Skip to content
Cloudflare API
Start here
API Reference

Intel

IntelASN

Get ASN Overview.
intel.asn.get(ASNasn, ASNGetParams**kwargs) -> ASN
GET/accounts/{account_id}/intel/asn/{asn}

IntelASNSubnets

Get ASN Subnets
intel.asn.subnets.get(ASNasn, SubnetGetParams**kwargs) -> SubnetGetResponse
GET/accounts/{account_id}/intel/asn/{asn}/subnets
ModelsExpand Collapse
class SubnetGetResponse: …
asn: Optional[ASN]
count: Optional[float]

Total results returned based on your search parameters.

ip_count_total: Optional[int]
page: Optional[float]

Current page within paginated list of results.

per_page: Optional[float]

Number of results per page of results.

subnets: Optional[List[str]]

IntelDNS

Get Passive DNS by IP
intel.dns.list(DNSListParams**kwargs) -> SyncV4PagePagination[Optional[DNS]]
GET/accounts/{account_id}/intel/dns
ModelsExpand Collapse
class DNS: …
count: Optional[float]

Total results returned based on your search parameters.

page: Optional[float]

Current page within paginated list of results.

per_page: Optional[float]

Number of results per page of results.

reverse_records: Optional[List[ReverseRecord]]

Reverse DNS look-ups observed during the time period.

first_seen: Optional[date]

First seen date of the DNS record during the time period.

formatdate
hostname: Optional[str]

Hostname that the IP was observed resolving to.

last_seen: Optional[date]

Last seen date of the DNS record during the time period.

formatdate

IntelDomains

Get Domain Details
intel.domains.get(DomainGetParams**kwargs) -> Domain
GET/accounts/{account_id}/intel/domain
ModelsExpand Collapse
class Domain: …
additional_information: Optional[AdditionalInformation]

Additional information related to the host name.

suspected_malware_family: Optional[str]

Suspected DGA malware family.

application: Optional[Application]

Application that the hostname belongs to.

id: Optional[int]
name: Optional[str]
content_categories: Optional[List[ContentCategory]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
domain: Optional[str]
inherited_content_categories: Optional[List[InheritedContentCategory]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
inherited_from: Optional[str]

Domain from which inherited_content_categories and inherited_risk_types are inherited, if applicable.

inherited_risk_types: Optional[List[InheritedRiskType]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
popularity_rank: Optional[int]

Global Cloudflare 100k ranking for the last 30 days, if available for the hostname. The top ranked domain is 1, the lowest ranked domain is 100,000.

resolves_to_refs: Optional[List[ResolvesToRef]]

Specifies a list of references to one or more IP addresses or domain names that the domain name currently resolves to.

value: Optional[str]

IP address or domain name.

risk_score: Optional[float]

Hostname risk score, which is a value between 0 (lowest risk) to 1 (highest risk).

risk_types: Optional[List[RiskType]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]

IntelDomainsBulks

Get Multiple Domain Details
intel.domains.bulks.get(BulkGetParams**kwargs) -> BulkGetResponse
GET/accounts/{account_id}/intel/domain/bulk
ModelsExpand Collapse
Optional[List[BulkGetResponseItem]]
additional_information: Optional[BulkGetResponseItemAdditionalInformation]

Additional information related to the host name.

suspected_malware_family: Optional[str]

Suspected DGA malware family.

application: Optional[BulkGetResponseItemApplication]

Application that the hostname belongs to.

id: Optional[int]
name: Optional[str]
content_categories: Optional[List[BulkGetResponseItemContentCategory]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
domain: Optional[str]
inherited_content_categories: Optional[List[BulkGetResponseItemInheritedContentCategory]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
inherited_from: Optional[str]

Domain from which inherited_content_categories and inherited_risk_types are inherited, if applicable.

inherited_risk_types: Optional[List[BulkGetResponseItemInheritedRiskType]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]
popularity_rank: Optional[int]

