LogoCloudflare API

Intel

intel

Intel

ASN

intel.asn

Methods

Get ASN Overview -> Envelope<
ASN
>
get/accounts/{account_id}/intel/asn/{asn}

Gets an overview of the Autonomous System Number (ASN) and a list of subnets for it.

IntelASN

Subnets

intel.asn.subnets

Methods

Get ASN Subnets -> { asn, count, ip_count_total, 3 more... }
get/accounts/{account_id}/intel/asn/{asn}/subnets

Get ASN Subnets

Intel

Attack Surface Report

intel.attack_surface_report

IntelAttack Surface Report

Issue Types

intel.attack_surface_report.issue_types

Methods

Get Security Center Issues Types -> Envelope<Array<string>>
get/accounts/{account_id}/intel/attack-surface-report/issue-types

Get Security Center Issues Types

IntelAttack Surface Report

Issues

intel.attack_surface_report.issues

Methods

Get Security Center Issue Counts By Class -> Envelope<Array<{ count, value }>>
get/accounts/{account_id}/intel/attack-surface-report/issues/class

Get Security Center Issue Counts by Class

Archive Security Center Insight -> { errors, messages, success }
put/accounts/{account_id}/intel/attack-surface-report/{issue_id}/dismiss

Archive Security Center Insight

Get Security Center Issues -> V4PagePagination<{ count, issues, page, 1 more... }>
get/accounts/{account_id}/intel/attack-surface-report/issues

Get Security Center Issues

Get Security Center Issue Counts By Severity -> Envelope<Array<{ count, value }>>
get/accounts/{account_id}/intel/attack-surface-report/issues/severity

Get Security Center Issue Counts by Severity

Get Security Center Issue Counts By Type -> Envelope<Array<{ count, value }>>
get/accounts/{account_id}/intel/attack-surface-report/issues/type

Get Security Center Issue Counts by Type

Domain types

IssueType = "compliance_violation" | "email_security" | "exposed_infrastructure" | 2 more...
SeverityQueryParam = "low" | "moderate" | "critical"
Intel

DNS

intel.dns

Methods

Get Passive DNS By IP -> V4PagePagination<
DNS
>
get/accounts/{account_id}/intel/dns

Gets a list of all the domains that have resolved to a specific IP address.

Domain types

DNS = { count, page, per_page, 1 more... }
Intel

Domain History

intel.domain_history

Methods

Get Domain History -> Envelope<Array<
DomainHistory
>>
get/accounts/{account_id}/intel/domain-history

Gets historical security threat and content categories currently and previously assigned to a domain.

Domain types

DomainHistory = { categorizations, domain }
Intel

Domains

intel.domains

Methods

Get Domain Details -> Envelope<
Domain
>
get/accounts/{account_id}/intel/domain

Gets security details and statistics about a domain.

Domain types

Domain = { additional_information, application, content_categories, 8 more... }
IntelDomains

Bulks

intel.domains.bulks

Methods

Get Multiple Domain Details -> Envelope<Array<{ additional_information, application, content_categories, 7 more... }>>
get/accounts/{account_id}/intel/domain/bulk

Same as summary

Intel

Indicator Feeds

intel.indicator_feeds

Methods

Create New Indicator Feed -> Envelope<{ id, created_on, description, 5 more... }>
post/accounts/{account_id}/intel/indicator-feeds

Create new indicator feed

Get Indicator Feed Data -> string
get/accounts/{account_id}/intel/indicator-feeds/{feed_id}/data

Get indicator feed data

Get Indicator Feed Metadata -> Envelope<{ id, created_on, description, 8 more... }>
get/accounts/{account_id}/intel/indicator-feeds/{feed_id}

Get indicator feed metadata

Get Indicator Feeds Owned By This Account -> SinglePage<{ id, created_on, description, 5 more... }>
get/accounts/{account_id}/intel/indicator-feeds

Get indicator feeds owned by this account

Update Indicator Feed Metadata -> Envelope<{ id, created_on, description, 5 more... }>
put/accounts/{account_id}/intel/indicator-feeds/{feed_id}

Update indicator feed metadata

IntelIndicator Feeds

Downloads

intel.indicator_feeds.downloads

Methods

Download Indicator Feed Data -> Envelope<{ file_id, filename, status }>
get/accounts/{account_id}/intel/indicator_feeds/{feed_id}/download

Download indicator feed data

IntelIndicator Feeds

Permissions

intel.indicator_feeds.permissions

Methods

Grant Permission To Indicator Feed -> Envelope<{ success }>
put/accounts/{account_id}/intel/indicator-feeds/permissions/add

Grant permission to indicator feed

Revoke Permission To Indicator Feed -> Envelope<{ success }>
put/accounts/{account_id}/intel/indicator-feeds/permissions/remove

Revoke permission to indicator feed

List Indicator Feed Permissions -> Envelope<Array<{ id, description, is_attributable, 3 more... }>>
get/accounts/{account_id}/intel/indicator-feeds/permissions/view

List indicator feed permissions

IntelIndicator Feeds

Snapshots

intel.indicator_feeds.snapshots

Methods

Update Indicator Feed Data -> Envelope<{ file_id, filename, status }>
put/accounts/{account_id}/intel/indicator-feeds/{feed_id}/snapshot

Update indicator feed data

Intel

IP Lists

intel.ip_lists

Methods

Get IP Lists -> Envelope<Array<
IPList
>>
get/accounts/{account_id}/intel/ip-list

Get IP Lists

Domain types

IPList = { id, description, name }
Intel

IPs

intel.ips

Methods

Get IP Overview -> Envelope<Array<
IP
>>
get/accounts/{account_id}/intel/ip

Gets the geolocation, ASN, infrastructure type of the ASN, and any security threat categories of an IP address.

Domain types

IP = { belongs_to_ref, ip, risk_types }
Intel

Miscategorizations

intel.miscategorizations

Methods

Create Miscategorization -> { errors, messages, success }
post/accounts/{account_id}/intel/miscategorization

Allows you to submit requests to change a domain’s category.

Intel

Sinkholes

intel.sinkholes

Methods

List Sinkholes Owned By This Account -> SinglePage<
Sinkhole
>
get/accounts/{account_id}/intel/sinkholes

List sinkholes owned by this account

Domain types

Sinkhole = { id, account_tag, created_on, 4 more... }
Intel

Whois

intel.whois

Methods

Get Whois Record -> Envelope<{ domain, extension, found, 84 more... }>
get/accounts/{account_id}/intel/whois

Get WHOIS Record

Security

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example: Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

Accepted Permissions (at least one required)

Intel Read

Parameters
account_id: string

Identifier

domain: string
Optional
Response fields
errors: Array<
ResponseInfo
>
messages: Array<
ResponseInfo
>
success: true

Whether the API call was successful

result: { domain, extension, found, 84 more... }
Optional
Request example
200Example

Domain types

Whois = { created_date, domain, nameservers, 6 more... }