# Casb # Applications ## List applications `client.ZeroTrust.Casb.Applications.List(ctx, params) (*[]CasbApplicationListResponse, error)` **get** `/accounts/{account_id}/one/applications` Returns a list of available applications with use cases and permissions. ### Parameters - `params CasbApplicationListParams` - `AccountID param.Field[string]` Path param: Cloudflare account identifier. - `Environment param.Field[string]` Query param: Filter by supported environment (standard, fedramp). ### Returns - `type CasbApplicationListResponse []CasbApplicationListResponse` - `ID CasbApplicationListResponseID` Vendor identifier (e.g. microsoft_internal, google_workspace). * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `SALESFORCE` - SALESFORCE * `SLACK` - SLACK - `const CasbApplicationListResponseIDBitbucket CasbApplicationListResponseID = "BITBUCKET"` - `const CasbApplicationListResponseIDBox CasbApplicationListResponseID = "BOX"` - `const CasbApplicationListResponseIDConfluence CasbApplicationListResponseID = "CONFLUENCE"` - `const CasbApplicationListResponseIDDropbox CasbApplicationListResponseID = "DROPBOX"` - `const CasbApplicationListResponseIDGitHub CasbApplicationListResponseID = "GITHUB"` - `const CasbApplicationListResponseIDGoogleWorkspace CasbApplicationListResponseID = "GOOGLE_WORKSPACE"` - `const CasbApplicationListResponseIDJira CasbApplicationListResponseID = "JIRA"` - `const CasbApplicationListResponseIDMicrosoftInternal CasbApplicationListResponseID = "MICROSOFT_INTERNAL"` - `const CasbApplicationListResponseIDSalesforce CasbApplicationListResponseID = "SALESFORCE"` - `const CasbApplicationListResponseIDSlack CasbApplicationListResponseID = "SLACK"` - `AuthMethods []CasbApplicationListResponseAuthMethod` Available auth methods. - `ID string` Auth method identifier. - `DisplayName string` Human-readable auth method name. - `Category string` Vendor category (e.g. Productivity, AI). - `Description string` Brief description of the integration. - `DisplayName string` Human-readable vendor name. - `DLPEnabled bool` Whether DLP scanning is supported. - `Logo string` Logo path. - `Permissions []CasbApplicationListResponsePermission` All permissions with severity. - `DisplayName string` Human-readable permission name. - `Scope string` Vendor-native scope identifier. - `Severity CasbApplicationListResponsePermissionsSeverity` Permission sensitivity level. * `low` - low * `medium` - medium * `high` - high * `critical` - critical - `const CasbApplicationListResponsePermissionsSeverityLow CasbApplicationListResponsePermissionsSeverity = "low"` - `const CasbApplicationListResponsePermissionsSeverityMedium CasbApplicationListResponsePermissionsSeverity = "medium"` - `const CasbApplicationListResponsePermissionsSeverityHigh CasbApplicationListResponsePermissionsSeverity = "high"` - `const CasbApplicationListResponsePermissionsSeverityCritical CasbApplicationListResponsePermissionsSeverity = "critical"` - `SupportedEnvironments []string` Environments this vendor supports (standard, fedramp). - `UseCases []CasbApplicationListResponseUseCase` Supported use cases. - `ID string` Use case identifier (e.g. casb, ces). - `DisplayName string` Human-readable use case name. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) applications, err := client.ZeroTrust.Casb.Applications.List(context.TODO(), zero_trust.CasbApplicationListParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", applications) } ``` #### Response ```json [ { "auth_methods": [ { "display_name": "OAuth 2.0 Admin Consent", "id": "oauth2_standard" } ], "category": "Productivity", "description": "Monitor OneDrive, SharePoint, Teams, and Outlook.", "display_name": "Microsoft", "dlp_enabled": true, "id": "MICROSOFT_INTERNAL", "logo": "/api/v4/accounts/12345678/casb/static/microsoft_internal.svg", "permissions": [ { "display_name": "Read all users' full profiles", "scope": "User.Read.All", "severity": "high" }, { "display_name": "Read all files", "scope": "Files.Read.All", "severity": "high" }, { "display_name": "Read and write mail", "scope": "Mail.ReadWrite", "severity": "critical" } ], "supported_environments": [ "standard", "fedramp" ], "use_cases": [ { "display_name": "Cloud Access Security Broker", "id": "casb" }, { "display_name": "Cloud Email