Skip to content
Cloudflare API
Start here
API Reference

Intel

IntelASN

Get ASN Overview.
intel.asn.get(ASNasn, ASNGetParams**kwargs) -> ASN
GET/accounts/{account_id}/intel/asn/{asn}

IntelASNSubnets

Get ASN Subnets
intel.asn.subnets.get(ASNasn, SubnetGetParams**kwargs) -> SubnetGetResponse
GET/accounts/{account_id}/intel/asn/{asn}/subnets
ModelsExpand Collapse
class SubnetGetResponse: …
asn: Optional[ASN]
count: Optional[float]

Total results returned based on your search parameters.

ip_count_total: Optional[int]
page: Optional[float]

Current page within paginated list of results.

per_page: Optional[float]

Number of results per page of results.

subnets: Optional[List[str]]

IntelDNS

Get Passive DNS by IP
intel.dns.list(DNSListParams**kwargs) -> SyncV4PagePagination[Optional[DNS]]
GET/accounts/{account_id}/intel/dns
ModelsExpand Collapse
class DNS: …
count: Optional[float]

Total results returned based on your search parameters.

page: Optional[float]

Current page within paginated list of results.

per_page: Optional[float]

Number of results per page of results.

reverse_records: Optional[List[ReverseRecord]]

Reverse DNS look-ups observed during the time period.

first_seen: Optional[date]

First seen date of the DNS record during the time period.

formatdate
hostname: Optional[str]

Hostname that the IP was observed resolving to.

last_seen: Optional[date]

Last seen date of the DNS record during the time period.

formatdate

IntelDomains

Get Domain Details
intel.domains.get(DomainGetParams**kwargs) -> Domain
GET/accounts/{account_id}/intel/domain
ModelsExpand Collapse
class Domain: …
additional_information: Optional[AdditionalInformation]

Additional information related to the host name.

suspected_malware_family: Optional[str]

Suspected DGA malware family.

application: Optional[Application]

Application that the hostname belongs to.

id: Optional[int]
name: Optional[str]
content_categories: Optional[List[ContentCategory]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
domain: Optional[str]
inherited_content_categories: Optional[List[InheritedContentCategory]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
inherited_from: Optional[str]

Domain from which inherited_content_categories and inherited_risk_types are inherited, if applicable.

inherited_risk_types: Optional[List[InheritedRiskType]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
popularity_rank: Optional[int]

Global Cloudflare 100k ranking for the last 30 days, if available for the hostname. The top ranked domain is 1, the lowest ranked domain is 100,000.

resolves_to_refs: Optional[List[ResolvesToRef]]

Specifies a list of references to one or more IP addresses or domain names that the domain name currently resolves to.

value: Optional[str]

IP address or domain name.

risk_score: Optional[float]

Hostname risk score, which is a value between 0 (lowest risk) to 1 (highest risk).

risk_types: Optional[List[RiskType]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]

IntelDomainsBulks

Get Multiple Domain Details
intel.domains.bulks.get(BulkGetParams**kwargs) -> BulkGetResponse
GET/accounts/{account_id}/intel/domain/bulk
ModelsExpand Collapse
Optional[List[BulkGetResponseItem]]
additional_information: Optional[BulkGetResponseItemAdditionalInformation]

Additional information related to the host name.

suspected_malware_family: Optional[str]

Suspected DGA malware family.

application: Optional[BulkGetResponseItemApplication]

Application that the hostname belongs to.

id: Optional[int]
name: Optional[str]
content_categories: Optional[List[BulkGetResponseItemContentCategory]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
domain: Optional[str]
inherited_content_categories: Optional[List[BulkGetResponseItemInheritedContentCategory]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
inherited_from: Optional[str]

Domain from which inherited_content_categories and inherited_risk_types are inherited, if applicable.

inherited_risk_types: Optional[List[BulkGetResponseItemInheritedRiskType]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
popularity_rank: Optional[int]

Global Cloudflare 100k ranking for the last 30 days, if available for the hostname. The top ranked domain is 1, the lowest ranked domain is 100,000.

