Skip to content
Cloudflare API
Start here
API Reference
Intel

Indicator Feeds

Get indicator feeds owned by this account
client.intel.indicatorFeeds.list(IndicatorFeedListParams { account_id } params, RequestOptionsoptions?): SinglePage<IndicatorFeedListResponse { id, created_on, description, 5 more } >
GET/accounts/{account_id}/intel/indicator-feeds
Get indicator feed metadata
client.intel.indicatorFeeds.get(numberfeedID, IndicatorFeedGetParams { account_id } params, RequestOptionsoptions?): IndicatorFeedGetResponse { id, created_on, description, 10 more }
GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}
Create new indicator feed
client.intel.indicatorFeeds.create(IndicatorFeedCreateParams { account_id, description, name } params, RequestOptionsoptions?): IndicatorFeedCreateResponse { id, created_on, description, 5 more }
POST/accounts/{account_id}/intel/indicator-feeds
Update indicator feed metadata
client.intel.indicatorFeeds.update(numberfeedID, IndicatorFeedUpdateParams { account_id, description, is_attributable, 3 more } params, RequestOptionsoptions?): IndicatorFeedUpdateResponse { id, created_on, description, 5 more }
PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}
Get indicator feed data
client.intel.indicatorFeeds.data(numberfeedID, IndicatorFeedDataParams { account_id } params, RequestOptionsoptions?): IndicatorFeedDataResponse
GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}/data
ModelsExpand Collapse
IndicatorFeedListResponse { id, created_on, description, 5 more }
id?: number

The unique identifier for the indicator feed

created_on?: string

The date and time when the data entry was created

formatdate-time
description?: string

The description of the example test

is_attributable?: boolean

Whether the indicator feed can be attributed to a provider

is_downloadable?: boolean

Whether the indicator feed can be downloaded

is_public?: boolean

Whether the indicator feed is exposed to customers

modified_on?: string

The date and time when the data entry was last modified

formatdate-time
name?: string

The name of the indicator feed

IndicatorFeedGetResponse { id, created_on, description, 10 more }
id?: number

The unique identifier for the indicator feed

created_on?: string

The date and time when the data entry was created

formatdate-time
description?: string

The description of the example test

is_attributable?: boolean

Whether the indicator feed can be attributed to a provider

is_downloadable?: boolean

Whether the indicator feed can be downloaded

is_public?: boolean

Whether the indicator feed is exposed to customers

last_upload_summary?: LastUploadSummary { persisted, skipped, uploaded }

Summary of indicator counts from the last successful upload to this feed. Populated by the custom-threat-feeds loader at the end of each successful load. Absent (omitted) when no upload has completed successfully or the upload errored before the summary write. Surfaces silent-failure paths so operators can see when their indicators were dropped (popularity allowlist, expired valid_until, etc.) without reading loader logs.

persisted?: Persisted { domains_added, domains_removed, ips_added, 3 more }

Net delta applied to feed indicators by this upload. Snapshot uploads emit both *_added and *_removed; delta-add emits only *_added; delta-remove emits only *_removed.

domains_added?: number
domains_removed?: number
ips_added?: number
ips_removed?: number
urls_added?: number
urls_removed?: number
skipped?: Skipped { allowlisted_domains, expired_indicators, invalid_indicators }

Counts of indicators that were uploaded but did not reach QuickSilver, broken down by reason.

allowlisted_domains?: number

Domains filtered by the global popularity allowlist at QS provisioning time. Popular domains (bing.com, naver.com, etc.) are protected from custom-threat-feed enforcement.

expired_indicators?: number

Indicators in the upload whose valid_until is already in the past. These are not added to QS; the expiration cron handles cleanup.

invalid_indicators?: number

Reserved for future use. Currently always 0 — the unifier aborts the entire upload on a single bad indicator.

uploaded?: Uploaded { domains, ips, urls }

Indicator counts from the unified file the loader received

domains?: number

Number of domain indicators in the upload

ips?: number

Number of IP indicators in the upload

urls?: number

Number of URL indicators in the upload

latest_upload_error?: string

Human-readable error message describing why the latest upload failed. Populated only when latest_upload_status is Error. Returns one of a small fixed set of category-level messages (invalid domain / IP / URL entries, malformed row or header, invalid valid_until timestamp, etc.) or the generic Upload failed for unknown or infrastructure-level errors. Never echoes raw error text from the underlying loader. Intel accounts receive the verbatim loader/API error text (including specific offending values) instead of these category-level messages.

