Skip to content
Cloudflare API
Start here
API Reference

Intel

IntelASN

Get ASN Overview.
intel.asn.get(ASNasn, ASNGetParams**kwargs) -> ASN
GET/accounts/{account_id}/intel/asn/{asn}

IntelASNSubnets

Get ASN Subnets
intel.asn.subnets.get(ASNasn, SubnetGetParams**kwargs) -> SubnetGetResponse
GET/accounts/{account_id}/intel/asn/{asn}/subnets
ModelsExpand Collapse
class SubnetGetResponse: …
asn: Optional[ASN]
count: Optional[float]

Total results returned based on your search parameters.

ip_count_total: Optional[int]
page: Optional[float]

Current page within paginated list of results.

per_page: Optional[float]

Number of results per page of results.

subnets: Optional[List[str]]

IntelDNS

Get Passive DNS by IP
intel.dns.list(DNSListParams**kwargs) -> SyncV4PagePagination[Optional[DNS]]
GET/accounts/{account_id}/intel/dns
ModelsExpand Collapse
class DNS: …
count: Optional[float]

Total results returned based on your search parameters.

page: Optional[float]

Current page within paginated list of results.

per_page: Optional[float]

Number of results per page of results.

reverse_records: Optional[List[ReverseRecord]]

Reverse DNS look-ups observed during the time period.

first_seen: Optional[date]

First seen date of the DNS record during the time period.

formatdate
hostname: Optional[str]

Hostname that the IP was observed resolving to.

last_seen: Optional[date]

Last seen date of the DNS record during the time period.

formatdate

IntelDomains

Get Domain Details
intel.domains.get(DomainGetParams**kwargs) -> Domain
GET/accounts/{account_id}/intel/domain
ModelsExpand Collapse
class Domain: …
additional_information: Optional[AdditionalInformation]

Additional information related to the host name.

suspected_malware_family: Optional[str]

Suspected DGA malware family.

application: Optional[Application]

Application that the hostname belongs to.

id: Optional[int]
name: Optional[str]
content_categories: Optional[List[ContentCategory]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
domain: Optional[str]
inherited_content_categories: Optional[List[InheritedContentCategory]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
inherited_from: Optional[str]

Domain from which inherited_content_categories and inherited_risk_types are inherited, if applicable.

inherited_risk_types: Optional[List[InheritedRiskType]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
popularity_rank: Optional[int]

Global Cloudflare 100k ranking for the last 30 days, if available for the hostname. The top ranked domain is 1, the lowest ranked domain is 100,000.

resolves_to_refs: Optional[List[ResolvesToRef]]

Specifies a list of references to one or more IP addresses or domain names that the domain name currently resolves to.

value: Optional[str]

IP address or domain name.

risk_score: Optional[float]

Hostname risk score, which is a value between 0 (lowest risk) to 1 (highest risk).

risk_types: Optional[List[RiskType]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]

IntelDomainsBulks

Get Multiple Domain Details
intel.domains.bulks.get(BulkGetParams**kwargs) -> BulkGetResponse
GET/accounts/{account_id}/intel/domain/bulk
ModelsExpand Collapse
Optional[List[BulkGetResponseItem]]
additional_information: Optional[BulkGetResponseItemAdditionalInformation]

Additional information related to the host name.

suspected_malware_family: Optional[str]

Suspected DGA malware family.

application: Optional[BulkGetResponseItemApplication]

Application that the hostname belongs to.

id: Optional[int]
name: Optional[str]
content_categories: Optional[List[BulkGetResponseItemContentCategory]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
domain: Optional[str]
inherited_content_categories: Optional[List[BulkGetResponseItemInheritedContentCategory]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
inherited_from: Optional[str]

Domain from which inherited_content_categories and inherited_risk_types are inherited, if applicable.

inherited_risk_types: Optional[List[BulkGetResponseItemInheritedRiskType]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
popularity_rank: Optional[int]

Global Cloudflare 100k ranking for the last 30 days, if available for the hostname. The top ranked domain is 1, the lowest ranked domain is 100,000.

risk_score: Optional[float]

Hostname risk score, which is a value between 0 (lowest risk) to 1 (highest risk).

risk_types: Optional[List[BulkGetResponseItemRiskType]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]