risk_score: Optional[float]

Hostname risk score, which is a value between 0 (lowest risk) to 1 (highest risk).

risk_types: Optional[List[BulkGetResponseItemRiskType]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]

IntelDomain History

Get Domain History
intel.domain_history.get(DomainHistoryGetParams**kwargs) -> DomainHistoryGetResponse
GET/accounts/{account_id}/intel/domain-history
ModelsExpand Collapse
class DomainHistory: …
categorizations: Optional[List[Categorization]]
categories: Optional[List[CategorizationCategory]]
id: Optional[int]
name: Optional[str]
end: Optional[date]
formatdate
start: Optional[date]
formatdate
domain: Optional[str]
Optional[List[DomainHistory]]
categorizations: Optional[List[Categorization]]
categories: Optional[List[CategorizationCategory]]
id: Optional[int]
name: Optional[str]
end: Optional[date]
formatdate
start: Optional[date]
formatdate
domain: Optional[str]

IntelIPs

Get IP Overview
intel.ips.get(IPGetParams**kwargs) -> IPGetResponse
GET/accounts/{account_id}/intel/ip
ModelsExpand Collapse
class IP: …
belongs_to_ref: Optional[BelongsToRef]

Specifies a reference to the autonomous systems (AS) that the IP address belongs to.

id: Optional[str]
country: Optional[str]
description: Optional[str]
type: Optional[Literal["hosting_provider", "isp", "organization"]]

Infrastructure type of this ASN.

One of the following:
"hosting_provider"
"isp"
"organization"
value: Optional[str]
ip: Optional[str]
formatipv4
risk_types: Optional[List[RiskType]]
id: Optional[float]
name: Optional[str]
super_category_id: Optional[float]
Optional[List[IP]]
belongs_to_ref: Optional[BelongsToRef]

Specifies a reference to the autonomous systems (AS) that the IP address belongs to.

id: Optional[str]
country: Optional[str]
description: Optional[str]
type: Optional[Literal["hosting_provider", "isp", "organization"]]

Infrastructure type of this ASN.

One of the following:
"hosting_provider"
"isp"
"organization"
value: Optional[str]
ip: Optional[str]
formatipv4
risk_types: Optional[List[RiskType]]
id: Optional[float]
name: Optional[str]
super_category_id: Optional[float]

IntelIP Lists

ModelsExpand Collapse
class IPList: …
id: Optional[int]
description: Optional[str]
name: Optional[str]

IntelMiscategorizations

Create Miscategorization
intel.miscategorizations.create(MiscategorizationCreateParams**kwargs) -> MiscategorizationCreateResponse
POST/accounts/{account_id}/intel/miscategorization
ModelsExpand Collapse
class MiscategorizationCreateResponse: …
errors: List[Error]
code: int
minimum1000
message: str
documentation_url: Optional[str]
source: Optional[ErrorSource]
pointer: Optional[str]
messages: List[Message]
code: int
minimum1000
message: str
documentation_url: Optional[str]
source: Optional[MessageSource]
pointer: Optional[str]
success: Literal[true]

Whether the API call was successful.

