# Cloudforce One

# Scans

# Results

## Get the Latest Scan Result

`client.CloudforceOne.Scans.Results.Get(ctx, configID, query) (*ScanResultGetResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/scans/results/{config_id}`

Get the Latest Scan Result

### Parameters

- `configID string`

  Defines the Config ID.

- `query ScanResultGetParams`

  - `AccountID param.Field[string]`

    Defines the Account ID.

### Returns

- `type ScanResultGetResponse struct{…}`

  - `OneOneOneOne []ScanResult`

    - `Number float64`

    - `Proto string`

    - `Status string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  result, err := client.CloudforceOne.Scans.Results.Get(
    context.TODO(),
    "config_id",
    cloudforce_one.ScanResultGetParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", result.Number1.Number1.Number1.Number1)
}
```

#### Response

```json
{
  "errors": [
    "string"
  ],
  "messages": [
    "string"
  ],
  "result": {
    "1.1.1.1": [
      {
        "number": 8080,
        "proto": "tcp",
        "status": "open"
      }
    ]
  },
  "success": true
}
```

## Domain Types

### Scan Result

- `type ScanResult struct{…}`

  - `Number float64`

  - `Proto string`

  - `Status string`

# Config

## List Scan Configs

`client.CloudforceOne.Scans.Config.List(ctx, query) (*SinglePage[ScanConfigListResponse], error)`

**get** `/accounts/{account_id}/cloudforce-one/scans/config`

List Scan Configs

### Parameters

- `query ScanConfigListParams`

  - `AccountID param.Field[string]`

    Defines the Account ID.

### Returns

- `type ScanConfigListResponse struct{…}`

  - `ID string`

    Defines the Config ID.

  - `AccountID string`

  - `Frequency float64`

    Defines the number of days between each scan (0 = One-off scan).

  - `IPs []string`

    Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

  - `Ports []string`

    Defines a list of ports to scan. Valid values are:"default", "all", or a comma-separated list of ports or range of ports (e.g. ["1-80", "443"]). "default" scans the 100 most commonly open ports.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  page, err := client.CloudforceOne.Scans.Config.List(context.TODO(), cloudforce_one.ScanConfigListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "uuid",
      "account_id": "abcd1234abcd1234abcd1234abcd1234",
      "frequency": 7,
      "ips": [
        "1.1.1.1",
        "2606:4700:4700::1111"
      ],
      "ports": [
        "default"
      ]
    }
  ]
}
```

## Create a new Scan Config

`client.CloudforceOne.Scans.Config.New(ctx, params) (*ScanConfigNewResponse, error)`

**post** `/accounts/{account_id}/cloudforce-one/scans/config`

Create a new Scan Config

### Parameters

- `params ScanConfigNewParams`

  - `AccountID param.Field[string]`

    Path param: Defines the Account ID.

  - `IPs param.Field[[]string]`

    Body param: Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

  - `Frequency param.Field[float64]`

    Body param: Defines the number of days between each scan (0 = One-off scan).

  - `Ports param.Field[[]string]`

    Body param: Defines a list of ports to scan. Valid values are:"default", "all", or a comma-separated list of ports or range of ports (e.g. ["1-80", "443"]). "default" scans the 100 most commonly open ports.

### Returns

- `type ScanConfigNewResponse struct{…}`

  - `ID string`

    Defines the Config ID.

  - `AccountID string`

  - `Frequency float64`

    Defines the number of days between each scan (0 = One-off scan).

  - `IPs []string`

    Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

  - `Ports []string`

    Defines a list of ports to scan. Valid values are:"default", "all", or a comma-separated list of ports or range of ports (e.g. ["1-80", "443"]). "default" scans the 100 most commonly open ports.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  config, err := client.CloudforceOne.Scans.Config.New(context.TODO(), cloudforce_one.ScanConfigNewParams{
    AccountID: cloudflare.F("account_id"),
    IPs: cloudflare.F([]string{"1.1.1.1", "2606:4700:4700::1111"}),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", config.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "uuid",
    "account_id": "abcd1234abcd1234abcd1234abcd1234",
    "frequency": 7,
    "ips": [
      "1.1.1.1",
      "2606:4700:4700::1111"
    ],
    "ports": [
      "default"
    ]
  }
}
```

## Update an existing Scan Config

`client.CloudforceOne.Scans.Config.Edit(ctx, configID, params) (*ScanConfigEditResponse, error)`

**patch** `/accounts/{account_id}/cloudforce-one/scans/config/{config_id}`

Update an existing Scan Config

### Parameters

- `configID string`

  Defines the Config ID.

- `params ScanConfigEditParams`

  - `AccountID param.Field[string]`

    Path param: Defines the Account ID.

  - `Frequency param.Field[float64]`

    Body param: Defines the number of days between each scan (0 = One-off scan).

  - `IPs param.Field[[]string]`

    Body param: Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

  - `Ports param.Field[[]string]`

    Body param: Defines a list of ports to scan. Valid values are:"default", "all", or a comma-separated list of ports or range of ports (e.g. ["1-80", "443"]). "default" scans the 100 most commonly open ports.

### Returns

- `type ScanConfigEditResponse struct{…}`

  - `ID string`

    Defines the Config ID.

  - `AccountID string`

  - `Frequency float64`

    Defines the number of days between each scan (0 = One-off scan).

  - `IPs []string`

    Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

  - `Ports []string`

    Defines a list of ports to scan. Valid values are:"default", "all", or a comma-separated list of ports or range of ports (e.g. ["1-80", "443"]). "default" scans the 100 most commonly open ports.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.CloudforceOne.Scans.Config.Edit(
    context.TODO(),
    "config_id",
    cloudforce_one.ScanConfigEditParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "uuid",
    "account_id": "abcd1234abcd1234abcd1234abcd1234",
    "frequency": 7,
    "ips": [
      "1.1.1.1",
      "2606:4700:4700::1111"
    ],
    "ports": [
      "default"
    ]
  }
}
```

## Delete a Scan Config

`client.CloudforceOne.Scans.Config.Delete(ctx, configID, body) (*ScanConfigDeleteResponse, error)`

**delete** `/accounts/{account_id}/cloudforce-one/scans/config/{config_id}`

Delete a Scan Config

### Parameters

- `configID string`

  Defines the Config ID.

- `body ScanConfigDeleteParams`

  - `AccountID param.Field[string]`

    Defines the Account ID.

### Returns

- `type ScanConfigDeleteResponse interface{…}`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  config, err := client.CloudforceOne.Scans.Config.Delete(
    context.TODO(),
    "config_id",
    cloudforce_one.ScanConfigDeleteParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", config)
}
```

#### Response

```json
{
  "errors": [
    "string"
  ],
  "messages": [
    "string"
  ],
  "result": {},
  "success": true
}
```

# Binary Storage

## Retrieves a file from Binary Storage

`client.CloudforceOne.BinaryStorage.Get(ctx, hash, query) error`

**get** `/accounts/{account_id}/cloudforce-one/binary/{hash}`

Retrieves a binary file from the Cloudforce One binary storage for analysis.

### Parameters

- `hash string`

  hash of the binary

- `query BinaryStorageGetParams`

  - `AccountID param.Field[string]`

    Account ID.

### Example

```go
package main

import (
  "context"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  err := client.CloudforceOne.BinaryStorage.Get(
    context.TODO(),
    "hash",
    cloudforce_one.BinaryStorageGetParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
}
```

## Posts a file to Binary Storage

`client.CloudforceOne.BinaryStorage.New(ctx, params) (*BinaryStorageNewResponse, error)`

**post** `/accounts/{account_id}/cloudforce-one/binary`

Uploads a binary file to Cloudforce One's binary database for malware analysis and threat intelligence correlation.

### Parameters

- `params BinaryStorageNewParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `File param.Field[Reader]`

    Body param: The binary file content to upload.

### Returns

- `type BinaryStorageNewResponse struct{…}`

  - `ContentType string`

  - `Md5 string`

  - `Sha1 string`

  - `Sha256 string`

### Example

```go
package main

import (
  "bytes"
  "context"
  "fmt"
  "io"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  binaryStorage, err := client.CloudforceOne.BinaryStorage.New(context.TODO(), cloudforce_one.BinaryStorageNewParams{
    AccountID: cloudflare.F("account_id"),
    File: cloudflare.F(io.Reader(bytes.NewBuffer([]byte("Example data")))),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", binaryStorage.ContentType)
}
```

#### Response

```json
{
  "content_type": "text/plain",
  "md5": "5d84ade76d2a8387c81175bb0cbe6492",
  "sha1": "9aff6879626d957eafadda044e4f879aae1e7278",
  "sha256": "0000a7f2692ef479e2e3d02661568882cadec451cc8a64d4e7faca29810cd626"
}
```

# Requests

## List Requests

`client.CloudforceOne.Requests.List(ctx, params) (*SinglePage[ListItem], error)`

**post** `/accounts/{account_id}/cloudforce-one/requests`

Lists Cloudforce One intelligence requests with filtering and pagination.

### Parameters

- `params RequestListParams`

  - `AccountID param.Field[string]`

    Path param: Identifier.

  - `Page param.Field[int64]`

    Body param: Page number of results.

  - `PerPage param.Field[int64]`

    Body param: Number of results per page.

  - `CompletedAfter param.Field[Time]`

    Body param: Retrieve requests completed after this time.

  - `CompletedBefore param.Field[Time]`

    Body param: Retrieve requests completed before this time.

  - `CreatedAfter param.Field[Time]`

    Body param: Retrieve requests created after this time.

  - `CreatedBefore param.Field[Time]`

    Body param: Retrieve requests created before this time.

  - `RequestType param.Field[string]`

    Body param: Requested information from request.

  - `SortBy param.Field[string]`

    Body param: Field to sort results by.

  - `SortOrder param.Field[RequestListParamsSortOrder]`

    Body param: Sort order (asc or desc).

    - `const RequestListParamsSortOrderAsc RequestListParamsSortOrder = "asc"`

    - `const RequestListParamsSortOrderDesc RequestListParamsSortOrder = "desc"`

  - `Status param.Field[RequestListParamsStatus]`

    Body param: Request Status.

    - `const RequestListParamsStatusOpen RequestListParamsStatus = "open"`

    - `const RequestListParamsStatusAccepted RequestListParamsStatus = "accepted"`

    - `const RequestListParamsStatusReported RequestListParamsStatus = "reported"`

    - `const RequestListParamsStatusApproved RequestListParamsStatus = "approved"`

    - `const RequestListParamsStatusCompleted RequestListParamsStatus = "completed"`

    - `const RequestListParamsStatusDeclined RequestListParamsStatus = "declined"`

### Returns

- `type ListItem struct{…}`

  - `ID string`

    UUID.

  - `Created Time`

    Request creation time.

  - `Priority ListItemPriority`

    - `const ListItemPriorityRoutine ListItemPriority = "routine"`

    - `const ListItemPriorityHigh ListItemPriority = "high"`

    - `const ListItemPriorityUrgent ListItemPriority = "urgent"`

  - `Request string`

    Requested information from request.

  - `Summary string`

    Brief description of the request.

  - `TLP ListItemTLP`

    The CISA defined Traffic Light Protocol (TLP).

    - `const ListItemTLPClear ListItemTLP = "clear"`

    - `const ListItemTLPAmber ListItemTLP = "amber"`

    - `const ListItemTLPAmberStrict ListItemTLP = "amber-strict"`

    - `const ListItemTLPGreen ListItemTLP = "green"`

    - `const ListItemTLPRed ListItemTLP = "red"`

  - `Updated Time`

    Request last updated time.

  - `Completed Time`

    Request completion time.

  - `MessageTokens int64`

    Tokens for the request messages.

  - `ReadableID string`

    Readable Request ID.

  - `Status ListItemStatus`

    Request Status.

    - `const ListItemStatusOpen ListItemStatus = "open"`

    - `const ListItemStatusAccepted ListItemStatus = "accepted"`

    - `const ListItemStatusReported ListItemStatus = "reported"`

    - `const ListItemStatusApproved ListItemStatus = "approved"`

    - `const ListItemStatusCompleted ListItemStatus = "completed"`

    - `const ListItemStatusDeclined ListItemStatus = "declined"`

  - `Tokens int64`

    Tokens for the request.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  page, err := client.CloudforceOne.Requests.List(context.TODO(), cloudforce_one.RequestListParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    Page: cloudflare.F(int64(0)),
    PerPage: cloudflare.F(int64(10)),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
      "created": "2022-04-01T00:00:00Z",
      "priority": "routine",
      "request": "Victomology",
      "summary": "DoS attack",
      "tlp": "clear",
      "updated": "2022-04-01T00:00:00Z",
      "completed": "2024-01-01T00:00:00Z",
      "message_tokens": 16,
      "readable_id": "RFI-2022-000001",
      "status": "open",
      "tokens": 0
    }
  ]
}
```

## Get a Request

`client.CloudforceOne.Requests.Get(ctx, requestID, query) (*Item, error)`

**get** `/accounts/{account_id}/cloudforce-one/requests/{request_id}`

Retrieves details for a specific Cloudforce One intelligence request.

### Parameters

- `requestID string`

  UUID.

- `query RequestGetParams`

  - `AccountID param.Field[string]`

    Identifier.

### Returns

- `type Item struct{…}`

  - `ID string`

    UUID.

  - `Content string`

    Request content.

  - `Created Time`

  - `Priority Time`

  - `Request string`

    Requested information from request.

  - `Summary string`

    Brief description of the request.

  - `TLP ItemTLP`

    The CISA defined Traffic Light Protocol (TLP).

    - `const ItemTLPClear ItemTLP = "clear"`

    - `const ItemTLPAmber ItemTLP = "amber"`

    - `const ItemTLPAmberStrict ItemTLP = "amber-strict"`

    - `const ItemTLPGreen ItemTLP = "green"`

    - `const ItemTLPRed ItemTLP = "red"`

  - `Updated Time`

  - `Completed Time`

  - `MessageTokens int64`

    Tokens for the request messages.

  - `ReadableID string`

    Readable Request ID.

  - `Status ItemStatus`

    Request Status.

    - `const ItemStatusOpen ItemStatus = "open"`

    - `const ItemStatusAccepted ItemStatus = "accepted"`

    - `const ItemStatusReported ItemStatus = "reported"`

    - `const ItemStatusApproved ItemStatus = "approved"`

    - `const ItemStatusCompleted ItemStatus = "completed"`

    - `const ItemStatusDeclined ItemStatus = "declined"`

  - `Tokens int64`

    Tokens for the request.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  item, err := client.CloudforceOne.Requests.Get(
    context.TODO(),
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    cloudforce_one.RequestGetParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", item.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "content": "What regions were most effected by the recent DoS?",
    "created": "2022-04-01T05:20:00Z",
    "priority": "2022-04-01T05:20:00Z",
    "request": "Victomology",
    "summary": "DoS attack",
    "tlp": "clear",
    "updated": "2022-04-01T05:20:00Z",
    "completed": "2022-04-01T05:20:00Z",
    "message_tokens": 1,
    "readable_id": "RFI-2022-000001",
    "status": "open",
    "tokens": 16
  }
}
```

## Create a New Request.

`client.CloudforceOne.Requests.New(ctx, params) (*Item, error)`

**post** `/accounts/{account_id}/cloudforce-one/requests/new`

Creating a request adds the request into the Cloudforce One queue for analysis. In addition to the content, a short title, type, priority, and releasability should be provided. If one is not provided, a default will be assigned.

### Parameters

- `params RequestNewParams`

  - `AccountID param.Field[string]`

    Path param: Identifier.

  - `Content param.Field[string]`

    Body param: Request content.

  - `Priority param.Field[string]`

    Body param: Priority for analyzing the request.

  - `RequestType param.Field[string]`

    Body param: Requested information from request.

  - `Summary param.Field[string]`

    Body param: Brief description of the request.

  - `TLP param.Field[RequestNewParamsTLP]`

    Body param: The CISA defined Traffic Light Protocol (TLP).

    - `const RequestNewParamsTLPClear RequestNewParamsTLP = "clear"`

    - `const RequestNewParamsTLPAmber RequestNewParamsTLP = "amber"`

    - `const RequestNewParamsTLPAmberStrict RequestNewParamsTLP = "amber-strict"`

    - `const RequestNewParamsTLPGreen RequestNewParamsTLP = "green"`

    - `const RequestNewParamsTLPRed RequestNewParamsTLP = "red"`

### Returns

- `type Item struct{…}`

  - `ID string`

    UUID.

  - `Content string`

    Request content.

  - `Created Time`

  - `Priority Time`

  - `Request string`

    Requested information from request.

  - `Summary string`

    Brief description of the request.

  - `TLP ItemTLP`

    The CISA defined Traffic Light Protocol (TLP).

    - `const ItemTLPClear ItemTLP = "clear"`

    - `const ItemTLPAmber ItemTLP = "amber"`

    - `const ItemTLPAmberStrict ItemTLP = "amber-strict"`

    - `const ItemTLPGreen ItemTLP = "green"`

    - `const ItemTLPRed ItemTLP = "red"`

  - `Updated Time`

  - `Completed Time`

  - `MessageTokens int64`

    Tokens for the request messages.

  - `ReadableID string`

    Readable Request ID.

  - `Status ItemStatus`

    Request Status.

    - `const ItemStatusOpen ItemStatus = "open"`

    - `const ItemStatusAccepted ItemStatus = "accepted"`

    - `const ItemStatusReported ItemStatus = "reported"`

    - `const ItemStatusApproved ItemStatus = "approved"`

    - `const ItemStatusCompleted ItemStatus = "completed"`

    - `const ItemStatusDeclined ItemStatus = "declined"`

  - `Tokens int64`

    Tokens for the request.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  item, err := client.CloudforceOne.Requests.New(context.TODO(), cloudforce_one.RequestNewParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", item.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "content": "What regions were most effected by the recent DoS?",
    "created": "2022-04-01T05:20:00Z",
    "priority": "2022-04-01T05:20:00Z",
    "request": "Victomology",
    "summary": "DoS attack",
    "tlp": "clear",
    "updated": "2022-04-01T05:20:00Z",
    "completed": "2022-04-01T05:20:00Z",
    "message_tokens": 1,
    "readable_id": "RFI-2022-000001",
    "status": "open",
    "tokens": 16
  }
}
```

## Update a Request

`client.CloudforceOne.Requests.Update(ctx, requestID, params) (*Item, error)`

**put** `/accounts/{account_id}/cloudforce-one/requests/{request_id}`

Updating a request alters the request in the Cloudforce One queue. This API may be used to update any attributes of the request after the initial submission. Only fields that you choose to update need to be add to the request body.

### Parameters

- `requestID string`

  UUID.

- `params RequestUpdateParams`

  - `AccountID param.Field[string]`

    Path param: Identifier.

  - `Content param.Field[string]`

    Body param: Request content.

  - `Priority param.Field[string]`

    Body param: Priority for analyzing the request.

  - `RequestType param.Field[string]`

    Body param: Requested information from request.

  - `Summary param.Field[string]`

    Body param: Brief description of the request.

  - `TLP param.Field[RequestUpdateParamsTLP]`

    Body param: The CISA defined Traffic Light Protocol (TLP).

    - `const RequestUpdateParamsTLPClear RequestUpdateParamsTLP = "clear"`

    - `const RequestUpdateParamsTLPAmber RequestUpdateParamsTLP = "amber"`

    - `const RequestUpdateParamsTLPAmberStrict RequestUpdateParamsTLP = "amber-strict"`

    - `const RequestUpdateParamsTLPGreen RequestUpdateParamsTLP = "green"`

    - `const RequestUpdateParamsTLPRed RequestUpdateParamsTLP = "red"`

### Returns

- `type Item struct{…}`

  - `ID string`

    UUID.

  - `Content string`

    Request content.

  - `Created Time`

  - `Priority Time`

  - `Request string`

    Requested information from request.

  - `Summary string`

    Brief description of the request.

  - `TLP ItemTLP`

    The CISA defined Traffic Light Protocol (TLP).

    - `const ItemTLPClear ItemTLP = "clear"`

    - `const ItemTLPAmber ItemTLP = "amber"`

    - `const ItemTLPAmberStrict ItemTLP = "amber-strict"`

    - `const ItemTLPGreen ItemTLP = "green"`

    - `const ItemTLPRed ItemTLP = "red"`

  - `Updated Time`

  - `Completed Time`

  - `MessageTokens int64`

    Tokens for the request messages.

  - `ReadableID string`

    Readable Request ID.

  - `Status ItemStatus`

    Request Status.

    - `const ItemStatusOpen ItemStatus = "open"`

    - `const ItemStatusAccepted ItemStatus = "accepted"`

    - `const ItemStatusReported ItemStatus = "reported"`

    - `const ItemStatusApproved ItemStatus = "approved"`

    - `const ItemStatusCompleted ItemStatus = "completed"`

    - `const ItemStatusDeclined ItemStatus = "declined"`

  - `Tokens int64`

    Tokens for the request.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  item, err := client.CloudforceOne.Requests.Update(
    context.TODO(),
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    cloudforce_one.RequestUpdateParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", item.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "content": "What regions were most effected by the recent DoS?",
    "created": "2022-04-01T05:20:00Z",
    "priority": "2022-04-01T05:20:00Z",
    "request": "Victomology",
    "summary": "DoS attack",
    "tlp": "clear",
    "updated": "2022-04-01T05:20:00Z",
    "completed": "2022-04-01T05:20:00Z",
    "message_tokens": 1,
    "readable_id": "RFI-2022-000001",
    "status": "open",
    "tokens": 16
  }
}
```

## Delete a Request

`client.CloudforceOne.Requests.Delete(ctx, requestID, body) (*RequestDeleteResponse, error)`

**delete** `/accounts/{account_id}/cloudforce-one/requests/{request_id}`

Deletes a Cloudforce One intelligence request and all associated data.

### Parameters

- `requestID string`

  UUID.

- `body RequestDeleteParams`

  - `AccountID param.Field[string]`

    Identifier.

### Returns

- `type RequestDeleteResponse struct{…}`

  - `Errors []RequestDeleteResponseError`

    - `Code int64`

    - `Message string`

    - `DocumentationURL string`

    - `Source RequestDeleteResponseErrorsSource`

      - `Pointer string`

  - `Messages []RequestDeleteResponseMessage`

    - `Code int64`

    - `Message string`

    - `DocumentationURL string`

    - `Source RequestDeleteResponseMessagesSource`

      - `Pointer string`

  - `Success RequestDeleteResponseSuccess`

    Whether the API call was successful.

    - `const RequestDeleteResponseSuccessTrue RequestDeleteResponseSuccess = true`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  request, err := client.CloudforceOne.Requests.Delete(
    context.TODO(),
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    cloudforce_one.RequestDeleteParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", request.Errors)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true
}
```

## Get Request Quota

`client.CloudforceOne.Requests.Quota(ctx, query) (*Quota, error)`

**get** `/accounts/{account_id}/cloudforce-one/requests/quota`

Retrieves quota usage for Cloudforce One standard requests.

### Parameters

- `query RequestQuotaParams`

  - `AccountID param.Field[string]`

    Identifier.

### Returns

- `type Quota struct{…}`

  - `AnniversaryDate Time`

    Anniversary date is when annual quota limit is refreshed.

  - `QuarterAnniversaryDate Time`

    Quarter anniversary date is when quota limit is refreshed each quarter.

  - `Quota int64`

    Tokens for the quarter.

  - `Remaining int64`

    Tokens remaining for the quarter.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  quota, err := client.CloudforceOne.Requests.Quota(context.TODO(), cloudforce_one.RequestQuotaParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", quota.AnniversaryDate)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "anniversary_date": "2022-04-01T00:00:00Z",
    "quarter_anniversary_date": "2022-04-01T00:00:00Z",
    "quota": 120,
    "remaining": 64
  }
}
```

## Get Request Types

`client.CloudforceOne.Requests.Types(ctx, query) (*SinglePage[string], error)`

**get** `/accounts/{account_id}/cloudforce-one/requests/types`

Lists available request types for Cloudforce One intelligence requests.

### Parameters

- `query RequestTypesParams`

  - `AccountID param.Field[string]`

    Identifier.

### Returns

- `type RequestTypesItem string`

  Request Types.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  page, err := client.CloudforceOne.Requests.Types(context.TODO(), cloudforce_one.RequestTypesParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    "Indicators of Compromise",
    "Victomology"
  ]
}
```

## Get Request Priority, Status, and TLP constants

`client.CloudforceOne.Requests.Constants(ctx, query) (*RequestConstants, error)`

**get** `/accounts/{account_id}/cloudforce-one/requests/constants`

Retrieves constant values used in Cloudforce One requests, including valid statuses and types.