Global Cloudflare 100k ranking for the last 30 days, if available for the hostname. The top ranked domain is 1, the lowest ranked domain is 100,000.

risk_score: Optional[float]

Hostname risk score, which is a value between 0 (lowest risk) to 1 (highest risk).

risk_types: Optional[List[BulkGetResponseItemRiskType]]
id: Optional[int]
name: Optional[str]
super_category_id: Optional[int]

IntelDomain History

Get Domain History
intel.domain_history.get(DomainHistoryGetParams**kwargs) -> DomainHistoryGetResponse
GET/accounts/{account_id}/intel/domain-history
ModelsExpand Collapse
class DomainHistory: …
categorizations: Optional[List[Categorization]]
categories: Optional[List[CategorizationCategory]]
id: Optional[int]
name: Optional[str]
end: Optional[date]
formatdate
start: Optional[date]
formatdate
domain: Optional[str]
Optional[List[DomainHistory]]
categorizations: Optional[List[Categorization]]
categories: Optional[List[CategorizationCategory]]
id: Optional[int]
name: Optional[str]
end: Optional[date]
formatdate
start: Optional[date]
formatdate
domain: Optional[str]

IntelIPs

Get IP Overview
intel.ips.get(IPGetParams**kwargs) -> IPGetResponse
GET/accounts/{account_id}/intel/ip
ModelsExpand Collapse
class IP: …
belongs_to_ref: Optional[BelongsToRef]

Specifies a reference to the autonomous systems (AS) that the IP address belongs to.

id: Optional[str]
country: Optional[str]
description: Optional[str]
type: Optional[Literal["hosting_provider", "isp", "organization"]]

Infrastructure type of this ASN.

One of the following:
"hosting_provider"
"isp"
"organization"
value: Optional[str]
ip: Optional[str]
formatipv4
risk_types: Optional[List[RiskType]]
id: Optional[float]
name: Optional[str]
super_category_id: Optional[float]
Optional[List[IP]]
belongs_to_ref: Optional[BelongsToRef]

Specifies a reference to the autonomous systems (AS) that the IP address belongs to.

id: Optional[str]
country: Optional[str]
description: Optional[str]
type: Optional[Literal["hosting_provider", "isp", "organization"]]

Infrastructure type of this ASN.

One of the following:
"hosting_provider"
"isp"
"organization"
value: Optional[str]
ip: Optional[str]
formatipv4
risk_types: Optional[List[RiskType]]
id: Optional[float]
name: Optional[str]
super_category_id: Optional[float]

IntelIP Lists

ModelsExpand Collapse
class IPList: …
id: Optional[int]
description: Optional[str]
name: Optional[str]

IntelMiscategorizations

Create Miscategorization
intel.miscategorizations.create(MiscategorizationCreateParams**kwargs) -> MiscategorizationCreateResponse
POST/accounts/{account_id}/intel/miscategorization
ModelsExpand Collapse
class MiscategorizationCreateResponse: …
errors: List[Error]
code: int
minimum1000
message: str
documentation_url: Optional[str]
source: Optional[ErrorSource]
pointer: Optional[str]
messages: List[Message]
code: int
minimum1000
message: str
documentation_url: Optional[str]
source: Optional[MessageSource]
pointer: Optional[str]
success: Literal[true]

Whether the API call was successful.