IntelWhois

Get WHOIS Record
intel.whois.get(WhoisGetParams**kwargs) -> WhoisGetResponse
GET/accounts/{account_id}/intel/whois
ModelsExpand Collapse
class Whois: …
created_date: Optional[date]
formatdate
domain: Optional[str]
nameservers: Optional[List[str]]
registrant: Optional[str]
registrant_country: Optional[str]
registrant_email: Optional[str]
registrant_org: Optional[str]
registrar: Optional[str]
updated_date: Optional[date]
formatdate
class WhoisGetResponse: …
dnssec: bool
domain: str
extension: str
found: bool
nameservers: List[str]
punycode: str
registrant: str
registrar: str
id: Optional[str]
administrative_city: Optional[str]
administrative_country: Optional[str]
administrative_email: Optional[str]
administrative_fax: Optional[str]
administrative_fax_ext: Optional[str]
administrative_id: Optional[str]
administrative_name: Optional[str]
administrative_org: Optional[str]
administrative_phone: Optional[str]
administrative_phone_ext: Optional[str]
administrative_postal_code: Optional[str]
administrative_province: Optional[str]
administrative_referral_url: Optional[str]
administrative_street: Optional[str]
billing_city: Optional[str]
billing_country: Optional[str]
billing_email: Optional[str]
billing_fax: Optional[str]
billing_fax_ext: Optional[str]
billing_id: Optional[str]
billing_name: Optional[str]
billing_org: Optional[str]
billing_phone: Optional[str]
billing_phone_ext: Optional[str]
billing_postal_code: Optional[str]
billing_province: Optional[str]
billing_referral_url: Optional[str]
billing_street: Optional[str]
created_date: Optional[datetime]
formatdate-time
created_date_raw: Optional[str]
expiration_date: Optional[datetime]
formatdate-time
expiration_date_raw: Optional[str]
registrant_city: Optional[str]
registrant_country: Optional[str]
registrant_email: Optional[str]
registrant_fax: Optional[str]
registrant_fax_ext: Optional[str]
registrant_id: Optional[str]
registrant_name: Optional[str]
registrant_org: Optional[str]
registrant_phone: Optional[str]
registrant_phone_ext: Optional[str]
registrant_postal_code: Optional[str]
registrant_province: Optional[str]
registrant_referral_url: Optional[str]
registrant_street: Optional[str]
registrar_city: Optional[str]
registrar_country: Optional[str]
registrar_email: Optional[str]
registrar_fax: Optional[str]
registrar_fax_ext: Optional[str]
registrar_id: Optional[str]
registrar_name: Optional[str]
registrar_org: Optional[str]
registrar_phone: Optional[str]
registrar_phone_ext: Optional[str]
registrar_postal_code: Optional[str]
registrar_province: Optional[str]
registrar_referral_url: Optional[str]
registrar_street: Optional[str]
status: Optional[List[str]]
technical_city: Optional[str]
technical_country: Optional[str]
technical_email: Optional[str]
technical_fax: Optional[str]
technical_fax_ext: Optional[str]
technical_id: Optional[str]
technical_name: Optional[str]
technical_org: Optional[str]
technical_phone: Optional[str]
technical_phone_ext: Optional[str]
technical_postal_code: Optional[str]
technical_province: Optional[str]
technical_referral_url: Optional[str]
technical_street: Optional[str]
updated_date: Optional[datetime]
formatdate-time
updated_date_raw: Optional[str]
whois_server: Optional[str]

IntelURLs

Get URL Intelligence
intel.urls.get(URLGetParams**kwargs) -> URL
GET/accounts/{account_id}/intel/url
ModelsExpand Collapse
class URL: …
content_categories: List[ContentCategory]

Content categories associated with this URL.

id: Optional[int]
name: Optional[str]
source_id: Optional[int]
super_category_id: Optional[int]
full_url: str

The full URL that was looked up.

hostname: str

The hostname of the URL.

risk_type: List[RiskType]

Security risk types associated with this URL.

id: Optional[int]
name: Optional[str]
source_id: Optional[int]
super_category_id: Optional[int]
url_path: str

The path component of the URL.

IntelIndicator Feeds

Get indicator feeds owned by this account
intel.indicator_feeds.list(IndicatorFeedListParams**kwargs) -> SyncSinglePage[IndicatorFeedListResponse]
GET/accounts/{account_id}/intel/indicator-feeds
Get indicator feed metadata
intel.indicator_feeds.get(intfeed_id, IndicatorFeedGetParams**kwargs) -> IndicatorFeedGetResponse
GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}
Create new indicator feed
intel.indicator_feeds.create(IndicatorFeedCreateParams**kwargs) -> IndicatorFeedCreateResponse
POST/accounts/{account_id}/intel/indicator-feeds
Update indicator feed metadata
intel.indicator_feeds.update(intfeed_id, IndicatorFeedUpdateParams**kwargs) -> IndicatorFeedUpdateResponse
PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}
Get indicator feed data
intel.indicator_feeds.data(intfeed_id, IndicatorFeedDataParams**kwargs) -> IndicatorFeedDataResponse
GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}/data
ModelsExpand Collapse
class IndicatorFeedListResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

class IndicatorFeedGetResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

last_upload_summary: Optional[LastUploadSummary]

