API Reference

Cloudflare Managed Defense

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Vulnerability Discovery

Vulnerability DiscoveryRepositories

List repositories

GET/accounts/{account_id}/managed-defense/vulnerability-discovery/repos

Create repository

POST/accounts/{account_id}/managed-defense/vulnerability-discovery/repos

Get repository

GET/accounts/{account_id}/managed-defense/vulnerability-discovery/repos/{repo_id}

ModelsExpand Collapse

RepositoryListResponse object { id, created_at, name, 3 more }

id: string

formatuuid

created_at: string

formatdate-time

name: string

maxLength255

minLength1

readiness: "awaiting_source" or "processing" or "ready" or "failed"

One of the following:

"awaiting_source"

"processing"

"ready"

"failed"

source: "upload" or "worker"

One of the following:

"upload"

"worker"

import_error: optional object { code, message }

code: "worker_import_failed"

message: "Worker import failed."

RepositoryCreateResponse = object { repository, upload } or object { repository }

One of the following:

object { repository, upload }

repository: object { id, name, readiness, 2 more }

id: string

formatuuid

name: string

maxLength255

minLength1

readiness: "awaiting_source" or "processing" or "ready" or "failed"

One of the following:

"awaiting_source"

"processing"

"ready"

"failed"

source: "upload" or "worker"

One of the following:

"upload"

"worker"

import_error: optional object { code, message }

code: "worker_import_failed"

message: "Worker import failed."

upload: object { token, expires_in, remote }

token: string

maxLength8192

minLength1

expires_in: 3600

remote: string

formaturi

maxLength2048

Repository object { repository }

repository: object { id, name, readiness, 2 more }

id: string

formatuuid

name: string

maxLength255

minLength1

readiness: "awaiting_source" or "processing" or "ready" or "failed"

One of the following:

"awaiting_source"

"processing"

"ready"

"failed"

source: "upload" or "worker"

One of the following:

"upload"

"worker"

import_error: optional object { code, message }

code: "worker_import_failed"

message: "Worker import failed."

RepositoryGetResponse object { repository, scans }

repository: object { id, created_at, name, 3 more }

id: string

formatuuid

created_at: string

formatdate-time

name: string

maxLength255

minLength1

readiness: "awaiting_source" or "processing" or "ready" or "failed"

One of the following:

"awaiting_source"

"processing"

"ready"

"failed"

source: "upload" or "worker"

One of the following:

"upload"

"worker"

import_error: optional object { code, message }

code: "worker_import_failed"

message: "Worker import failed."

scans: array of object { id, completed_at, message, 6 more }

id: string

formatuuid

completed_at: string

formatdate-time

message: string

maxLength1024

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

repositories: array of object { id, name, phase, 2 more }

id: string

formatuuid

name: string

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

report_status: "not_ready" or "pending_review" or "published" or "withdrawn"

One of the following:

"not_ready"

"pending_review"

"published"

"withdrawn"

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

started_at: string

formatdate-time

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

submitted_at: string

formatdate-time

telemetry_window: optional object { end, start }

UTC ISO-8601 interval. Start is inclusive, end is exclusive, and the interval must be positive and at most seven days.

end: string

formatdate-time

start: string

formatdate-time

Vulnerability DiscoveryScans

List scans

GET/accounts/{account_id}/managed-defense/vulnerability-discovery/scans

Create scan

POST/accounts/{account_id}/managed-defense/vulnerability-discovery/scans

Get scan

GET/accounts/{account_id}/managed-defense/vulnerability-discovery/scans/{scan_id}

Get reviewed vulnerability report

GET/accounts/{account_id}/managed-defense/vulnerability-discovery/scans/{scan_id}/report

ModelsExpand Collapse

ScanListResponse object { id, completed_at, message, 6 more }

id: string

formatuuid

completed_at: string

formatdate-time

message: string

maxLength1024

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

repositories: array of object { id, name, phase, 2 more }

id: string

formatuuid

name: string

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

report_status: "not_ready" or "pending_review" or "published" or "withdrawn"

One of the following:

"not_ready"

"pending_review"

"published"

"withdrawn"

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

started_at: string

formatdate-time

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

submitted_at: string

formatdate-time

telemetry_window: optional object { end, start }

UTC ISO-8601 interval. Start is inclusive, end is exclusive, and the interval must be positive and at most seven days.

end: string

formatdate-time

start: string

formatdate-time

ScanCreateResponse object { id, completed_at, message, 6 more }

id: string

formatuuid

completed_at: string

formatdate-time

message: string

maxLength1024

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

repositories: array of object { id, name, phase, 2 more }

id: string

formatuuid

name: string

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

report_status: "not_ready" or "pending_review" or "published" or "withdrawn"

