Skip to content
Cloudflare API
Start here
API Reference
Cloudforce One
Threat Events
Tags

Updates a tag (SoT)

client.cloudforceOne.threatEvents.tags.edit(stringtagUUID, TagEditParams { account_id, activeDuration, actorCategory, 21 more } params, RequestOptionsoptions?): TagEditResponse { uuid, value, activeDuration, 34 more }
PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

Updates a Source-of-Truth tag by UUID.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
Accepted Permissions (at least one required)
Cloudforce One Write
ParametersExpand Collapse
tagUUID: string

Tag UUID.

params: TagEditParams { account_id, activeDuration, actorCategory, 21 more }
account_id: string

Path param: Account ID.

activeDuration?: string | UnionMember1 { value, confidence, tlp }

Body param

One of the following:
string
UnionMember1 { value, confidence, tlp }
value: string
confidence?: number
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
actorCategory?: string | UnionMember1 { value, confidence, tlp }

Body param

One of the following:
string
UnionMember1 { value, confidence, tlp }
value: string
confidence?: number
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
aliases?: Array<Alias>

Body param: Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more | null
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
aliasGroupNames?: Array<string>

Body param

aliasGroupNamesInternal?: Array<string>

Body param

attributionOrganization?: string | UnionMember1 { value, confidence, tlp }

Body param

One of the following:
string
UnionMember1 { value, confidence, tlp }
value: string
confidence?: number
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
categoryUuid?: string

Body param: Tag type (category) UUID. When changed, existing properties are re-validated against the new category’s schema (400 on mismatch). Set to null to unlink (typeless; properties stop being validated).

confidence?: number

Body param: Overall tag confidence (1-10). Omit to preserve existing.

maximum10
minimum1
dateOfDiscovery?: string

Body param: Date of discovery (ISO YYYY-MM-DD). Omit to preserve existing.

description?: string

Body param

externalReferences?: Array<ExternalReference>

Body param: Structured external references ({ url, description }). Public: returned to all accounts.

url: string
description?: string | null
internalAliases?: Array<InternalAlias>

Body param: Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more | null
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
internalDescription?: string

Body param

lastSeen?: string

Body param

motive?: string | UnionMember1 { value, confidence, tlp }

Body param

One of the following:
string
UnionMember1 { value, confidence, tlp }
value: string
confidence?: number
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
opsecLevel?: string | UnionMember1 { value, confidence, tlp }

Body param

One of the following:
string
UnionMember1 { value, confidence, tlp }
value: string
confidence?: number
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
originCountryISO?: string | UnionMember1 { value, confidence, tlp }

Body param

One of the following:
string
UnionMember1 { value, confidence, tlp }
value: string
confidence?: number
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
priority?: number | UnionMember1 { value, confidence, tlp }

Body param

One of the following:
number
UnionMember1 { value, confidence, tlp }
value: number
confidence?: number
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
properties?: Record<string, unknown>

Body param: Custom field values blob. When omitted, the existing value is preserved. When provided, performs a shallow per-key merge over the stored value (unmentioned keys are retained). Setting an individual key to null deletes that key. Validation runs against the merged result, so a partial update may omit a schema-required key if the stored value supplies it.

sophisticationLevel?: string | UnionMember1 { value, confidence, tlp }

Body param

One of the following:
string
UnionMember1 { value, confidence, tlp }
value: string
confidence?: number
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
tlp?: "red" | "amber" | "amber-strict" | 4 more

Body param: Tag-level TLP marking. Omit to preserve existing. Cannot be cleared to null.

One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
value?: string

Body param

ReturnsExpand Collapse
TagEditResponse { uuid, value, activeDuration, 34 more }
uuid: string
value: string
activeDuration?: string
activeDuration_annotated?: ActiveDurationAnnotated | null
value: string
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
actorCategory?: string
actorCategory_annotated?: ActorCategoryAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more | null
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
aliasGroupNames?: Array<string>
aliasGroupNamesInternal?: Array<string>
attributionOrganization?: string
attributionOrganization_annotated?: AttributionOrganizationAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
categoryName?: string
categoryUuid?: string
confidence?: number | null

Overall tag confidence (1-10).