Summary of indicator counts from the last successful upload to this feed. Populated by the custom-threat-feeds loader at the end of each successful load. Absent (omitted) when no upload has completed successfully or the upload errored before the summary write. Surfaces silent-failure paths so operators can see when their indicators were dropped (popularity allowlist, expired valid_until, etc.) without reading loader logs.

persisted: Optional[LastUploadSummaryPersisted]

Net delta applied to feed indicators by this upload. Snapshot uploads emit both *_added and *_removed; delta-add emits only *_added; delta-remove emits only *_removed.

domains_added: Optional[int]
domains_removed: Optional[int]
ips_added: Optional[int]
ips_removed: Optional[int]
urls_added: Optional[int]
urls_removed: Optional[int]
skipped: Optional[LastUploadSummarySkipped]

Counts of indicators that were uploaded but did not reach QuickSilver, broken down by reason.

allowlisted_domains: Optional[int]

Domains filtered by the global popularity allowlist at QS provisioning time. Popular domains (bing.com, naver.com, etc.) are protected from custom-threat-feed enforcement.

expired_indicators: Optional[int]

Indicators in the upload whose valid_until is already in the past. These are not added to QS; the expiration cron handles cleanup.

invalid_indicators: Optional[int]

Reserved for future use. Currently always 0 — the unifier aborts the entire upload on a single bad indicator.

uploaded: Optional[LastUploadSummaryUploaded]

Indicator counts from the unified file the loader received

domains: Optional[int]

Number of domain indicators in the upload

ips: Optional[int]

Number of IP indicators in the upload

urls: Optional[int]

Number of URL indicators in the upload

latest_upload_error: Optional[str]

Human-readable error message describing why the latest upload failed. Populated only when latest_upload_status is Error. Returns one of a small fixed set of category-level messages (invalid domain / IP / URL entries, malformed row or header, invalid valid_until timestamp, etc.) or the generic Upload failed for unknown or infrastructure-level errors. Never echoes raw error text from the underlying loader. Intel accounts receive the verbatim loader/API error text (including specific offending values) instead of these category-level messages.

latest_upload_status: Optional[Literal["Mirroring", "Unifying", "Loading", 3 more]]

Status of the latest snapshot uploaded

One of the following:
"Mirroring"
"Unifying"
"Loading"
"Provisioning"
"Complete"
"Error"
modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

provider_id: Optional[int]

The unique identifier for the provider

provider_name: Optional[str]

The provider of the indicator feed

class IndicatorFeedCreateResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

class IndicatorFeedUpdateResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

str

IntelIndicator FeedsSnapshots

Update indicator feed data
intel.indicator_feeds.snapshots.update(intfeed_id, SnapshotUpdateParams**kwargs) -> SnapshotUpdateResponse
PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}/snapshot
ModelsExpand Collapse
class SnapshotUpdateResponse: …
file_id: Optional[int]

Feed id

filename: Optional[str]

Name of the file unified in our system

poll_url: Optional[str]

Account-relative polling path. Prepend /accounts/{account_id} using the same account identifier and API host as the upload request. The path omits the account segment because the service does not have your account identifier in this context.

status: Optional[str]

Current status of the upload at the moment the request returned. This is NOT a terminal state: the file is unified inline, but the durable loader has only accepted it, so the upload is still Unifying. Poll poll_url until the status reaches a terminal value (Unified or Error).

upload_id: Optional[int]

Identifier of the upload row, for polling this upload to a terminal state via poll_url.