### Parameters

- `query RequestConstantsParams`

  - `AccountID param.Field[string]`

    Identifier.

### Returns

- `type RequestConstants struct{…}`

  - `Priority []RequestConstantsPriority`

    - `const RequestConstantsPriorityRoutine RequestConstantsPriority = "routine"`

    - `const RequestConstantsPriorityHigh RequestConstantsPriority = "high"`

    - `const RequestConstantsPriorityUrgent RequestConstantsPriority = "urgent"`

  - `Status []RequestConstantsStatus`

    - `const RequestConstantsStatusOpen RequestConstantsStatus = "open"`

    - `const RequestConstantsStatusAccepted RequestConstantsStatus = "accepted"`

    - `const RequestConstantsStatusReported RequestConstantsStatus = "reported"`

    - `const RequestConstantsStatusApproved RequestConstantsStatus = "approved"`

    - `const RequestConstantsStatusCompleted RequestConstantsStatus = "completed"`

    - `const RequestConstantsStatusDeclined RequestConstantsStatus = "declined"`

  - `TLP []RequestConstantsTLP`

    - `const RequestConstantsTLPClear RequestConstantsTLP = "clear"`

    - `const RequestConstantsTLPAmber RequestConstantsTLP = "amber"`

    - `const RequestConstantsTLPAmberStrict RequestConstantsTLP = "amber-strict"`

    - `const RequestConstantsTLPGreen RequestConstantsTLP = "green"`

    - `const RequestConstantsTLPRed RequestConstantsTLP = "red"`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  requestConstants, err := client.CloudforceOne.Requests.Constants(context.TODO(), cloudforce_one.RequestConstantsParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", requestConstants.Priority)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "priority": [
      "routine",
      "high",
      "urgent"
    ],
    "status": [
      "open",
      "accepted",
      "reported",
      "approved",
      "completed",
      "declined"
    ],
    "tlp": [
      "clear",
      "green",
      "amber",
      "amber-strict",
      "red"
    ]
  }
}
```

## Domain Types

### Item

- `type Item struct{…}`

  - `ID string`

    UUID.

  - `Content string`

    Request content.

  - `Created Time`

  - `Priority Time`

  - `Request string`

    Requested information from request.

  - `Summary string`

    Brief description of the request.

  - `TLP ItemTLP`

    The CISA defined Traffic Light Protocol (TLP).

    - `const ItemTLPClear ItemTLP = "clear"`

    - `const ItemTLPAmber ItemTLP = "amber"`

    - `const ItemTLPAmberStrict ItemTLP = "amber-strict"`

    - `const ItemTLPGreen ItemTLP = "green"`

    - `const ItemTLPRed ItemTLP = "red"`

  - `Updated Time`

  - `Completed Time`

  - `MessageTokens int64`

    Tokens for the request messages.

  - `ReadableID string`

    Readable Request ID.

  - `Status ItemStatus`

    Request Status.

    - `const ItemStatusOpen ItemStatus = "open"`

    - `const ItemStatusAccepted ItemStatus = "accepted"`

    - `const ItemStatusReported ItemStatus = "reported"`

    - `const ItemStatusApproved ItemStatus = "approved"`

    - `const ItemStatusCompleted ItemStatus = "completed"`

    - `const ItemStatusDeclined ItemStatus = "declined"`

  - `Tokens int64`

    Tokens for the request.

### List Item

- `type ListItem struct{…}`

  - `ID string`

    UUID.

  - `Created Time`

    Request creation time.

  - `Priority ListItemPriority`

    - `const ListItemPriorityRoutine ListItemPriority = "routine"`

    - `const ListItemPriorityHigh ListItemPriority = "high"`

    - `const ListItemPriorityUrgent ListItemPriority = "urgent"`

  - `Request string`

    Requested information from request.

  - `Summary string`

    Brief description of the request.

  - `TLP ListItemTLP`

    The CISA defined Traffic Light Protocol (TLP).

    - `const ListItemTLPClear ListItemTLP = "clear"`

    - `const ListItemTLPAmber ListItemTLP = "amber"`

    - `const ListItemTLPAmberStrict ListItemTLP = "amber-strict"`

    - `const ListItemTLPGreen ListItemTLP = "green"`

    - `const ListItemTLPRed ListItemTLP = "red"`

  - `Updated Time`

    Request last updated time.

  - `Completed Time`

    Request completion time.

  - `MessageTokens int64`

    Tokens for the request messages.

  - `ReadableID string`

    Readable Request ID.

  - `Status ListItemStatus`

    Request Status.

    - `const ListItemStatusOpen ListItemStatus = "open"`

    - `const ListItemStatusAccepted ListItemStatus = "accepted"`

    - `const ListItemStatusReported ListItemStatus = "reported"`

    - `const ListItemStatusApproved ListItemStatus = "approved"`

    - `const ListItemStatusCompleted ListItemStatus = "completed"`

    - `const ListItemStatusDeclined ListItemStatus = "declined"`

  - `Tokens int64`

    Tokens for the request.

### Quota

- `type Quota struct{…}`

  - `AnniversaryDate Time`

    Anniversary date is when annual quota limit is refreshed.

  - `QuarterAnniversaryDate Time`

    Quarter anniversary date is when quota limit is refreshed each quarter.

  - `Quota int64`

    Tokens for the quarter.

  - `Remaining int64`

    Tokens remaining for the quarter.

### Request Constants

- `type RequestConstants struct{…}`

  - `Priority []RequestConstantsPriority`

    - `const RequestConstantsPriorityRoutine RequestConstantsPriority = "routine"`

    - `const RequestConstantsPriorityHigh RequestConstantsPriority = "high"`

    - `const RequestConstantsPriorityUrgent RequestConstantsPriority = "urgent"`

  - `Status []RequestConstantsStatus`

    - `const RequestConstantsStatusOpen RequestConstantsStatus = "open"`

    - `const RequestConstantsStatusAccepted RequestConstantsStatus = "accepted"`

    - `const RequestConstantsStatusReported RequestConstantsStatus = "reported"`

    - `const RequestConstantsStatusApproved RequestConstantsStatus = "approved"`

    - `const RequestConstantsStatusCompleted RequestConstantsStatus = "completed"`

    - `const RequestConstantsStatusDeclined RequestConstantsStatus = "declined"`

  - `TLP []RequestConstantsTLP`

    - `const RequestConstantsTLPClear RequestConstantsTLP = "clear"`

    - `const RequestConstantsTLPAmber RequestConstantsTLP = "amber"`

    - `const RequestConstantsTLPAmberStrict RequestConstantsTLP = "amber-strict"`

    - `const RequestConstantsTLPGreen RequestConstantsTLP = "green"`

    - `const RequestConstantsTLPRed RequestConstantsTLP = "red"`

### Request Types

- `type RequestTypes []string`

# Message

## List Request Messages

`client.CloudforceOne.Requests.Message.Get(ctx, requestID, params) (*SinglePage[Message], error)`

**post** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/message`

Lists messages in a Cloudforce One intelligence request conversation.

### Parameters

- `requestID string`

  UUID.

- `params RequestMessageGetParams`

  - `AccountID param.Field[string]`

    Path param: Identifier.

  - `Page param.Field[int64]`

    Body param: Page number of results.

  - `PerPage param.Field[int64]`

    Body param: Number of results per page.

  - `After param.Field[Time]`

    Body param: Retrieve mes  ges created after this time.

  - `Before param.Field[Time]`

    Body param: Retrieve messages created before this time.

  - `SortBy param.Field[string]`

    Body param: Field to sort results by.

  - `SortOrder param.Field[RequestMessageGetParamsSortOrder]`

    Body param: Sort order (asc or desc).

    - `const RequestMessageGetParamsSortOrderAsc RequestMessageGetParamsSortOrder = "asc"`

    - `const RequestMessageGetParamsSortOrderDesc RequestMessageGetParamsSortOrder = "desc"`

### Returns

- `type Message struct{…}`

  - `ID int64`

    Message ID.

  - `Author string`

    Author of message.

  - `Content string`

    Content of message.

  - `IsFollowOnRequest bool`

    Whether the message is a follow-on request.

  - `Updated Time`

    Defines the message last updated time.

  - `Created Time`

    Defines the message creation time.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  page, err := client.CloudforceOne.Requests.Message.Get(
    context.TODO(),
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    cloudforce_one.RequestMessageGetParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
      Page: cloudflare.F(int64(0)),
      PerPage: cloudflare.F(int64(10)),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": 0,
      "author": "user@domain.com",
      "content": "Can you elaborate on the type of DoS that occurred?",
      "is_follow_on_request": true,
      "updated": "2022-01-01T00:00:00Z",
      "created": "2022-01-01T00:00:00Z"
    }
  ]
}
```

## Create a New Request Message

`client.CloudforceOne.Requests.Message.New(ctx, requestID, params) (*Message, error)`

**post** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/new`

Adds a message to a Cloudforce One intelligence request conversation.

### Parameters

- `requestID string`

  UUID.

- `params RequestMessageNewParams`

  - `AccountID param.Field[string]`

    Path param: Identifier.

  - `Content param.Field[string]`

    Body param: Content of message.

### Returns

- `type Message struct{…}`

  - `ID int64`

    Message ID.

  - `Author string`

    Author of message.

  - `Content string`

    Content of message.

  - `IsFollowOnRequest bool`

    Whether the message is a follow-on request.

  - `Updated Time`

    Defines the message last updated time.

  - `Created Time`

    Defines the message creation time.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  message, err := client.CloudforceOne.Requests.Message.New(
    context.TODO(),
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    cloudforce_one.RequestMessageNewParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", message.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": 0,
    "author": "user@domain.com",
    "content": "Can you elaborate on the type of DoS that occurred?",
    "is_follow_on_request": true,
    "updated": "2022-01-01T00:00:00Z",
    "created": "2022-01-01T00:00:00Z"
  }
}
```

## Update a Request Message

`client.CloudforceOne.Requests.Message.Update(ctx, requestID, messageID, params) (*Message, error)`

**put** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}`

Updates a message in a Cloudforce One intelligence request thread.

### Parameters

- `requestID string`

  UUID.

- `messageID int64`

- `params RequestMessageUpdateParams`

  - `AccountID param.Field[string]`

    Path param: Identifier.

  - `Content param.Field[string]`

    Body param: Content of message.

### Returns

- `type Message struct{…}`

  - `ID int64`

    Message ID.

  - `Author string`

    Author of message.

  - `Content string`

    Content of message.

  - `IsFollowOnRequest bool`

    Whether the message is a follow-on request.

  - `Updated Time`

    Defines the message last updated time.

  - `Created Time`

    Defines the message creation time.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  message, err := client.CloudforceOne.Requests.Message.Update(
    context.TODO(),
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    int64(0),
    cloudforce_one.RequestMessageUpdateParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", message.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": 0,
    "author": "user@domain.com",
    "content": "Can you elaborate on the type of DoS that occurred?",
    "is_follow_on_request": true,
    "updated": "2022-01-01T00:00:00Z",
    "created": "2022-01-01T00:00:00Z"
  }
}
```

## Delete a Request Message

`client.CloudforceOne.Requests.Message.Delete(ctx, requestID, messageID, body) (*RequestMessageDeleteResponse, error)`

**delete** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}`

Removes a message from a Cloudforce One intelligence request thread.

### Parameters

- `requestID string`

  UUID.

- `messageID int64`

- `body RequestMessageDeleteParams`

  - `AccountID param.Field[string]`

    Identifier.

### Returns

- `type RequestMessageDeleteResponse struct{…}`

  - `Errors []RequestMessageDeleteResponseError`

    - `Code int64`

    - `Message string`

    - `DocumentationURL string`

    - `Source RequestMessageDeleteResponseErrorsSource`

      - `Pointer string`

  - `Messages []RequestMessageDeleteResponseMessage`

    - `Code int64`

    - `Message string`

    - `DocumentationURL string`

    - `Source RequestMessageDeleteResponseMessagesSource`

      - `Pointer string`

  - `Success RequestMessageDeleteResponseSuccess`

    Whether the API call was successful.

    - `const RequestMessageDeleteResponseSuccessTrue RequestMessageDeleteResponseSuccess = true`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  message, err := client.CloudforceOne.Requests.Message.Delete(
    context.TODO(),
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    int64(0),
    cloudforce_one.RequestMessageDeleteParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", message.Errors)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true
}
```

## Domain Types

### Message

- `type Message struct{…}`

  - `ID int64`

    Message ID.

  - `Author string`

    Author of message.

  - `Content string`

    Content of message.

  - `IsFollowOnRequest bool`

    Whether the message is a follow-on request.

  - `Updated Time`

    Defines the message last updated time.

  - `Created Time`

    Defines the message creation time.

# Priority

## Get a Priority Intelligence Requirement

`client.CloudforceOne.Requests.Priority.Get(ctx, priorityID, query) (*Item, error)`

**get** `/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}`

Retrieves a specific priority intelligence request from Cloudforce One.

### Parameters

- `priorityID string`

  UUID.

- `query RequestPriorityGetParams`

  - `AccountID param.Field[string]`

    Identifier.

### Returns

- `type Item struct{…}`

  - `ID string`

    UUID.

  - `Content string`

    Request content.

  - `Created Time`

  - `Priority Time`

  - `Request string`

    Requested information from request.

  - `Summary string`

    Brief description of the request.

  - `TLP ItemTLP`

    The CISA defined Traffic Light Protocol (TLP).

    - `const ItemTLPClear ItemTLP = "clear"`

    - `const ItemTLPAmber ItemTLP = "amber"`

    - `const ItemTLPAmberStrict ItemTLP = "amber-strict"`

    - `const ItemTLPGreen ItemTLP = "green"`

    - `const ItemTLPRed ItemTLP = "red"`

  - `Updated Time`

  - `Completed Time`

  - `MessageTokens int64`

    Tokens for the request messages.

  - `ReadableID string`

    Readable Request ID.

  - `Status ItemStatus`

    Request Status.

    - `const ItemStatusOpen ItemStatus = "open"`

    - `const ItemStatusAccepted ItemStatus = "accepted"`

    - `const ItemStatusReported ItemStatus = "reported"`

    - `const ItemStatusApproved ItemStatus = "approved"`

    - `const ItemStatusCompleted ItemStatus = "completed"`

    - `const ItemStatusDeclined ItemStatus = "declined"`

  - `Tokens int64`

    Tokens for the request.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  item, err := client.CloudforceOne.Requests.Priority.Get(
    context.TODO(),
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    cloudforce_one.RequestPriorityGetParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", item.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "content": "What regions were most effected by the recent DoS?",
    "created": "2022-04-01T05:20:00Z",
    "priority": "2022-04-01T05:20:00Z",
    "request": "Victomology",
    "summary": "DoS attack",
    "tlp": "clear",
    "updated": "2022-04-01T05:20:00Z",
    "completed": "2022-04-01T05:20:00Z",
    "message_tokens": 1,
    "readable_id": "RFI-2022-000001",
    "status": "open",
    "tokens": 16
  }
}
```

## Create a New Priority Intelligence Requirement

`client.CloudforceOne.Requests.Priority.New(ctx, params) (*Priority, error)`

**post** `/accounts/{account_id}/cloudforce-one/requests/priority/new`

Creates a new priority intelligence request in Cloudforce One.

### Parameters

- `params RequestPriorityNewParams`

  - `AccountID param.Field[string]`

    Path param: Identifier.

  - `PriorityEdit param.Field[PriorityEdit]`

    Body param

### Returns

- `type Priority struct{…}`

  - `ID string`

    UUID.

  - `Created Time`

    Priority creation time.

  - `Labels []Label`

    List of labels.

  - `Priority int64`

    Priority.

  - `Requirement string`

    Requirement.

  - `TLP PriorityTLP`

    The CISA defined Traffic Light Protocol (TLP).

    - `const PriorityTLPClear PriorityTLP = "clear"`

    - `const PriorityTLPAmber PriorityTLP = "amber"`

    - `const PriorityTLPAmberStrict PriorityTLP = "amber-strict"`

    - `const PriorityTLPGreen PriorityTLP = "green"`

    - `const PriorityTLPRed PriorityTLP = "red"`

  - `Updated Time`

    Priority last updated time.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  priority, err := client.CloudforceOne.Requests.Priority.New(context.TODO(), cloudforce_one.RequestPriorityNewParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    PriorityEdit: cloudforce_one.PriorityEditParam{
      Labels: cloudflare.F([]cloudforce_one.LabelParam{"DoS", "CVE"}),
      Priority: cloudflare.F(int64(1)),
      Requirement: cloudflare.F("DoS attacks carried out by CVEs"),
      TLP: cloudflare.F(cloudforce_one.PriorityEditTLPClear),
    },
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", priority.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "created": "2022-04-01T05:20:00Z",
    "labels": [
      "DoS",
      "CVE"
    ],
    "priority": 1,
    "requirement": "DoS attacks carried out by CVEs",
    "tlp": "clear",
    "updated": "2022-04-01T05:20:00Z"
  }
}
```

## Update a Priority Intelligence Requirement

`client.CloudforceOne.Requests.Priority.Update(ctx, priorityID, params) (*Item, error)`

**put** `/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}`

Updates a priority intelligence request in Cloudforce One.

### Parameters

- `priorityID string`

  UUID.

- `params RequestPriorityUpdateParams`

  - `AccountID param.Field[string]`

    Path param: Identifier.

  - `PriorityEdit param.Field[PriorityEdit]`

    Body param

### Returns

- `type Item struct{…}`

  - `ID string`

    UUID.

  - `Content string`

    Request content.

  - `Created Time`

  - `Priority Time`

  - `Request string`

    Requested information from request.

  - `Summary string`

    Brief description of the request.

  - `TLP ItemTLP`

    The CISA defined Traffic Light Protocol (TLP).

    - `const ItemTLPClear ItemTLP = "clear"`

    - `const ItemTLPAmber ItemTLP = "amber"`

    - `const ItemTLPAmberStrict ItemTLP = "amber-strict"`

    - `const ItemTLPGreen ItemTLP = "green"`

    - `const ItemTLPRed ItemTLP = "red"`

  - `Updated Time`

  - `Completed Time`

  - `MessageTokens int64`

    Tokens for the request messages.

  - `ReadableID string`

    Readable Request ID.

  - `Status ItemStatus`

    Request Status.

    - `const ItemStatusOpen ItemStatus = "open"`

    - `const ItemStatusAccepted ItemStatus = "accepted"`

    - `const ItemStatusReported ItemStatus = "reported"`

    - `const ItemStatusApproved ItemStatus = "approved"`

    - `const ItemStatusCompleted ItemStatus = "completed"`

    - `const ItemStatusDeclined ItemStatus = "declined"`

  - `Tokens int64`

    Tokens for the request.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  item, err := client.CloudforceOne.Requests.Priority.Update(
    context.TODO(),
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    cloudforce_one.RequestPriorityUpdateParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
      PriorityEdit: cloudforce_one.PriorityEditParam{
        Labels: cloudflare.F([]cloudforce_one.LabelParam{"DoS", "CVE"}),
        Priority: cloudflare.F(int64(1)),
        Requirement: cloudflare.F("DoS attacks carried out by CVEs"),
        TLP: cloudflare.F(cloudforce_one.PriorityEditTLPClear),
      },
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", item.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "content": "What regions were most effected by the recent DoS?",
    "created": "2022-04-01T05:20:00Z",
    "priority": "2022-04-01T05:20:00Z",
    "request": "Victomology",
    "summary": "DoS attack",
    "tlp": "clear",
    "updated": "2022-04-01T05:20:00Z",
    "completed": "2022-04-01T05:20:00Z",
    "message_tokens": 1,
    "readable_id": "RFI-2022-000001",
    "status": "open",
    "tokens": 16
  }
}
```

## Delete a Priority Intelligence Requirement

`client.CloudforceOne.Requests.Priority.Delete(ctx, priorityID, body) (*RequestPriorityDeleteResponse, error)`

**delete** `/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}`

Deletes a priority intelligence request from Cloudforce One.

### Parameters

- `priorityID string`

  UUID.

- `body RequestPriorityDeleteParams`

  - `AccountID param.Field[string]`

    Identifier.

### Returns

- `type RequestPriorityDeleteResponse struct{…}`

  - `Errors []RequestPriorityDeleteResponseError`

    - `Code int64`

    - `Message string`

    - `DocumentationURL string`

    - `Source RequestPriorityDeleteResponseErrorsSource`

      - `Pointer string`

  - `Messages []RequestPriorityDeleteResponseMessage`

    - `Code int64`

    - `Message string`

    - `DocumentationURL string`

    - `Source RequestPriorityDeleteResponseMessagesSource`

      - `Pointer string`

  - `Success RequestPriorityDeleteResponseSuccess`

    Whether the API call was successful.

    - `const RequestPriorityDeleteResponseSuccessTrue RequestPriorityDeleteResponseSuccess = true`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  priority, err := client.CloudforceOne.Requests.Priority.Delete(
    context.TODO(),
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    cloudforce_one.RequestPriorityDeleteParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", priority.Errors)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true
}
```

## Get Priority Intelligence Requirement Quota

`client.CloudforceOne.Requests.Priority.Quota(ctx, query) (*Quota, error)`

**get** `/accounts/{account_id}/cloudforce-one/requests/priority/quota`

Retrieves quota usage for Cloudforce One priority requests.

### Parameters

- `query RequestPriorityQuotaParams`

  - `AccountID param.Field[string]`

    Identifier.

### Returns

- `type Quota struct{…}`

  - `AnniversaryDate Time`

    Anniversary date is when annual quota limit is refreshed.

  - `QuarterAnniversaryDate Time`

    Quarter anniversary date is when quota limit is refreshed each quarter.

  - `Quota int64`

    Tokens for the quarter.

  - `Remaining int64`

    Tokens remaining for the quarter.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  quota, err := client.CloudforceOne.Requests.Priority.Quota(context.TODO(), cloudforce_one.RequestPriorityQuotaParams{
    AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", quota.AnniversaryDate)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "anniversary_date": "2022-04-01T00:00:00Z",
    "quarter_anniversary_date": "2022-04-01T00:00:00Z",
    "quota": 120,
    "remaining": 64
  }
}
```

## Domain Types

### Label

- `type Label string`

### Priority

- `type Priority struct{…}`

  - `ID string`

    UUID.

  - `Created Time`

    Priority creation time.

  - `Labels []Label`

    List of labels.

  - `Priority int64`

    Priority.

  - `Requirement string`

    Requirement.

  - `TLP PriorityTLP`

    The CISA defined Traffic Light Protocol (TLP).

    - `const PriorityTLPClear PriorityTLP = "clear"`

    - `const PriorityTLPAmber PriorityTLP = "amber"`

    - `const PriorityTLPAmberStrict PriorityTLP = "amber-strict"`

    - `const PriorityTLPGreen PriorityTLP = "green"`

    - `const PriorityTLPRed PriorityTLP = "red"`

  - `Updated Time`

    Priority last updated time.

### Priority Edit

- `type PriorityEdit struct{…}`

  - `Labels []Label`

    List of labels.

  - `Priority int64`

    Priority.

  - `Requirement string`

    Requirement.

  - `TLP PriorityEditTLP`

    The CISA defined Traffic Light Protocol (TLP).