IntelWhois

Get WHOIS Record
intel.whois.get(WhoisGetParams**kwargs) -> WhoisGetResponse
GET/accounts/{account_id}/intel/whois
ModelsExpand Collapse
class Whois: …
created_date: Optional[date]
formatdate
domain: Optional[str]
nameservers: Optional[List[str]]
registrant: Optional[str]
registrant_country: Optional[str]
registrant_email: Optional[str]
registrant_org: Optional[str]
registrar: Optional[str]
updated_date: Optional[date]
formatdate
class WhoisGetResponse: …
dnssec: bool
domain: str
extension: str
found: bool
nameservers: List[str]
punycode: str
registrant: str
registrar: str
id: Optional[str]
administrative_city: Optional[str]
administrative_country: Optional[str]
administrative_email: Optional[str]
administrative_fax: Optional[str]
administrative_fax_ext: Optional[str]
administrative_id: Optional[str]
administrative_name: Optional[str]
administrative_org: Optional[str]
administrative_phone: Optional[str]
administrative_phone_ext: Optional[str]
administrative_postal_code: Optional[str]
administrative_province: Optional[str]
administrative_referral_url: Optional[str]
administrative_street: Optional[str]
billing_city: Optional[str]
billing_country: Optional[str]
billing_email: Optional[str]
billing_fax: Optional[str]
billing_fax_ext: Optional[str]
billing_id: Optional[str]
billing_name: Optional[str]
billing_org: Optional[str]
billing_phone: Optional[str]
billing_phone_ext: Optional[str]
billing_postal_code: Optional[str]
billing_province: Optional[str]
billing_referral_url: Optional[str]
billing_street: Optional[str]
created_date: Optional[datetime]
formatdate-time
created_date_raw: Optional[str]
expiration_date: Optional[datetime]
formatdate-time
expiration_date_raw: Optional[str]
registrant_city: Optional[str]
registrant_country: Optional[str]
registrant_email: Optional[str]
registrant_fax: Optional[str]
registrant_fax_ext: Optional[str]
registrant_id: Optional[str]
registrant_name: Optional[str]
registrant_org: Optional[str]
registrant_phone: Optional[str]
registrant_phone_ext: Optional[str]
registrant_postal_code: Optional[str]
registrant_province: Optional[str]
registrant_referral_url: Optional[str]
registrant_street: Optional[str]
registrar_city: Optional[str]
registrar_country: Optional[str]
registrar_email: Optional[str]
registrar_fax: Optional[str]
registrar_fax_ext: Optional[str]
registrar_id: Optional[str]
registrar_name: Optional[str]
registrar_org: Optional[str]
registrar_phone: Optional[str]
registrar_phone_ext: Optional[str]
registrar_postal_code: Optional[str]
registrar_province: Optional[str]
registrar_referral_url: Optional[str]
registrar_street: Optional[str]
status: Optional[List[str]]
technical_city: Optional[str]
technical_country: Optional[str]
technical_email: Optional[str]
technical_fax: Optional[str]
technical_fax_ext: Optional[str]
technical_id: Optional[str]
technical_name: Optional[str]
technical_org: Optional[str]
technical_phone: Optional[str]
technical_phone_ext: Optional[str]
technical_postal_code: Optional[str]
technical_province: Optional[str]
technical_referral_url: Optional[str]
technical_street: Optional[str]
updated_date: Optional[datetime]
formatdate-time
updated_date_raw: Optional[str]
whois_server: Optional[str]

IntelURLs

Get URL Intelligence
intel.urls.get(URLGetParams**kwargs) -> URL
GET/accounts/{account_id}/intel/url
ModelsExpand Collapse
class URL: …
content_categories: List[ContentCategory]

Content categories associated with this URL.

id: Optional[int]
name: Optional[str]
source_id: Optional[int]
super_category_id: Optional[int]
full_url: str

The full URL that was looked up.

hostname: str

The hostname of the URL.

risk_type: List[RiskType]

Security risk types associated with this URL.

id: Optional[int]
name: Optional[str]
source_id: Optional[int]
super_category_id: Optional[int]
url_path: str

The path component of the URL.