IntelDomain History

Get Domain History
intel.domain_history.get(DomainHistoryGetParams**kwargs) -> DomainHistoryGetResponse
GET/accounts/{account_id}/intel/domain-history
ModelsExpand Collapse
class DomainHistory: …
categorizations: Optional[List[Categorization]]
categories: Optional[List[CategorizationCategory]]
id: Optional[int]
name: Optional[str]
end: Optional[date]
formatdate
start: Optional[date]
formatdate
domain: Optional[str]
Optional[List[DomainHistory]]
categorizations: Optional[List[Categorization]]
categories: Optional[List[CategorizationCategory]]
id: Optional[int]
name: Optional[str]
end: Optional[date]
formatdate
start: Optional[date]
formatdate
domain: Optional[str]

IntelIPs

Get IP Overview
intel.ips.get(IPGetParams**kwargs) -> IPGetResponse
GET/accounts/{account_id}/intel/ip
ModelsExpand Collapse
class IP: …
belongs_to_ref: Optional[BelongsToRef]

Specifies a reference to the autonomous systems (AS) that the IP address belongs to.

id: Optional[str]
country: Optional[str]
description: Optional[str]
type: Optional[Literal["hosting_provider", "isp", "organization"]]

Infrastructure type of this ASN.

One of the following:
"hosting_provider"
"isp"
"organization"
value: Optional[str]
ip: Optional[str]
formatipv4
risk_types: Optional[List[RiskType]]
id: Optional[float]
name: Optional[str]
super_category_id: Optional[float]
Optional[List[IP]]
belongs_to_ref: Optional[BelongsToRef]

Specifies a reference to the autonomous systems (AS) that the IP address belongs to.

id: Optional[str]
country: Optional[str]
description: Optional[str]
type: Optional[Literal["hosting_provider", "isp", "organization"]]

Infrastructure type of this ASN.

One of the following:
"hosting_provider"
"isp"
"organization"
value: Optional[str]
ip: Optional[str]
formatipv4
risk_types: Optional[List[RiskType]]
id: Optional[float]
name: Optional[str]
super_category_id: Optional[float]

IntelIP Lists

ModelsExpand Collapse
class IPList: …
id: Optional[int]
description: Optional[str]
name: Optional[str]

IntelMiscategorizations

Create Miscategorization
intel.miscategorizations.create(MiscategorizationCreateParams**kwargs) -> MiscategorizationCreateResponse
POST/accounts/{account_id}/intel/miscategorization
ModelsExpand Collapse
class MiscategorizationCreateResponse: …
errors: List[Error]
code: int
minimum1000
message: str
documentation_url: Optional[str]
source: Optional[ErrorSource]
pointer: Optional[str]
messages: List[Message]
code: int
minimum1000
message: str
documentation_url: Optional[str]
source: Optional[MessageSource]
pointer: Optional[str]
success: Literal[true]

Whether the API call was successful.

IntelWhois

Get WHOIS Record
intel.whois.get(WhoisGetParams**kwargs) -> WhoisGetResponse
GET/accounts/{account_id}/intel/whois
ModelsExpand Collapse
class Whois: …
created_date: Optional[date]
formatdate
domain: Optional[str]
nameservers: Optional[List[str]]
registrant: Optional[str]
registrant_country: Optional[str]
registrant_email: Optional[str]
registrant_org: Optional[str]
registrar: Optional[str]
updated_date: Optional[date]
formatdate
class WhoisGetResponse: …
dnssec: bool
domain: str
extension: str
found: bool
nameservers: List[str]
punycode: str
registrant: str
registrar: str
id: Optional[str]
administrative_city: Optional[str]
administrative_country: Optional[str]
administrative_email: Optional[str]
administrative_fax: Optional[str]
administrative_fax_ext: Optional[str]
administrative_id: Optional[str]
administrative_name: Optional[str]
administrative_org: Optional[str]
administrative_phone: Optional[str]
administrative_phone_ext: Optional[str]
administrative_postal_code: Optional[str]
administrative_province: Optional[str]
administrative_referral_url: Optional[str]
administrative_street: Optional[str]
billing_city: Optional[str]
billing_country: Optional[str]
billing_email: Optional[str]
billing_fax: Optional[str]
billing_fax_ext: Optional[str]
billing_id: Optional[str]
billing_name: Optional[str]
billing_org: Optional[str]
billing_phone: Optional[str]
billing_phone_ext: Optional[str]
billing_postal_code: Optional[str]
billing_province: Optional[str]
billing_referral_url: Optional[str]
billing_street: Optional[str]
created_date: Optional[datetime]
formatdate-time
created_date_raw: Optional[str]
expiration_date: Optional[datetime]
formatdate-time
expiration_date_raw: Optional[str]
registrant_city: Optional[str]
registrant_country: Optional[str]
registrant_email: Optional[str]
registrant_fax: Optional[str]
registrant_fax_ext: Optional[str]
registrant_id: Optional[str]
registrant_name: Optional[str]
registrant_org: Optional[str]
registrant_phone: Optional[str]
registrant_phone_ext: Optional[str]
registrant_postal_code: Optional[str]
registrant_province: Optional[str]
registrant_referral_url: Optional[str]
registrant_street: Optional[str]
registrar_city: Optional[str]
registrar_country: Optional[str]
registrar_email: Optional[str]
registrar_fax: Optional[str]
registrar_fax_ext: Optional[str]
registrar_id: Optional[str]
registrar_name: Optional[str]
registrar_org: Optional[str]
registrar_phone: Optional[str]
registrar_phone_ext: Optional[str]
registrar_postal_code: Optional[str]
registrar_province: Optional[str]
registrar_referral_url: Optional[str]
registrar_street: Optional[str]
status: Optional[List[str]]
technical_city: Optional[str]
technical_country: Optional[str]
technical_email: Optional[str]
technical_fax: Optional[str]
technical_fax_ext: Optional[str]
technical_id: Optional[str]
technical_name: Optional[str]
technical_org: Optional[str]
technical_phone: Optional[str]
technical_phone_ext: Optional[str]
technical_postal_code: Optional[str]
technical_province: Optional[str]
technical_referral_url: Optional[str]
technical_street: Optional[str]
updated_date: Optional[datetime]
formatdate-time
updated_date_raw: Optional[str]
whois_server: Optional[str]