    - `const PriorityEditTLPClear PriorityEditTLP = "clear"`

    - `const PriorityEditTLPAmber PriorityEditTLP = "amber"`

    - `const PriorityEditTLPAmberStrict PriorityEditTLP = "amber-strict"`

    - `const PriorityEditTLPGreen PriorityEditTLP = "green"`

    - `const PriorityEditTLPRed PriorityEditTLP = "red"`

# Assets

## Get a Request Asset

`client.CloudforceOne.Requests.Assets.Get(ctx, requestID, assetID, query) (*SinglePage[RequestAssetGetResponse], error)`

**get** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}`

Retrieves an asset attached to a Cloudforce One intelligence request.

### Parameters

- `requestID string`

  UUID.

- `assetID string`

  UUID.

- `query RequestAssetGetParams`

  - `AccountID param.Field[string]`

    Identifier.

### Returns

- `type RequestAssetGetResponse struct{…}`

  - `ID int64`

    Asset ID.

  - `Name string`

    Asset name.

  - `Created Time`

    Defines the asset creation time.

  - `Description string`

    Asset description.

  - `FileType string`

    Asset file type.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  page, err := client.CloudforceOne.Requests.Assets.Get(
    context.TODO(),
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    cloudforce_one.RequestAssetGetParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": 0,
      "name": "example.docx",
      "created": "2022-01-01T00:00:00Z",
      "description": "example description",
      "file_type": "docx"
    }
  ]
}
```

## List Request Assets

`client.CloudforceOne.Requests.Assets.New(ctx, requestID, params) (*SinglePage[RequestAssetNewResponse], error)`

**post** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset`

Lists assets attached to a Cloudforce One intelligence request.

### Parameters

- `requestID string`

  UUID.

- `params RequestAssetNewParams`

  - `AccountID param.Field[string]`

    Path param: Identifier.

  - `Page param.Field[int64]`

    Body param: Page number of results.

  - `PerPage param.Field[int64]`

    Body param: Number of results per page.

### Returns

- `type RequestAssetNewResponse struct{…}`

  - `ID int64`

    Asset ID.

  - `Name string`

    Asset name.

  - `Created Time`

    Defines the asset creation time.

  - `Description string`

    Asset description.

  - `FileType string`

    Asset file type.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  page, err := client.CloudforceOne.Requests.Assets.New(
    context.TODO(),
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    cloudforce_one.RequestAssetNewParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
      Page: cloudflare.F(int64(0)),
      PerPage: cloudflare.F(int64(10)),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", page)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "id": 0,
      "name": "example.docx",
      "created": "2022-01-01T00:00:00Z",
      "description": "example description",
      "file_type": "docx"
    }
  ]
}
```

## Update a Request Asset

`client.CloudforceOne.Requests.Assets.Update(ctx, requestID, assetID, params) (*RequestAssetUpdateResponse, error)`

**put** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}`

Updates an asset in a Cloudforce One intelligence request.

### Parameters

- `requestID string`

  UUID.

- `assetID string`

  UUID.

- `params RequestAssetUpdateParams`

  - `AccountID param.Field[string]`

    Path param: Identifier.

  - `Source param.Field[string]`

    Body param: Asset file to upload.

### Returns

- `type RequestAssetUpdateResponse struct{…}`

  - `ID int64`

    Asset ID.

  - `Name string`

    Asset name.

  - `Created Time`

    Defines the asset creation time.

  - `Description string`

    Asset description.

  - `FileType string`

    Asset file type.

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  asset, err := client.CloudforceOne.Requests.Assets.Update(
    context.TODO(),
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    cloudforce_one.RequestAssetUpdateParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", asset.ID)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": 0,
    "name": "example.docx",
    "created": "2022-01-01T00:00:00Z",
    "description": "example description",
    "file_type": "docx"
  }
}
```

## Delete a Request Asset

`client.CloudforceOne.Requests.Assets.Delete(ctx, requestID, assetID, body) (*RequestAssetDeleteResponse, error)`

**delete** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}`

Removes an asset from a Cloudforce One intelligence request.

### Parameters

- `requestID string`

  UUID.

- `assetID string`

  UUID.

- `body RequestAssetDeleteParams`

  - `AccountID param.Field[string]`

    Identifier.

### Returns

- `type RequestAssetDeleteResponse struct{…}`

  - `Errors []RequestAssetDeleteResponseError`

    - `Code int64`

    - `Message string`

    - `DocumentationURL string`

    - `Source RequestAssetDeleteResponseErrorsSource`

      - `Pointer string`

  - `Messages []RequestAssetDeleteResponseMessage`

    - `Code int64`

    - `Message string`

    - `DocumentationURL string`

    - `Source RequestAssetDeleteResponseMessagesSource`

      - `Pointer string`

  - `Success RequestAssetDeleteResponseSuccess`

    Whether the API call was successful.

    - `const RequestAssetDeleteResponseSuccessTrue RequestAssetDeleteResponseSuccess = true`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIKey("144c9defac04969c7bfad8efaa8ea194"),
    option.WithAPIEmail("user@example.com"),
  )
  asset, err := client.CloudforceOne.Requests.Assets.Delete(
    context.TODO(),
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
    cloudforce_one.RequestAssetDeleteParams{
      AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", asset.Errors)
}
```

#### Response

```json
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true
}
```

# Threat Events

## Filter and list events

`client.CloudforceOne.ThreatEvents.List(ctx, params) (*[]ThreatEventListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events`

Use `datasetId=all` or `datasetId=*` to query all event datasets for the account (limited to 50). When `datasetId` is unspecified, events are listed from the default Cloudforce One Threat Events dataset. To list existing datasets, use the [`List Datasets`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint.

### Parameters

- `params ThreatEventListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `Cursor param.Field[string]`

    Query param: Cursor for pagination. When provided, filters are embedded in the cursor so you only need to pass cursor and pageSize. Returned in the previous response's result_info.cursor field. Use cursor-based pagination for deep pagination (beyond 100,000 records) or for optimal performance.

  - `DatasetID param.Field[[]string]`

    Query param: Dataset IDs to query events from (array of UUIDs), or special value 'all' or '*' to query all event datasets for the account. If not provided, uses the default dataset.

  - `ForceRefresh param.Field[bool]`

    Query param

  - `Format param.Field[ThreatEventListParamsFormat]`

    Query param

    - `const ThreatEventListParamsFormatJson ThreatEventListParamsFormat = "json"`

    - `const ThreatEventListParamsFormatStix2 ThreatEventListParamsFormat = "stix2"`

    - `const ThreatEventListParamsFormatTaxii ThreatEventListParamsFormat = "taxii"`

  - `Order param.Field[ThreatEventListParamsOrder]`

    Query param

    - `const ThreatEventListParamsOrderAsc ThreatEventListParamsOrder = "asc"`

    - `const ThreatEventListParamsOrderDesc ThreatEventListParamsOrder = "desc"`

  - `OrderBy param.Field[string]`

    Query param

  - `Page param.Field[float64]`

    Query param: Page number (1-indexed) for offset-based pagination. Limited to offset of 100,000 records. For deep pagination, use cursor-based pagination instead.

  - `PageSize param.Field[float64]`

    Query param: Number of results per page. Maximum 25,000.

  - `Search param.Field[[]ThreatEventListParamsSearch]`

    Query param

    - `Field string`

      Event field to search on. Allowed: attacker, attackerCountry, category, createdAt, date, event, indicator, indicatorType, killChain, mitreAttack, tags, targetCountry, targetIndustry, tlp, uuid.

    - `Op ThreatEventListParamsSearchOp`

      Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'tags', op:'in', value:['malware','apt']}.

      - `const ThreatEventListParamsSearchOpEquals ThreatEventListParamsSearchOp = "equals"`

      - `const ThreatEventListParamsSearchOpNot ThreatEventListParamsSearchOp = "not"`

      - `const ThreatEventListParamsSearchOpGt ThreatEventListParamsSearchOp = "gt"`

      - `const ThreatEventListParamsSearchOpGte ThreatEventListParamsSearchOp = "gte"`

      - `const ThreatEventListParamsSearchOpLt ThreatEventListParamsSearchOp = "lt"`

      - `const ThreatEventListParamsSearchOpLte ThreatEventListParamsSearchOp = "lte"`

      - `const ThreatEventListParamsSearchOpLike ThreatEventListParamsSearchOp = "like"`

      - `const ThreatEventListParamsSearchOpContains ThreatEventListParamsSearchOp = "contains"`

      - `const ThreatEventListParamsSearchOpStartsWith ThreatEventListParamsSearchOp = "startsWith"`

      - `const ThreatEventListParamsSearchOpEndsWith ThreatEventListParamsSearchOp = "endsWith"`

      - `const ThreatEventListParamsSearchOpIn ThreatEventListParamsSearchOp = "in"`

      - `const ThreatEventListParamsSearchOpFind ThreatEventListParamsSearchOp = "find"`

    - `Value ThreatEventListParamsSearchValueUnion`

      Search value. String or number for most operators. Array for 'in' operator (max 100 items).

      - `UnionString`

      - `UnionFloat`

      - `type ThreatEventListParamsSearchValueArray []ThreatEventListParamsSearchValueArrayUnion`

        - `UnionString`

        - `UnionFloat`

  - `Source param.Field[ThreatEventListParamsSource]`

    Query param: Read backend. 'do' (default) reads Durable Object storage. 'r2catalog' reads R2 Data Catalog (admin-only, experimental; supports a subset of search fields — no 'tags').

    - `const ThreatEventListParamsSourceDo ThreatEventListParamsSource = "do"`

    - `const ThreatEventListParamsSourceR2catalog ThreatEventListParamsSource = "r2catalog"`

### Returns

- `type ThreatEventListResponse []ThreatEventListResponse`

  - `Attacker string`

  - `AttackerCountry string`

  - `AttackerCountryAlpha3 string`

  - `Category string`

  - `DatasetID string`

  - `Date string`

  - `Event string`

  - `HasChildren bool`

  - `Indicator string`

  - `IndicatorType string`

  - `IndicatorTypeID float64`

  - `KillChain float64`

  - `MitreAttack []string`

  - `MitreCapec []string`

  - `NumReferenced float64`

  - `NumReferences float64`

  - `RawID string`

  - `Referenced []string`

  - `ReferencedIDs []float64`

  - `References []string`

  - `ReferencesIDs []float64`

  - `Tags []string`

  - `TargetCountry string`

  - `TargetCountryAlpha3 string`

  - `TargetIndustry string`

  - `TLP string`

  - `UUID string`

  - `Insight string`

  - `ReleasabilityID string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  threatEvents, err := client.CloudforceOne.ThreatEvents.List(context.TODO(), cloudforce_one.ThreatEventListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", threatEvents)
}
```

#### Response

```json
[
  {
    "attacker": "Flying Yeti",
    "attackerCountry": "CN",
    "attackerCountryAlpha3": "CHN",
    "category": "Domain Resolution",
    "datasetId": "dataset-example-id",
    "date": "2022-04-01T00:00:00Z",
    "event": "An attacker registered the domain domain.com",
    "hasChildren": true,
    "indicator": "domain.com",
    "indicatorType": "domain",
    "indicatorTypeId": 5,
    "killChain": 0,
    "mitreAttack": [
      " "
    ],
    "mitreCapec": [
      " "
    ],
    "numReferenced": 0,
    "numReferences": 0,
    "rawId": "453gw34w3",
    "referenced": [
      " "
    ],
    "referencedIds": [
      0
    ],
    "references": [
      " "
    ],
    "referencesIds": [
      0
    ],
    "tags": [
      "malware"
    ],
    "targetCountry": "US",
    "targetCountryAlpha3": "USA",
    "targetIndustry": "Agriculture",
    "tlp": "amber",
    "uuid": "12345678-1234-1234-1234-1234567890ab",
    "insight": "insight",
    "releasabilityId": "releasabilityId"
  }
]
```

## Reads an event

`client.CloudforceOne.ThreatEvents.Get(ctx, eventID, query) (*ThreatEventGetResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/{event_id}`

This Method is deprecated. Please use /events/dataset/:dataset_id/events/:event_id instead.

### Parameters

- `eventID string`

  Event UUID.

- `query ThreatEventGetParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventGetResponse struct{…}`

  - `Attacker string`

  - `AttackerCountry string`

  - `AttackerCountryAlpha3 string`

  - `Category string`

  - `DatasetID string`

  - `Date string`

  - `Event string`

  - `HasChildren bool`

  - `Indicator string`

  - `IndicatorType string`

  - `IndicatorTypeID float64`

  - `KillChain float64`

  - `MitreAttack []string`

  - `MitreCapec []string`

  - `NumReferenced float64`

  - `NumReferences float64`

  - `RawID string`

  - `Referenced []string`

  - `ReferencedIDs []float64`

  - `References []string`

  - `ReferencesIDs []float64`

  - `Tags []string`

  - `TargetCountry string`

  - `TargetCountryAlpha3 string`

  - `TargetIndustry string`

  - `TLP string`

  - `UUID string`

  - `Insight string`

  - `ReleasabilityID string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  threatEvent, err := client.CloudforceOne.ThreatEvents.Get(
    context.TODO(),
    "event_id",
    cloudforce_one.ThreatEventGetParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", threatEvent.UUID)
}
```

#### Response

```json
{
  "attacker": "Flying Yeti",
  "attackerCountry": "CN",
  "attackerCountryAlpha3": "CHN",
  "category": "Domain Resolution",
  "datasetId": "dataset-example-id",
  "date": "2022-04-01T00:00:00Z",
  "event": "An attacker registered the domain domain.com",
  "hasChildren": true,
  "indicator": "domain.com",
  "indicatorType": "domain",
  "indicatorTypeId": 5,
  "killChain": 0,
  "mitreAttack": [
    " "
  ],
  "mitreCapec": [
    " "
  ],
  "numReferenced": 0,
  "numReferences": 0,
  "rawId": "453gw34w3",
  "referenced": [
    " "
  ],
  "referencedIds": [
    0
  ],
  "references": [
    " "
  ],
  "referencesIds": [
    0
  ],
  "tags": [
    "malware"
  ],
  "targetCountry": "US",
  "targetCountryAlpha3": "USA",
  "targetIndustry": "Agriculture",
  "tlp": "amber",
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "insight": "insight",
  "releasabilityId": "releasabilityId"
}
```

## Creates a new event

`client.CloudforceOne.ThreatEvents.New(ctx, params) (*ThreatEventNewResponse, error)`

**post** `/accounts/{account_id}/cloudforce-one/events/create`

To create a dataset, see the [`Create Dataset`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create/) endpoint. When `datasetId` parameter is unspecified, it will be created in a default dataset named `Cloudforce One Threat Events`.

### Parameters

- `params ThreatEventNewParams`

  - `PathAccountID param.Field[string]`

    Path param: Account ID.

  - `Category param.Field[string]`

    Body param

  - `Date param.Field[Time]`

    Body param

  - `Event param.Field[string]`

    Body param

  - `Raw param.Field[ThreatEventNewParamsRaw]`

    Body param

    - `Data map[string, unknown]`

    - `Source string`

    - `TLP string`

  - `TLP param.Field[string]`

    Body param

  - `BodyAccountID param.Field[float64]`

    Body param

  - `Attacker param.Field[string]`

    Body param

  - `AttackerCountry param.Field[string]`

    Body param

  - `DatasetID param.Field[string]`

    Body param

  - `Indicator param.Field[string]`

    Body param

  - `Indicators param.Field[[]ThreatEventNewParamsIndicator]`

    Body param: Array of indicators for this event. Supports multiple indicators per event for complex scenarios.

    - `IndicatorType string`

      The type of indicator (e.g., DOMAIN, IP, JA3, HASH)

    - `Value string`

      The indicator value (e.g., domain name, IP address, hash)

  - `IndicatorType param.Field[string]`

    Body param

  - `Insight param.Field[string]`

    Body param

  - `Tags param.Field[[]string]`

    Body param

  - `TargetCountry param.Field[string]`

    Body param

  - `TargetIndustry param.Field[string]`

    Body param

### Returns

- `type ThreatEventNewResponse struct{…}`

  - `Attacker string`

  - `AttackerCountry string`

  - `AttackerCountryAlpha3 string`

  - `Category string`

  - `DatasetID string`

  - `Date string`

  - `Event string`

  - `HasChildren bool`

  - `Indicator string`

  - `IndicatorType string`

  - `IndicatorTypeID float64`

  - `KillChain float64`

  - `MitreAttack []string`

  - `MitreCapec []string`

  - `NumReferenced float64`

  - `NumReferences float64`

  - `RawID string`

  - `Referenced []string`

  - `ReferencedIDs []float64`

  - `References []string`

  - `ReferencesIDs []float64`

  - `Tags []string`

  - `TargetCountry string`

  - `TargetCountryAlpha3 string`

  - `TargetIndustry string`

  - `TLP string`

  - `UUID string`

  - `Insight string`

  - `ReleasabilityID string`

### Example

```go
package main

import (
  "context"
  "fmt"
  "time"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  threatEvent, err := client.CloudforceOne.ThreatEvents.New(context.TODO(), cloudforce_one.ThreatEventNewParams{
    PathAccountID: cloudflare.F("account_id"),
    Category: cloudflare.F("Domain Resolution"),
    Date: cloudflare.F(time.Now()),
    Event: cloudflare.F("An attacker registered the domain domain.com"),
    Raw: cloudflare.F(cloudforce_one.ThreatEventNewParamsRaw{
      Data: cloudflare.F(map[string]interface{}{
      "foo": "bar",
      }),
    }),
    TLP: cloudflare.F("amber"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", threatEvent.UUID)
}
```

#### Response

```json
{
  "attacker": "Flying Yeti",
  "attackerCountry": "CN",
  "attackerCountryAlpha3": "CHN",
  "category": "Domain Resolution",
  "datasetId": "dataset-example-id",
  "date": "2022-04-01T00:00:00Z",
  "event": "An attacker registered the domain domain.com",
  "hasChildren": true,
  "indicator": "domain.com",
  "indicatorType": "domain",
  "indicatorTypeId": 5,
  "killChain": 0,
  "mitreAttack": [
    " "
  ],
  "mitreCapec": [
    " "
  ],
  "numReferenced": 0,
  "numReferences": 0,
  "rawId": "453gw34w3",
  "referenced": [
    " "
  ],
  "referencedIds": [
    0
  ],
  "references": [
    " "
  ],
  "referencesIds": [
    0
  ],
  "tags": [
    "malware"
  ],
  "targetCountry": "US",
  "targetCountryAlpha3": "USA",
  "targetIndustry": "Agriculture",
  "tlp": "amber",
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "insight": "insight",
  "releasabilityId": "releasabilityId"
}
```

## Updates an event

`client.CloudforceOne.ThreatEvents.Edit(ctx, eventID, params) (*ThreatEventEditResponse, error)`

**patch** `/accounts/{account_id}/cloudforce-one/events/{event_id}`

Update an existing event by its identifier.

### Parameters

- `eventID string`

  Event UUID.

- `params ThreatEventEditParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `DatasetID param.Field[string]`

    Body param: Dataset ID containing the event to update.

  - `Attacker param.Field[string]`

    Body param

  - `AttackerCountry param.Field[string]`

    Body param

  - `Category param.Field[string]`

    Body param

  - `CreatedAt param.Field[Time]`

    Body param

  - `Date param.Field[Time]`

    Body param

  - `Event param.Field[string]`

    Body param

  - `Indicator param.Field[string]`

    Body param

  - `IndicatorType param.Field[string]`

    Body param

  - `Insight param.Field[string]`

    Body param

  - `Raw param.Field[ThreatEventEditParamsRaw]`

    Body param

    - `Data map[string, unknown]`

    - `Source string`

    - `TLP string`

  - `TargetCountry param.Field[string]`

    Body param

  - `TargetIndustry param.Field[string]`

    Body param

  - `TLP param.Field[string]`

    Body param

### Returns

- `type ThreatEventEditResponse struct{…}`

  - `Attacker string`

  - `AttackerCountry string`

  - `AttackerCountryAlpha3 string`

  - `Category string`

  - `DatasetID string`

  - `Date string`

  - `Event string`

  - `HasChildren bool`

  - `Indicator string`

  - `IndicatorType string`

  - `IndicatorTypeID float64`

  - `KillChain float64`

  - `MitreAttack []string`

  - `MitreCapec []string`

  - `NumReferenced float64`

  - `NumReferences float64`

  - `RawID string`

  - `Referenced []string`

  - `ReferencedIDs []float64`

  - `References []string`

  - `ReferencesIDs []float64`

  - `Tags []string`

  - `TargetCountry string`

  - `TargetCountryAlpha3 string`

  - `TargetIndustry string`

  - `TLP string`

  - `UUID string`

  - `Insight string`

  - `ReleasabilityID string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.CloudforceOne.ThreatEvents.Edit(
    context.TODO(),
    "event_id",
    cloudforce_one.ThreatEventEditParams{
      AccountID: cloudflare.F("account_id"),
      DatasetID: cloudflare.F("9b769969-a211-466c-8ac3-cb91266a066a"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.UUID)
}
```

#### Response

```json
{
  "attacker": "Flying Yeti",
  "attackerCountry": "CN",
  "attackerCountryAlpha3": "CHN",
  "category": "Domain Resolution",
  "datasetId": "dataset-example-id",
  "date": "2022-04-01T00:00:00Z",
  "event": "An attacker registered the domain domain.com",
  "hasChildren": true,
  "indicator": "domain.com",
  "indicatorType": "domain",
  "indicatorTypeId": 5,
  "killChain": 0,
  "mitreAttack": [
    " "
  ],
  "mitreCapec": [
    " "
  ],
  "numReferenced": 0,
  "numReferences": 0,
  "rawId": "453gw34w3",
  "referenced": [
    " "
  ],
  "referencedIds": [
    0
  ],
  "references": [
    " "
  ],
  "referencesIds": [
    0
  ],
  "tags": [
    "malware"
  ],
  "targetCountry": "US",
  "targetCountryAlpha3": "USA",
  "targetIndustry": "Agriculture",
  "tlp": "amber",
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "insight": "insight",
  "releasabilityId": "releasabilityId"
}
```

## Creates bulk events

`client.CloudforceOne.ThreatEvents.BulkNew(ctx, params) (*ThreatEventBulkNewResponse, error)`

**post** `/accounts/{account_id}/cloudforce-one/events/create/bulk`

The `datasetId` parameter must be defined. To list existing datasets (and their IDs) in your account, use the [`List Datasets`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint.

### Parameters

- `params ThreatEventBulkNewParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `Data param.Field[[]ThreatEventBulkNewParamsData]`

    Body param

    - `Category string`

    - `Date Time`

    - `Event string`

    - `Raw ThreatEventBulkNewParamsDataRaw`

      - `Data map[string, unknown]`

      - `Source string`

      - `TLP string`

    - `TLP string`

    - `AccountID float64`

    - `Attacker string`

    - `AttackerCountry string`

    - `DatasetID string`

    - `Indicator string`

    - `Indicators []ThreatEventBulkNewParamsDataIndicator`

      Array of indicators for this event. Supports multiple indicators per event for complex scenarios.

      - `IndicatorType string`

        The type of indicator (e.g., DOMAIN, IP, JA3, HASH)

      - `Value string`

        The indicator value (e.g., domain name, IP address, hash)

    - `IndicatorType string`

    - `Insight string`

    - `Tags []string`

    - `TargetCountry string`

    - `TargetIndustry string`

  - `DatasetID param.Field[string]`

    Body param

  - `IncludeCreatedEvents param.Field[bool]`

    Body param: When true, response includes array of created event UUIDs and shard IDs. Useful for tracking which events were created and where.

### Returns

- `type ThreatEventBulkNewResponse struct{…}`

  Detailed result of bulk event creation with auto-tag management

  - `CreatedEventsCount float64`

    Number of events created

  - `CreatedTagsCount float64`

    Number of new tags created in SoT

  - `ErrorCount float64`

    Number of errors encountered

  - `QueuedIndicatorsCount float64`

    Number of indicators queued for async processing

  - `CreateBulkEventsRequestID string`

    Correlation ID for async indicator processing

  - `CreatedEvents []ThreatEventBulkNewResponseCreatedEvent`

    Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true

    - `EventIndex float64`

      Original index in the input data array

    - `ShardID string`

      Dataset ID of the shard where the event was created

    - `UUID string`

      UUID of the created event

  - `Errors []ThreatEventBulkNewResponseError`

    Array of error details

    - `Error string`

      Error message

    - `EventIndex float64`

      Index of the event that caused the error

### Example