formatint64

IntelIndicator FeedsPermissions

List indicator feed permissions
intel.indicator_feeds.permissions.list(PermissionListParams**kwargs) -> PermissionListResponse
GET/accounts/{account_id}/intel/indicator-feeds/permissions/view
Grant permission to indicator feed
intel.indicator_feeds.permissions.create(PermissionCreateParams**kwargs) -> PermissionCreateResponse
PUT/accounts/{account_id}/intel/indicator-feeds/permissions/add
Revoke permission to indicator feed
intel.indicator_feeds.permissions.delete(PermissionDeleteParams**kwargs) -> PermissionDeleteResponse
PUT/accounts/{account_id}/intel/indicator-feeds/permissions/remove
ModelsExpand Collapse
List[PermissionListResponseItem]
id: Optional[int]

The unique identifier for the indicator feed

description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

name: Optional[str]

The name of the indicator feed

class PermissionCreateResponse: …
success: Optional[bool]

Whether the update succeeded or not

class PermissionDeleteResponse: …
success: Optional[bool]

Whether the update succeeded or not

IntelIndicator FeedsDownloads

IntelSinkholes

List sinkholes owned by this account
intel.sinkholes.list(SinkholeListParams**kwargs) -> SyncSinglePage[Sinkhole]
GET/accounts/{account_id}/intel/sinkholes
Get a sinkhole
intel.sinkholes.get(strsinkhole_id, SinkholeGetParams**kwargs) -> Sinkhole
GET/accounts/{account_id}/intel/sinkholes/{sinkhole_id}
Create a new sinkhole for your account
intel.sinkholes.create(SinkholeCreateParams**kwargs) -> Sinkhole
POST/accounts/{account_id}/intel/sinkholes
Update a sinkhole
intel.sinkholes.update(strsinkhole_id, SinkholeUpdateParams**kwargs) -> object
PUT/accounts/{account_id}/intel/sinkholes/{sinkhole_id}
Delete a sinkhole
intel.sinkholes.delete(strsinkhole_id, SinkholeDeleteParams**kwargs) -> object
DELETE/accounts/{account_id}/intel/sinkholes/{sinkhole_id}
ModelsExpand Collapse
class Sinkhole: …
id: Optional[str]

The unique identifier for the sinkhole.

account_tag: Optional[str]

The account tag that owns this sinkhole.

created_on: Optional[datetime]

The date and time when the sinkhole was created.

formatdate-time
modified_on: Optional[datetime]

The date and time when the sinkhole was last modified.

formatdate-time
name: Optional[str]

The name of the sinkhole.

r2_bucket: Optional[str]

The name of the R2 bucket to store results.

r2_id: Optional[str]

The id of the R2 instance.

IntelSinkholesIngresses

Create an ingress rule
intel.sinkholes.ingresses.create(strsinkhole_id, IngressCreateParams**kwargs) -> IngressCreateResponse
POST/zones/{zone_id}/intel/sinkholes/{sinkhole_id}/ingresses
Get an ingress rule
intel.sinkholes.ingresses.get(stringress_id, IngressGetParams**kwargs) -> IngressGetResponse
GET/zones/{zone_id}/intel/sinkholes/{sinkhole_id}/ingresses/{ingress_id}
Update an ingress rule
intel.sinkholes.ingresses.update(stringress_id, IngressUpdateParams**kwargs) -> object
PUT/zones/{zone_id}/intel/sinkholes/{sinkhole_id}/ingresses/{ingress_id}
Delete an ingress rule
intel.sinkholes.ingresses.delete(stringress_id, IngressDeleteParams**kwargs) -> object
DELETE/zones/{zone_id}/intel/sinkholes/{sinkhole_id}/ingresses/{ingress_id}
ModelsExpand Collapse
class IngressCreateResponse: …
id: Optional[str]

The unique identifier for the ingress rule.

cidr: Optional[str]

The CIDR block for the ingress rule.

created_on: Optional[datetime]

The date and time when the ingress rule was created.

formatdate-time
modified_on: Optional[datetime]

