feed_1"
  }
}
```

## Update indicator feed metadata

`client.Intel.IndicatorFeeds.Update(ctx, feedID, params) (*IndicatorFeedUpdateResponse, error)`

**put** `/accounts/{account_id}/intel/indicator-feeds/{feed_id}`

Revises details for a specific custom threat indicator feed.

### Parameters

- `feedID int64`

  Indicator feed ID

- `params IndicatorFeedUpdateParams`

  - `AccountID param.Field[string]`

    Path param: Identifier

  - `Description param.Field[string]`

    Body param: The new description of the feed

  - `IsAttributable param.Field[bool]`

    Body param: The new is_attributable value of the feed

  - `IsDownloadable param.Field[bool]`

    Body param: The new is_downloadable value of the feed

  - `IsPublic param.Field[bool]`

    Body param: The new is_public value of the feed

  - `Name param.Field[string]`

    Body param: The new name of the feed

### Returns

- `type IndicatorFeedUpdateResponse struct{…}`

  - `ID int64`

    The unique identifier for the indicator feed

  - `CreatedOn Time`

    The date and time when the data entry was created

  - `Description string`

    The description of the example test

  - `IsAttributable bool`

    Whether the indicator feed can be attributed to a provider

  - `IsDownloadable bool`

    Whether the indicator feed can be downloaded

  - `IsPublic bool`

    Whether the indicator feed is exposed to customers

  - `ModifiedOn Time`

    The date and time when the data entry was last modified

  - `Name string`

    The name of the indicator feed

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/intel"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  indicatorFeed, err := client.Intel.IndicatorFeeds.Update(
    context.TODO(),
    int64(12),
    intel.IndicatorFeedUpdateParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", indicatorFeed.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": 1,
    "created_on": "2023-05-12T12:21:56.777653Z",
    "description": "example feed description",
    "is_attributable": false,
    "is_downloadable": false,
    "is_public": false,
    "modified_on": "2023-06-18T03:13:34.123321Z",
    "name": "example_feed_1"
  }
}
```

## Get indicator feed data

`client.Intel.IndicatorFeeds.Data(ctx, feedID, query) (*string, error)`

**get** `/accounts/{account_id}/intel/indicator-feeds/{feed_id}/data`

Retrieves the raw data entries in a custom threat indicator feed.

### Parameters

- `feedID int64`

  Indicator feed ID

- `query IndicatorFeedDataParams`

  - `AccountID param.Field[string]`

    Identifier

### Returns

- `type IndicatorFeedDataResponse string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/intel"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  response, err := client.Intel.IndicatorFeeds.Data(
    context.TODO(),
    int64(12),
    intel.IndicatorFeedDataParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response)
}
```

# Snapshots

## Update indicator feed data

`client.Intel.IndicatorFeeds.Snapshots.Update(ctx, feedID, params) (*IndicatorFeedSnapshotUpdateResponse, error)`

**put** `/accounts/{account_id}/intel/indicator-feeds/{feed_id}/snapshot`

Revises the raw data entries in a custom threat indicator feed.

### Parameters

- `feedID int64`

  Indicator feed ID

- `params IndicatorFeedSnapshotUpdateParams`

  - `AccountID param.Field[string]`

    Path param: Identifier

  - `Source param.Field[string]`

    Body param: The file to upload

### Returns

- `type IndicatorFeedSnapshotUpdateResponse struct{…}`

  - `FileID int64`

    Feed id

  - `Filename string`

    Name of the file unified in our system

  - `Status string`

    Current status of upload, should be unified

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/intel"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  snapshot, err := client.Intel.IndicatorFeeds.Snapshots.Update(
    context.TODO(),
    int64(12),
    intel.IndicatorFeedSnapshotUpdateParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", snapshot.FileID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "file_id": 1,
    "filename": "snapshot_file.unified",
    "status": "unified"
  }
}
```

# Permissions

## List indicator feed permissions

`client.Intel.IndicatorFeeds.Permissions.List(ctx, query) (*[]IndicatorFeedPermissionListResponse, error)`

**get** `/accounts/{account_id}/intel/indicator-feeds/permissions/view`

Lists current access permissions for custom threat indicator feeds.

### Parameters

- `query IndicatorFeedPermissionListParams`

  - `AccountID param.Field[string]`

    Identifier

### Returns

- `type IndicatorFeedPermissionListResponseEnvelopeResult []IndicatorFeedPermissionListResponse`

  - `ID int64`

    The unique identifier for the indicator feed

  - `Description string`

    The description of the example test

  - `IsAttributable bool`

    Whether the indicator feed can be attributed to a provider

  - `IsDownloadable bool`

    Whether the indicator feed can be downloaded

  - `IsPublic bool`

    Whether the indicator feed is exposed to customers

  - `Name string`

    The name of the indicator feed

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/intel"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  permissions, err := client.Intel.IndicatorFeeds.Permissions.List(context.TODO(), intel.IndicatorFeedPermissionListParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", permissions)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": 1,
      "description": "An important indicator list",
      "is_attributable": false,
      "is_downloadable": false,
      "is_public": false,
      "name": "indicator_list_1"
    },
    {
      "id": 2,
      "description": "An even more important indicator list",
      "is_attributable": true,
      "is_downloadable": false,
      "is_public": true,
      "name": "indicator_list_2"
    }
  ]
}
```

## Grant permission to indicator feed

`client.Intel.IndicatorFeeds.Permissions.New(ctx, params) (*IndicatorFeedPermissionNewResponse, error)`

**put** `/accounts/{account_id}/intel/indicator-feeds/permissions/add`

Grants access permissions for a custom threat indicator feed to other accounts.

### Parameters

- `params IndicatorFeedPermissionNewParams`

  - `AccountID param.Field[string]`

    Path param: Identifier

  - `AccountTag param.Field[string]`

    Body param: The Cloudflare account tag of the account to change permissions on

  - `FeedID param.Field[int64]`

    Body param: The ID of the feed to add/remove permissions on

### Returns

- `type IndicatorFeedPermissionNewResponse struct{…}`

  - `Success bool`

    Whether the update succeeded or not

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/intel"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  permission, err := client.Intel.IndicatorFeeds.Permissions.New(context.TODO(), intel.IndicatorFeedPermissionNewParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", permission.Success)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "success": true
  }
}
```

## Revoke permission to indicator feed

`client.Intel.IndicatorFeeds.Permissions.Delete(ctx, params) (*IndicatorFeedPermissionDeleteResponse, error)`

**put** `/accounts/{account_id}/intel/indicator-feeds/permissions/remove`

Revokes access permissions for a custom threat indicator feed.

### Parameters

- `params IndicatorFeedPermissionDeleteParams`

  - `AccountID param.Field[string]`

    Path param: Identifier

  - `AccountTag param.Field[string]`

    Body param: The Cloudflare account tag of the account to change permissions on

  - `FeedID param.Field[int64]`

    Body param: The ID of the feed to add/remove permissions on

### Returns

- `type IndicatorFeedPermissionDeleteResponse struct{…}`

  - `Success bool`

    Whether the update succeeded or not

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/intel"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  permission, err := client.Intel.IndicatorFeeds.Permissions.Delete(context.TODO(), intel.IndicatorFeedPermissionDeleteParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", permission.Success)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "success": true
  }
}
```

# Downloads