Skip to content
Cloudflare API
Start here
API Reference
Intel

Indicator Feeds

Get indicator feeds owned by this account
intel.indicator_feeds.list(IndicatorFeedListParams**kwargs) -> SyncSinglePage[IndicatorFeedListResponse]
GET/accounts/{account_id}/intel/indicator-feeds
Get indicator feed metadata
intel.indicator_feeds.get(intfeed_id, IndicatorFeedGetParams**kwargs) -> IndicatorFeedGetResponse
GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}
Create new indicator feed
intel.indicator_feeds.create(IndicatorFeedCreateParams**kwargs) -> IndicatorFeedCreateResponse
POST/accounts/{account_id}/intel/indicator-feeds
Update indicator feed metadata
intel.indicator_feeds.update(intfeed_id, IndicatorFeedUpdateParams**kwargs) -> IndicatorFeedUpdateResponse
PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}
Get indicator feed data
intel.indicator_feeds.data(intfeed_id, IndicatorFeedDataParams**kwargs) -> IndicatorFeedDataResponse
GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}/data
ModelsExpand Collapse
class IndicatorFeedListResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

class IndicatorFeedGetResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

last_upload_summary: Optional[LastUploadSummary]

Summary of indicator counts from the last successful upload to this feed. Populated by the custom-threat-feeds loader at the end of each successful load. Absent (omitted) when no upload has completed successfully or the upload errored before the summary write. Surfaces silent-failure paths so operators can see when their indicators were dropped (popularity allowlist, expired valid_until, etc.) without reading loader logs.

persisted: Optional[LastUploadSummaryPersisted]

Net delta applied to feed indicators by this upload. Snapshot uploads emit both *_added and *_removed; delta-add emits only *_added; delta-remove emits only *_removed.

domains_added: Optional[int]
domains_removed: Optional[int]
ips_added: Optional[int]
ips_removed: Optional[int]
urls_added: Optional[int]
urls_removed: Optional[int]
skipped: Optional[LastUploadSummarySkipped]

Counts of indicators that were uploaded but did not reach QuickSilver, broken down by reason.

allowlisted_domains: Optional[int]

Domains filtered by the global popularity allowlist at QS provisioning time. Popular domains (bing.com, naver.com, etc.) are protected from custom-threat-feed enforcement.

expired_indicators: Optional[int]

Indicators in the upload whose valid_until is already in the past. These are not added to QS; the expiration cron handles cleanup.

invalid_indicators: Optional[int]

Reserved for future use. Currently always 0 — the unifier aborts the entire upload on a single bad indicator.

uploaded: Optional[LastUploadSummaryUploaded]

Indicator counts from the unified file the loader received

domains: Optional[int]

Number of domain indicators in the upload

ips: Optional[int]

Number of IP indicators in the upload

urls: Optional[int]

Number of URL indicators in the upload

latest_upload_status: Optional[Literal["Mirroring", "Unifying", "Loading", 3 more]]

Status of the latest snapshot uploaded

One of the following:
"Mirroring"
"Unifying"
"Loading"
"Provisioning"
"Complete"
"Error"
modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

provider_id: Optional[int]

The unique identifier for the provider

provider_name: Optional[str]

The provider of the indicator feed

class IndicatorFeedCreateResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

class IndicatorFeedUpdateResponse: …
id: Optional[int]

The unique identifier for the indicator feed

created_on: Optional[datetime]

The date and time when the data entry was created

formatdate-time
description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

modified_on: Optional[datetime]

The date and time when the data entry was last modified

formatdate-time
name: Optional[str]

The name of the indicator feed

str

Indicator FeedsSnapshots

Update indicator feed data
intel.indicator_feeds.snapshots.update(intfeed_id, SnapshotUpdateParams**kwargs) -> SnapshotUpdateResponse
PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}/snapshot
ModelsExpand Collapse
class SnapshotUpdateResponse: …
file_id: Optional[int]

Feed id

filename: Optional[str]

Name of the file unified in our system

status: Optional[str]

Current status of upload, should be unified

Indicator FeedsPermissions

List indicator feed permissions
intel.indicator_feeds.permissions.list(PermissionListParams**kwargs) -> PermissionListResponse
GET/accounts/{account_id}/intel/indicator-feeds/permissions/view
Grant permission to indicator feed
intel.indicator_feeds.permissions.create(PermissionCreateParams**kwargs) -> PermissionCreateResponse
PUT/accounts/{account_id}/intel/indicator-feeds/permissions/add
Revoke permission to indicator feed
intel.indicator_feeds.permissions.delete(PermissionDeleteParams**kwargs) -> PermissionDeleteResponse
PUT/accounts/{account_id}/intel/indicator-feeds/permissions/remove
ModelsExpand Collapse
List[PermissionListResponseItem]
id: Optional[int]

The unique identifier for the indicator feed

description: Optional[str]

The description of the example test

is_attributable: Optional[bool]

Whether the indicator feed can be attributed to a provider

is_downloadable: Optional[bool]

Whether the indicator feed can be downloaded

is_public: Optional[bool]

Whether the indicator feed is exposed to customers

name: Optional[str]

The name of the indicator feed

class PermissionCreateResponse: …
success: Optional[bool]

Whether the update succeeded or not

class PermissionDeleteResponse: …
success: Optional[bool]

Whether the update succeeded or not

Indicator FeedsDownloads