One of the following:

"not_ready"

"pending_review"

"published"

"withdrawn"

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

started_at: string

formatdate-time

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

submitted_at: string

formatdate-time

telemetry_window: optional object { end, start }

UTC ISO-8601 interval. Start is inclusive, end is exclusive, and the interval must be positive and at most seven days.

end: string

formatdate-time

start: string

formatdate-time

ScanGetResponse object { id, completed_at, message, 6 more }

id: string

formatuuid

completed_at: string

formatdate-time

message: string

maxLength1024

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

repositories: array of object { id, name, phase, 2 more }

id: string

formatuuid

name: string

phase: "provisioning" or "indexing" or "analyzing" or 2 more

One of the following:

"provisioning"

"indexing"

"analyzing"

"reporting"

"finalizing"

report_status: "not_ready" or "pending_review" or "published" or "withdrawn"

One of the following:

"not_ready"

"pending_review"

"published"

"withdrawn"

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

started_at: string

formatdate-time

status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

submitted_at: string

formatdate-time

telemetry_window: optional object { end, start }

UTC ISO-8601 interval. Start is inclusive, end is exclusive, and the interval must be positive and at most seven days.

end: string

formatdate-time

start: string

formatdate-time

ScanGetReportResponse object { publication, report, repositories, scan_id }

publication: object { published_at, revision_id, version }

published_at: string

formatdate-time

revision_id: string

formatuuid

version: number

minimum1

report: object { executive_summary, generated_at, overall_severity, 3 more }

executive_summary: string

maxLength10000

minLength1

generated_at: string

Revision requests must echo the existing generation timestamp unchanged.

formatdate-time

overall_severity: "critical" or "high" or "medium" or 2 more

One of the following:

"critical"

"high"

"medium"

"low"

"info"

repositories: array of object { findings, overall_severity, repository_id, 5 more }

findings: array of object { id, conditions, cwe, 17 more }

id: string

maxLength128

minLength1

conditions: array of string

cwe: string

minLength1

impact: string

maxLength4000

minLength1

location: object { file, line, route }

file: string

minLength1

line: number

minimum1

route: string

reachability: array of object { consumer, reachable, via }

consumer: string

minLength1

reachable: boolean

via: string

remediation: object { code_changes, strategy }

code_changes: string

strategy: string

minLength1

root_cause: string

maxLength4000

minLength1

severity: "critical" or "high" or "medium" or 2 more

One of the following:

"critical"

"high"

"medium"

"low"

"info"

severity_basis: string

minLength1

summary: string

maxLength4000

minLength1

telemetry: object { references, state }

references: array of string

state: "no_route" or "no_telemetry" or "no_match" or "matched"

One of the following:

"no_route"

"no_telemetry"

"no_match"

"matched"

title: string

maxLength200

minLength1

trace: array of object { line, path, scope, why }

line: number

minimum1

path: string

minLength1

scope: string

why: string

waf_rules: object { broad, targeted }

broad: object { action, confidence, description, 4 more }

action: "block" or "managed_challenge" or "js_challenge" or "log"

One of the following:

"block"

"managed_challenge"

"js_challenge"

"log"

confidence: "low" or "medium" or "high"

One of the following:

"low"

"medium"

"high"

description: string

minLength1

expression: string

maxLength4096

minLength1

false_positive_risk: string

minLength1

name: string

maxLength25

minLength1

rationale: string

minLength1

targeted: object { action, confidence, description, 4 more }

action: "block" or "managed_challenge" or "js_challenge" or "log"

One of the following:

"block"

"managed_challenge"

"js_challenge"

"log"

confidence: "low" or "medium" or "high"

One of the following:

"low"

"medium"

"high"

description: string

minLength1

expression: string

maxLength4096

minLength1

false_positive_risk: string

minLength1

name: string

maxLength25

minLength1

rationale: string

minLength1

attacker_position: optional "external" or "authenticated" or "internal" or "post_compromise"

Least-privileged position required to trigger the finding. Optional on legacy report revisions.

One of the following:

"external"

"authenticated"

"internal"

"post_compromise"

external_links: optional array of object { title, url }

title: string

maxLength200

minLength1

url: string

formaturi

maxLength2048

open_question: optional string

One bounded unresolved proof question. Optional on legacy report revisions.

maxLength500

proof_method: optional "structural" or "experimental" or "acquired_source" or 2 more

Method used or needed to close the proof. Optional on legacy report revisions.