```go
package main

import (
  "context"
  "fmt"
  "time"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.CloudforceOne.ThreatEvents.BulkNew(context.TODO(), cloudforce_one.ThreatEventBulkNewParams{
    AccountID: cloudflare.F("account_id"),
    Data: cloudflare.F([]cloudforce_one.ThreatEventBulkNewParamsData{cloudforce_one.ThreatEventBulkNewParamsData{
      Category: cloudflare.F("Domain Resolution"),
      Date: cloudflare.F(time.Now()),
      Event: cloudflare.F("An attacker registered the domain domain.com"),
      Raw: cloudflare.F(cloudforce_one.ThreatEventBulkNewParamsDataRaw{
        Data: cloudflare.F(map[string]interface{}{
        "foo": "bar",
        }),
      }),
      TLP: cloudflare.F("amber"),
    }}),
    DatasetID: cloudflare.F("durableObjectName"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.CreatedEventsCount)
}
```

#### Response

```json
{
  "createdEventsCount": 0,
  "createdTagsCount": 0,
  "errorCount": 0,
  "queuedIndicatorsCount": 0,
  "createBulkEventsRequestId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
  "createdEvents": [
    {
      "eventIndex": 0,
      "shardId": "shardId",
      "uuid": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
    }
  ],
  "errors": [
    {
      "error": "error",
      "eventIndex": 0
    }
  ]
}
```

## Creates bulk DOS event with relationships and indicators

`client.CloudforceOne.ThreatEvents.BulkNewRelationships(ctx, params) (*ThreatEventBulkNewRelationshipsResponse, error)`

**post** `/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships`

This method is deprecated. Please use `event_create_bulk` instead

### Parameters

- `params ThreatEventBulkNewRelationshipsParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `Data param.Field[[]ThreatEventBulkNewRelationshipsParamsData]`

    Body param

    - `Category string`

    - `Date Time`

    - `Event string`

    - `Raw ThreatEventBulkNewRelationshipsParamsDataRaw`

      - `Data map[string, unknown]`

      - `Source string`

      - `TLP string`

    - `TLP string`

    - `AccountID float64`

    - `Attacker string`

    - `AttackerCountry string`

    - `DatasetID string`

    - `Indicator string`

    - `Indicators []ThreatEventBulkNewRelationshipsParamsDataIndicator`

      Array of indicators for this event. Supports multiple indicators per event for complex scenarios.

      - `IndicatorType string`

        The type of indicator (e.g., DOMAIN, IP, JA3, HASH)

      - `Value string`

        The indicator value (e.g., domain name, IP address, hash)

    - `IndicatorType string`

    - `Insight string`

    - `Tags []string`

    - `TargetCountry string`

    - `TargetIndustry string`

  - `DatasetID param.Field[string]`

    Body param

### Returns

- `type ThreatEventBulkNewRelationshipsResponse struct{…}`

  Result of bulk relationship creation operation

  - `CreatedEventsCount float64`

    Number of events created

  - `CreatedIndicatorsCount float64`

    Number of indicators created

  - `CreatedRelationshipsCount float64`

    Number of relationships created

  - `ErrorCount float64`

    Number of errors encountered

  - `Errors []ThreatEventBulkNewRelationshipsResponseError`

    Array of error details

    - `Error string`

      Error message

    - `EventIndex float64`

      Index of the event that caused the error

### Example

```go
package main

import (
  "context"
  "fmt"
  "time"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.CloudforceOne.ThreatEvents.BulkNewRelationships(context.TODO(), cloudforce_one.ThreatEventBulkNewRelationshipsParams{
    AccountID: cloudflare.F("account_id"),
    Data: cloudflare.F([]cloudforce_one.ThreatEventBulkNewRelationshipsParamsData{cloudforce_one.ThreatEventBulkNewRelationshipsParamsData{
      Category: cloudflare.F("Domain Resolution"),
      Date: cloudflare.F(time.Now()),
      Event: cloudflare.F("An attacker registered the domain domain.com"),
      Raw: cloudflare.F(cloudforce_one.ThreatEventBulkNewRelationshipsParamsDataRaw{
        Data: cloudflare.F(map[string]interface{}{
        "foo": "bar",
        }),
      }),
      TLP: cloudflare.F("amber"),
    }}),
    DatasetID: cloudflare.F("durableObjectName"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.CreatedEventsCount)
}
```

#### Response

```json
{
  "createdEventsCount": 0,
  "createdIndicatorsCount": 0,
  "createdRelationshipsCount": 0,
  "errorCount": 0,
  "errors": [
    {
      "error": "error",
      "eventIndex": 0
    }
  ]
}
```

# Aggregate

## Aggregate events by single or multiple columns with optional date filtering

`client.CloudforceOne.ThreatEvents.Aggregate.List(ctx, params) (*ThreatEventAggregateListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/aggregate`

Aggregate threat events by one or more columns (e.g., attacker, targetIndustry) with optional date filtering and daily grouping. Supports multi-dimensional aggregation for cross-analysis.

### Parameters

- `params ThreatEventAggregateListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `AggregateBy param.Field[string]`

    Query param: Column(s) to aggregate by - single column or comma-separated list (e.g., 'attacker', 'targetIndustry', 'attacker,targetIndustry')

  - `DatasetID param.Field[[]string]`

    Query param: Dataset ID(s) to filter by. Can be a single dataset ID, comma-separated list, or array. If not provided, uses default dataset

  - `EndDate param.Field[string]`

    Query param: End date for filtering (ISO 8601 format, e.g., '2024-12-31')

  - `GroupByDate param.Field[bool]`

    Query param: Whether to group results by date (daily aggregation)

  - `Limit param.Field[float64]`

    Query param: Maximum number of results to return

  - `StartDate param.Field[string]`

    Query param: Start date for filtering (ISO 8601 format, e.g., '2024-01-01')

### Returns

- `type ThreatEventAggregateListResponse struct{…}`

  - `AggregateBy string`

    Column(s) that were aggregated by

  - `Aggregations []ThreatEventAggregateListResponseAggregation`

    Array of aggregation results with dynamic fields based on aggregateBy columns

    - `Count float64`

      Number of events for this aggregation

    - `Date string`

      Date (if groupByDate is true)

  - `Total float64`

    Total number of events in the aggregation

  - `DateRange ThreatEventAggregateListResponseDateRange`

    Date range used for filtering

    - `EndDate string`

    - `StartDate string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  aggregates, err := client.CloudforceOne.ThreatEvents.Aggregate.List(context.TODO(), cloudforce_one.ThreatEventAggregateListParams{
    AccountID: cloudflare.F("account_id"),
    AggregateBy: cloudflare.F("aggregateBy"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", aggregates.AggregateBy)
}
```

#### Response

```json
{
  "aggregateBy": "aggregateBy",
  "aggregations": [
    {
      "count": 0,
      "date": "date"
    }
  ],
  "total": 0,
  "dateRange": {
    "endDate": "endDate",
    "startDate": "startDate"
  }
}
```

# Graphql

## GraphQL endpoint for event aggregation

`client.CloudforceOne.ThreatEvents.Graphql.New(ctx, body) (*ThreatEventGraphqlNewResponse, error)`

**post** `/accounts/{account_id}/cloudforce-one/events/graphql`

Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation.

### Parameters

- `body ThreatEventGraphqlNewParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventGraphqlNewResponse struct{…}`

  - `Data unknown`

  - `Errors []unknown`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  graphql, err := client.CloudforceOne.ThreatEvents.Graphql.New(context.TODO(), cloudforce_one.ThreatEventGraphqlNewParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", graphql.Data)
}
```

#### Response

```json
{
  "data": {},
  "errors": [
    {}
  ]
}
```

# Graph

## Query graph neighborhood from R2 Data Catalog

`client.CloudforceOne.ThreatEvents.Graph.List(ctx, params) (*ThreatEventGraphListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/graph`

Expands the single-level relationship neighborhood of one or more seed nodes (event, indicator, or tag) from R2 Data Catalog. Seeds use compact id format (type:uuid), e.g. "event:550e8400-...". Multi-seed requests merge and deduplicate results server-side. Hydrates neighbor entities with summary data from Durable Objects. Supports filtering by relationship type and dataset scope.

### Parameters

- `params ThreatEventGraphListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `Cursor param.Field[string]`

    Query param: Opaque pagination token. Only valid when seeds has exactly 1 entry; 400 otherwise.

  - `DatasetIDs param.Field[[]string]`

    Query param: Comma-separated dataset UUIDs to restrict neighbor scope. Intersected with ACL grants.

  - `Direction param.Field[string]`

    Query param: Edge direction relative to each seed: out (seed→neighbors), in (neighbors→seed), both (default).

  - `Expand param.Field[[]string]`

    Query param: Comma-separated list of response sections to expand (hydrate). Allowed: `nodes`. Omitting `expand` returns identifier-only nodes.

  - `Hydration param.Field[string]`

    Query param: Hydration strategy for neighbor nodes when expand=nodes is set. r2_join (default): use R2 JOIN query + DO fallback. do_only: use plain R2 query + hydrate all neighbors via Durable Objects.

  - `Limit param.Field[float64]`

    Query param: Max neighbors per seed (default: 100, max: 1000). Values above 1000 return 400.

  - `MaxNodes param.Field[float64]`

    Query param: Total accumulated node cap across all seeds (default: 500, max: 1000). Values above 1000 return 400.

  - `RelationshipTypes param.Field[[]string]`

    Query param: Comma-separated relationship types to filter by. Allowed: tagged_with, appears_in, related_to, caused_by, attributed_to.

  - `Seeds param.Field[[]string]`

    Query param: Comma-separated compact seed ids (type:uuid). Example: seeds=event:550e8400-...,indicator:661fa920-... Provide 1–50 entries; omitting seeds returns 400.

### Returns

- `type ThreatEventGraphListResponse struct{…}`

  - `Edges []ThreatEventGraphListResponseEdge`

    - `ID string`

      Deterministic composite edge id (source→target:relationshipType)

    - `RelationshipType string`

    - `Source string`

      Compact id of the source node (type:uuid)

    - `SourceID string`

    - `SourceType string`

    - `Target string`

      Compact id of the target node (type:uuid)

    - `TargetID string`

    - `TargetType string`

  - `Node map[string, unknown]`

    Focal node object (legacy single-seed). Null when unavailable.

  - `Nodes []map[string, unknown]`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  graphs, err := client.CloudforceOne.ThreatEvents.Graph.List(context.TODO(), cloudforce_one.ThreatEventGraphListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", graphs.Edges)
}
```

#### Response

```json
{
  "errors": [],
  "messages": [],
  "result": {
    "edges": [
      {
        "id": "event:550e8400-e29b-41d4-a716-446655440000→indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04:appears_in",
        "relationshipType": "appears_in",
        "source": "event:550e8400-e29b-41d4-a716-446655440000",
        "sourceId": "550e8400-e29b-41d4-a716-446655440000",
        "sourceType": "event",
        "target": "indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04",
        "targetId": "661fa920-bbf3-4e71-9c55-2a3d8e7f1b04",
        "targetType": "indicator"
      }
    ],
    "node": null,
    "nodes": [
      {
        "attacker": "APT28",
        "category": "intrusion",
        "datasetId": "a1b2c3d4-0001-4000-8000-000000000001",
        "date": "2026-06-01",
        "event": "Attacker registered domain evil.example.com",
        "id": "event:550e8400-e29b-41d4-a716-446655440000",
        "role": "focal",
        "type": "event",
        "uuid": "550e8400-e29b-41d4-a716-446655440000"
      },
      {
        "datasetId": "a1b2c3d4-0001-4000-8000-000000000001",
        "id": "indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04",
        "indicatorType": "domain",
        "role": "focal",
        "type": "indicator",
        "uuid": "661fa920-bbf3-4e71-9c55-2a3d8e7f1b04",
        "value": "evil.example.com"
      },
      {
        "categoryId": "threat-actor",
        "id": "tag:772af1c8-dc4a-4a29-b3e6-4f8c9d2a6e71",
        "type": "tag",
        "uuid": "772af1c8-dc4a-4a29-b3e6-4f8c9d2a6e71",
        "value": "APT28"
      }
    ]
  },
  "result_info": {
    "count": 3,
    "cursor": null,
    "depth_reached": 1,
    "edge_count": 1,
    "has_more": false,
    "query_time_ms": 890,
    "seeds": [
      "event:550e8400-e29b-41d4-a716-446655440000",
      "indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04"
    ],
    "total_count": 3,
    "truncated": false
  },
  "success": true
}
```

# Queries

## List all saved event queries

`client.CloudforceOne.ThreatEvents.Queries.List(ctx, query) (*[]ThreatEventQueryListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/queries`

Retrieve all saved event queries for the account

### Parameters

- `query ThreatEventQueryListParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventQueryListResponse []ThreatEventQueryListResponse`

  - `ID int64`

    Unique identifier for the saved query

  - `AccountID int64`

    Account ID

  - `AlertEnabled bool`

    Whether alerts are enabled

  - `AlertRollupEnabled bool`

    Whether alert rollup is enabled

  - `CreatedAt string`

    Creation timestamp

  - `Name string`

    Name of the saved query

  - `QueryJson string`

    JSON string containing the query parameters

  - `RuleEnabled bool`

    Whether rule is enabled

  - `UpdatedAt string`

    Last update timestamp

  - `UserEmail string`

    Email of the user who created the query

  - `CustomThreatFeedID int64`

    Intel Indicator Feed ID (numeric)

  - `RuleListID string`

    WAF rules list ID for blocking

  - `RuleScope string`

    Scope for the rule

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  queries, err := client.CloudforceOne.ThreatEvents.Queries.List(context.TODO(), cloudforce_one.ThreatEventQueryListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", queries)
}
```

#### Response

```json
[
  {
    "id": 0,
    "account_id": 0,
    "alert_enabled": true,
    "alert_rollup_enabled": true,
    "created_at": "created_at",
    "name": "name",
    "query_json": "query_json",
    "rule_enabled": true,
    "updated_at": "updated_at",
    "user_email": "user_email",
    "custom_threat_feed_id": 0,
    "rule_list_id": "rule_list_id",
    "rule_scope": "rule_scope"
  }
]
```

## Create a saved event query

`client.CloudforceOne.ThreatEvents.Queries.New(ctx, params) (*ThreatEventQueryNewResponse, error)`

**post** `/accounts/{account_id}/cloudforce-one/events/queries/create`

Create a new saved event query for the account

### Parameters

- `params ThreatEventQueryNewParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `AlertEnabled param.Field[bool]`

    Body param: Enable alerts for this query

  - `AlertRollupEnabled param.Field[bool]`

    Body param: Enable alert rollup for this query

  - `Name param.Field[string]`

    Body param: Unique name for the saved query

  - `QueryJson param.Field[string]`

    Body param: JSON string containing the query parameters

  - `RuleEnabled param.Field[bool]`

    Body param: Enable rule for this query

  - `RuleScope param.Field[string]`

    Body param: Scope for the rule

### Returns

- `type ThreatEventQueryNewResponse struct{…}`

  - `ID int64`

    Unique identifier for the saved query

  - `AccountID int64`

    Account ID

  - `AlertEnabled bool`

    Whether alerts are enabled

  - `AlertRollupEnabled bool`

    Whether alert rollup is enabled

  - `CreatedAt string`

    Creation timestamp

  - `Name string`

    Name of the saved query

  - `QueryJson string`

    JSON string containing the query parameters

  - `RuleEnabled bool`

    Whether rule is enabled

  - `UpdatedAt string`

    Last update timestamp

  - `UserEmail string`

    Email of the user who created the query

  - `CustomThreatFeedID int64`

    Intel Indicator Feed ID (numeric)

  - `RuleListID string`

    WAF rules list ID for blocking

  - `RuleScope string`

    Scope for the rule

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  query, err := client.CloudforceOne.ThreatEvents.Queries.New(context.TODO(), cloudforce_one.ThreatEventQueryNewParams{
    AccountID: cloudflare.F("account_id"),
    AlertEnabled: cloudflare.F(true),
    AlertRollupEnabled: cloudflare.F(true),
    Name: cloudflare.F("name"),
    QueryJson: cloudflare.F("query_json"),
    RuleEnabled: cloudflare.F(true),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", query.ID)
}
```

#### Response

```json
{
  "id": 0,
  "account_id": 0,
  "alert_enabled": true,
  "alert_rollup_enabled": true,
  "created_at": "created_at",
  "name": "name",
  "query_json": "query_json",
  "rule_enabled": true,
  "updated_at": "updated_at",
  "user_email": "user_email",
  "custom_threat_feed_id": 0,
  "rule_list_id": "rule_list_id",
  "rule_scope": "rule_scope"
}
```

## Read a saved event query

`client.CloudforceOne.ThreatEvents.Queries.Get(ctx, queryID, query) (*ThreatEventQueryGetResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/queries/{query_id}`

Retrieve a saved event query by its ID

### Parameters

- `queryID int64`

  Event query ID

- `query ThreatEventQueryGetParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventQueryGetResponse struct{…}`

  - `ID int64`

    Unique identifier for the saved query

  - `AccountID int64`

    Account ID

  - `AlertEnabled bool`

    Whether alerts are enabled

  - `AlertRollupEnabled bool`

    Whether alert rollup is enabled

  - `CreatedAt string`

    Creation timestamp

  - `Name string`

    Name of the saved query

  - `QueryJson string`

    JSON string containing the query parameters

  - `RuleEnabled bool`

    Whether rule is enabled

  - `UpdatedAt string`

    Last update timestamp

  - `UserEmail string`

    Email of the user who created the query

  - `CustomThreatFeedID int64`

    Intel Indicator Feed ID (numeric)

  - `RuleListID string`

    WAF rules list ID for blocking

  - `RuleScope string`

    Scope for the rule

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  query, err := client.CloudforceOne.ThreatEvents.Queries.Get(
    context.TODO(),
    int64(0),
    cloudforce_one.ThreatEventQueryGetParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", query.ID)
}
```

#### Response

```json
{
  "id": 0,
  "account_id": 0,
  "alert_enabled": true,
  "alert_rollup_enabled": true,
  "created_at": "created_at",
  "name": "name",
  "query_json": "query_json",
  "rule_enabled": true,
  "updated_at": "updated_at",
  "user_email": "user_email",
  "custom_threat_feed_id": 0,
  "rule_list_id": "rule_list_id",
  "rule_scope": "rule_scope"
}
```

## Update a saved event query

`client.CloudforceOne.ThreatEvents.Queries.Edit(ctx, queryID, params) (*ThreatEventQueryEditResponse, error)`

**patch** `/accounts/{account_id}/cloudforce-one/events/queries/{query_id}`

Update an existing saved event query by its ID

### Parameters

- `queryID int64`

  Event query ID

- `params ThreatEventQueryEditParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `AlertEnabled param.Field[bool]`

    Body param: Enable alerts for this query

  - `AlertRollupEnabled param.Field[bool]`

    Body param: Enable alert rollup for this query

  - `Name param.Field[string]`

    Body param: Unique name for the saved query

  - `QueryJson param.Field[string]`

    Body param: JSON string containing the query parameters

  - `RuleEnabled param.Field[bool]`

    Body param: Enable rule for this query

  - `RuleScope param.Field[string]`

    Body param: Scope for the rule

### Returns

- `type ThreatEventQueryEditResponse struct{…}`

  - `ID int64`

    Unique identifier for the saved query

  - `AccountID int64`

    Account ID

  - `AlertEnabled bool`

    Whether alerts are enabled

  - `AlertRollupEnabled bool`

    Whether alert rollup is enabled

  - `CreatedAt string`

    Creation timestamp

  - `Name string`

    Name of the saved query

  - `QueryJson string`

    JSON string containing the query parameters

  - `RuleEnabled bool`

    Whether rule is enabled

  - `UpdatedAt string`

    Last update timestamp

  - `UserEmail string`

    Email of the user who created the query

  - `CustomThreatFeedID int64`

    Intel Indicator Feed ID (numeric)

  - `RuleListID string`

    WAF rules list ID for blocking

  - `RuleScope string`

    Scope for the rule

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.CloudforceOne.ThreatEvents.Queries.Edit(
    context.TODO(),
    int64(0),
    cloudforce_one.ThreatEventQueryEditParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.ID)
}
```

#### Response

```json
{
  "id": 0,
  "account_id": 0,
  "alert_enabled": true,
  "alert_rollup_enabled": true,
  "created_at": "created_at",
  "name": "name",
  "query_json": "query_json",
  "rule_enabled": true,
  "updated_at": "updated_at",
  "user_email": "user_email",
  "custom_threat_feed_id": 0,
  "rule_list_id": "rule_list_id",
  "rule_scope": "rule_scope"
}
```

## Delete a saved event query

`client.CloudforceOne.ThreatEvents.Queries.Delete(ctx, queryID, body) error`

**delete** `/accounts/{account_id}/cloudforce-one/events/queries/{query_id}`

Delete a saved event query by its ID

### Parameters

- `queryID int64`

  Event query ID

- `body ThreatEventQueryDeleteParams`

  - `AccountID param.Field[string]`

    Account ID.

### Example

```go
package main

import (
  "context"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  err := client.CloudforceOne.ThreatEvents.Queries.Delete(
    context.TODO(),
    int64(0),
    cloudforce_one.ThreatEventQueryDeleteParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
}
```

# Relationships

## Filter and list events related to specific event

`client.CloudforceOne.ThreatEvents.Relationships.List(ctx, eventID, params) (*[]ThreatEventRelationshipListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships`

The `event_id` must be defined (to list existing events (and their IDs), use the [`Filter and List Events`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/methods/list/) endpoint). Also, must provide query parameters.

### Parameters

- `eventID string`

  Event UUID.

- `params ThreatEventRelationshipListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `DatasetID param.Field[string]`

    Query param: The dataset ID to search within.

  - `Direction param.Field[ThreatEventRelationshipListParamsDirection]`

    Query param: The direction to traverse the graph. Defaults to 'both' to search all.

    - `const ThreatEventRelationshipListParamsDirectionAncestors ThreatEventRelationshipListParamsDirection = "ancestors"`

    - `const ThreatEventRelationshipListParamsDirectionDescendants ThreatEventRelationshipListParamsDirection = "descendants"`

    - `const ThreatEventRelationshipListParamsDirectionBoth ThreatEventRelationshipListParamsDirection = "both"`

  - `IncludeParent param.Field[bool]`

    Query param: Whether to include the starting event in the results. Defaults to true.

  - `IndicatorTypeIDs param.Field[[]string]`

    Query param: An optional array of indicator type IDs to filter the results by.

  - `MaxDepth param.Field[float64]`

    Query param: The maximum depth to traverse. Defaults to 5.

  - `Page param.Field[float64]`

    Query param

  - `PageSize param.Field[float64]`

    Query param

  - `RelationshipTypes param.Field[ThreatEventRelationshipListParamsRelationshipTypesUnion]`

    Query param: An optional array of relationship types to filter by.