maximum10
minimum1
createdAt?: string
dateOfDiscovery?: string
description?: string
externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string
description?: string | null
externalReferences_annotated?: Array<ExternalReferencesAnnotated> | null
value: string
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
internalAliases?: Array<InternalAlias>

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more | null
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
internalDescription?: string
lastSeen?: string
motive?: string
motive_annotated?: MotiveAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
opsecLevel?: string
opsecLevel_annotated?: OpsecLevelAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
originCountryISO?: string | null

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated?: OriginCountryISOAnnotated | null
value: string | null
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
priority?: number
priority_annotated?: PriorityAnnotated | null
value: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
properties?: Record<string, unknown> | null

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel?: string
sophisticationLevel_annotated?: SophisticationLevelAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
tlp?: "red" | "amber" | "amber-strict" | 4 more | null

Tag-level TLP handling marking.

One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
updatedAt?: string
version?: number

Updates a tag (SoT)

import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const response = await client.cloudforceOne.threatEvents.tags.edit('tag_uuid', {
  account_id: 'account_id',
});

console.log(response.uuid);
{
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "value": "APT28",
  "activeDuration": "activeDuration",
  "activeDuration_annotated": {
    "value": "value",
    "tlp": "red"
  },
  "actorCategory": "actorCategory",
  "actorCategory_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "aliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "aliasGroupNames": [
    "string"
  ],
  "aliasGroupNamesInternal": [
    "string"
  ],
  "attributionOrganization": "attributionOrganization",
  "attributionOrganization_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "categoryName": "Actor",
  "categoryUuid": "12345678-1234-1234-1234-1234567890ab",
  "confidence": 8,
  "createdAt": "createdAt",
  "dateOfDiscovery": "2024-01-15T00:00:00Z",
  "description": "description",
  "externalReferenceLinks": [
    "string"
  ],
  "externalReferences": [
    {
      "url": "https://example.com/report",
      "description": "Vendor threat report"
    }
  ],
  "externalReferences_annotated": [
    {
      "value": "value",
      "tlp": "red"
    }
  ],
  "internalAliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "internalDescription": "internalDescription",
  "lastSeen": "lastSeen",
  "motive": "motive",
  "motive_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "opsecLevel": "opsecLevel",
  "opsecLevel_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "originCountryISO": "originCountryISO",
  "originCountryISO_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "priority": 0,
  "priority_annotated": {
    "value": 0,
    "tlp": "red"
  },
  "properties": {
    "foo": "bar"
  },
  "sophisticationLevel": "sophisticationLevel",
  "sophisticationLevel_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "tlp": "amber",
  "updatedAt": "updatedAt",
  "version": 0
}
Returns Examples
{
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "value": "APT28",
  "activeDuration": "activeDuration",
  "activeDuration_annotated": {
    "value": "value",
    "tlp": "red"
  },
  "actorCategory": "actorCategory",
  "actorCategory_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "aliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "aliasGroupNames": [
    "string"
  ],
  "aliasGroupNamesInternal": [
    "string"
  ],
  "attributionOrganization": "attributionOrganization",
  "attributionOrganization_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "categoryName": "Actor",
  "categoryUuid": "12345678-1234-1234-1234-1234567890ab",
  "confidence": 8,
  "createdAt": "createdAt",
  "dateOfDiscovery": "2024-01-15T00:00:00Z",
  "description": "description",
  "externalReferenceLinks": [
    "string"
  ],
  "externalReferences": [
    {
      "url": "https://example.com/report",
      "description": "Vendor threat report"
    }
  ],
  "externalReferences_annotated": [
    {
      "value": "value",
      "tlp": "red"
    }
  ],
  "internalAliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "internalDescription": "internalDescription",
  "lastSeen": "lastSeen",
  "motive": "motive",
  "motive_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "opsecLevel": "opsecLevel",
  "opsecLevel_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "originCountryISO": "originCountryISO",
  "originCountryISO_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "priority": 0,
  "priority_annotated": {
    "value": 0,
    "tlp": "red"
  },
  "properties": {
    "foo": "bar"
  },
  "sophisticationLevel": "sophisticationLevel",
  "sophisticationLevel_annotated": {
    "value": "value",
    "confidence": 0,
    "tlp": "red"
  },
  "tlp": "amber",
  "updatedAt": "updatedAt",
  "version": 0
}