Cloudflare API | Intel › Indicator Feeds › Downloads › Download Indicator Feed Data

API Reference

Account & User Management

Resource Sharing

AI

Certificate Management

Certificate Authorities

Client Certificates

Custom Certificates

Custom Hostnames

Keyless Certificates

MTLS Certificates

Origin CA Certificates

Origin Post Quantum Encryption

Origin TLS Client Auth

Cloudflare One

DNS

Account Custom Nameservers

Domain/Zone Management

IP Addresses

Media

Networking

Magic Network Monitoring

Observability

Radar

Routing & Performance

Rules

Cloud Connector

Managed Transforms

URL Normalization

Security

Content Scanning

Leaked Credential Checks

Storage & Databases

Workers & Pages

Durable Objects

Workers For Platforms

Shared

Intel

intel

ASN

intel.asn

Methods

Get ASN Overview -> Envelope<

>

get/accounts/{account_id}/intel/asn/{asn}

Gets an overview of the Autonomous System Number (ASN) and a list of subnets for it.

Subnets

intel.asn.subnets

Methods

Get ASN Subnets -> { asn, count, ip_count_total, 3 more... }

get/accounts/{account_id}/intel/asn/{asn}/subnets

Get ASN Subnets

Attack Surface Report

intel.attack_surface_report

Intel Attack Surface Report

Issue Types

intel.attack_surface_report.issue_types

Methods

Get Security Center Issues Types -> Envelope<Array<string>>

get/accounts/{account_id}/intel/attack-surface-report/issue-types

Get Security Center Issues Types

Intel Attack Surface Report

Issues

intel.attack_surface_report.issues

Methods

Get Security Center Issue Counts By Class -> Envelope<Array<{ count, value }>>

get/accounts/{account_id}/intel/attack-surface-report/issues/class

Get Security Center Issue Counts by Class

Archive Security Center Insight -> { errors, messages, success }

put/accounts/{account_id}/intel/attack-surface-report/{issue_id}/dismiss

Archive Security Center Insight

Get Security Center Issues -> V4PagePagination<{ count, issues, page, 1 more... }>

get/accounts/{account_id}/intel/attack-surface-report/issues

Get Security Center Issues

Get Security Center Issue Counts By Severity -> Envelope<Array<{ count, value }>>

get/accounts/{account_id}/intel/attack-surface-report/issues/severity

Get Security Center Issue Counts by Severity

Get Security Center Issue Counts By Type -> Envelope<Array<{ count, value }>>

get/accounts/{account_id}/intel/attack-surface-report/issues/type

Get Security Center Issue Counts by Type

Domain types

IssueType = "compliance_violation" | "email_security" | "exposed_infrastructure" | 2 more...

SeverityQueryParam = "low" | "moderate" | "critical"

DNS

intel.dns

Methods

Get Passive DNS By IP -> V4PagePagination<

>

get/accounts/{account_id}/intel/dns

Gets a list of all the domains that have resolved to a specific IP address.

Domain types

DNS = { count, page, per_page, 1 more... }

Domain History

intel.domain_history

Methods

Get Domain History -> Envelope<Array<

>>

get/accounts/{account_id}/intel/domain-history

Gets historical security threat and content categories currently and previously assigned to a domain.

Domain types

DomainHistory = { categorizations, domain }

Domains

intel.domains

Methods

Get Domain Details -> Envelope<

>

get/accounts/{account_id}/intel/domain

Gets security details and statistics about a domain.