IntelIndicator Feeds

Get indicator feeds owned by this account
intel.indicator_feeds.list(IndicatorFeedListParams**kwargs) -> SyncSinglePage[IndicatorFeedListResponse]
GET/accounts/{account_id}/intel/indicator-feeds
Get indicator feed metadata
intel.indicator_feeds.get(intfeed_id, IndicatorFeedGetParams**kwargs) -> IndicatorFeedGetResponse
GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}
Create new indicator feed
intel.indicator_feeds.create(IndicatorFeedCreateParams**kwargs) -> IndicatorFeedCreateResponse
POST/accounts/{account_id}/intel/indicator-feeds
Update indicator feed metadata
intel.indicator_feeds.update(intfeed_id, IndicatorFeedUpdateParams**kwargs) -> IndicatorFeedUpdateResponse
PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}
Get indicator feed data
intel.indicator_feeds.data(intfeed_id, IndicatorFeedDataParams**kwargs) -> IndicatorFeedDataResponse
GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}/data
ModelsExpand Collapse
class IndicatorFeedListResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

class IndicatorFeedGetResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

last_upload_summary: Optional[LastUploadSummary]

Summary of indicator counts from the last successful upload to this feed. Populated by the custom-threat-feeds loader at the end of each successful load. Absent (omitted) when no upload has completed successfully or the upload errored before the summary write. Surfaces silent-failure paths so operators can see when their indicators were dropped (popularity allowlist, expired valid_until, etc.) without reading loader logs.

persisted: Optional[LastUploadSummaryPersisted]

Net delta applied to feed indicators by this upload. Snapshot uploads emit both *_added and *_removed; delta-add emits only *_added; delta-remove emits only *_removed.

domains_added: Optional[int]
domains_removed: Optional[int]
ips_added: Optional[int]
ips_removed: Optional[int]
urls_added: Optional[int]
urls_removed: Optional[int]
skipped: Optional[LastUploadSummarySkipped]

Counts of indicators that were uploaded but did not reach QuickSilver, broken down by reason.

allowlisted_domains: Optional[int]

Domains filtered by the global popularity allowlist at QS provisioning time. Popular domains (bing.com, naver.com, etc.) are protected from custom-threat-feed enforcement.

expired_indicators: Optional[int]

Indicators in the upload whose valid_until is already in the past. These are not added to QS; the expiration cron handles cleanup.

invalid_indicators: Optional[int]

Reserved for future use. Currently always 0 — the unifier aborts the entire upload on a single bad indicator.

uploaded: Optional[LastUploadSummaryUploaded]

Indicator counts from the unified file the loader received

domains: Optional[int]

Number of domain indicators in the upload

ips: Optional[int]

Number of IP indicators in the upload

urls: Optional[int]

Number of URL indicators in the upload

latest_upload_error: Optional[str]

Human-readable error message describing why the latest upload failed. Populated only when latest_upload_status is Error. Returns one of a small fixed set of category-level messages (invalid domain / IP / URL entries, malformed row or header, invalid valid_until timestamp, etc.) or the generic Upload failed for unknown or infrastructure-level errors. Never echoes raw error text from the underlying loader. Intel accounts receive the verbatim loader/API error text (including specific offending values) instead of these category-level messages.

latest_upload_status: Optional[Literal["Mirroring", "Unifying", "Loading", 3 more]]

Status of the latest snapshot uploaded

One of the following:
"Mirroring"
"Unifying"
"Loading"
"Provisioning"
"Complete"
"Error"
modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

provider_id: Optional[int]

The unique identifier for the provider

provider_name: Optional[str]

The provider of the indicator feed

class IndicatorFeedCreateResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

class IndicatorFeedUpdateResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

str

IntelIndicator FeedsSnapshots

Update indicator feed data
intel.indicator_feeds.snapshots.update(intfeed_id, SnapshotUpdateParams**kwargs) -> SnapshotUpdateResponse
PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}/snapshot
ModelsExpand Collapse
class SnapshotUpdateResponse: …
file_id: Optional[int]

Feed id

filename: Optional[str]

Name of the file unified in our system

status: Optional[str]