The date and time when the ingress rule was last modified.

formatdate-time
sinkhole_id: Optional[str]

The sinkhole this ingress rule belongs to.

zone_tag: Optional[str]

The zone tag associated with this ingress rule.

class IngressGetResponse: …
id: Optional[str]

The unique identifier for the ingress rule.

cidr: Optional[str]

The CIDR block for the ingress rule.

created_on: Optional[datetime]

The date and time when the ingress rule was created.

formatdate-time
modified_on: Optional[datetime]

The date and time when the ingress rule was last modified.

formatdate-time
sinkhole_id: Optional[str]

The sinkhole this ingress rule belongs to.

zone_tag: Optional[str]

The zone tag associated with this ingress rule.

IntelAttack Surface Report

IntelAttack Surface ReportIssue Types

Retrieves Security Center Issues Types
intel.attack_surface_report.issue_types.get(IssueTypeGetParams**kwargs) -> SyncSinglePage[IssueTypeGetResponse]
GET/accounts/{account_id}/intel/attack-surface-report/issue-types
ModelsExpand Collapse
str

IntelAttack Surface ReportIssues

Retrieves Security Center Issues
Deprecated
intel.attack_surface_report.issues.list(IssueListParams**kwargs) -> SyncV4PagePagination[Optional[IssueListResponse]]
GET/accounts/{account_id}/intel/attack-surface-report/issues
Retrieves Security Center Issue Counts by Class
Deprecated
intel.attack_surface_report.issues.class_(IssueClassParams**kwargs) -> IssueClassResponse
GET/accounts/{account_id}/intel/attack-surface-report/issues/class
Retrieves Security Center Issue Counts by Severity
Deprecated
intel.attack_surface_report.issues.severity(IssueSeverityParams**kwargs) -> IssueSeverityResponse
GET/accounts/{account_id}/intel/attack-surface-report/issues/severity
Retrieves Security Center Issue Counts by Type
Deprecated
intel.attack_surface_report.issues.type(IssueTypeParams**kwargs) -> IssueTypeResponse
GET/accounts/{account_id}/intel/attack-surface-report/issues/type
ModelsExpand Collapse
Literal["compliance_violation", "email_security", "exposed_infrastructure", 3 more]
One of the following:
"compliance_violation"
"email_security"
"exposed_infrastructure"
"insecure_configuration"
"weak_authentication"
"configuration_suggestion"
Literal["low", "moderate", "critical"]
One of the following:
"low"
"moderate"
"critical"
class IssueListResponse: …
count: Optional[int]

Indicates the total number of results.

issues: Optional[List[Issue]]
id: Optional[str]
dismissed: Optional[bool]
has_extended_context: Optional[bool]

Indicates whether the insight has a large payload that requires fetching via the context endpoint.

issue_class: Optional[str]
issue_type: Optional[IssueType]
payload: Optional[IssuePayload]
detection_method: Optional[str]

Describes the method used to detect insight.

zone_tag: Optional[str]
resolve_text: Optional[str]
severity: Optional[Literal["Low", "Moderate", "Critical"]]
One of the following:
"Low"
"Moderate"
"Critical"
since: Optional[datetime]
formatdate-time
status: Optional[Literal["active", "resolved"]]

The current status of the insight.

One of the following:
"active"
"resolved"
subject: Optional[str]
timestamp: Optional[datetime]
formatdate-time
user_classification: Optional[Literal["false_positive", "accept_risk", "other"]]

User-defined classification for the insight. Can be ‘false_positive’, ‘accept_risk’, ‘other’, or null.

One of the following:
"false_positive"
"accept_risk"
"other"
page: Optional[int]

Specifies the current page within paginated list of results.

per_page: Optional[int]

Sets the number of results per page of results.

maximum1000
minimum1
List[IssueClassResponseItem]
count: Optional[int]
value: Optional[str]
List[IssueSeverityResponseItem]
count: Optional[int]
value: Optional[str]
List[IssueTypeResponseItem]
count: Optional[int]
value: Optional[str]