Domain types

Domain = { additional_information, application, content_categories, 8 more... }

Bulks

intel.domains.bulks

Methods

Get Multiple Domain Details -> Envelope<Array<{ additional_information, application, content_categories, 7 more... }>>

get/accounts/{account_id}/intel/domain/bulk

Same as summary

Indicator Feeds

intel.indicator_feeds

Methods

Create New Indicator Feed -> Envelope<{ id, created_on, description, 5 more... }>

post/accounts/{account_id}/intel/indicator-feeds

Create new indicator feed

Get Indicator Feed Data -> string

get/accounts/{account_id}/intel/indicator-feeds/{feed_id}/data

Get indicator feed data

Get Indicator Feed Metadata -> Envelope<{ id, created_on, description, 8 more... }>

get/accounts/{account_id}/intel/indicator-feeds/{feed_id}

Get indicator feed metadata

Get Indicator Feeds Owned By This Account -> SinglePage<{ id, created_on, description, 5 more... }>

get/accounts/{account_id}/intel/indicator-feeds

Get indicator feeds owned by this account

Update Indicator Feed Metadata -> Envelope<{ id, created_on, description, 5 more... }>

put/accounts/{account_id}/intel/indicator-feeds/{feed_id}

Update indicator feed metadata

Intel Indicator Feeds

Downloads

intel.indicator_feeds.downloads

Methods

Download Indicator Feed Data -> Envelope<{ file_id, filename, status }>

get/accounts/{account_id}/intel/indicator_feeds/{feed_id}/download

Download indicator feed data

Security

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example: X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example: X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

Parameters

account_id: string

Identifier

feed_id: number

Indicator feed ID

Response fields

errors: Array<

>

messages: Array<

>

success: true

Whether the API call was successful

result: { file_id, filename, status }

Optional

Request example

curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/intel/indicator_feeds/$FEED_ID/download \
    -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
    -H "X-Auth-Key: $CLOUDFLARE_API_KEY"

200Example

{
  "errors": [
    {
      "code": 1000,
      "message": "message"
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message"
    }
  ],
  "success": true,
  "result": {
    "file_id": 1,
    "filename": "snapshot_file.unified",
    "status": "unified"
  }
}

Intel Indicator Feeds

Permissions

intel.indicator_feeds.permissions

Methods

Grant Permission To Indicator Feed -> Envelope<{ success }>

put/accounts/{account_id}/intel/indicator-feeds/permissions/add

Grant permission to indicator feed

Revoke Permission To Indicator Feed -> Envelope<{ success }>

put/accounts/{account_id}/intel/indicator-feeds/permissions/remove

Revoke permission to indicator feed

List Indicator Feed Permissions -> Envelope<Array<{ id, description, is_attributable, 3 more... }>>

get/accounts/{account_id}/intel/indicator-feeds/permissions/view

List indicator feed permissions

Intel Indicator Feeds

Snapshots

intel.indicator_feeds.snapshots

Methods

Update Indicator Feed Data -> Envelope<{ file_id, filename, status }>

put/accounts/{account_id}/intel/indicator-feeds/{feed_id}/snapshot

Update indicator feed data

IP Lists

intel.ip_lists

Methods

Get IP Lists -> Envelope<Array<

>>

get/accounts/{account_id}/intel/ip-list

Get IP Lists

Domain types

IPList = { id, description, name }

IPs

intel.ips

Methods

Get IP Overview -> Envelope<Array<

>>

get/accounts/{account_id}/intel/ip

Gets the geolocation, ASN, infrastructure type of the ASN, and any security threat categories of an IP address.

Domain types

IP = { belongs_to_ref, ip, risk_types }

Miscategorizations

intel.miscategorizations

Methods

Create Miscategorization -> { errors, messages, success }

post/accounts/{account_id}/intel/miscategorization

Allows you to submit requests to change a domain’s category.

Sinkholes

intel.sinkholes

Methods

List Sinkholes Owned By This Account -> SinglePage<

>

get/accounts/{account_id}/intel/sinkholes

List sinkholes owned by this account

Domain types

Sinkhole = { id, account_tag, created_on, 4 more... }

Whois

intel.whois

Methods

Get Whois Record -> Envelope<{ domain, extension, found, 84 more... }>

get/accounts/{account_id}/intel/whois

Get WHOIS Record

Domain types

Whois = { created_date, domain, nameservers, 6 more... }