## Creates bulk events

`client.cloudforceOne.threatEvents.bulkCreate(ThreatEventBulkCreateParamsparams, RequestOptionsoptions?): ThreatEventBulkCreateResponse`

**post** `/accounts/{account_id}/cloudforce-one/events/create/bulk`

The `datasetId` parameter must be defined. To list existing datasets (and their IDs) in your account, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint.

### Parameters

- `params: ThreatEventBulkCreateParams`

  - `account_id: string`

    Path param: Account ID.

  - `data: Array<Data>`

    Body param

    - `category: string`

    - `date: string`

    - `event: string`

    - `raw: Raw`

      - `data: Record<string, unknown> | null`

      - `source?: string`

      - `tlp?: string`

    - `tlp: string`

    - `accountId?: number`

    - `attacker?: string | null`

    - `attackerCountry?: string`

    - `datasetId?: string`

    - `indicator?: string`

    - `indicators?: Array<Indicator>`

      Array of indicators for this event. Supports multiple indicators per event for complex scenarios.

      - `indicatorType: string`

        The type of indicator (e.g., DOMAIN, IP, JA3, HASH)

      - `value: string`

        The indicator value (e.g., domain name, IP address, hash)

    - `indicatorType?: string`

    - `insight?: string`

    - `tags?: Array<string>`

    - `targetCountry?: string`

    - `targetIndustry?: string`

  - `datasetId: string`

    Body param

  - `includeCreatedEvents?: boolean`

    Body param: When true, response includes array of created event UUIDs and shard IDs. Useful for tracking which events were created and where.

### Returns

- `ThreatEventBulkCreateResponse`

  Detailed result of bulk event creation with auto-tag management

  - `createdEventsCount: number`

    Number of events created

  - `createdTagsCount: number`

    Number of new tags created in SoT

  - `errorCount: number`

    Number of errors encountered

  - `queuedIndicatorsCount: number`

    Number of indicators queued for async processing

  - `createBulkEventsRequestId?: string`

    Correlation ID for async indicator processing

  - `createdEvents?: Array<CreatedEvent>`

    Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true

    - `eventIndex: number`

      Original index in the input data array

    - `shardId: string`

      Dataset ID of the shard where the event was created

    - `uuid: string`

      UUID of the created event

  - `errors?: Array<Error>`

    Array of error details

    - `error: string`

      Error message

    - `eventIndex: number`

      Index of the event that caused the error

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const response = await client.cloudforceOne.threatEvents.bulkCreate({
  account_id: 'account_id',
  data: [
    {
      category: 'Domain Resolution',
      date: '2022-04-01T00:00:00Z',
      event: 'An attacker registered the domain domain.com',
      raw: { data: { foo: 'bar' } },
      tlp: 'amber',
    },
  ],
  datasetId: 'durableObjectName',
});

console.log(response.createdEventsCount);
```

#### Response

```json
{
  "createdEventsCount": 0,
  "createdTagsCount": 0,
  "errorCount": 0,
  "queuedIndicatorsCount": 0,
  "createBulkEventsRequestId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
  "createdEvents": [
    {
      "eventIndex": 0,
      "shardId": "shardId",
      "uuid": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
    }
  ],
  "errors": [
    {
      "error": "error",
      "eventIndex": 0
    }
  ]
}
```