IntelIndicator Feeds

Get indicator feeds owned by this account
intel.indicator_feeds.list(IndicatorFeedListParams**kwargs) -> SyncSinglePage[IndicatorFeedListResponse]
GET/accounts/{account_id}/intel/indicator-feeds
Get indicator feed metadata
intel.indicator_feeds.get(intfeed_id, IndicatorFeedGetParams**kwargs) -> IndicatorFeedGetResponse
GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}
Create new indicator feed
intel.indicator_feeds.create(IndicatorFeedCreateParams**kwargs) -> IndicatorFeedCreateResponse
POST/accounts/{account_id}/intel/indicator-feeds
Update indicator feed metadata
intel.indicator_feeds.update(intfeed_id, IndicatorFeedUpdateParams**kwargs) -> IndicatorFeedUpdateResponse
PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}
Get indicator feed data
intel.indicator_feeds.data(intfeed_id, IndicatorFeedDataParams**kwargs) -> IndicatorFeedDataResponse
GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}/data
ModelsExpand Collapse
class IndicatorFeedListResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

class IndicatorFeedGetResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

latest_upload_status: Optional[Literal["Mirroring", "Unifying", "Loading", 3 more]]

Status of the latest snapshot uploaded

One of the following:
"Mirroring"
"Unifying"
"Loading"
"Provisioning"
"Complete"
"Error"
modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

provider_id: Optional[str]

The unique identifier for the provider

provider_name: Optional[str]

The provider of the indicator feed

class IndicatorFeedCreateResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

class IndicatorFeedUpdateResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

str

IntelIndicator FeedsSnapshots

Update indicator feed data
intel.indicator_feeds.snapshots.update(intfeed_id, SnapshotUpdateParams**kwargs) -> SnapshotUpdateResponse
PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}/snapshot
ModelsExpand Collapse
class SnapshotUpdateResponse: …
file_id: Optional[int]

Feed id

filename: Optional[str]

Name of the file unified in our system

status: Optional[str]

Current status of upload, should be unified

IntelIndicator FeedsPermissions

List indicator feed permissions
intel.indicator_feeds.permissions.list(PermissionListParams**kwargs) -> PermissionListResponse
GET/accounts/{account_id}/intel/indicator-feeds/permissions/view
Grant permission to indicator feed
intel.indicator_feeds.permissions.create(PermissionCreateParams**kwargs) -> PermissionCreateResponse
PUT/accounts/{account_id}/intel/indicator-feeds/permissions/add
Revoke permission to indicator feed
intel.indicator_feeds.permissions.delete(PermissionDeleteParams**kwargs) -> PermissionDeleteResponse
PUT/accounts/{account_id}/intel/indicator-feeds/permissions/remove
ModelsExpand Collapse
List[PermissionListResponseItem]
id: Optional[int]

The unique identifier for the indicator feed

description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

name: Optional[str]