latest_upload_status?: "Mirroring" | "Unifying" | "Loading" | 3 more

Status of the latest snapshot uploaded

One of the following:
"Mirroring"
"Unifying"
"Loading"
"Provisioning"
"Complete"
"Error"
modified_on?: string

The date and time when the data entry was last modified

formatdate-time
name?: string

The name of the indicator feed

provider_id?: number

The unique identifier for the provider

provider_name?: string

The provider of the indicator feed

IndicatorFeedCreateResponse { id, created_on, description, 5 more }
id?: number

The unique identifier for the indicator feed

created_on?: string

The date and time when the data entry was created

formatdate-time
description?: string

The description of the example test

is_attributable?: boolean

Whether the indicator feed can be attributed to a provider

is_downloadable?: boolean

Whether the indicator feed can be downloaded

is_public?: boolean

Whether the indicator feed is exposed to customers

modified_on?: string

The date and time when the data entry was last modified

formatdate-time
name?: string

The name of the indicator feed

IndicatorFeedUpdateResponse { id, created_on, description, 5 more }
id?: number

The unique identifier for the indicator feed

created_on?: string

The date and time when the data entry was created

formatdate-time
description?: string

The description of the example test

is_attributable?: boolean

Whether the indicator feed can be attributed to a provider

is_downloadable?: boolean

Whether the indicator feed can be downloaded

is_public?: boolean

Whether the indicator feed is exposed to customers

modified_on?: string

The date and time when the data entry was last modified

formatdate-time
name?: string

The name of the indicator feed

IndicatorFeedDataResponse = string

Indicator FeedsSnapshots

Update indicator feed data
client.intel.indicatorFeeds.snapshots.update(numberfeedID, SnapshotUpdateParams { account_id, source, cfAsyncUpload } params, RequestOptionsoptions?): SnapshotUpdateResponse { file_id, filename, poll_url, 2 more }
PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}/snapshot
ModelsExpand Collapse
SnapshotUpdateResponse { file_id, filename, poll_url, 2 more }
file_id?: number

Feed id

filename?: string

Name of the file unified in our system

poll_url?: string

Account-relative polling path. Prepend /accounts/{account_id} using the same account identifier and API host as the upload request. The path omits the account segment because the service does not have your account identifier in this context.

status?: string

Current status of the upload at the moment the request returned. This is NOT a terminal state: the file is unified inline, but the durable loader has only accepted it, so the upload is still Unifying. Poll poll_url until the status reaches a terminal value (Unified or Error).

upload_id?: number

Identifier of the upload row, for polling this upload to a terminal state via poll_url.

formatint64

Indicator FeedsPermissions

List indicator feed permissions
client.intel.indicatorFeeds.permissions.list(PermissionListParams { account_id } params, RequestOptionsoptions?): PermissionListResponse { id, description, is_attributable, 3 more }
GET/accounts/{account_id}/intel/indicator-feeds/permissions/view
Grant permission to indicator feed
client.intel.indicatorFeeds.permissions.create(PermissionCreateParams { account_id, account_tag, feed_id } params, RequestOptionsoptions?): PermissionCreateResponse { success }
PUT/accounts/{account_id}/intel/indicator-feeds/permissions/add
Revoke permission to indicator feed
client.intel.indicatorFeeds.permissions.delete(PermissionDeleteParams { account_id, account_tag, feed_id } params, RequestOptionsoptions?): PermissionDeleteResponse { success }
PUT/accounts/{account_id}/intel/indicator-feeds/permissions/remove
ModelsExpand Collapse
PermissionListResponse = Array<PermissionListResponseItem>
id?: number

The unique identifier for the indicator feed

description?: string

The description of the example test

is_attributable?: boolean

Whether the indicator feed can be attributed to a provider

is_downloadable?: boolean

Whether the indicator feed can be downloaded

is_public?: boolean

Whether the indicator feed is exposed to customers

name?: string

The name of the indicator feed

PermissionCreateResponse { success }
success?: boolean

Whether the update succeeded or not

PermissionDeleteResponse { success }
success?: boolean

Whether the update succeeded or not

Indicator FeedsDownloads