    - `UnionString`

    - `type ThreatEventRelationshipListParamsRelationshipTypesArray []string`

### Returns

- `type ThreatEventRelationshipListResponse []ThreatEventRelationshipListResponse`

  - `Attacker string`

  - `AttackerCountry string`

  - `AttackerCountryAlpha3 string`

  - `Category string`

  - `DatasetID string`

  - `Date string`

  - `Event string`

  - `HasChildren bool`

  - `Indicator string`

  - `IndicatorType string`

  - `IndicatorTypeID float64`

  - `KillChain float64`

  - `MitreAttack []string`

  - `MitreCapec []string`

  - `NumReferenced float64`

  - `NumReferences float64`

  - `RawID string`

  - `Referenced []string`

  - `ReferencedIDs []float64`

  - `References []string`

  - `ReferencesIDs []float64`

  - `Tags []string`

  - `TargetCountry string`

  - `TargetCountryAlpha3 string`

  - `TargetIndustry string`

  - `TLP string`

  - `UUID string`

  - `Insight string`

  - `ReleasabilityID string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  relationships, err := client.CloudforceOne.ThreatEvents.Relationships.List(
    context.TODO(),
    "event_id",
    cloudforce_one.ThreatEventRelationshipListParams{
      AccountID: cloudflare.F("account_id"),
      DatasetID: cloudflare.F("datasetId"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", relationships)
}
```

#### Response

```json
[
  {
    "attacker": "Flying Yeti",
    "attackerCountry": "CN",
    "attackerCountryAlpha3": "CHN",
    "category": "Domain Resolution",
    "datasetId": "dataset-example-id",
    "date": "2022-04-01T00:00:00Z",
    "event": "An attacker registered the domain domain.com",
    "hasChildren": true,
    "indicator": "domain.com",
    "indicatorType": "domain",
    "indicatorTypeId": 5,
    "killChain": 0,
    "mitreAttack": [
      " "
    ],
    "mitreCapec": [
      " "
    ],
    "numReferenced": 0,
    "numReferences": 0,
    "rawId": "453gw34w3",
    "referenced": [
      " "
    ],
    "referencedIds": [
      0
    ],
    "references": [
      " "
    ],
    "referencesIds": [
      0
    ],
    "tags": [
      "malware"
    ],
    "targetCountry": "US",
    "targetCountryAlpha3": "USA",
    "targetIndustry": "Agriculture",
    "tlp": "amber",
    "uuid": "12345678-1234-1234-1234-1234567890ab",
    "insight": "insight",
    "releasabilityId": "releasabilityId"
  }
]
```

# Indicators

## Lists indicators across multiple datasets

`client.CloudforceOne.ThreatEvents.Indicators.List(ctx, params) (*ThreatEventIndicatorListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/indicators`

Retrieves a paginated list of indicators across specified datasets. Use datasetIds=all or datasetIds=* to query all datasets for the account. If no datasetIds provided, uses the default dataset.

### Parameters

- `params ThreatEventIndicatorListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `CreatedAfter param.Field[Time]`

    Query param: Filter indicators created on or after this date. Must use ISO 8601 format (e.g., '2024-01-15T00:00:00Z').

  - `CreatedBefore param.Field[Time]`

    Query param: Filter indicators created on or before this date. Must use ISO 8601 format (e.g., '2024-12-31T23:59:59Z').

  - `DatasetIDs param.Field[[]string]`

    Query param: Dataset IDs to query indicators from (array of UUIDs), or special value 'all' or '*' to query all datasets. If not provided, uses the default dataset.

  - `Format param.Field[ThreatEventIndicatorListParamsFormat]`

    Query param: Output format for indicator data. 'json' returns the default format, 'stix2' returns STIX 2.1 Indicator SDOs, 'taxii' returns a TAXII 2.1 Envelope with Content-Type application/taxii+json;version=2.1.

    - `const ThreatEventIndicatorListParamsFormatJson ThreatEventIndicatorListParamsFormat = "json"`

    - `const ThreatEventIndicatorListParamsFormatStix2 ThreatEventIndicatorListParamsFormat = "stix2"`

    - `const ThreatEventIndicatorListParamsFormatTaxii ThreatEventIndicatorListParamsFormat = "taxii"`

  - `IncludeTags param.Field[bool]`

    Query param: Whether to include full tag details for each indicator. Defaults to true.

  - `IncludeTotalCount param.Field[bool]`

    Query param: Whether to compute accurate total count via COUNT(*). Defaults to false for performance. When false, total_count is an approximation.

  - `IndicatorType param.Field[string]`

    Query param

  - `Name param.Field[string]`

    Query param: Filter indicators by value using substring match (LIKE). Legacy alternative to structured search.

  - `Page param.Field[float64]`

    Query param

  - `PageSize param.Field[float64]`

    Query param

  - `RelatedEvents param.Field[[]string]`

    Query param: Filter by related event IDs

  - `RelatedEventsLimit param.Field[float64]`

    Query param: Limit the number of related events returned per indicator. Default: 2. Set to 0 for none, -1 for all events.

  - `Search param.Field[[]ThreatEventIndicatorListParamsSearch]`

    Query param: Structured search as a JSON array of {field, op, value} objects. Searchable fields: value, indicatorType. Supports operators: equals, not, contains, startsWith, endsWith, gt, lt, gte, lte, like, in, find. Use the 'in' operator with an array value to bulk-check up to 100 indicators in a single request, e.g. search=[{"field":"value","op":"in","value":["evil.com","bad.org"]}]. Multiple conditions are AND'd together. Max 10 conditions per request.

    - `Field ThreatEventIndicatorListParamsSearchField`

      The indicator field to search on. Allowed: value, indicatorType.

      - `const ThreatEventIndicatorListParamsSearchFieldValue ThreatEventIndicatorListParamsSearchField = "value"`

      - `const ThreatEventIndicatorListParamsSearchFieldIndicatorType ThreatEventIndicatorListParamsSearchField = "indicatorType"`

    - `Op ThreatEventIndicatorListParamsSearchOp`

      Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'value', op:'in', value:['evil.com','bad.org']}.

      - `const ThreatEventIndicatorListParamsSearchOpEquals ThreatEventIndicatorListParamsSearchOp = "equals"`

      - `const ThreatEventIndicatorListParamsSearchOpNot ThreatEventIndicatorListParamsSearchOp = "not"`

      - `const ThreatEventIndicatorListParamsSearchOpGt ThreatEventIndicatorListParamsSearchOp = "gt"`

      - `const ThreatEventIndicatorListParamsSearchOpGte ThreatEventIndicatorListParamsSearchOp = "gte"`

      - `const ThreatEventIndicatorListParamsSearchOpLt ThreatEventIndicatorListParamsSearchOp = "lt"`

      - `const ThreatEventIndicatorListParamsSearchOpLte ThreatEventIndicatorListParamsSearchOp = "lte"`

      - `const ThreatEventIndicatorListParamsSearchOpLike ThreatEventIndicatorListParamsSearchOp = "like"`

      - `const ThreatEventIndicatorListParamsSearchOpContains ThreatEventIndicatorListParamsSearchOp = "contains"`

      - `const ThreatEventIndicatorListParamsSearchOpStartsWith ThreatEventIndicatorListParamsSearchOp = "startsWith"`

      - `const ThreatEventIndicatorListParamsSearchOpEndsWith ThreatEventIndicatorListParamsSearchOp = "endsWith"`

      - `const ThreatEventIndicatorListParamsSearchOpIn ThreatEventIndicatorListParamsSearchOp = "in"`

      - `const ThreatEventIndicatorListParamsSearchOpFind ThreatEventIndicatorListParamsSearchOp = "find"`

    - `Value ThreatEventIndicatorListParamsSearchValueUnion`

      Search value. String for most operators. Array of strings for 'in' operator (max 100 items).

      - `UnionString`

      - `type ThreatEventIndicatorListParamsSearchValueArray []string`

  - `Source param.Field[ThreatEventIndicatorListParamsSource]`

    Query param: Read backend. 'do' (default) reads Durable Object storage. 'r2catalog' reads R2 Data Catalog (admin-only, experimental; supports a subset of search fields).

    - `const ThreatEventIndicatorListParamsSourceDo ThreatEventIndicatorListParamsSource = "do"`

    - `const ThreatEventIndicatorListParamsSourceR2catalog ThreatEventIndicatorListParamsSource = "r2catalog"`

  - `Tags param.Field[[]string]`

    Query param: Filter by tag values or UUIDs. Indicators must have at least one of the specified tags (OR logic). Supports both tag UUID and tag value.

  - `TagSearch param.Field[[]ThreatEventIndicatorListParamsTagSearch]`

    Query param: Structured tag-metadata filter as a JSON array of {field, op, value} objects. Operates against the per-dataset IndicatorTag mirror so you can find indicators by tag attributes (origin country, motive, sophistication, priority, etc.) without a separate Tags lookup. Common dashboard usage: drill from a country into indicators, e.g. tagSearch=[{"field":"originCountryISO","op":"in","value":["IR","CN"]}]. Country values may be passed as alpha-2, alpha-3, name, or alias (e.g. "iran"). Operators: equals, not, gt/gte/lt/lte (numeric only), contains/like/find/startsWith/endsWith (string only), in. AND-joined across entries; combined with `tags`, a matching tag must satisfy both. Max 10 entries per request, max 100 values per 'in'. Performance notes: `originCountryISO` uses its B-tree index for equals/not/in. `priority` uses its B-tree index for numeric comparisons. Other string columns (`actorCategory`, `motive`, etc.) are case-insensitive and unindexed; current catalog size makes this a non-issue. `endsWith` and `aliasGroupNames` contains/like are leading-wildcard scans and slow on large result sets. `aliasGroupNames` matches on the JSON-encoded text, so substrings can cross alias boundaries ("apt28" also matches "apt280" when both appear in the same tag's alias list).

    - `Field ThreatEventIndicatorListParamsTagSearchField`

      Tag mirror field to filter on. Allowed: value, categoryId, actorCategory, aliasGroupNames, attributionConfidence, attributionOrganization, motive, opsecLevel, originCountryISO, sophisticationLevel, priority, analyticPriority. Filters operate against the per-dataset IndicatorTag mirror (which is kept in sync with the Tags SoT by the tag-propagation workflow).

      - `const ThreatEventIndicatorListParamsTagSearchFieldValue ThreatEventIndicatorListParamsTagSearchField = "value"`

      - `const ThreatEventIndicatorListParamsTagSearchFieldCategoryID ThreatEventIndicatorListParamsTagSearchField = "categoryId"`

      - `const ThreatEventIndicatorListParamsTagSearchFieldActorCategory ThreatEventIndicatorListParamsTagSearchField = "actorCategory"`

      - `const ThreatEventIndicatorListParamsTagSearchFieldAliasGroupNames ThreatEventIndicatorListParamsTagSearchField = "aliasGroupNames"`

      - `const ThreatEventIndicatorListParamsTagSearchFieldAttributionConfidence ThreatEventIndicatorListParamsTagSearchField = "attributionConfidence"`

      - `const ThreatEventIndicatorListParamsTagSearchFieldAttributionOrganization ThreatEventIndicatorListParamsTagSearchField = "attributionOrganization"`

      - `const ThreatEventIndicatorListParamsTagSearchFieldMotive ThreatEventIndicatorListParamsTagSearchField = "motive"`

      - `const ThreatEventIndicatorListParamsTagSearchFieldOpsecLevel ThreatEventIndicatorListParamsTagSearchField = "opsecLevel"`

      - `const ThreatEventIndicatorListParamsTagSearchFieldOriginCountryISO ThreatEventIndicatorListParamsTagSearchField = "originCountryISO"`

      - `const ThreatEventIndicatorListParamsTagSearchFieldSophisticationLevel ThreatEventIndicatorListParamsTagSearchField = "sophisticationLevel"`

      - `const ThreatEventIndicatorListParamsTagSearchFieldPriority ThreatEventIndicatorListParamsTagSearchField = "priority"`

      - `const ThreatEventIndicatorListParamsTagSearchFieldAnalyticPriority ThreatEventIndicatorListParamsTagSearchField = "analyticPriority"`

    - `Op ThreatEventIndicatorListParamsTagSearchOp`

      Search operator. Use 'in' for bulk OR within a single field, e.g. {field:"originCountryISO", op:"in", value:["IR","CN"]}.

      - `const ThreatEventIndicatorListParamsTagSearchOpEquals ThreatEventIndicatorListParamsTagSearchOp = "equals"`

      - `const ThreatEventIndicatorListParamsTagSearchOpNot ThreatEventIndicatorListParamsTagSearchOp = "not"`

      - `const ThreatEventIndicatorListParamsTagSearchOpGt ThreatEventIndicatorListParamsTagSearchOp = "gt"`

      - `const ThreatEventIndicatorListParamsTagSearchOpGte ThreatEventIndicatorListParamsTagSearchOp = "gte"`

      - `const ThreatEventIndicatorListParamsTagSearchOpLt ThreatEventIndicatorListParamsTagSearchOp = "lt"`

      - `const ThreatEventIndicatorListParamsTagSearchOpLte ThreatEventIndicatorListParamsTagSearchOp = "lte"`

      - `const ThreatEventIndicatorListParamsTagSearchOpLike ThreatEventIndicatorListParamsTagSearchOp = "like"`

      - `const ThreatEventIndicatorListParamsTagSearchOpContains ThreatEventIndicatorListParamsTagSearchOp = "contains"`

      - `const ThreatEventIndicatorListParamsTagSearchOpStartsWith ThreatEventIndicatorListParamsTagSearchOp = "startsWith"`

      - `const ThreatEventIndicatorListParamsTagSearchOpEndsWith ThreatEventIndicatorListParamsTagSearchOp = "endsWith"`

      - `const ThreatEventIndicatorListParamsTagSearchOpIn ThreatEventIndicatorListParamsTagSearchOp = "in"`

      - `const ThreatEventIndicatorListParamsTagSearchOpFind ThreatEventIndicatorListParamsTagSearchOp = "find"`

    - `Value ThreatEventIndicatorListParamsTagSearchValueUnion`

      Search value. String or number for most operators. Array for 'in' (max 100 items). Country values may be passed as alpha-2, alpha-3, name, or common alias (e.g. "iran", "IR", "IRN") and are normalized to alpha-2 server-side.

      - `UnionString`

      - `UnionFloat`

      - `type ThreatEventIndicatorListParamsTagSearchValueArray []ThreatEventIndicatorListParamsTagSearchValueArrayUnion`

        - `UnionString`

        - `UnionFloat`

### Returns

- `type ThreatEventIndicatorListResponse struct{…}`

  - `Properties ThreatEventIndicatorListResponseProperties`

    - `Indicators ThreatEventIndicatorListResponsePropertiesIndicators`

      - `Items ThreatEventIndicatorListResponsePropertiesIndicatorsItems`

        - `CreatedAt Time`

        - `IndicatorType string`

        - `UpdatedAt Time`

        - `UUID string`

        - `Value string`

        - `DatasetID string`

          The dataset ID this indicator belongs to. Included in list responses.

        - `RelatedEvents []ThreatEventIndicatorListResponsePropertiesIndicatorsItemsRelatedEvent`

          - `DatasetID string`

          - `EventID string`

        - `Tags []ThreatEventIndicatorListResponsePropertiesIndicatorsItemsTag`

          - `CategoryName string`

          - `UUID string`

          - `Value string`

      - `Type string`

    - `Pagination ThreatEventIndicatorListResponsePropertiesPagination`

      - `Properties ThreatEventIndicatorListResponsePropertiesPaginationProperties`

        - `Count ThreatEventIndicatorListResponsePropertiesPaginationPropertiesCount`

          - `Type string`

        - `Page ThreatEventIndicatorListResponsePropertiesPaginationPropertiesPage`

          - `Type string`

        - `PerPage ThreatEventIndicatorListResponsePropertiesPaginationPropertiesPerPage`

          - `Type string`

        - `TotalCount ThreatEventIndicatorListResponsePropertiesPaginationPropertiesTotalCount`

          - `Type string`

      - `Type string`

  - `Type string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  indicators, err := client.CloudforceOne.ThreatEvents.Indicators.List(context.TODO(), cloudforce_one.ThreatEventIndicatorListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", indicators.Properties)
}
```

#### Response

```json
{
  "properties": {
    "indicators": {
      "items": {
        "createdAt": "2022-04-01T00:00:00Z",
        "indicatorType": "domain",
        "updatedAt": "2022-04-01T00:00:00Z",
        "uuid": "12345678-1234-1234-1234-1234567890ab",
        "value": "malicious-domain.com",
        "datasetId": "dataset-uuid-123",
        "relatedEvents": [
          {
            "datasetId": "dataset-uuid-123",
            "eventId": "event-uuid-456"
          }
        ],
        "tags": [
          {
            "categoryName": "categoryName",
            "uuid": "uuid",
            "value": "value"
          }
        ]
      },
      "type": "array"
    },
    "pagination": {
      "properties": {
        "count": {
          "type": "number"
        },
        "page": {
          "type": "number"
        },
        "per_page": {
          "type": "number"
        },
        "total_count": {
          "type": "number"
        }
      },
      "type": "object"
    }
  },
  "type": "object"
}
```

# Aggregate

## Aggregate indicators by column(s)

`client.CloudforceOne.ThreatEvents.Indicators.Aggregate.List(ctx, params) (*ThreatEventIndicatorAggregateListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/indicators/aggregate`

Aggregate threat indicators by one or more columns (e.g., indicatorType, value) across datasets. Returns top-N groups ordered by count.

### Parameters

- `params ThreatEventIndicatorAggregateListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `AggregateBy param.Field[string]`

    Query param: Column(s) to aggregate by - single column or comma-separated list (e.g., 'indicatorType', 'value', 'indicatorType,value')

  - `CreatedAfter param.Field[string]`

    Query param: Filter indicators created after this date (ISO 8601 format, e.g., '2024-01-01')

  - `CreatedBefore param.Field[string]`

    Query param: Filter indicators created before this date (ISO 8601 format, e.g., '2024-12-31')

  - `DatasetIDs param.Field[[]string]`

    Query param: Dataset ID(s) to filter by. Can be a single dataset ID or comma-separated list. If not provided, aggregates across all accessible datasets

  - `EventDateAfter param.Field[string]`

    Query param: For measure=relationships: only count event links whose eventDate is on/after this date (ISO 8601). Use to bound 'top indicator' to recent activity.

  - `EventDateBefore param.Field[string]`

    Query param: For measure=relationships: only count event links whose eventDate is on/before this date (ISO 8601).

  - `Limit param.Field[float64]`

    Query param: Maximum number of aggregation results to return (1-100)

  - `Measure param.Field[ThreatEventIndicatorAggregateListParamsMeasure]`

    Query param: What to count per group: 'indicators' (catalog rows, default) or 'relationships' (linked events per indicator). Use 'relationships' for 'top indicator by event activity'.

    - `const ThreatEventIndicatorAggregateListParamsMeasureIndicators ThreatEventIndicatorAggregateListParamsMeasure = "indicators"`

    - `const ThreatEventIndicatorAggregateListParamsMeasureRelationships ThreatEventIndicatorAggregateListParamsMeasure = "relationships"`

  - `TagUUID param.Field[string]`

    Query param: Scope to indicators associated with this tag/actor UUID. Combine with measure=relationships for 'top indicator for an actor'.

### Returns

- `type ThreatEventIndicatorAggregateListResponse struct{…}`

  - `AggregateBy string`

    Column(s) that were aggregated by

  - `Aggregations []ThreatEventIndicatorAggregateListResponseAggregation`

    Array of aggregation results with dynamic fields based on aggregateBy columns

    - `Count float64`

      Number of indicators for this aggregation

  - `FailedDatasets float64`

    Number of datasets whose aggregation failed and were excluded from the result

  - `Total float64`

    Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  aggregates, err := client.CloudforceOne.ThreatEvents.Indicators.Aggregate.List(context.TODO(), cloudforce_one.ThreatEventIndicatorAggregateListParams{
    AccountID: cloudflare.F("account_id"),
    AggregateBy: cloudflare.F("aggregateBy"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", aggregates.AggregateBy)
}
```

#### Response

```json
{
  "aggregateBy": "aggregateBy",
  "aggregations": [
    {
      "count": 0
    }
  ],
  "failedDatasets": 0,
  "total": 0
}
```

# Types

## Lists indicator types across multiple datasets

`client.CloudforceOne.ThreatEvents.Indicators.Types.List(ctx, params) (*ThreatEventIndicatorTypeListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/indicator-types`

List indicator types across one or more datasets for the account.

### Parameters

- `params ThreatEventIndicatorTypeListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `DatasetIDs param.Field[[]string]`

    Query param: Array of dataset IDs to query indicator types from. If not provided, queries all datasets for the account.

### Returns

- `type ThreatEventIndicatorTypeListResponse struct{…}`

  - `Items ThreatEventIndicatorTypeListResponseItems`

    - `Type string`

  - `Type string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  types, err := client.CloudforceOne.ThreatEvents.Indicators.Types.List(context.TODO(), cloudforce_one.ThreatEventIndicatorTypeListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", types.Items)
}
```

#### Response

```json
{
  "items": {
    "type": "string"
  },
  "type": "array"
}
```

# By Dataset

## Lists indicators

`client.CloudforceOne.ThreatEvents.Indicators.ByDataset.List(ctx, datasetID, params) (*ThreatEventIndicatorByDatasetListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators`

This method is deprecated. Please use /events/indicators to retrieve a paginated list of indicators.

### Parameters

- `datasetID string`

  Dataset UUID.

- `params ThreatEventIndicatorByDatasetListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `IndicatorType param.Field[string]`

    Query param

  - `Name param.Field[string]`

    Query param: Filter by indicator value (substring match)

  - `Page param.Field[float64]`

    Query param

  - `PageSize param.Field[float64]`

    Query param

  - `RelatedEvent param.Field[[]string]`

    Query param: Filter indicators by related event UUID(s). Multiple UUIDs can be provided by repeating the parameter.

### Returns

- `type ThreatEventIndicatorByDatasetListResponse struct{…}`

  - `Indicators []ThreatEventIndicatorByDatasetListResponseIndicator`

    - `CreatedAt Time`

    - `IndicatorType string`

    - `UpdatedAt Time`

    - `UUID string`

    - `Value string`

    - `DatasetID string`

      The dataset ID this indicator belongs to. Included in list responses.

    - `RelatedEvents []ThreatEventIndicatorByDatasetListResponseIndicatorsRelatedEvent`

      - `DatasetID string`

      - `EventID string`

    - `Tags []ThreatEventIndicatorByDatasetListResponseIndicatorsTag`

      - `CategoryName string`

      - `UUID string`

      - `Value string`

  - `Pagination ThreatEventIndicatorByDatasetListResponsePagination`

    - `Page float64`

    - `PageSize float64`

    - `TotalCount float64`

    - `TotalPages float64`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  byDatasets, err := client.CloudforceOne.ThreatEvents.Indicators.ByDataset.List(
    context.TODO(),
    "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
    cloudforce_one.ThreatEventIndicatorByDatasetListParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", byDatasets.Indicators)
}
```

#### Response

```json
{
  "indicators": [
    {
      "createdAt": "2022-04-01T00:00:00Z",
      "indicatorType": "domain",
      "updatedAt": "2022-04-01T00:00:00Z",
      "uuid": "12345678-1234-1234-1234-1234567890ab",
      "value": "malicious-domain.com",
      "datasetId": "dataset-uuid-123",
      "relatedEvents": [
        {
          "datasetId": "dataset-uuid-123",
          "eventId": "event-uuid-456"
        }
      ],
      "tags": [
        {
          "categoryName": "categoryName",
          "uuid": "uuid",
          "value": "value"
        }
      ]
    }
  ],
  "pagination": {
    "page": 0,
    "pageSize": 0,
    "totalCount": 0,
    "totalPages": 0
  }
}
```

## Reads an indicator

`client.CloudforceOne.ThreatEvents.Indicators.ByDataset.Get(ctx, datasetID, indicatorID, query) (*ThreatEventIndicatorByDatasetGetResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}`

Retrieves a specific indicator by its UUID.

### Parameters

- `datasetID string`

  Dataset ID.

- `indicatorID string`

  Indicator UUID.

- `query ThreatEventIndicatorByDatasetGetParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventIndicatorByDatasetGetResponse struct{…}`

  - `CreatedAt Time`

  - `IndicatorType string`

  - `UpdatedAt Time`

  - `UUID string`

  - `Value string`

  - `DatasetID string`

    The dataset ID this indicator belongs to. Included in list responses.

  - `RelatedEvents []ThreatEventIndicatorByDatasetGetResponseRelatedEvent`

    - `DatasetID string`

    - `EventID string`

  - `Tags []ThreatEventIndicatorByDatasetGetResponseTag`

    - `CategoryName string`

    - `UUID string`

    - `Value string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  byDataset, err := client.CloudforceOne.ThreatEvents.Indicators.ByDataset.Get(
    context.TODO(),
    "dataset_id",
    "indicator_id",
    cloudforce_one.ThreatEventIndicatorByDatasetGetParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", byDataset.UUID)
}
```

#### Response

```json
{
  "createdAt": "2022-04-01T00:00:00Z",
  "indicatorType": "domain",
  "updatedAt": "2022-04-01T00:00:00Z",
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "value": "malicious-domain.com",
  "datasetId": "dataset-uuid-123",
  "relatedEvents": [
    {
      "datasetId": "dataset-uuid-123",
      "eventId": "event-uuid-456"
    }
  ],
  "tags": [
    {
      "categoryName": "categoryName",
      "uuid": "uuid",
      "value": "value"
    }
  ]
}
```

# Tags

## List mirrored tags for an indicator dataset

`client.CloudforceOne.ThreatEvents.Indicators.ByDataset.Tags.List(ctx, datasetID, query) (*[]ThreatEventIndicatorByDatasetTagListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags`

Returns all mirrored tags from the indicator dataset (DO mirror table). No pagination.