Current status of upload, should be unified

IntelIndicator FeedsPermissions

List indicator feed permissions
intel.indicator_feeds.permissions.list(PermissionListParams**kwargs) -> PermissionListResponse
GET/accounts/{account_id}/intel/indicator-feeds/permissions/view
Grant permission to indicator feed
intel.indicator_feeds.permissions.create(PermissionCreateParams**kwargs) -> PermissionCreateResponse
PUT/accounts/{account_id}/intel/indicator-feeds/permissions/add
Revoke permission to indicator feed
intel.indicator_feeds.permissions.delete(PermissionDeleteParams**kwargs) -> PermissionDeleteResponse
PUT/accounts/{account_id}/intel/indicator-feeds/permissions/remove
ModelsExpand Collapse
List[PermissionListResponseItem]
id: Optional[int]

The unique identifier for the indicator feed

description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

name: Optional[str]

The name of the indicator feed

class PermissionCreateResponse: …
success: Optional[bool]

Whether the update succeeded or not

class PermissionDeleteResponse: …
success: Optional[bool]

Whether the update succeeded or not

IntelIndicator FeedsDownloads

IntelSinkholes

List sinkholes owned by this account
intel.sinkholes.list(SinkholeListParams**kwargs) -> SyncSinglePage[Sinkhole]
GET/accounts/{account_id}/intel/sinkholes
Get a sinkhole
intel.sinkholes.get(strsinkhole_id, SinkholeGetParams**kwargs) -> Sinkhole
GET/accounts/{account_id}/intel/sinkholes/{sinkhole_id}
Create a new sinkhole for your account
intel.sinkholes.create(SinkholeCreateParams**kwargs) -> Sinkhole
POST/accounts/{account_id}/intel/sinkholes
Update a sinkhole
intel.sinkholes.update(strsinkhole_id, SinkholeUpdateParams**kwargs) -> object
PUT/accounts/{account_id}/intel/sinkholes/{sinkhole_id}
Delete a sinkhole
intel.sinkholes.delete(strsinkhole_id, SinkholeDeleteParams**kwargs) -> object
DELETE/accounts/{account_id}/intel/sinkholes/{sinkhole_id}
ModelsExpand Collapse
class Sinkhole: …
id: Optional[str]

The unique identifier for the sinkhole.

account_tag: Optional[str]

The account tag that owns this sinkhole.

created_on: Optional[datetime]

The date and time when the sinkhole was created.

formatdate-time
modified_on: Optional[datetime]

The date and time when the sinkhole was last modified.

formatdate-time
name: Optional[str]

The name of the sinkhole.

r2_bucket: Optional[str]

The name of the R2 bucket to store results.

r2_id: Optional[str]

The id of the R2 instance.

IntelSinkholesIngresses

Create an ingress rule
intel.sinkholes.ingresses.create(strsinkhole_id, IngressCreateParams**kwargs) -> IngressCreateResponse
POST/zones/{zone_id}/intel/sinkholes/{sinkhole_id}/ingresses
Get an ingress rule
intel.sinkholes.ingresses.get(stringress_id, IngressGetParams**kwargs) -> IngressGetResponse
GET/zones/{zone_id}/intel/sinkholes/{sinkhole_id}/ingresses/{ingress_id}
Update an ingress rule
intel.sinkholes.ingresses.update(stringress_id, IngressUpdateParams**kwargs) -> object
PUT/zones/{zone_id}/intel/sinkholes/{sinkhole_id}/ingresses/{ingress_id}
Delete an ingress rule
intel.sinkholes.ingresses.delete(stringress_id, IngressDeleteParams**kwargs) -> object
DELETE/zones/{zone_id}/intel/sinkholes/{sinkhole_id}/ingresses/{ingress_id}
ModelsExpand Collapse
class IngressCreateResponse: …
id: Optional[str]

The unique identifier for the ingress rule.

cidr: Optional[str]

The CIDR block for the ingress rule.

created_on: Optional[datetime]

The date and time when the ingress rule was created.

formatdate-time
modified_on: Optional[datetime]

The date and time when the ingress rule was last modified.

formatdate-time
sinkhole_id: Optional[str]