One of the following:

"structural"

"experimental"

"acquired_source"

"public_knowledge"

"team_question"

proof_state: optional "closed" or "pending_source" or "pending_public" or 2 more

Current proof lifecycle state. Optional on legacy report revisions.

One of the following:

"closed"

"pending_source"

"pending_public"

"pending_experiment"

"pending_team"

overall_severity: "critical" or "high" or "medium" or 2 more

One of the following:

"critical"

"high"

"medium"

"low"

"info"

repository_id: string

formatuuid

repository_name: string

minLength1

summary: string

maxLength4000

minLength1

traffic_context: object { http, target, waf, web_assets }

http: object { error_paths, hot_paths, request_volume }

error_paths: array of object { id, hits, host, 2 more }

id: string

minLength1

hits: number

minimum0

host: string

minLength1

path: string

minLength1

status: number

maximum599

minimum100

hot_paths: array of object { id, hits, host, 2 more }

id: string

minLength1

hits: number

minimum0

host: string

minLength1

path: string

minLength1

top_status: number

maximum599

minimum100

request_volume: number

minimum0

target: object { hosts, kind, telemetry_window }

hosts: array of string

kind: "worker" or "origin"

One of the following:

"worker"

"origin"

telemetry_window: optional object { end, start }

UTC ISO-8601 interval. Start is inclusive, end is exclusive, and the interval must be positive and at most seven days.

end: string

formatdate-time

start: string

formatdate-time

waf: object { hit_volume, rules }

hit_volume: number

minimum0

rules: array of object { id, hit_volume, paths, 2 more }

id: string

minLength1

hit_volume: number

minimum0

paths: array of object { id, hit_volume, host, path }

id: string

minLength1

hit_volume: number

minimum0

host: string

minLength1

path: string

minLength1

rule_id: string

minLength1

rule_version: number

minimum0

web_assets: object { operations, paths, risk_types }

operations: array of object { id, endpoint, host, 3 more }

id: string

minLength1

endpoint: string

minLength1

host: string

minLength1

method: string

minLength1

risk_labels: array of object { description, name }

description: string

name: string

minLength1

performance: optional object { avg_origin_latency_ms, error_rate, estimated_requests }

avg_origin_latency_ms: number

minimum0

error_rate: number

maximum1

minimum0

estimated_requests: number

minimum0

paths: array of object { id, avg_origin_latency_ms, error_rate, 3 more }

id: string

minLength1

avg_origin_latency_ms: number

minimum0

error_rate: number

maximum1

minimum0

estimated_requests: number

minimum0

host: string

minLength1

path: string

minLength1

risk_types: array of object { description, name, operation_count }

description: string

name: string

minLength1

operation_count: number

minimum0

external_links: optional array of object { title, url }

title: string

maxLength200

minLength1

url: string

formaturi

maxLength2048

limitations: optional array of string

schema_version: 2

title: string

maxLength200

minLength1

repositories: array of object { id, name, report_status, scan_status }

id: string

formatuuid

name: string

report_status: "not_ready" or "pending_review" or "published" or "withdrawn"

One of the following:

"not_ready"

"pending_review"

"published"

"withdrawn"

scan_status: "requested" or "accepted" or "running" or 4 more

One of the following:

"requested"

"accepted"

"running"

"completed"

"failed"

"rejected"

"cancelled"

scan_id: string

formatuuid

Vulnerability DiscoveryReports

Get reviewed vulnerability report

GET/accounts/{account_id}/managed-defense/vulnerability-discovery/repos/{repo_id}/scans/{scan_id}/report

ModelsExpand Collapse

ReportGetResponse object { publication, report, repository_id, scan_id }

publication: object { published_at, revision_id, version }

published_at: string

formatdate-time

revision_id: string

formatuuid

version: number

minimum1

report: object { findings, overall_severity, repository_id, 5 more }

findings: array of object { id, conditions, cwe, 17 more }

id: string

maxLength128

minLength1

conditions: array of string

cwe: string

minLength1

impact: string

maxLength4000

minLength1

location: object { file, line, route }

file: string

minLength1

line: number

minimum1

route: string

reachability: array of object { consumer, reachable, via }

consumer: string

minLength1

reachable: boolean

via: string

remediation: object { code_changes, strategy }

code_changes: string

strategy: string

minLength1

root_cause: string

maxLength4000

minLength1

severity: "critical" or "high" or "medium" or 2 more

One of the following:

"critical"

"high"

"medium"

"low"

"info"

severity_basis: string

minLength1

summary: string

maxLength4000

minLength1

telemetry: object { references, state }

references: array of string

state: "no_route" or "no_telemetry" or "no_match" or "matched"

One of the following:

"no_route"

"no_telemetry"