### Parameters

- `datasetID string`

  Dataset ID.

- `query ThreatEventIndicatorByDatasetTagListParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventIndicatorByDatasetTagListResponse []ThreatEventIndicatorByDatasetTagListResponse`

  Array of mirror tag rows

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  tags, err := client.CloudforceOne.ThreatEvents.Indicators.ByDataset.Tags.List(
    context.TODO(),
    "dataset_id",
    cloudforce_one.ThreatEventIndicatorByDatasetTagListParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", tags)
}
```

#### Response

```json
[
  {}
]
```

# Attackers

## Lists attackers across multiple datasets

`client.CloudforceOne.ThreatEvents.Attackers.List(ctx, params) (*ThreatEventAttackerListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/attackers`

List attacker names referenced in events across one or more datasets.

### Parameters

- `params ThreatEventAttackerListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `DatasetIDs param.Field[[]string]`

    Query param: Array of dataset IDs to query attackers from. If not provided, uses the default dataset.

### Returns

- `type ThreatEventAttackerListResponse struct{…}`

  - `Items ThreatEventAttackerListResponseItems`

    - `Type string`

  - `Type string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  attackers, err := client.CloudforceOne.ThreatEvents.Attackers.List(context.TODO(), cloudforce_one.ThreatEventAttackerListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", attackers.Items)
}
```

#### Response

```json
{
  "items": {
    "type": "string"
  },
  "type": "array"
}
```

# Categories

## Lists categories across multiple datasets

`client.CloudforceOne.ThreatEvents.Categories.List(ctx, params) (*[]ThreatEventCategoryListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/categories`

List categories across one or more datasets for the account.

### Parameters

- `params ThreatEventCategoryListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `DatasetIDs param.Field[[]string]`

    Query param: Array of dataset IDs to query categories from. If not provided, uses the default dataset.

### Returns

- `type ThreatEventCategoryListResponse []ThreatEventCategoryListResponse`

  - `KillChain float64`

  - `Name string`

  - `UUID string`

  - `MitreAttack []string`

  - `MitreCapec []string`

  - `Shortname string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  categories, err := client.CloudforceOne.ThreatEvents.Categories.List(context.TODO(), cloudforce_one.ThreatEventCategoryListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", categories)
}
```

#### Response

```json
[
  {
    "killChain": 0,
    "name": "name",
    "uuid": "12345678-1234-1234-1234-1234567890ab",
    "mitreAttack": [
      "T1234"
    ],
    "mitreCapec": [
      "123"
    ],
    "shortname": "shortname"
  }
]
```

## Reads a category

`client.CloudforceOne.ThreatEvents.Categories.Get(ctx, categoryID, query) (*ThreatEventCategoryGetResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/categories/{category_id}`

Retrieve a single category by its identifier.

### Parameters

- `categoryID string`

  Category UUID.

- `query ThreatEventCategoryGetParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventCategoryGetResponse struct{…}`

  - `KillChain float64`

  - `Name string`

  - `UUID string`

  - `MitreAttack []string`

  - `MitreCapec []string`

  - `Shortname string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  category, err := client.CloudforceOne.ThreatEvents.Categories.Get(
    context.TODO(),
    "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
    cloudforce_one.ThreatEventCategoryGetParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", category.UUID)
}
```

#### Response

```json
{
  "killChain": 0,
  "name": "name",
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "mitreAttack": [
    "T1234"
  ],
  "mitreCapec": [
    "123"
  ],
  "shortname": "shortname"
}
```

## Creates a new category

`client.CloudforceOne.ThreatEvents.Categories.New(ctx, params) (*ThreatEventCategoryNewResponse, error)`

**post** `/accounts/{account_id}/cloudforce-one/events/categories/create`

Create a new event category for the account.

### Parameters

- `params ThreatEventCategoryNewParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `KillChain param.Field[float64]`

    Body param

  - `Name param.Field[string]`

    Body param

  - `MitreAttack param.Field[[]string]`

    Body param

  - `MitreCapec param.Field[[]string]`

    Body param

  - `Shortname param.Field[string]`

    Body param

### Returns

- `type ThreatEventCategoryNewResponse struct{…}`

  - `KillChain float64`

  - `Name string`

  - `UUID string`

  - `MitreAttack []string`

  - `MitreCapec []string`

  - `Shortname string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  category, err := client.CloudforceOne.ThreatEvents.Categories.New(context.TODO(), cloudforce_one.ThreatEventCategoryNewParams{
    AccountID: cloudflare.F("account_id"),
    KillChain: cloudflare.F(0.000000),
    Name: cloudflare.F("name"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", category.UUID)
}
```

#### Response

```json
{
  "killChain": 0,
  "name": "name",
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "mitreAttack": [
    "T1234"
  ],
  "mitreCapec": [
    "123"
  ],
  "shortname": "shortname"
}
```

## Updates a category

`client.CloudforceOne.ThreatEvents.Categories.Edit(ctx, categoryID, params) (*ThreatEventCategoryEditResponse, error)`

**patch** `/accounts/{account_id}/cloudforce-one/events/categories/{category_id}`

Update an existing category by its identifier.

### Parameters

- `categoryID string`

  Category UUID.

- `params ThreatEventCategoryEditParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `KillChain param.Field[float64]`

    Body param

  - `MitreAttack param.Field[[]string]`

    Body param

  - `MitreCapec param.Field[[]string]`

    Body param

  - `Name param.Field[string]`

    Body param

  - `Shortname param.Field[string]`

    Body param

### Returns

- `type ThreatEventCategoryEditResponse struct{…}`

  - `KillChain float64`

  - `Name string`

  - `UUID string`

  - `MitreAttack []string`

  - `MitreCapec []string`

  - `Shortname string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.CloudforceOne.ThreatEvents.Categories.Edit(
    context.TODO(),
    "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
    cloudforce_one.ThreatEventCategoryEditParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.UUID)
}
```

#### Response

```json
{
  "killChain": 0,
  "name": "name",
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "mitreAttack": [
    "T1234"
  ],
  "mitreCapec": [
    "123"
  ],
  "shortname": "shortname"
}
```

## Deletes a category

`client.CloudforceOne.ThreatEvents.Categories.Delete(ctx, categoryID, body) (*ThreatEventCategoryDeleteResponse, error)`

**delete** `/accounts/{account_id}/cloudforce-one/events/categories/{category_id}`

Delete a category by its identifier.

### Parameters

- `categoryID string`

  Category UUID.

- `body ThreatEventCategoryDeleteParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventCategoryDeleteResponse struct{…}`

  - `UUID string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  category, err := client.CloudforceOne.ThreatEvents.Categories.Delete(
    context.TODO(),
    "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
    cloudforce_one.ThreatEventCategoryDeleteParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", category.UUID)
}
```

#### Response

```json
{
  "uuid": "12345678-1234-1234-1234-1234567890ab"
}
```

# Catalog

## Lists categories

`client.CloudforceOne.ThreatEvents.Categories.Catalog.List(ctx, query) (*[]ThreatEventCategoryCatalogListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/categories/catalog`

List all categories stored in the account catalog.

### Parameters

- `query ThreatEventCategoryCatalogListParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventCategoryCatalogListResponse []ThreatEventCategoryCatalogListResponse`

  - `KillChain float64`

  - `Name string`

  - `UUID string`

  - `MitreAttack []string`

  - `MitreCapec []string`

  - `Shortname string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  catalogs, err := client.CloudforceOne.ThreatEvents.Categories.Catalog.List(context.TODO(), cloudforce_one.ThreatEventCategoryCatalogListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", catalogs)
}
```

#### Response

```json
[
  {
    "killChain": 0,
    "name": "name",
    "uuid": "12345678-1234-1234-1234-1234567890ab",
    "mitreAttack": [
      "T1234"
    ],
    "mitreCapec": [
      "123"
    ],
    "shortname": "shortname"
  }
]
```

# Countries

## Retrieves countries information for all countries

`client.CloudforceOne.ThreatEvents.Countries.List(ctx, query) (*[]ThreatEventCountryListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/countries`

Retrieve country code information for all supported countries.

### Parameters

- `query ThreatEventCountryListParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventCountryListResponse []ThreatEventCountryListResponse`

  - `Result []ThreatEventCountryListResponseResult`

    - `Alpha2 string`

    - `Alpha3 string`

    - `Name string`

  - `Success string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  countries, err := client.CloudforceOne.ThreatEvents.Countries.List(context.TODO(), cloudforce_one.ThreatEventCountryListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", countries)
}
```

#### Response

```json
[
  {
    "result": [
      {
        "alpha2": "AF",
        "alpha3": "AF",
        "name": "Afghanistan"
      }
    ],
    "success": "true"
  }
]
```

# Crons

# Datasets

## Lists all datasets in an account

`client.CloudforceOne.ThreatEvents.Datasets.List(ctx, params) (*[]ThreatEventDatasetListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/dataset`

List all datasets accessible to the account.

### Parameters

- `params ThreatEventDatasetListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `IncludeDeleted param.Field[bool]`

    Query param: When true, include soft-deleted datasets in the response. Each item includes a `deletedAt` field (ISO 8601 or null). Default: false.

### Returns

- `type ThreatEventDatasetListResponse []ThreatEventDatasetListResponse`

  - `IsPublic bool`

  - `Name string`

  - `UUID string`

  - `DeletedAt string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  datasets, err := client.CloudforceOne.ThreatEvents.Datasets.List(context.TODO(), cloudforce_one.ThreatEventDatasetListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", datasets)
}
```

#### Response

```json
[
  {
    "isPublic": true,
    "name": "friendly dataset name",
    "uuid": "12345678-1234-1234-1234-1234567890ab",
    "deletedAt": "deletedAt"
  }
]
```

## Reads a dataset

`client.CloudforceOne.ThreatEvents.Datasets.Get(ctx, datasetID, query) (*ThreatEventDatasetGetResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}`

Retrieve metadata for a specific dataset.

### Parameters

- `datasetID string`

  Dataset ID.

- `query ThreatEventDatasetGetParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventDatasetGetResponse struct{…}`

  - `IsPublic bool`

  - `Name string`

  - `UUID string`

  - `DeletedAt string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  dataset, err := client.CloudforceOne.ThreatEvents.Datasets.Get(
    context.TODO(),
    "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
    cloudforce_one.ThreatEventDatasetGetParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", dataset.UUID)
}
```

#### Response

```json
{
  "isPublic": true,
  "name": "friendly dataset name",
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "deletedAt": "deletedAt"
}
```

## Creates a dataset

`client.CloudforceOne.ThreatEvents.Datasets.New(ctx, params) (*ThreatEventDatasetNewResponse, error)`

**post** `/accounts/{account_id}/cloudforce-one/events/dataset/create`

Create a new dataset in the account.

### Parameters

- `params ThreatEventDatasetNewParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `IsPublic param.Field[bool]`

    Body param: If true, then anyone can search the dataset. If false, then its limited to the account.

  - `Name param.Field[string]`

    Body param: Used to describe the dataset within the account context.

### Returns

- `type ThreatEventDatasetNewResponse struct{…}`

  - `IsPublic bool`

  - `Name string`

  - `UUID string`

  - `DeletedAt string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  dataset, err := client.CloudforceOne.ThreatEvents.Datasets.New(context.TODO(), cloudforce_one.ThreatEventDatasetNewParams{
    AccountID: cloudflare.F("account_id"),
    IsPublic: cloudflare.F(true),
    Name: cloudflare.F("x"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", dataset.UUID)
}
```

#### Response

```json
{
  "isPublic": true,
  "name": "friendly dataset name",
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "deletedAt": "deletedAt"
}
```

## Updates an existing dataset

`client.CloudforceOne.ThreatEvents.Datasets.Edit(ctx, datasetID, params) (*ThreatEventDatasetEditResponse, error)`

**patch** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}`

Update an existing dataset by its identifier.

### Parameters

- `datasetID string`

  Dataset ID.

- `params ThreatEventDatasetEditParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `IsPublic param.Field[bool]`

    Body param: If true, then anyone can search the dataset. If false, then its limited to the account.

  - `Name param.Field[string]`

    Body param: Used to describe the dataset within the account context.

### Returns

- `type ThreatEventDatasetEditResponse struct{…}`

  - `IsPublic bool`

  - `Name string`

  - `UUID string`

  - `DeletedAt string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.CloudforceOne.ThreatEvents.Datasets.Edit(
    context.TODO(),
    "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
    cloudforce_one.ThreatEventDatasetEditParams{
      AccountID: cloudflare.F("account_id"),
      IsPublic: cloudflare.F(true),
      Name: cloudflare.F("x"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.UUID)
}
```

#### Response

```json
{
  "isPublic": true,
  "name": "friendly dataset name",
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "deletedAt": "deletedAt"
}
```

## Delete a dataset

`client.CloudforceOne.ThreatEvents.Datasets.Delete(ctx, datasetID, body) (*ThreatEventDatasetDeleteResponse, error)`

**delete** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}`

Soft-deletes a dataset given a datasetId.

### Parameters

- `datasetID string`

  Dataset ID to delete

- `body ThreatEventDatasetDeleteParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventDatasetDeleteResponse struct{…}`

  - `Name string`

  - `UUID string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  dataset, err := client.CloudforceOne.ThreatEvents.Datasets.Delete(
    context.TODO(),
    "dataset_id",
    cloudforce_one.ThreatEventDatasetDeleteParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", dataset.UUID)
}
```

#### Response

```json
{
  "name": "friendly dataset name",
  "uuid": "12345678-1234-1234-1234-1234567890ab"
}
```

## Reads raw data for an event by UUID

`client.CloudforceOne.ThreatEvents.Datasets.Raw(ctx, datasetID, eventID, query) (*ThreatEventDatasetRawResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}`

Retrieves the raw data associated with an event. Searches across all shards in the dataset.

### Parameters

- `datasetID string`

  Dataset ID.

- `eventID string`

  Event ID.

- `query ThreatEventDatasetRawParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventDatasetRawResponse struct{…}`

  - `ID float64`

  - `AccountID float64`

  - `Created string`

  - `Data string`

  - `Source string`

  - `TLP string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.CloudforceOne.ThreatEvents.Datasets.Raw(
    context.TODO(),
    "dataset_id",
    "event_id",
    cloudforce_one.ThreatEventDatasetRawParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.ID)
}
```

#### Response

```json
{
  "id": 1,
  "accountId": 1234,
  "created": "1970-01-01T00:00:00.000Z",
  "data": "{\"foo\": \"bar\"}",
  "source": "https://example.com",
  "tlp": "amber"
}
```

# Health

# Events

## Reads an event

`client.CloudforceOne.ThreatEvents.Datasets.Events.Get(ctx, datasetID, eventID, query) (*ThreatEventDatasetEventGetResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}`

Retrieves a specific event by its UUID.

### Parameters

- `datasetID string`

  Dataset ID.

- `eventID string`

  Event UUID.

- `query ThreatEventDatasetEventGetParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventDatasetEventGetResponse struct{…}`

  - `Attacker string`

  - `AttackerCountry string`

  - `AttackerCountryAlpha3 string`

  - `Category string`

  - `DatasetID string`

  - `Date string`

  - `Event string`

  - `HasChildren bool`

  - `Indicator string`

  - `IndicatorType string`

  - `IndicatorTypeID float64`

  - `KillChain float64`

  - `MitreAttack []string`

  - `MitreCapec []string`

  - `NumReferenced float64`

  - `NumReferences float64`

  - `RawID string`

  - `Referenced []string`

  - `ReferencedIDs []float64`

  - `References []string`

  - `ReferencesIDs []float64`

  - `Tags []string`

  - `TargetCountry string`

  - `TargetCountryAlpha3 string`

  - `TargetIndustry string`

  - `TLP string`

  - `UUID string`

  - `Insight string`

  - `ReleasabilityID string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  event, err := client.CloudforceOne.ThreatEvents.Datasets.Events.Get(
    context.TODO(),
    "dataset_id",
    "event_id",
    cloudforce_one.ThreatEventDatasetEventGetParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", event.UUID)
}
```

#### Response

```json
{
  "attacker": "Flying Yeti",
  "attackerCountry": "CN",
  "attackerCountryAlpha3": "CHN",
  "category": "Domain Resolution",
  "datasetId": "dataset-example-id",
  "date": "2022-04-01T00:00:00Z",
  "event": "An attacker registered the domain domain.com",
  "hasChildren": true,
  "indicator": "domain.com",
  "indicatorType": "domain",
  "indicatorTypeId": 5,
  "killChain": 0,
  "mitreAttack": [
    " "
  ],
  "mitreCapec": [
    " "
  ],
  "numReferenced": 0,
  "numReferences": 0,
  "rawId": "453gw34w3",
  "referenced": [
    " "
  ],
  "referencedIds": [
    0
  ],
  "references": [
    " "
  ],
  "referencesIds": [
    0
  ],
  "tags": [
    "malware"
  ],
  "targetCountry": "US",
  "targetCountryAlpha3": "USA",
  "targetIndustry": "Agriculture",
  "tlp": "amber",
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "insight": "insight",
  "releasabilityId": "releasabilityId"
}
```

# Indicator Types

## Lists all indicator types

`client.CloudforceOne.ThreatEvents.IndicatorTypes.List(ctx, query) (*ThreatEventIndicatorTypeListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/indicatorTypes`

This Method is deprecated. Please use /events/dataset/:dataset_id/indicatorTypes instead.

### Parameters

- `query ThreatEventIndicatorTypeListParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventIndicatorTypeListResponse struct{…}`

  - `Items ThreatEventIndicatorTypeListResponseItems`

    - `Type string`

  - `Type string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  indicatorTypes, err := client.CloudforceOne.ThreatEvents.IndicatorTypes.List(context.TODO(), cloudforce_one.ThreatEventIndicatorTypeListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", indicatorTypes.Items)
}
```

#### Response

```json
{
  "items": {
    "type": "string"
  },
  "type": "array"
}
```

# Raw

## Reads data for a raw event

`client.CloudforceOne.ThreatEvents.Raw.Get(ctx, eventID, rawID, query) (*ThreatEventRawGetResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}`

Retrieve raw data for a specific event.

### Parameters

- `eventID string`

  Event UUID.

- `rawID string`

  Raw Event UUID.

- `query ThreatEventRawGetParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventRawGetResponse struct{…}`

  - `ID string`

  - `AccountID float64`

  - `Created string`

  - `Data unknown`

  - `Source string`

  - `TLP string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  raw, err := client.CloudforceOne.ThreatEvents.Raw.Get(
    context.TODO(),
    "event_id",
    "raw_id",
    cloudforce_one.ThreatEventRawGetParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", raw.ID)
}
```

#### Response

```json
{
  "id": "1234",
  "accountId": 1234,
  "created": "1970-01-01",
  "data": {},
  "source": "https://example.com",
  "tlp": "amber"
}
```

## Updates a raw event

`client.CloudforceOne.ThreatEvents.Raw.Edit(ctx, eventID, rawID, params) (*ThreatEventRawEditResponse, error)`

**patch** `/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}`

Update raw data for a specific event.

### Parameters

- `eventID string`

  Event UUID.

- `rawID string`

  Raw Event UUID.

- `params ThreatEventRawEditParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `Data param.Field[unknown]`

    Body param

  - `Source param.Field[string]`

    Body param

  - `TLP param.Field[string]`

    Body param

### Returns

- `type ThreatEventRawEditResponse struct{…}`

  - `ID string`

  - `Data unknown`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.CloudforceOne.ThreatEvents.Raw.Edit(
    context.TODO(),
    "event_id",
    "raw_id",
    cloudforce_one.ThreatEventRawEditParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.ID)
}
```

#### Response

```json
{
  "id": "1234",
  "data": {}
}
```

# Relate

## Removes an event reference

`client.CloudforceOne.ThreatEvents.Relate.Delete(ctx, eventID, body) (*ThreatEventRelateDeleteResponse, error)`

**delete** `/accounts/{account_id}/cloudforce-one/events/relate/{event_id}`

Remove one or more references from an event.

### Parameters

- `eventID string`

  Event UUID.

- `body ThreatEventRelateDeleteParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventRelateDeleteResponse struct{…}`

  - `Success bool`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  relate, err := client.CloudforceOne.ThreatEvents.Relate.Delete(
    context.TODO(),
    "event_id",
    cloudforce_one.ThreatEventRelateDeleteParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", relate.Success)
}
```

#### Response

```json
{
  "result": {
    "success": true
  },
  "success": true
}
```

# Tags

## Lists all tags (SoT)

`client.CloudforceOne.ThreatEvents.Tags.List(ctx, params) (*ThreatEventTagListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/tags`

Returns all Source-of-Truth tags for an account. Supports legacy free-text `search` on tag value and `categoryUuid` exact match, plus a structured `filters` JSON array for filtering by metadata fields (originCountryISO, actorCategory, motive, priority, etc.). Country values may be passed as alpha-2, alpha-3, name, or common alias.

### Parameters

- `params ThreatEventTagListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `CategoryUUID param.Field[string]`

    Query param

  - `Filters param.Field[[]ThreatEventTagListParamsFilter]`

    Query param: Structured filters as a JSON array of {field, op, value} objects. Searchable fields: uuid, value, actorCategory, actorCategoryConfidence, aliasGroupNames, attributionConfidence, attributionConfidenceScore, attributionOrganization, categoryName, motive, motiveConfidence, opsecLevel, originCountryISO, originCountryConfidence, sophisticationLevel, priority, analyticPriority. Operators: equals, not, contains, startsWith, endsWith, gt, lt, gte, lte, like, in, find. Use 'in' for bulk OR within a single field, e.g. filters=[{"field":"originCountryISO","op":"in","value":["IR","CN"]}]. Multiple entries are AND-joined. Max 10 entries per request, max 100 values per 'in'. Per-field notes: `uuid` accepts only 'equals' and 'in' (other operators throw ValidationError) — matched against the canonical lowercase storage but callers may pass either case (the server lowercases before comparison); index-backed by the column's UNIQUE constraint and intended for batched UUID → tag resolution. `originCountryISO` uses its B-tree index for equals/not/in. `priority` uses its B-tree index for numeric comparisons. Other string columns (`actorCategory`, `motive`, etc.) are case-insensitive and unindexed; current catalog size makes this a non-issue. `endsWith` and `aliasGroupNames` contains/like are leading-wildcard scans and slow on large result sets. `aliasGroupNames` matches on the JSON-encoded text, so substrings can cross alias boundaries (a search for "apt28" will also match "apt280" if both appear in the same tag's alias list).

    - `Field ThreatEventTagListParamsFiltersField`

      Tag field to search on. Allowed: uuid, value, actorCategory, actorCategoryConfidence, aliasGroupNames, attributionConfidence, attributionConfidenceScore, attributionOrganization, categoryName, motive, motiveConfidence, opsecLevel, originCountryISO, originCountryConfidence, sophisticationLevel, priority, analyticPriority.