The sinkhole this ingress rule belongs to.

zone_tag: Optional[str]

The zone tag associated with this ingress rule.

class IngressGetResponse: …
id: Optional[str]

The unique identifier for the ingress rule.

cidr: Optional[str]

The CIDR block for the ingress rule.

created_on: Optional[datetime]

The date and time when the ingress rule was created.

formatdate-time
modified_on: Optional[datetime]

The date and time when the ingress rule was last modified.

formatdate-time
sinkhole_id: Optional[str]

The sinkhole this ingress rule belongs to.

zone_tag: Optional[str]

The zone tag associated with this ingress rule.

IntelAttack Surface Report

IntelAttack Surface ReportIssue Types

Retrieves Security Center Issues Types
intel.attack_surface_report.issue_types.get(IssueTypeGetParams**kwargs) -> SyncSinglePage[IssueTypeGetResponse]
GET/accounts/{account_id}/intel/attack-surface-report/issue-types
ModelsExpand Collapse
str

IntelAttack Surface ReportIssues

Retrieves Security Center Issues
Deprecated
intel.attack_surface_report.issues.list(IssueListParams**kwargs) -> SyncV4PagePagination[Optional[IssueListResponse]]
GET/accounts/{account_id}/intel/attack-surface-report/issues
Retrieves Security Center Issue Counts by Class
Deprecated
intel.attack_surface_report.issues.class_(IssueClassParams**kwargs) -> IssueClassResponse
GET/accounts/{account_id}/intel/attack-surface-report/issues/class
Retrieves Security Center Issue Counts by Severity
Deprecated
intel.attack_surface_report.issues.severity(IssueSeverityParams**kwargs) -> IssueSeverityResponse
GET/accounts/{account_id}/intel/attack-surface-report/issues/severity
Retrieves Security Center Issue Counts by Type
Deprecated
intel.attack_surface_report.issues.type(IssueTypeParams**kwargs) -> IssueTypeResponse
GET/accounts/{account_id}/intel/attack-surface-report/issues/type
ModelsExpand Collapse
Literal["compliance_violation", "email_security", "exposed_infrastructure", 3 more]
One of the following:
"compliance_violation"
"email_security"
"exposed_infrastructure"
"insecure_configuration"
"weak_authentication"
"configuration_suggestion"
Literal["low", "moderate", "critical"]
One of the following:
"low"
"moderate"
"critical"
class IssueListResponse: …
count: Optional[int]

Indicates the total number of results.

issues: Optional[List[Issue]]
id: Optional[str]
dismissed: Optional[bool]
has_extended_context: Optional[bool]

Indicates whether the insight has a large payload that requires fetching via the context endpoint.

issue_class: Optional[str]
issue_type: Optional[IssueType]
payload: Optional[IssuePayload]
detection_method: Optional[str]

Describes the method used to detect insight.

zone_tag: Optional[str]
resolve_text: Optional[str]
severity: Optional[Literal["Low", "Moderate", "Critical"]]
One of the following:
"Low"
"Moderate"
"Critical"
since: Optional[datetime]
formatdate-time
status: Optional[Literal["active", "resolved"]]

The current status of the insight.

One of the following:
"active"
"resolved"
subject: Optional[str]
timestamp: Optional[datetime]
formatdate-time
user_classification: Optional[Literal["false_positive", "accept_risk", "other"]]

User-defined classification for the insight. Can be ‘false_positive’, ‘accept_risk’, ‘other’, or null.

One of the following:
"false_positive"
"accept_risk"
"other"
page: Optional[int]

Specifies the current page within paginated list of results.

per_page: Optional[int]

Sets the number of results per page of results.

maximum1000
minimum1
List[IssueClassResponseItem]
count: Optional[int]
value: Optional[str]
List[IssueSeverityResponseItem]
count: Optional[int]
value: Optional[str]
List[IssueTypeResponseItem]
count: Optional[int]
value: Optional[str]