The name of the indicator feed

class PermissionCreateResponse: …
success: Optional[bool]

Whether the update succeeded or not

class PermissionDeleteResponse: …
success: Optional[bool]

Whether the update succeeded or not

IntelIndicator FeedsDownloads

IntelSinkholes

List sinkholes owned by this account
intel.sinkholes.list(SinkholeListParams**kwargs) -> SyncSinglePage[Sinkhole]
GET/accounts/{account_id}/intel/sinkholes
ModelsExpand Collapse
class Sinkhole: …
id: Optional[int]

The unique identifier for the sinkhole

account_tag: Optional[str]

The account tag that owns this sinkhole

created_on: Optional[datetime]

The date and time when the sinkhole was created

formatdate-time
modified_on: Optional[datetime]

The date and time when the sinkhole was last modified

formatdate-time
name: Optional[str]

The name of the sinkhole

r2_bucket: Optional[str]

The name of the R2 bucket to store results

r2_id: Optional[str]

The id of the R2 instance

IntelAttack Surface Report

IntelAttack Surface ReportIssue Types

Retrieves Security Center Issues Types
intel.attack_surface_report.issue_types.get(IssueTypeGetParams**kwargs) -> SyncSinglePage[IssueTypeGetResponse]
GET/accounts/{account_id}/intel/attack-surface-report/issue-types
ModelsExpand Collapse
str

IntelAttack Surface ReportIssues

Retrieves Security Center Issues
Deprecated
intel.attack_surface_report.issues.list(IssueListParams**kwargs) -> SyncV4PagePagination[Optional[IssueListResponse]]
GET/accounts/{account_id}/intel/attack-surface-report/issues
Retrieves Security Center Issue Counts by Class
Deprecated
intel.attack_surface_report.issues.class_(IssueClassParams**kwargs) -> IssueClassResponse
GET/accounts/{account_id}/intel/attack-surface-report/issues/class
Retrieves Security Center Issue Counts by Severity
Deprecated
intel.attack_surface_report.issues.severity(IssueSeverityParams**kwargs) -> IssueSeverityResponse
GET/accounts/{account_id}/intel/attack-surface-report/issues/severity
Retrieves Security Center Issue Counts by Type
Deprecated
intel.attack_surface_report.issues.type(IssueTypeParams**kwargs) -> IssueTypeResponse
GET/accounts/{account_id}/intel/attack-surface-report/issues/type
Archives Security Center Insight
Deprecated
intel.attack_surface_report.issues.dismiss(strissue_id, IssueDismissParams**kwargs) -> IssueDismissResponse
PUT/accounts/{account_id}/intel/attack-surface-report/{issue_id}/dismiss
ModelsExpand Collapse
Literal["compliance_violation", "email_security", "exposed_infrastructure", 3 more]
One of the following:
"compliance_violation"
"email_security"
"exposed_infrastructure"
"insecure_configuration"
"weak_authentication"
"configuration_suggestion"
Literal["low", "moderate", "critical"]
One of the following:
"low"
"moderate"
"critical"
class IssueListResponse: …
count: Optional[int]

Indicates the total number of results.

issues: Optional[List[Issue]]
id: Optional[str]
dismissed: Optional[bool]
issue_class: Optional[str]
issue_type: Optional[IssueType]
payload: Optional[IssuePayload]
detection_method: Optional[str]

Describes the method used to detect insight.

zone_tag: Optional[str]
resolve_text: Optional[str]
severity: Optional[Literal["Low", "Moderate", "Critical"]]
One of the following:
"Low"
"Moderate"
"Critical"
since: Optional[datetime]
formatdate-time
subject: Optional[str]
timestamp: Optional[datetime]
formatdate-time
page: Optional[int]

Specifies the current page within paginated list of results.

per_page: Optional[int]

Sets the number of results per page of results.

maximum1000
minimum1
List[IssueClassResponseItem]
count: Optional[int]
value: Optional[str]
List[IssueSeverityResponseItem]
count: Optional[int]
value: Optional[str]
List[IssueTypeResponseItem]
count: Optional[int]
value: Optional[str]
class IssueDismissResponse: …
errors: List[Error]
code: int
minimum1000
message: str
documentation_url: Optional[str]
source: Optional[ErrorSource]
pointer: Optional[str]
messages: List[Message]
code: int
minimum1000
message: str
documentation_url: Optional[str]
source: Optional[MessageSource]
pointer: Optional[str]
success: Literal[true]

Whether the API call was successful.