"no_match"

"matched"

title: string

maxLength200

minLength1

trace: array of object { line, path, scope, why }

line: number

minimum1

path: string

minLength1

scope: string

why: string

waf_rules: object { broad, targeted }

broad: object { action, confidence, description, 4 more }

action: "block" or "managed_challenge" or "js_challenge" or "log"

One of the following:

"block"

"managed_challenge"

"js_challenge"

"log"

confidence: "low" or "medium" or "high"

One of the following:

"low"

"medium"

"high"

description: string

minLength1

expression: string

maxLength4096

minLength1

false_positive_risk: string

minLength1

name: string

maxLength25

minLength1

rationale: string

minLength1

targeted: object { action, confidence, description, 4 more }

action: "block" or "managed_challenge" or "js_challenge" or "log"

One of the following:

"block"

"managed_challenge"

"js_challenge"

"log"

confidence: "low" or "medium" or "high"

One of the following:

"low"

"medium"

"high"

description: string

minLength1

expression: string

maxLength4096

minLength1

false_positive_risk: string

minLength1

name: string

maxLength25

minLength1

rationale: string

minLength1

attacker_position: optional "external" or "authenticated" or "internal" or "post_compromise"

Least-privileged position required to trigger the finding. Optional on legacy report revisions.

One of the following:

"external"

"authenticated"

"internal"

"post_compromise"

external_links: optional array of object { title, url }

title: string

maxLength200

minLength1

url: string

formaturi

maxLength2048

open_question: optional string

One bounded unresolved proof question. Optional on legacy report revisions.

maxLength500

proof_method: optional "structural" or "experimental" or "acquired_source" or 2 more

Method used or needed to close the proof. Optional on legacy report revisions.

One of the following:

"structural"

"experimental"

"acquired_source"

"public_knowledge"

"team_question"

proof_state: optional "closed" or "pending_source" or "pending_public" or 2 more

Current proof lifecycle state. Optional on legacy report revisions.

One of the following:

"closed"

"pending_source"

"pending_public"

"pending_experiment"

"pending_team"

overall_severity: "critical" or "high" or "medium" or 2 more

One of the following:

"critical"

"high"

"medium"

"low"

"info"

repository_id: string

formatuuid

repository_name: string

minLength1

summary: string

maxLength4000

minLength1

traffic_context: object { http, target, waf, web_assets }

http: object { error_paths, hot_paths, request_volume }

error_paths: array of object { id, hits, host, 2 more }

id: string

minLength1

hits: number

minimum0

host: string

minLength1

path: string

minLength1

status: number

maximum599

minimum100

hot_paths: array of object { id, hits, host, 2 more }

id: string

minLength1

hits: number

minimum0

host: string

minLength1

path: string

minLength1

top_status: number

maximum599

minimum100

request_volume: number

minimum0

target: object { hosts, kind, telemetry_window }

hosts: array of string

kind: "worker" or "origin"

One of the following:

"worker"

"origin"

telemetry_window: optional object { end, start }

UTC ISO-8601 interval. Start is inclusive, end is exclusive, and the interval must be positive and at most seven days.

end: string

formatdate-time

start: string

formatdate-time

waf: object { hit_volume, rules }

hit_volume: number

minimum0

rules: array of object { id, hit_volume, paths, 2 more }

id: string

minLength1

hit_volume: number

minimum0

paths: array of object { id, hit_volume, host, path }

id: string

minLength1

hit_volume: number

minimum0

host: string

minLength1

path: string

minLength1

rule_id: string

minLength1

rule_version: number

minimum0

web_assets: object { operations, paths, risk_types }

operations: array of object { id, endpoint, host, 3 more }

id: string

minLength1

endpoint: string

minLength1

host: string

minLength1

method: string

minLength1

risk_labels: array of object { description, name }

description: string

name: string

minLength1

performance: optional object { avg_origin_latency_ms, error_rate, estimated_requests }

avg_origin_latency_ms: number

minimum0

error_rate: number

maximum1

minimum0

estimated_requests: number

minimum0

paths: array of object { id, avg_origin_latency_ms, error_rate, 3 more }

id: string

minLength1

avg_origin_latency_ms: number

minimum0

error_rate: number

maximum1

minimum0

estimated_requests: number

minimum0

host: string

minLength1

path: string

minLength1

risk_types: array of object { description, name, operation_count }

description: string

name: string

minLength1

operation_count: number

minimum0

external_links: optional array of object { title, url }

title: string

maxLength200

minLength1

url: string

formaturi

maxLength2048

limitations: optional array of string

repository_id: string

formatuuid

scan_id: string

maxLength128

minLength1