Updates a tag (SoT)

PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

Updates a Source-of-Truth tag by UUID.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

Accepted Permissions (at least one required)

Cloudforce One Write

Path ParametersExpand Collapse

account_id: string

Account ID.

tag_uuid: string

Tag UUID.

Body ParametersJSONExpand Collapse

activeDuration: optional string or object { value, confidence, tlp }

One of the following:

string

object { value, confidence, tlp }

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory: optional string or object { value, confidence, tlp }

One of the following:

string

object { value, confidence, tlp }

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

attributionOrganization: optional string or object { value, confidence, tlp }

One of the following:

string

object { value, confidence, tlp }

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryUuid: optional string

Tag type (category) UUID. When changed, existing properties are re-validated against the new category’s schema (400 on mismatch). Set to null to unlink (typeless; properties stop being validated).

confidence: optional number

Overall tag confidence (1-10). Omit to preserve existing.

maximum10

minimum1

dateOfDiscovery: optional string

Date of discovery (ISO YYYY-MM-DD). Omit to preserve existing.

description: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

internalAliases: optional array of object { value, confidence, tlp }

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription: optional string

lastSeen: optional string

motive: optional string or object { value, confidence, tlp }

One of the following:

string

object { value, confidence, tlp }

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel: optional string or object { value, confidence, tlp }

One of the following:

string

object { value, confidence, tlp }

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO: optional string or object { value, confidence, tlp }

One of the following:

string

object { value, confidence, tlp }

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority: optional number or object { value, confidence, tlp }

One of the following:

number

object { value, confidence, tlp }

value: number

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties: optional map[unknown]

Custom field values blob. When omitted, the existing value is preserved. When provided, performs a shallow per-key merge over the stored value (unmentioned keys are retained). Setting an individual key to null deletes that key. Validation runs against the merged result, so a partial update may omit a schema-required key if the stored value supplies it.

sophisticationLevel: optional string or object { value, confidence, tlp }

One of the following:

string

object { value, confidence, tlp }

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp: optional "red" or "amber" or "amber-strict" or 4 more

Tag-level TLP marking. Omit to preserve existing. Cannot be cleared to null.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

value: optional string

ReturnsExpand Collapse

uuid: string

value: string

activeDuration: optional string

activeDuration_annotated: optional object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory: optional string

actorCategory_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

attributionOrganization: optional string

attributionOrganization_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName: optional string

categoryUuid: optional string

confidence: optional number

Overall tag confidence (1-10).

maximum10

minimum1

createdAt: optional string

dateOfDiscovery: optional string

description: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

externalReferences_annotated: optional array of object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases: optional array of object { value, confidence, tlp }

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription: optional string

lastSeen: optional string

motive: optional string

motive_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel: optional string

opsecLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO: optional string

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority: optional number

priority_annotated: optional object { value, tlp }

value: number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties: optional map[unknown]

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel: optional string

sophisticationLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp: optional "red" or "amber" or "amber-strict" or 4 more

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt: optional string

version: optional number

Updates a tag (SoT)

curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cloudforce-one/events/tags/$TAG_UUID \
    -X PATCH \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

{
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "value": "APT28",
  "activeDuration": "activeDuration",
  "activeDuration_annotated": {
    "value": "value",
    "tlp": "red"
  },
  "actorCategory": "actorCategory",
  "actorCategory_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "aliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "aliasGroupNames": [
    "string"
  ],
  "aliasGroupNamesInternal": [
    "string"
  ],
  "attributionOrganization": "attributionOrganization",
  "attributionOrganization_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "categoryName": "Actor",
  "categoryUuid": "12345678-1234-1234-1234-1234567890ab",
  "confidence": 8,
  "createdAt": "createdAt",
  "dateOfDiscovery": "2024-01-15T00:00:00Z",
  "description": "description",
  "externalReferenceLinks": [
    "string"
  ],
  "externalReferences": [
    {
      "url": "https://example.com/report",
      "description": "Vendor threat report"
    }
  ],
  "externalReferences_annotated": [
    {
      "value": "value",
      "tlp": "red"
    }
  ],
  "internalAliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "internalDescription": "internalDescription",
  "lastSeen": "lastSeen",
  "motive": "motive",
  "motive_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "opsecLevel": "opsecLevel",
  "opsecLevel_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "originCountryISO": "originCountryISO",
  "originCountryISO_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "priority": 0,
  "priority_annotated": {
    "value": 0,
    "tlp": "red"
  },
  "properties": {
    "foo": "bar"
  },
  "sophisticationLevel": "sophisticationLevel",
  "sophisticationLevel_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "tlp": "amber",
  "updatedAt": "updatedAt",
  "version": 0
}

Returns Examples

{
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "value": "APT28",
  "activeDuration": "activeDuration",
  "activeDuration_annotated": {
    "value": "value",
    "tlp": "red"
  },
  "actorCategory": "actorCategory",
  "actorCategory_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "aliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "aliasGroupNames": [
    "string"
  ],
  "aliasGroupNamesInternal": [
    "string"
  ],
  "attributionOrganization": "attributionOrganization",
  "attributionOrganization_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "categoryName": "Actor",
  "categoryUuid": "12345678-1234-1234-1234-1234567890ab",
  "confidence": 8,
  "createdAt": "createdAt",
  "dateOfDiscovery": "2024-01-15T00:00:00Z",
  "description": "description",
  "externalReferenceLinks": [
    "string"
  ],
  "externalReferences": [
    {
      "url": "https://example.com/report",
      "description": "Vendor threat report"
    }
  ],
  "externalReferences_annotated": [
    {
      "value": "value",
      "tlp": "red"
    }
  ],
  "internalAliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "internalDescription": "internalDescription",
  "lastSeen": "lastSeen",
  "motive": "motive",
  "motive_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "opsecLevel": "opsecLevel",
  "opsecLevel_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "originCountryISO": "originCountryISO",
  "originCountryISO_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "priority": 0,
  "priority_annotated": {
    "value": 0,
    "tlp": "red"
  },
  "properties": {
    "foo": "bar"
  },
  "sophisticationLevel": "sophisticationLevel",
  "sophisticationLevel_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "tlp": "amber",
  "updatedAt": "updatedAt",
  "version": 0
}