      - `const ThreatEventTagListParamsFiltersFieldUUID ThreatEventTagListParamsFiltersField = "uuid"`

      - `const ThreatEventTagListParamsFiltersFieldValue ThreatEventTagListParamsFiltersField = "value"`

      - `const ThreatEventTagListParamsFiltersFieldActorCategory ThreatEventTagListParamsFiltersField = "actorCategory"`

      - `const ThreatEventTagListParamsFiltersFieldActorCategoryConfidence ThreatEventTagListParamsFiltersField = "actorCategoryConfidence"`

      - `const ThreatEventTagListParamsFiltersFieldAliasGroupNames ThreatEventTagListParamsFiltersField = "aliasGroupNames"`

      - `const ThreatEventTagListParamsFiltersFieldAttributionConfidence ThreatEventTagListParamsFiltersField = "attributionConfidence"`

      - `const ThreatEventTagListParamsFiltersFieldAttributionConfidenceScore ThreatEventTagListParamsFiltersField = "attributionConfidenceScore"`

      - `const ThreatEventTagListParamsFiltersFieldAttributionOrganization ThreatEventTagListParamsFiltersField = "attributionOrganization"`

      - `const ThreatEventTagListParamsFiltersFieldCategoryName ThreatEventTagListParamsFiltersField = "categoryName"`

      - `const ThreatEventTagListParamsFiltersFieldMotive ThreatEventTagListParamsFiltersField = "motive"`

      - `const ThreatEventTagListParamsFiltersFieldMotiveConfidence ThreatEventTagListParamsFiltersField = "motiveConfidence"`

      - `const ThreatEventTagListParamsFiltersFieldOpsecLevel ThreatEventTagListParamsFiltersField = "opsecLevel"`

      - `const ThreatEventTagListParamsFiltersFieldOriginCountryISO ThreatEventTagListParamsFiltersField = "originCountryISO"`

      - `const ThreatEventTagListParamsFiltersFieldOriginCountryConfidence ThreatEventTagListParamsFiltersField = "originCountryConfidence"`

      - `const ThreatEventTagListParamsFiltersFieldSophisticationLevel ThreatEventTagListParamsFiltersField = "sophisticationLevel"`

      - `const ThreatEventTagListParamsFiltersFieldPriority ThreatEventTagListParamsFiltersField = "priority"`

      - `const ThreatEventTagListParamsFiltersFieldAnalyticPriority ThreatEventTagListParamsFiltersField = "analyticPriority"`

    - `Op ThreatEventTagListParamsFiltersOp`

      Search operator. Use 'in' for bulk OR within a single field, e.g. {field:"originCountryISO", op:"in", value:["IR","CN"]}.

      - `const ThreatEventTagListParamsFiltersOpEquals ThreatEventTagListParamsFiltersOp = "equals"`

      - `const ThreatEventTagListParamsFiltersOpNot ThreatEventTagListParamsFiltersOp = "not"`

      - `const ThreatEventTagListParamsFiltersOpGt ThreatEventTagListParamsFiltersOp = "gt"`

      - `const ThreatEventTagListParamsFiltersOpGte ThreatEventTagListParamsFiltersOp = "gte"`

      - `const ThreatEventTagListParamsFiltersOpLt ThreatEventTagListParamsFiltersOp = "lt"`

      - `const ThreatEventTagListParamsFiltersOpLte ThreatEventTagListParamsFiltersOp = "lte"`

      - `const ThreatEventTagListParamsFiltersOpLike ThreatEventTagListParamsFiltersOp = "like"`

      - `const ThreatEventTagListParamsFiltersOpContains ThreatEventTagListParamsFiltersOp = "contains"`

      - `const ThreatEventTagListParamsFiltersOpStartsWith ThreatEventTagListParamsFiltersOp = "startsWith"`

      - `const ThreatEventTagListParamsFiltersOpEndsWith ThreatEventTagListParamsFiltersOp = "endsWith"`

      - `const ThreatEventTagListParamsFiltersOpIn ThreatEventTagListParamsFiltersOp = "in"`

      - `const ThreatEventTagListParamsFiltersOpFind ThreatEventTagListParamsFiltersOp = "find"`

    - `Value ThreatEventTagListParamsFiltersValueUnion`

      Search value. String or number for most operators. Array for 'in' (max 100 items). Country values may be passed as alpha-2, alpha-3, name, or common alias (e.g. 'iran', 'IR', 'IRN') and are normalized to alpha-2 server-side.

      - `UnionString`

      - `UnionFloat`

      - `type ThreatEventTagListParamsFiltersValueArray []ThreatEventTagListParamsFiltersValueArrayUnion`

        - `UnionString`

        - `UnionFloat`

  - `Page param.Field[float64]`

    Query param

  - `PageSize param.Field[float64]`

    Query param

  - `Search param.Field[string]`

    Query param: Legacy free-text substring match on tag value.

### Returns

- `type ThreatEventTagListResponse struct{…}`

  - `Pagination ThreatEventTagListResponsePagination`

    - `Page float64`

    - `PageSize float64`

    - `TotalCount float64`

    - `TotalPages float64`

  - `Tags []ThreatEventTagListResponseTag`

    - `UUID string`

    - `Value string`

    - `ActiveDuration string`

    - `ActorCategory string`

    - `ActorCategoryConfidence int64`

      Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

    - `Aliases []ThreatEventTagListResponseTagsAlias`

      Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

      - `Value string`

      - `Confidence int64`

      - `TLP ThreatEventTagListResponseTagsAliasesTLP`

        - `const ThreatEventTagListResponseTagsAliasesTLPRed ThreatEventTagListResponseTagsAliasesTLP = "red"`

        - `const ThreatEventTagListResponseTagsAliasesTLPAmber ThreatEventTagListResponseTagsAliasesTLP = "amber"`

        - `const ThreatEventTagListResponseTagsAliasesTLPGreen ThreatEventTagListResponseTagsAliasesTLP = "green"`

        - `const ThreatEventTagListResponseTagsAliasesTLPWhite ThreatEventTagListResponseTagsAliasesTLP = "white"`

    - `AliasGroupNames []string`

    - `AliasGroupNamesInternal []string`

    - `AnalyticPriority float64`

    - `AttributionConfidence string`

    - `AttributionConfidenceScore int64`

    - `AttributionOrganization string`

    - `CategoryName string`

    - `CategoryUUID string`

    - `DateOfDiscovery string`

    - `ExternalReferenceLinks []string`

    - `ExternalReferences []ThreatEventTagListResponseTagsExternalReference`

      Structured external references ({ url, description }). Public: returned to all accounts.

      - `URL string`

      - `Description string`

    - `InternalAliases []ThreatEventTagListResponseTagsInternalAlias`

      Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

      - `Value string`

      - `Confidence int64`

      - `TLP ThreatEventTagListResponseTagsInternalAliasesTLP`

        - `const ThreatEventTagListResponseTagsInternalAliasesTLPRed ThreatEventTagListResponseTagsInternalAliasesTLP = "red"`

        - `const ThreatEventTagListResponseTagsInternalAliasesTLPAmber ThreatEventTagListResponseTagsInternalAliasesTLP = "amber"`

        - `const ThreatEventTagListResponseTagsInternalAliasesTLPGreen ThreatEventTagListResponseTagsInternalAliasesTLP = "green"`

        - `const ThreatEventTagListResponseTagsInternalAliasesTLPWhite ThreatEventTagListResponseTagsInternalAliasesTLP = "white"`

    - `InternalDescription string`

    - `Motive string`

    - `MotiveConfidence int64`

      Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

    - `OpsecLevel string`

    - `OriginCountryConfidence int64`

      Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

    - `OriginCountryISO string`

    - `OriginCountryISOAlpha3 string`

    - `OriginCountryTLP ThreatEventTagListResponseTagsOriginCountryTLP`

      TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

      - `const ThreatEventTagListResponseTagsOriginCountryTLPRed ThreatEventTagListResponseTagsOriginCountryTLP = "red"`

      - `const ThreatEventTagListResponseTagsOriginCountryTLPAmber ThreatEventTagListResponseTagsOriginCountryTLP = "amber"`

      - `const ThreatEventTagListResponseTagsOriginCountryTLPGreen ThreatEventTagListResponseTagsOriginCountryTLP = "green"`

      - `const ThreatEventTagListResponseTagsOriginCountryTLPWhite ThreatEventTagListResponseTagsOriginCountryTLP = "white"`

    - `Priority float64`

    - `SophisticationLevel string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  tags, err := client.CloudforceOne.ThreatEvents.Tags.List(context.TODO(), cloudforce_one.ThreatEventTagListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", tags.Pagination)
}
```

#### Response

```json
{
  "pagination": {
    "page": 0,
    "pageSize": 0,
    "totalCount": 0,
    "totalPages": 0
  },
  "tags": [
    {
      "uuid": "12345678-1234-1234-1234-1234567890ab",
      "value": "APT28",
      "activeDuration": "activeDuration",
      "actorCategory": "actorCategory",
      "actorCategoryConfidence": 7,
      "aliases": [
        {
          "value": "Fancy Bear",
          "confidence": 8,
          "tlp": "amber"
        }
      ],
      "aliasGroupNames": [
        "string"
      ],
      "aliasGroupNamesInternal": [
        "string"
      ],
      "analyticPriority": 0,
      "attributionConfidence": "attributionConfidence",
      "attributionConfidenceScore": 7,
      "attributionOrganization": "attributionOrganization",
      "categoryName": "Nation State",
      "categoryUuid": "12345678-1234-1234-1234-1234567890ab",
      "dateOfDiscovery": "2024-01-15",
      "externalReferenceLinks": [
        "string"
      ],
      "externalReferences": [
        {
          "url": "https://example.com/report",
          "description": "Vendor threat report"
        }
      ],
      "internalAliases": [
        {
          "value": "Fancy Bear",
          "confidence": 8,
          "tlp": "amber"
        }
      ],
      "internalDescription": "internalDescription",
      "motive": "motive",
      "motiveConfidence": 7,
      "opsecLevel": "opsecLevel",
      "originCountryConfidence": 7,
      "originCountryISO": "originCountryISO",
      "originCountryISOAlpha3": "IRN",
      "originCountryTlp": "amber",
      "priority": 0,
      "sophisticationLevel": "sophisticationLevel"
    }
  ]
}
```

## Creates a new tag

`client.CloudforceOne.ThreatEvents.Tags.New(ctx, params) (*ThreatEventTagNewResponse, error)`

**post** `/accounts/{account_id}/cloudforce-one/events/tags/create`

Creates a new tag to be used accross threat events.

### Parameters

- `params ThreatEventTagNewParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `Value param.Field[string]`

    Body param

  - `ActiveDuration param.Field[string]`

    Body param

  - `ActorCategory param.Field[string]`

    Body param: Actor variety. Allowed values: Activist, Competitor, Customer, Crime Syndicate, Former Employee, Nation State, Organized Crime, Nation State Affiliated, Terrorist, Unaffiliated.

  - `ActorCategoryConfidence param.Field[int64]`

    Body param: Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

  - `Aliases param.Field[[]ThreatEventTagNewParamsAlias]`

    Body param: Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

    - `Value string`

    - `Confidence int64`

    - `TLP ThreatEventTagNewParamsAliasesTLP`

      - `const ThreatEventTagNewParamsAliasesTLPRed ThreatEventTagNewParamsAliasesTLP = "red"`

      - `const ThreatEventTagNewParamsAliasesTLPAmber ThreatEventTagNewParamsAliasesTLP = "amber"`

      - `const ThreatEventTagNewParamsAliasesTLPGreen ThreatEventTagNewParamsAliasesTLP = "green"`

      - `const ThreatEventTagNewParamsAliasesTLPWhite ThreatEventTagNewParamsAliasesTLP = "white"`

  - `AliasGroupNames param.Field[[]string]`

    Body param

  - `AliasGroupNamesInternal param.Field[[]string]`

    Body param

  - `AnalyticPriority param.Field[float64]`

    Body param

  - `AttributionConfidence param.Field[string]`

    Body param

  - `AttributionConfidenceScore param.Field[int64]`

    Body param

  - `AttributionOrganization param.Field[string]`

    Body param

  - `CategoryUUID param.Field[string]`

    Body param

  - `DateOfDiscovery param.Field[string]`

    Body param: Date the actor was discovered (ISO YYYY-MM-DD).

  - `ExternalReferenceLinks param.Field[[]string]`

    Body param

  - `ExternalReferences param.Field[[]ThreatEventTagNewParamsExternalReference]`

    Body param: Structured external references ({ url, description }). Public: returned to all accounts.

    - `URL string`

    - `Description string`

  - `InternalAliases param.Field[[]ThreatEventTagNewParamsInternalAlias]`

    Body param: Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

    - `Value string`

    - `Confidence int64`

    - `TLP ThreatEventTagNewParamsInternalAliasesTLP`

      - `const ThreatEventTagNewParamsInternalAliasesTLPRed ThreatEventTagNewParamsInternalAliasesTLP = "red"`

      - `const ThreatEventTagNewParamsInternalAliasesTLPAmber ThreatEventTagNewParamsInternalAliasesTLP = "amber"`

      - `const ThreatEventTagNewParamsInternalAliasesTLPGreen ThreatEventTagNewParamsInternalAliasesTLP = "green"`

      - `const ThreatEventTagNewParamsInternalAliasesTLPWhite ThreatEventTagNewParamsInternalAliasesTLP = "white"`

  - `InternalDescription param.Field[string]`

    Body param

  - `Motive param.Field[string]`

    Body param: Actor motive. Allowed values: Convenience, Fear, Fun, Financial, Grudge, Ideology, Espionage.

  - `MotiveConfidence param.Field[int64]`

    Body param: Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

  - `OpsecLevel param.Field[string]`

    Body param

  - `OriginCountryConfidence param.Field[int64]`

    Body param: Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

  - `OriginCountryISO param.Field[string]`

    Body param

  - `OriginCountryTLP param.Field[ThreatEventTagNewParamsOriginCountryTLP]`

    Body param: TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

    - `const ThreatEventTagNewParamsOriginCountryTLPRed ThreatEventTagNewParamsOriginCountryTLP = "red"`

    - `const ThreatEventTagNewParamsOriginCountryTLPAmber ThreatEventTagNewParamsOriginCountryTLP = "amber"`

    - `const ThreatEventTagNewParamsOriginCountryTLPGreen ThreatEventTagNewParamsOriginCountryTLP = "green"`

    - `const ThreatEventTagNewParamsOriginCountryTLPWhite ThreatEventTagNewParamsOriginCountryTLP = "white"`

  - `Priority param.Field[float64]`

    Body param

  - `SophisticationLevel param.Field[string]`

    Body param

### Returns

- `type ThreatEventTagNewResponse struct{…}`

  - `UUID string`

  - `Value string`

  - `ActiveDuration string`

  - `ActorCategory string`

  - `ActorCategoryConfidence int64`

    Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

  - `Aliases []ThreatEventTagNewResponseAlias`

    Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

    - `Value string`

    - `Confidence int64`

    - `TLP ThreatEventTagNewResponseAliasesTLP`

      - `const ThreatEventTagNewResponseAliasesTLPRed ThreatEventTagNewResponseAliasesTLP = "red"`

      - `const ThreatEventTagNewResponseAliasesTLPAmber ThreatEventTagNewResponseAliasesTLP = "amber"`

      - `const ThreatEventTagNewResponseAliasesTLPGreen ThreatEventTagNewResponseAliasesTLP = "green"`

      - `const ThreatEventTagNewResponseAliasesTLPWhite ThreatEventTagNewResponseAliasesTLP = "white"`

  - `AliasGroupNames []string`

  - `AliasGroupNamesInternal []string`

  - `AnalyticPriority float64`

  - `AttributionConfidence string`

  - `AttributionConfidenceScore int64`

  - `AttributionOrganization string`

  - `CategoryName string`

  - `CategoryUUID string`

  - `DateOfDiscovery string`

  - `ExternalReferenceLinks []string`

  - `ExternalReferences []ThreatEventTagNewResponseExternalReference`

    Structured external references ({ url, description }). Public: returned to all accounts.

    - `URL string`

    - `Description string`

  - `InternalAliases []ThreatEventTagNewResponseInternalAlias`

    Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

    - `Value string`

    - `Confidence int64`

    - `TLP ThreatEventTagNewResponseInternalAliasesTLP`

      - `const ThreatEventTagNewResponseInternalAliasesTLPRed ThreatEventTagNewResponseInternalAliasesTLP = "red"`

      - `const ThreatEventTagNewResponseInternalAliasesTLPAmber ThreatEventTagNewResponseInternalAliasesTLP = "amber"`

      - `const ThreatEventTagNewResponseInternalAliasesTLPGreen ThreatEventTagNewResponseInternalAliasesTLP = "green"`

      - `const ThreatEventTagNewResponseInternalAliasesTLPWhite ThreatEventTagNewResponseInternalAliasesTLP = "white"`

  - `InternalDescription string`

  - `Motive string`

  - `MotiveConfidence int64`

    Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

  - `OpsecLevel string`

  - `OriginCountryConfidence int64`

    Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

  - `OriginCountryISO string`

  - `OriginCountryISOAlpha3 string`

  - `OriginCountryTLP ThreatEventTagNewResponseOriginCountryTLP`

    TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

    - `const ThreatEventTagNewResponseOriginCountryTLPRed ThreatEventTagNewResponseOriginCountryTLP = "red"`

    - `const ThreatEventTagNewResponseOriginCountryTLPAmber ThreatEventTagNewResponseOriginCountryTLP = "amber"`

    - `const ThreatEventTagNewResponseOriginCountryTLPGreen ThreatEventTagNewResponseOriginCountryTLP = "green"`

    - `const ThreatEventTagNewResponseOriginCountryTLPWhite ThreatEventTagNewResponseOriginCountryTLP = "white"`

  - `Priority float64`

  - `SophisticationLevel string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  tag, err := client.CloudforceOne.ThreatEvents.Tags.New(context.TODO(), cloudforce_one.ThreatEventTagNewParams{
    AccountID: cloudflare.F("account_id"),
    Value: cloudflare.F("APT28"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", tag.UUID)
}
```

#### Response

```json
{
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "value": "APT28",
  "activeDuration": "activeDuration",
  "actorCategory": "actorCategory",
  "actorCategoryConfidence": 7,
  "aliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "aliasGroupNames": [
    "string"
  ],
  "aliasGroupNamesInternal": [
    "string"
  ],
  "analyticPriority": 0,
  "attributionConfidence": "attributionConfidence",
  "attributionConfidenceScore": 7,
  "attributionOrganization": "attributionOrganization",
  "categoryName": "Nation State",
  "categoryUuid": "12345678-1234-1234-1234-1234567890ab",
  "dateOfDiscovery": "2024-01-15",
  "externalReferenceLinks": [
    "string"
  ],
  "externalReferences": [
    {
      "url": "https://example.com/report",
      "description": "Vendor threat report"
    }
  ],
  "internalAliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "internalDescription": "internalDescription",
  "motive": "motive",
  "motiveConfidence": 7,
  "opsecLevel": "opsecLevel",
  "originCountryConfidence": 7,
  "originCountryISO": "originCountryISO",
  "originCountryISOAlpha3": "IRN",
  "originCountryTlp": "amber",
  "priority": 0,
  "sophisticationLevel": "sophisticationLevel"
}
```

## Updates a tag (SoT)

`client.CloudforceOne.ThreatEvents.Tags.Edit(ctx, tagUUID, params) (*ThreatEventTagEditResponse, error)`

**patch** `/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}`

Updates a Source-of-Truth tag by UUID.

### Parameters

- `tagUUID string`

  Tag UUID.

- `params ThreatEventTagEditParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `ActiveDuration param.Field[string]`

    Body param

  - `ActorCategory param.Field[string]`

    Body param: Actor variety. Allowed values: Activist, Competitor, Customer, Crime Syndicate, Former Employee, Nation State, Organized Crime, Nation State Affiliated, Terrorist, Unaffiliated.

  - `ActorCategoryConfidence param.Field[int64]`

    Body param: Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

  - `Aliases param.Field[[]ThreatEventTagEditParamsAlias]`

    Body param: Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

    - `Value string`

    - `Confidence int64`

    - `TLP ThreatEventTagEditParamsAliasesTLP`

      - `const ThreatEventTagEditParamsAliasesTLPRed ThreatEventTagEditParamsAliasesTLP = "red"`

      - `const ThreatEventTagEditParamsAliasesTLPAmber ThreatEventTagEditParamsAliasesTLP = "amber"`

      - `const ThreatEventTagEditParamsAliasesTLPGreen ThreatEventTagEditParamsAliasesTLP = "green"`

      - `const ThreatEventTagEditParamsAliasesTLPWhite ThreatEventTagEditParamsAliasesTLP = "white"`

  - `AliasGroupNames param.Field[[]string]`

    Body param

  - `AliasGroupNamesInternal param.Field[[]string]`

    Body param

  - `AnalyticPriority param.Field[float64]`

    Body param

  - `AttributionConfidence param.Field[string]`

    Body param

  - `AttributionConfidenceScore param.Field[int64]`

    Body param

  - `AttributionOrganization param.Field[string]`

    Body param

  - `CategoryUUID param.Field[string]`

    Body param

  - `DateOfDiscovery param.Field[string]`

    Body param: Date the actor was discovered (ISO YYYY-MM-DD).

  - `ExternalReferenceLinks param.Field[[]string]`

    Body param

  - `ExternalReferences param.Field[[]ThreatEventTagEditParamsExternalReference]`

    Body param: Structured external references ({ url, description }). Public: returned to all accounts.

    - `URL string`

    - `Description string`

  - `InternalAliases param.Field[[]ThreatEventTagEditParamsInternalAlias]`

    Body param: Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

    - `Value string`

    - `Confidence int64`

    - `TLP ThreatEventTagEditParamsInternalAliasesTLP`

      - `const ThreatEventTagEditParamsInternalAliasesTLPRed ThreatEventTagEditParamsInternalAliasesTLP = "red"`

      - `const ThreatEventTagEditParamsInternalAliasesTLPAmber ThreatEventTagEditParamsInternalAliasesTLP = "amber"`

      - `const ThreatEventTagEditParamsInternalAliasesTLPGreen ThreatEventTagEditParamsInternalAliasesTLP = "green"`

      - `const ThreatEventTagEditParamsInternalAliasesTLPWhite ThreatEventTagEditParamsInternalAliasesTLP = "white"`

  - `InternalDescription param.Field[string]`

    Body param

  - `Motive param.Field[string]`

    Body param: Actor motive. Allowed values: Convenience, Fear, Fun, Financial, Grudge, Ideology, Espionage.

  - `MotiveConfidence param.Field[int64]`

    Body param: Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

  - `OpsecLevel param.Field[string]`

    Body param

  - `OriginCountryConfidence param.Field[int64]`

    Body param: Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

  - `OriginCountryISO param.Field[string]`

    Body param

  - `OriginCountryTLP param.Field[ThreatEventTagEditParamsOriginCountryTLP]`

    Body param: TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

    - `const ThreatEventTagEditParamsOriginCountryTLPRed ThreatEventTagEditParamsOriginCountryTLP = "red"`

    - `const ThreatEventTagEditParamsOriginCountryTLPAmber ThreatEventTagEditParamsOriginCountryTLP = "amber"`

    - `const ThreatEventTagEditParamsOriginCountryTLPGreen ThreatEventTagEditParamsOriginCountryTLP = "green"`

    - `const ThreatEventTagEditParamsOriginCountryTLPWhite ThreatEventTagEditParamsOriginCountryTLP = "white"`

  - `Priority param.Field[float64]`

    Body param

  - `SophisticationLevel param.Field[string]`

    Body param

  - `Value param.Field[string]`

    Body param

### Returns

- `type ThreatEventTagEditResponse struct{…}`

  - `UUID string`

  - `Value string`

  - `ActiveDuration string`

  - `ActorCategory string`

  - `ActorCategoryConfidence int64`

    Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

  - `Aliases []ThreatEventTagEditResponseAlias`

    Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

    - `Value string`

    - `Confidence int64`

    - `TLP ThreatEventTagEditResponseAliasesTLP`

      - `const ThreatEventTagEditResponseAliasesTLPRed ThreatEventTagEditResponseAliasesTLP = "red"`

      - `const ThreatEventTagEditResponseAliasesTLPAmber ThreatEventTagEditResponseAliasesTLP = "amber"`

      - `const ThreatEventTagEditResponseAliasesTLPGreen ThreatEventTagEditResponseAliasesTLP = "green"`

      - `const ThreatEventTagEditResponseAliasesTLPWhite ThreatEventTagEditResponseAliasesTLP = "white"`

  - `AliasGroupNames []string`

  - `AliasGroupNamesInternal []string`

  - `AnalyticPriority float64`

  - `AttributionConfidence string`

  - `AttributionConfidenceScore int64`

  - `AttributionOrganization string`

  - `CategoryName string`

  - `CategoryUUID string`

  - `DateOfDiscovery string`

  - `ExternalReferenceLinks []string`

  - `ExternalReferences []ThreatEventTagEditResponseExternalReference`

    Structured external references ({ url, description }). Public: returned to all accounts.

    - `URL string`

    - `Description string`

  - `InternalAliases []ThreatEventTagEditResponseInternalAlias`

    Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

    - `Value string`

    - `Confidence int64`

    - `TLP ThreatEventTagEditResponseInternalAliasesTLP`

      - `const ThreatEventTagEditResponseInternalAliasesTLPRed ThreatEventTagEditResponseInternalAliasesTLP = "red"`

      - `const ThreatEventTagEditResponseInternalAliasesTLPAmber ThreatEventTagEditResponseInternalAliasesTLP = "amber"`

      - `const ThreatEventTagEditResponseInternalAliasesTLPGreen ThreatEventTagEditResponseInternalAliasesTLP = "green"`

      - `const ThreatEventTagEditResponseInternalAliasesTLPWhite ThreatEventTagEditResponseInternalAliasesTLP = "white"`

  - `InternalDescription string`

  - `Motive string`

  - `MotiveConfidence int64`

    Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

  - `OpsecLevel string`

  - `OriginCountryConfidence int64`

    Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

  - `OriginCountryISO string`

  - `OriginCountryISOAlpha3 string`

  - `OriginCountryTLP ThreatEventTagEditResponseOriginCountryTLP`

    TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

    - `const ThreatEventTagEditResponseOriginCountryTLPRed ThreatEventTagEditResponseOriginCountryTLP = "red"`

    - `const ThreatEventTagEditResponseOriginCountryTLPAmber ThreatEventTagEditResponseOriginCountryTLP = "amber"`

    - `const ThreatEventTagEditResponseOriginCountryTLPGreen ThreatEventTagEditResponseOriginCountryTLP = "green"`

    - `const ThreatEventTagEditResponseOriginCountryTLPWhite ThreatEventTagEditResponseOriginCountryTLP = "white"`

  - `Priority float64`

  - `SophisticationLevel string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.CloudforceOne.ThreatEvents.Tags.Edit(
    context.TODO(),
    "tag_uuid",
    cloudforce_one.ThreatEventTagEditParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.UUID)
}
```

#### Response

```json
{
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "value": "APT28",
  "activeDuration": "activeDuration",
  "actorCategory": "actorCategory",
  "actorCategoryConfidence": 7,
  "aliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "aliasGroupNames": [
    "string"
  ],
  "aliasGroupNamesInternal": [
    "string"
  ],
  "analyticPriority": 0,
  "attributionConfidence": "attributionConfidence",
  "attributionConfidenceScore": 7,
  "attributionOrganization": "attributionOrganization",
  "categoryName": "Nation State",
  "categoryUuid": "12345678-1234-1234-1234-1234567890ab",
  "dateOfDiscovery": "2024-01-15",
  "externalReferenceLinks": [
    "string"
  ],
  "externalReferences": [
    {
      "url": "https://example.com/report",
      "description": "Vendor threat report"
    }
  ],
  "internalAliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "internalDescription": "internalDescription",
  "motive": "motive",
  "motiveConfidence": 7,
  "opsecLevel": "opsecLevel",
  "originCountryConfidence": 7,
  "originCountryISO": "originCountryISO",
  "originCountryISOAlpha3": "IRN",
  "originCountryTlp": "amber",
  "priority": 0,
  "sophisticationLevel": "sophisticationLevel"
}
```

## Deletes a tag (SoT)

`client.CloudforceOne.ThreatEvents.Tags.Delete(ctx, tagUUID, body) (*ThreatEventTagDeleteResponse, error)`

**delete** `/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}`

Deletes a Source-of-Truth tag by UUID.

### Parameters

- `tagUUID string`

  Tag UUID.

- `body ThreatEventTagDeleteParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventTagDeleteResponse struct{…}`

  - `UUID string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  tag, err := client.CloudforceOne.ThreatEvents.Tags.Delete(
    context.TODO(),
    "tag_uuid",
    cloudforce_one.ThreatEventTagDeleteParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", tag.UUID)
}
```

#### Response

```json
{
  "uuid": "12345678-1234-1234-1234-1234567890ab"
}
```

# Categories

## Lists all tag categories (SoT)

`client.CloudforceOne.ThreatEvents.Tags.Categories.List(ctx, params) (*ThreatEventTagCategoryListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/tags/categories`

Returns all Source-of-Truth tag categories for an account.

### Parameters

- `params ThreatEventTagCategoryListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `Search param.Field[string]`

    Query param

### Returns

- `type ThreatEventTagCategoryListResponse struct{…}`

  - `Categories []ThreatEventTagCategoryListResponseCategory`

    - `Name string`

    - `UUID string`

    - `CreatedAt string`

    - `Description string`

    - `UpdatedAt string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  categories, err := client.CloudforceOne.ThreatEvents.Tags.Categories.List(context.TODO(), cloudforce_one.ThreatEventTagCategoryListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", categories.Categories)
}
```

#### Response

```json
{
  "categories": [
    {
      "name": "Actor",
      "uuid": "12345678-1234-1234-1234-1234567890ab",
      "createdAt": "createdAt",
      "description": "description",
      "updatedAt": "updatedAt"
    }
  ]
}
```

## Creates a new tag category (SoT)

`client.CloudforceOne.ThreatEvents.Tags.Categories.New(ctx, params) (*ThreatEventTagCategoryNewResponse, error)`

**post** `/accounts/{account_id}/cloudforce-one/events/tags/categories/create`

Creates a new Source-of-Truth tag category for an account.

### Parameters

- `params ThreatEventTagCategoryNewParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `Name param.Field[string]`

    Body param

  - `Description param.Field[string]`

    Body param

### Returns

- `type ThreatEventTagCategoryNewResponse struct{…}`

  - `Name string`

  - `UUID string`

  - `CreatedAt string`

  - `Description string`

  - `UpdatedAt string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  category, err := client.CloudforceOne.ThreatEvents.Tags.Categories.New(context.TODO(), cloudforce_one.ThreatEventTagCategoryNewParams{
    AccountID: cloudflare.F("account_id"),
    Name: cloudflare.F("Actor"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", category.UUID)
}
```

#### Response

```json
{
  "name": "Actor",
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "createdAt": "createdAt",
  "description": "description",
  "updatedAt": "updatedAt"
}
```

## Updates a tag category (SoT)

`client.CloudforceOne.ThreatEvents.Tags.Categories.Edit(ctx, categoryUUID, params) (*ThreatEventTagCategoryEditResponse, error)`

**patch** `/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}`

Updates a Source-of-Truth tag category by UUID.

### Parameters

- `categoryUUID string`

  Tag Category UUID.

- `params ThreatEventTagCategoryEditParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `Description param.Field[string]`

    Body param

  - `Name param.Field[string]`

    Body param

### Returns

- `type ThreatEventTagCategoryEditResponse struct{…}`

  - `Name string`

  - `UUID string`

  - `CreatedAt string`

  - `Description string`

  - `UpdatedAt string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.CloudforceOne.ThreatEvents.Tags.Categories.Edit(
    context.TODO(),
    "category_uuid",
    cloudforce_one.ThreatEventTagCategoryEditParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.UUID)
}
```

#### Response

```json
{
  "name": "Actor",
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "createdAt": "createdAt",
  "description": "description",
  "updatedAt": "updatedAt"
}
```

## Deletes a tag category (SoT)

`client.CloudforceOne.ThreatEvents.Tags.Categories.Delete(ctx, categoryUUID, body) (*ThreatEventTagCategoryDeleteResponse, error)`

**delete** `/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}`

Deletes a Source-of-Truth tag category by UUID.

### Parameters

- `categoryUUID string`

  Tag Category UUID.

- `body ThreatEventTagCategoryDeleteParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventTagCategoryDeleteResponse struct{…}`

  - `UUID string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  category, err := client.CloudforceOne.ThreatEvents.Tags.Categories.Delete(
    context.TODO(),
    "category_uuid",
    cloudforce_one.ThreatEventTagCategoryDeleteParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", category.UUID)
}
```

#### Response

```json
{
  "uuid": "12345678-1234-1234-1234-1234567890ab"
}
```

# Indicators

## List indicators related to a tag

`client.CloudforceOne.ThreatEvents.Tags.Indicators.List(ctx, tagUUID, params) (*ThreatEventTagIndicatorListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators`

Returns indicators associated with the provided tag UUID, with pagination. By default fans out across every indicator dataset the account can read; pass datasetIds to scope to specific datasets.

### Parameters

- `tagUUID string`

  Tag UUID.

- `params ThreatEventTagIndicatorListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `DatasetIDs param.Field[[]string]`

    Query param: Dataset UUIDs to scope to (repeat the param for multiple), or 'all' / '*' for every readable indicator dataset. Omit to search all readable datasets.

  - `IndicatorType param.Field[string]`

    Query param

  - `Page param.Field[float64]`

    Query param

  - `PageSize param.Field[float64]`

    Query param

  - `RelatedEvent param.Field[[]string]`

    Query param: Filter indicators by related event UUID(s). Multiple UUIDs can be provided by repeating the parameter.

  - `Search param.Field[[]ThreatEventTagIndicatorListParamsSearch]`

    Query param: Structured search as a JSON array of {field, op, value} objects. Searchable fields: value, indicatorType. Multiple conditions are AND'd together. Max 10 conditions per request.

    - `Field ThreatEventTagIndicatorListParamsSearchField`

      The indicator field to search on. Allowed: value, indicatorType.

      - `const ThreatEventTagIndicatorListParamsSearchFieldValue ThreatEventTagIndicatorListParamsSearchField = "value"`

      - `const ThreatEventTagIndicatorListParamsSearchFieldIndicatorType ThreatEventTagIndicatorListParamsSearchField = "indicatorType"`

    - `Op ThreatEventTagIndicatorListParamsSearchOp`

      Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'value', op:'in', value:['evil.com','bad.org']}.

      - `const ThreatEventTagIndicatorListParamsSearchOpEquals ThreatEventTagIndicatorListParamsSearchOp = "equals"`

      - `const ThreatEventTagIndicatorListParamsSearchOpNot ThreatEventTagIndicatorListParamsSearchOp = "not"`

      - `const ThreatEventTagIndicatorListParamsSearchOpGt ThreatEventTagIndicatorListParamsSearchOp = "gt"`

      - `const ThreatEventTagIndicatorListParamsSearchOpGte ThreatEventTagIndicatorListParamsSearchOp = "gte"`

      - `const ThreatEventTagIndicatorListParamsSearchOpLt ThreatEventTagIndicatorListParamsSearchOp = "lt"`

      - `const ThreatEventTagIndicatorListParamsSearchOpLte ThreatEventTagIndicatorListParamsSearchOp = "lte"`

      - `const ThreatEventTagIndicatorListParamsSearchOpLike ThreatEventTagIndicatorListParamsSearchOp = "like"`

      - `const ThreatEventTagIndicatorListParamsSearchOpContains ThreatEventTagIndicatorListParamsSearchOp = "contains"`

      - `const ThreatEventTagIndicatorListParamsSearchOpStartsWith ThreatEventTagIndicatorListParamsSearchOp = "startsWith"`

      - `const ThreatEventTagIndicatorListParamsSearchOpEndsWith ThreatEventTagIndicatorListParamsSearchOp = "endsWith"`

      - `const ThreatEventTagIndicatorListParamsSearchOpIn ThreatEventTagIndicatorListParamsSearchOp = "in"`

      - `const ThreatEventTagIndicatorListParamsSearchOpFind ThreatEventTagIndicatorListParamsSearchOp = "find"`

    - `Value ThreatEventTagIndicatorListParamsSearchValueUnion`

      Search value. String for most operators. Array of strings for 'in' operator (max 100 items).

      - `UnionString`

      - `type ThreatEventTagIndicatorListParamsSearchValueArray []string`

### Returns

- `type ThreatEventTagIndicatorListResponse struct{…}`

  - `Indicators []ThreatEventTagIndicatorListResponseIndicator`

    - `CreatedAt Time`

    - `IndicatorType string`

    - `UpdatedAt Time`

    - `UUID string`

    - `Value string`

    - `DatasetID string`

      The dataset ID this indicator belongs to. Included in list responses.

    - `RelatedEvents []ThreatEventTagIndicatorListResponseIndicatorsRelatedEvent`

      - `DatasetID string`

      - `EventID string`

    - `Tags []ThreatEventTagIndicatorListResponseIndicatorsTag`

      - `CategoryName string`

      - `UUID string`

      - `Value string`

  - `Pagination ThreatEventTagIndicatorListResponsePagination`

    - `Page float64`

    - `PageSize float64`

    - `TotalCount float64`

    - `TotalPages float64`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  indicators, err := client.CloudforceOne.ThreatEvents.Tags.Indicators.List(
    context.TODO(),
    "tag_uuid",
    cloudforce_one.ThreatEventTagIndicatorListParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", indicators.Indicators)
}
```

#### Response

```json
{
  "indicators": [
    {
      "createdAt": "2022-04-01T00:00:00Z",
      "indicatorType": "domain",
      "updatedAt": "2022-04-01T00:00:00Z",
      "uuid": "12345678-1234-1234-1234-1234567890ab",
      "value": "malicious-domain.com",
      "datasetId": "dataset-uuid-123",
      "relatedEvents": [
        {
          "datasetId": "dataset-uuid-123",
          "eventId": "event-uuid-456"
        }
      ],
      "tags": [
        {
          "categoryName": "categoryName",
          "uuid": "uuid",
          "value": "value"
        }
      ]
    }
  ],
  "pagination": {
    "page": 0,
    "pageSize": 0,
    "totalCount": 0,
    "totalPages": 0
  }
}
```

# By Dataset

## List indicators related to a tag within a dataset (deprecated)

`client.CloudforceOne.ThreatEvents.Tags.Indicators.ByDataset.List(ctx, datasetID, tagUUID, params) (*ThreatEventTagIndicatorByDatasetListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators`

This endpoint is deprecated. Use GET /:account_id/events/tags/:tag_uuid/indicators with the optional datasetIds query parameter instead. Returns indicators associated with the provided tag UUID within a single dataset's indicator shards, with pagination.

### Parameters

- `datasetID string`

  Dataset UUID.

- `tagUUID string`

  Tag UUID.

- `params ThreatEventTagIndicatorByDatasetListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `IndicatorType param.Field[string]`

    Query param

  - `Page param.Field[float64]`

    Query param

  - `PageSize param.Field[float64]`

    Query param

  - `RelatedEvent param.Field[[]string]`

    Query param: Filter indicators by related event UUID(s). Multiple UUIDs can be provided by repeating the parameter.

  - `Search param.Field[[]ThreatEventTagIndicatorByDatasetListParamsSearch]`

    Query param: Structured search as a JSON array of {field, op, value} objects. Searchable fields: value, indicatorType. Multiple conditions are AND'd together. Max 10 conditions per request.

    - `Field ThreatEventTagIndicatorByDatasetListParamsSearchField`

      The indicator field to search on. Allowed: value, indicatorType.

      - `const ThreatEventTagIndicatorByDatasetListParamsSearchFieldValue ThreatEventTagIndicatorByDatasetListParamsSearchField = "value"`

      - `const ThreatEventTagIndicatorByDatasetListParamsSearchFieldIndicatorType ThreatEventTagIndicatorByDatasetListParamsSearchField = "indicatorType"`

    - `Op ThreatEventTagIndicatorByDatasetListParamsSearchOp`

      Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'value', op:'in', value:['evil.com','bad.org']}.

      - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpEquals ThreatEventTagIndicatorByDatasetListParamsSearchOp = "equals"`

      - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpNot ThreatEventTagIndicatorByDatasetListParamsSearchOp = "not"`

      - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpGt ThreatEventTagIndicatorByDatasetListParamsSearchOp = "gt"`

      - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpGte ThreatEventTagIndicatorByDatasetListParamsSearchOp = "gte"`

      - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpLt ThreatEventTagIndicatorByDatasetListParamsSearchOp = "lt"`

      - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpLte ThreatEventTagIndicatorByDatasetListParamsSearchOp = "lte"`

      - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpLike ThreatEventTagIndicatorByDatasetListParamsSearchOp = "like"`

      - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpContains ThreatEventTagIndicatorByDatasetListParamsSearchOp = "contains"`

      - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpStartsWith ThreatEventTagIndicatorByDatasetListParamsSearchOp = "startsWith"`

      - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpEndsWith ThreatEventTagIndicatorByDatasetListParamsSearchOp = "endsWith"`

      - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpIn ThreatEventTagIndicatorByDatasetListParamsSearchOp = "in"`

      - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpFind ThreatEventTagIndicatorByDatasetListParamsSearchOp = "find"`

    - `Value ThreatEventTagIndicatorByDatasetListParamsSearchValueUnion`

      Search value. String for most operators. Array of strings for 'in' operator (max 100 items).

      - `UnionString`

      - `type ThreatEventTagIndicatorByDatasetListParamsSearchValueArray []string`

### Returns

- `type ThreatEventTagIndicatorByDatasetListResponse struct{…}`

  - `Indicators []ThreatEventTagIndicatorByDatasetListResponseIndicator`

    - `CreatedAt Time`

    - `IndicatorType string`

    - `UpdatedAt Time`

    - `UUID string`

    - `Value string`

    - `DatasetID string`

      The dataset ID this indicator belongs to. Included in list responses.

    - `RelatedEvents []ThreatEventTagIndicatorByDatasetListResponseIndicatorsRelatedEvent`

      - `DatasetID string`

      - `EventID string`

    - `Tags []ThreatEventTagIndicatorByDatasetListResponseIndicatorsTag`

      - `CategoryName string`

      - `UUID string`

      - `Value string`

  - `Pagination ThreatEventTagIndicatorByDatasetListResponsePagination`

    - `Page float64`

    - `PageSize float64`

    - `TotalCount float64`

    - `TotalPages float64`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  byDatasets, err := client.CloudforceOne.ThreatEvents.Tags.Indicators.ByDataset.List(
    context.TODO(),
    "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
    "tag_uuid",
    cloudforce_one.ThreatEventTagIndicatorByDatasetListParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", byDatasets.Indicators)
}
```

#### Response

```json
{
  "indicators": [
    {
      "createdAt": "2022-04-01T00:00:00Z",
      "indicatorType": "domain",
      "updatedAt": "2022-04-01T00:00:00Z",
      "uuid": "12345678-1234-1234-1234-1234567890ab",
      "value": "malicious-domain.com",
      "datasetId": "dataset-uuid-123",
      "relatedEvents": [
        {
          "datasetId": "dataset-uuid-123",
          "eventId": "event-uuid-456"
        }
      ],
      "tags": [
        {
          "categoryName": "categoryName",
          "uuid": "uuid",
          "value": "value"
        }
      ]
    }
  ],
  "pagination": {
    "page": 0,
    "pageSize": 0,
    "totalCount": 0,
    "totalPages": 0
  }
}
```

# Event Tags

## Adds a tag to an event

`client.CloudforceOne.ThreatEvents.EventTags.New(ctx, eventID, params) (*ThreatEventEventTagNewResponse, error)`

**post** `/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create`

Add one or more tags to an event.

### Parameters

- `eventID string`

  Event UUID.

- `params ThreatEventEventTagNewParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `Tags param.Field[[]string]`

    Body param

### Returns

- `type ThreatEventEventTagNewResponse struct{…}`

  - `Success bool`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  eventTag, err := client.CloudforceOne.ThreatEvents.EventTags.New(
    context.TODO(),
    "event_id",
    cloudforce_one.ThreatEventEventTagNewParams{
      AccountID: cloudflare.F("account_id"),
      Tags: cloudflare.F([]string{"botnet"}),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", eventTag.Success)
}
```

#### Response

```json
{
  "result": {
    "success": true
  },
  "success": true
}
```

## Removes a tag from an event

`client.CloudforceOne.ThreatEvents.EventTags.Delete(ctx, eventID, body) (*ThreatEventEventTagDeleteResponse, error)`

**delete** `/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}`

Remove one or more tags from an event.

### Parameters

- `eventID string`

  Event UUID.

- `body ThreatEventEventTagDeleteParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventEventTagDeleteResponse struct{…}`

  - `Success bool`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  eventTag, err := client.CloudforceOne.ThreatEvents.EventTags.Delete(
    context.TODO(),
    "event_id",
    cloudforce_one.ThreatEventEventTagDeleteParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", eventTag.Success)
}
```

#### Response

```json
{
  "result": {
    "success": true
  },
  "success": true
}
```

# Target Industries

## Lists target industries across multiple datasets

`client.CloudforceOne.ThreatEvents.TargetIndustries.List(ctx, params) (*ThreatEventTargetIndustryListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/targetIndustries`

List target industries referenced in events across one or more datasets.

### Parameters

- `params ThreatEventTargetIndustryListParams`

  - `AccountID param.Field[string]`

    Path param: Account ID.

  - `DatasetIDs param.Field[[]string]`

    Query param: Array of dataset IDs to query target industries from. If not provided, uses the default dataset.

### Returns

- `type ThreatEventTargetIndustryListResponse struct{…}`

  - `Items ThreatEventTargetIndustryListResponseItems`

    - `Type string`

  - `Type string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  targetIndustries, err := client.CloudforceOne.ThreatEvents.TargetIndustries.List(context.TODO(), cloudforce_one.ThreatEventTargetIndustryListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", targetIndustries.Items)
}
```

#### Response

```json
{
  "items": {
    "type": "string"
  },
  "type": "array"
}
```

# By Dataset

## Lists all target industries for a specific dataset

`client.CloudforceOne.ThreatEvents.TargetIndustries.ByDataset.List(ctx, datasetID, query) (*ThreatEventTargetIndustryByDatasetListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries`

List all target industries referenced in events for a specific dataset.

### Parameters

- `datasetID string`

  Dataset UUID.

- `query ThreatEventTargetIndustryByDatasetListParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventTargetIndustryByDatasetListResponse struct{…}`

  - `Items ThreatEventTargetIndustryByDatasetListResponseItems`

    - `Type string`

  - `Type string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  byDatasets, err := client.CloudforceOne.ThreatEvents.TargetIndustries.ByDataset.List(
    context.TODO(),
    "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
    cloudforce_one.ThreatEventTargetIndustryByDatasetListParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", byDatasets.Items)
}
```

#### Response

```json
{
  "items": {
    "type": "string"
  },
  "type": "array"
}
```

# Catalog

## Lists all target industries from industry map catalog

`client.CloudforceOne.ThreatEvents.TargetIndustries.Catalog.List(ctx, query) (*ThreatEventTargetIndustryCatalogListResponse, error)`

**get** `/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog`

List all predefined target industries from the industry map catalog.

### Parameters

- `query ThreatEventTargetIndustryCatalogListParams`

  - `AccountID param.Field[string]`

    Account ID.

### Returns

- `type ThreatEventTargetIndustryCatalogListResponse struct{…}`

  - `Items ThreatEventTargetIndustryCatalogListResponseItems`

    - `Type string`

  - `Type string`

### Example

```go
package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  catalogs, err := client.CloudforceOne.ThreatEvents.TargetIndustries.Catalog.List(context.TODO(), cloudforce_one.ThreatEventTargetIndustryCatalogListParams{
    AccountID: cloudflare.F("account_id"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", catalogs.Items)
}
```

#### Response

```json
{
  "items": {
    "type": "string"
  },
  "type": "array"
}
```

# Insights