Security", "id": "ces" } ] } ] ``` ## Get application details `client.ZeroTrust.Casb.Applications.Get(ctx, applicationID, query) (*CasbApplicationGetResponse, error)` **get** `/accounts/{account_id}/one/applications/{application_id}` Returns full application details including auth methods, use cases, and permissions. ### Parameters - `applicationID CasbApplicationGetParamsApplicationID` - `const CasbApplicationGetParamsApplicationIDBitbucket CasbApplicationGetParamsApplicationID = "BITBUCKET"` - `const CasbApplicationGetParamsApplicationIDBox CasbApplicationGetParamsApplicationID = "BOX"` - `const CasbApplicationGetParamsApplicationIDConfluence CasbApplicationGetParamsApplicationID = "CONFLUENCE"` - `const CasbApplicationGetParamsApplicationIDDropbox CasbApplicationGetParamsApplicationID = "DROPBOX"` - `const CasbApplicationGetParamsApplicationIDGitHub CasbApplicationGetParamsApplicationID = "GITHUB"` - `const CasbApplicationGetParamsApplicationIDGoogleWorkspace CasbApplicationGetParamsApplicationID = "GOOGLE_WORKSPACE"` - `const CasbApplicationGetParamsApplicationIDJira CasbApplicationGetParamsApplicationID = "JIRA"` - `const CasbApplicationGetParamsApplicationIDMicrosoftInternal CasbApplicationGetParamsApplicationID = "MICROSOFT_INTERNAL"` - `const CasbApplicationGetParamsApplicationIDSalesforce CasbApplicationGetParamsApplicationID = "SALESFORCE"` - `const CasbApplicationGetParamsApplicationIDSlack CasbApplicationGetParamsApplicationID = "SLACK"` - `query CasbApplicationGetParams` - `AccountID param.Field[string]` Cloudflare account identifier. ### Returns - `type CasbApplicationGetResponse struct{…}` Full application detail for onboarding UI. - `ID CasbApplicationGetResponseID` Vendor identifier. * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `SALESFORCE` - SALESFORCE * `SLACK` - SLACK - `const CasbApplicationGetResponseIDBitbucket CasbApplicationGetResponseID = "BITBUCKET"` - `const CasbApplicationGetResponseIDBox CasbApplicationGetResponseID = "BOX"` - `const CasbApplicationGetResponseIDConfluence CasbApplicationGetResponseID = "CONFLUENCE"` - `const CasbApplicationGetResponseIDDropbox CasbApplicationGetResponseID = "DROPBOX"` - `const CasbApplicationGetResponseIDGitHub CasbApplicationGetResponseID = "GITHUB"` - `const CasbApplicationGetResponseIDGoogleWorkspace CasbApplicationGetResponseID = "GOOGLE_WORKSPACE"` - `const CasbApplicationGetResponseIDJira CasbApplicationGetResponseID = "JIRA"` - `const CasbApplicationGetResponseIDMicrosoftInternal CasbApplicationGetResponseID = "MICROSOFT_INTERNAL"` - `const CasbApplicationGetResponseIDSalesforce CasbApplicationGetResponseID = "SALESFORCE"` - `const CasbApplicationGetResponseIDSlack CasbApplicationGetResponseID = "SLACK"` - `AuthMethods []CasbApplicationGetResponseAuthMethod` Available authentication methods. - `ID string` Auth method identifier. - `DisplayName string` Human-readable auth method name. - `IsDefault bool` Whether this is the default auth method. - `SupportedEnvironments []string` Environments this auth method supports. - `Category string` Vendor category. - `Description string` Brief description. - `DisplayName string` Human-readable vendor name. - `DLPEnabled bool` Whether DLP scanning is supported. - `Instructions string` Setup instructions for the user. - `Logo string` Logo path. - `UseCases []CasbApplicationGetResponseUseCase` Use cases with full scope details. - `ID string` Use case identifier. - `BaseScopes []CasbApplicationGetResponseUseCasesBaseScope` Scopes always required for this use case. - `DisplayName string` Human-readable permission name. - `Scope string` Vendor-native scope identifier. - `Severity CasbApplicationGetResponseUseCasesBaseScopesSeverity` Permission sensitivity level. * `low` - low * `medium` - medium * `high` - high * `critical` - critical - `const CasbApplicationGetResponseUseCasesBaseScopesSeverityLow CasbApplicationGetResponseUseCasesBaseScopesSeverity = "low"` - `const CasbApplicationGetResponseUseCasesBaseScopesSeverityMedium CasbApplicationGetResponseUseCasesBaseScopesSeverity = "medium"` - `const CasbApplicationGetResponseUseCasesBaseScopesSeverityHigh CasbApplicationGetResponseUseCasesBaseScopesSeverity = "high"` - `const CasbApplicationGetResponseUseCasesBaseScopesSeverityCritical CasbApplicationGetResponseUseCasesBaseScopesSeverity = "critical"` - `Description string` Use case description. - `DisplayName string` Human-readable use case name. - `Features []CasbApplicationGetResponseUseCasesFeature` Optional features with extra scopes. - `ID string` Feature identifier. - `Description string` Feature description. - `DisplayName string` Human-readable feature name. - `Scopes []CasbApplicationGetResponseUseCasesFeaturesScope` Additional scopes when feature is enabled. - `DisplayName string` Human-readable permission name. - `Scope string` Vendor-native scope identifier. - `Severity CasbApplicationGetResponseUseCasesFeaturesScopesSeverity` Permission sensitivity level. * `low` - low * `medium` - medium * `high` - high * `critical` - critical - `const CasbApplicationGetResponseUseCasesFeaturesScopesSeverityLow CasbApplicationGetResponseUseCasesFeaturesScopesSeverity = "low"` - `const CasbApplicationGetResponseUseCasesFeaturesScopesSeverityMedium CasbApplicationGetResponseUseCasesFeaturesScopesSeverity = "medium"` - `const CasbApplicationGetResponseUseCasesFeaturesScopesSeverityHigh CasbApplicationGetResponseUseCasesFeaturesScopesSeverity = "high"` - `const CasbApplicationGetResponseUseCasesFeaturesScopesSeverityCritical CasbApplicationGetResponseUseCasesFeaturesScopesSeverity = "critical"` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) application, err := client.ZeroTrust.Casb.Applications.Get( context.TODO(), zero_trust.CasbApplicationGetParamsApplicationIDBitbucket, zero_trust.CasbApplicationGetParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", application.ID) } ``` #### Response ```json { "auth_methods": [ { "display_name": "OAuth 2.0 Admin Consent", "id": "oauth2", "is_default": true, "supported_environments": [ "standard", "fedramp" ] } ], "category": "Productivity", "description": "Monitor OneDrive, SharePoint, Teams, and Outlook.", "display_name": "Microsoft", "dlp_enabled": true, "id": "MICROSOFT_INTERNAL", "instructions": "You'll need a Microsoft 365 admin account with Global Admin or Application Admin role.", "logo": "/api/v4/accounts/12345678/casb/static/microsoft_internal.svg", "use_cases": [ { "base_scopes": [ { "display_name": "Read all users' full profiles", "scope": "User.Read.All", "severity": "high" }, { "display_name": "Read all files", "scope": "Files.Read.All", "severity": "high" } ], "description": "Discover and secure SaaS applications", "display_name": "Cloud Access Security Broker", "features": [ { "description": "Automatically remediate security issues", "display_name": "Auto Remediation", "id": "auto_remediation", "scopes": [ { "display_name": "Read and write all files", "scope": "Files.ReadWrite.All", "severity": "critical" } ] } ], "id": "casb" } ] } ``` # Auth Methods ## Get auth methods `client.ZeroTrust.Casb.Applications.AuthMethods.List(ctx, applicationID, query) (*[]CasbApplicationAuthMethodListResponse, error)` **get** `/accounts/{account_id}/one/applications/{application_id}/auth-methods` Returns available auth methods for the specified vendor, including credential schema, instructions, and example payloads. Use this to understand what credentials are required before calling POST /v2/integrations. ### Parameters - `applicationID CasbApplicationAuthMethodListParamsApplicationID` - `const CasbApplicationAuthMethodListParamsApplicationIDBitbucket CasbApplicationAuthMethodListParamsApplicationID = "BITBUCKET"` - `const CasbApplicationAuthMethodListParamsApplicationIDBox CasbApplicationAuthMethodListParamsApplicationID = "BOX"` - `const CasbApplicationAuthMethodListParamsApplicationIDConfluence CasbApplicationAuthMethodListParamsApplicationID = "CONFLUENCE"` - `const CasbApplicationAuthMethodListParamsApplicationIDDropbox CasbApplicationAuthMethodListParamsApplicationID = "DROPBOX"` - `const CasbApplicationAuthMethodListParamsApplicationIDGitHub CasbApplicationAuthMethodListParamsApplicationID = "GITHUB"` - `const CasbApplicationAuthMethodListParamsApplicationIDGoogleWorkspace CasbApplicationAuthMethodListParamsApplicationID = "GOOGLE_WORKSPACE"` - `const CasbApplicationAuthMethodListParamsApplicationIDJira CasbApplicationAuthMethodListParamsApplicationID = "JIRA"` - `const CasbApplicationAuthMethodListParamsApplicationIDMicrosoftInternal CasbApplicationAuthMethodListParamsApplicationID = "MICROSOFT_INTERNAL"` - `const CasbApplicationAuthMethodListParamsApplicationIDSalesforce CasbApplicationAuthMethodListParamsApplicationID = "SALESFORCE"` - `const CasbApplicationAuthMethodListParamsApplicationIDSlack CasbApplicationAuthMethodListParamsApplicationID = "SLACK"` - `query CasbApplicationAuthMethodListParams` - `AccountID param.Field[string]` Cloudflare account identifier. ### Returns - `type CasbApplicationAuthMethodListResponse []CasbApplicationAuthMethodListResponse` - `ID string` Auth method identifier. - `DisplayName string` Human-readable auth method name. - `HumanInteractionRequired bool` Whether setup requires human interaction or integration can be created purely using API (e.g., For OAuth can not be created without user interaction). - `Instructions CasbApplicationAuthMethodListResponseInstructions` Step-by-step instructions for obtaining credentials. - `Markdown string` Detailed instructions in markdown format. - `PayloadExample map[string, unknown]` Example credentials payload with placeholder values. - `PayloadSchema map[string, unknown]` JSON Schema for the credentials object in POST /v2/integrations request. - `RedirectURL string` OAuth redirect URL for vendors requiring human interaction. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) authMethods, err := client.ZeroTrust.Casb.Applications.AuthMethods.List( context.TODO(), zero_trust.CasbApplicationAuthMethodListParamsApplicationIDBitbucket, zero_trust.CasbApplicationAuthMethodListParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", authMethods) } ``` #### Response ```json [ { "id": "id", "display_name": "display_name", "human_interaction_required": true, "instructions": { "markdown": "markdown" }, "payload_example": { "foo": "bar" }, "payload_schema": { "foo": "bar" }, "redirect_url": "redirect_url" } ] ``` # Integrations ## List integrations `client.ZeroTrust.Casb.Integrations.List(ctx, params) (*CasbIntegrationListResponse, error)` **get** `/accounts/{account_id}/one/integrations` Returns a paginated list of integrations for the account. ### Parameters - `params CasbIntegrationListParams` - `AccountID param.Field[string]` Path param: Cloudflare account identifier. - `Application param.Field[string]` Query param: Filter by application/vendor (e.g., GOOGLE_WORKSPACE, MICROSOFT_INTERNAL). - `Direction param.Field[CasbIntegrationListParamsDirection]` Query param: Direction to order results. - `const CasbIntegrationListParamsDirectionAsc CasbIntegrationListParamsDirection = "asc"` - `const CasbIntegrationListParamsDirectionDesc CasbIntegrationListParamsDirection = "desc"` - `DLPEnabled param.Field[bool]` Query param: Filter by DLP enabled status (true/false). - `Order param.Field[CasbIntegrationListParamsOrder]` Query param: Field to order results by. - `const CasbIntegrationListParamsOrderApplication CasbIntegrationListParamsOrder = "application"` - `const CasbIntegrationListParamsOrderCreated CasbIntegrationListParamsOrder = "created"` - `const CasbIntegrationListParamsOrderName CasbIntegrationListParamsOrder = "name"` - `const CasbIntegrationListParamsOrderStatus CasbIntegrationListParamsOrder = "status"` - `Page param.Field[int64]` Query param: Page number within the paginated result set. - `PageSize param.Field[int64]` Query param: Number of results per page. - `Search param.Field[string]` Query param: Search integrations by name or application. - `Status param.Field[CasbIntegrationListParamsStatus]` Query param: Filter by integration status. - `const CasbIntegrationListParamsStatusHealthy CasbIntegrationListParamsStatus = "Healthy"` - `const CasbIntegrationListParamsStatusInitializing CasbIntegrationListParamsStatus = "Initializing"` - `const CasbIntegrationListParamsStatusOffline CasbIntegrationListParamsStatus = "Offline"` - `const CasbIntegrationListParamsStatusUnhealthy CasbIntegrationListParamsStatus = "Unhealthy"` - `UseCases param.Field[string]` Query param: Filter by enabled use cases (e.g., casb, ces). Matches integrations enrolled in any of the specified values. Can be specified multiple times. ### Returns - `type CasbIntegrationListResponse interface{…}` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) integrations, err := client.ZeroTrust.Casb.Integrations.List(context.TODO(), zero_trust.CasbIntegrationListParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", integrations) } ``` #### Response ```json { "errors": [], "messages": [], "result": [ { "application": { "category": "Productivity", "display_name": "Google Workspace", "logo": "https://onprem.cloudflare.com/static/google_workspace.png" }, "created": "2025-01-15T10:00:00Z", "id": "019d2e6a-d995-7185-afbd-4feead9e42ec", "is_paused": false, "name": "My Google Workspace", "status": "Healthy", "updated": "2025-04-10T08:30:00Z" } ], "result_info": { "count": 1, "next": null, "page": 1, "per_page": 10, "previous": null, "total_count": 1 }, "success": true } ``` ## Get integration details `client.ZeroTrust.Casb.Integrations.Get(ctx, id, query) (*CasbIntegrationGetResponse, error)` **get** `/accounts/{account_id}/one/integrations/{id}` Returns full integration details including use cases and permissions. ### Parameters - `id string` - `query CasbIntegrationGetParams` - `AccountID param.Field[string]` Cloudflare account identifier. ### Returns - `type CasbIntegrationGetResponse struct{…}` Serializer for v2 integration detail response with use cases. - `ID string` Integration ID. - `Application map[string, string]` - `AuthMethod map[string, string]` The integration's authentication method. - `AuthorizationLink CasbIntegrationGetResponseAuthorizationLink` Authorization link for the integration. - `Components map[string, unknown]` - `Link string` - `Created Time` When the integration was created. - `CredentialsExpiry Time` Credentials expiry time. - `DLPProfiles []string` DLP Profiles enabled for the integration. - `HealthDetails []map[string, unknown]` Health details with remediation hints. - `IsPaused bool` Whether the user paused the integration. - `LastHydrated Time` Last time the integration was hydrated. - `Name string` Name of the integration. - `OrganizationID int64` Organization ID. - `Status string` Integration status. - `Updated Time` When the integration was last updated. - `UseCases []map[string, unknown]` Use cases enabled for the integration. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) integration, err := client.ZeroTrust.Casb.Integrations.Get( context.TODO(), "id", zero_trust.CasbIntegrationGetParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", integration.ID) } ``` #### Response ```json { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "application": { "foo": "string" }, "auth_method": { "foo": "string" }, "authorization_link": { "components": { "foo": "bar" }, "link": "link" }, "created": "2019-12-27T18:11:19.117Z", "credentials_expiry": "2019-12-27T18:11:19.117Z", "dlp_profiles": [ "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" ], "health_details": [ { "foo": "bar" } ], "is_paused": true, "last_hydrated": "2019-12-27T18:11:19.117Z", "name": "name", "organization_id": 0, "status": "status", "updated": "2019-12-27T18:11:19.117Z", "use_cases": [ { "foo": "bar" } ] } ``` ## Create integration `client.ZeroTrust.Casb.Integrations.New(ctx, params) (*CasbIntegrationNewResponse, error)` **post** `/accounts/{account_id}/one/integrations` Creates a new integration for the specified application. Integration creation with OAuth is not supported by API at the moment. For other auth methods, use `GET /v2/applications/{application_id}/credential-guide` to see the required credential structure and example payloads for each vendor. ### Parameters - `params CasbIntegrationNewParams` - `AccountID param.Field[string]` Path param: Cloudflare account identifier. - `Application param.Field[CasbIntegrationNewParamsApplication]` Body param: Vendor/application slug (e.g., GOOGLE_WORKSPACE). * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `SALESFORCE` - SALESFORCE * `SLACK` - SLACK - `const CasbIntegrationNewParamsApplicationBitbucket CasbIntegrationNewParamsApplication = "BITBUCKET"` - `const CasbIntegrationNewParamsApplicationBox CasbIntegrationNewParamsApplication = "BOX"` - `const CasbIntegrationNewParamsApplicationConfluence CasbIntegrationNewParamsApplication = "CONFLUENCE"` - `const CasbIntegrationNewParamsApplicationDropbox CasbIntegrationNewParamsApplication = "DROPBOX"` - `const CasbIntegrationNewParamsApplicationGitHub CasbIntegrationNewParamsApplication = "GITHUB"` - `const CasbIntegrationNewParamsApplicationGoogleWorkspace CasbIntegrationNewParamsApplication = "GOOGLE_WORKSPACE"` - `const CasbIntegrationNewParamsApplicationJira CasbIntegrationNewParamsApplication = "JIRA"` - `const CasbIntegrationNewParamsApplicationMicrosoftInternal CasbIntegrationNewParamsApplication = "MICROSOFT_INTERNAL"` - `const CasbIntegrationNewParamsApplicationSalesforce CasbIntegrationNewParamsApplication = "SALESFORCE"` - `const CasbIntegrationNewParamsApplicationSlack CasbIntegrationNewParamsApplication = "SLACK"` - `Credentials param.Field[map[string, unknown]]` Body param: Credentials for the integration. - `Name param.Field[string]` Body param: Name of the integration. - `AuthMethod param.Field[string]` Body param: Authentication method slug (uses default if omitted). - `DLPProfiles param.Field[[]string]` Body param: List of DLP profile IDs to associate. - `Permissions param.Field[[]string]` Body param: List of permission scopes (uses policy defaults if empty). - `UseCases param.Field[[]CasbIntegrationNewParamsUseCase]` Body param: List of use case or feature slugs to enroll (e.g., ['casb', 'ces', 'auto_remediation']). - `const CasbIntegrationNewParamsUseCaseCasb CasbIntegrationNewParamsUseCase = "casb"` - `const CasbIntegrationNewParamsUseCaseCes CasbIntegrationNewParamsUseCase = "ces"` - `const CasbIntegrationNewParamsUseCaseAutoRemediation CasbIntegrationNewParamsUseCase = "auto_remediation"` ### Returns - `type CasbIntegrationNewResponse struct{…}` Serializer for v2 integration detail response with use cases. - `ID string` Integration ID. - `Application map[string, string]` - `AuthMethod map[string, string]` The integration's authentication method. - `AuthorizationLink CasbIntegrationNewResponseAuthorizationLink` Authorization link for the integration. - `Components map[string, unknown]` - `Link string` - `Created Time` When the integration was created. - `CredentialsExpiry Time` Credentials expiry time. - `DLPProfiles []string` DLP Profiles enabled for the integration. - `HealthDetails []map[string, unknown]` Health details with remediation hints. - `IsPaused bool` Whether the user paused the integration. - `LastHydrated Time` Last time the integration was hydrated. - `Name string` Name of the integration. - `OrganizationID int64` Organization ID. - `Status string` Integration status. - `Updated Time` When the integration was last updated. - `UseCases []map[string, unknown]` Use cases enabled for the integration. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) integration, err := client.ZeroTrust.Casb.Integrations.New(context.TODO(), zero_trust.CasbIntegrationNewParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), Application: cloudflare.F(zero_trust.CasbIntegrationNewParamsApplicationGoogleWorkspace), Credentials: cloudflare.F(map[string]interface{}{ "admin_email": "admin@corp.com", }), Name: cloudflare.F("My Google Workspace"), AuthMethod: cloudflare.F("service_account"), DLPProfiles: cloudflare.F([]string{"e91a2360-da51-4fdf-9711-bcdecd462614"}), Permissions: cloudflare.F([]string{"https://www.googleapis.com/auth/drive.readonly"}), UseCases: cloudflare.F([]zero_trust.CasbIntegrationNewParamsUseCase{zero_trust.CasbIntegrationNewParamsUseCaseCasb, zero_trust.CasbIntegrationNewParamsUseCaseCes}), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", integration.ID) } ``` #### Response ```json { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "application": { "foo": "string" }, "auth_method": { "foo": "string" }, "authorization_link": { "components": { "foo": "bar" }, "link": "link" }, "created": "2019-12-27T18:11:19.117Z", "credentials_expiry": "2019-12-27T18:11:19.117Z", "dlp_profiles": [ "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" ], "health_details": [ { "foo": "bar" } ], "is_paused": true, "last_hydrated": "2019-12-27T18:11:19.117Z", "name": "name", "organization_id": 0, "status": "status", "updated": "2019-12-27T18:11:19.117Z", "use_cases": [ { "foo": "bar" } ] } ``` ## Update integration `client.ZeroTrust.Casb.Integrations.Update(ctx, id, params) (*CasbIntegrationUpdateResponse, error)` **patch** `/accounts/{account_id}/one/integrations/{id}` Updates an integration's name, permissions, DLP profiles, use cases, or credentials. ### Parameters - `id string` - `params CasbIntegrationUpdateParams` - `AccountID param.Field[string]` Path param: Cloudflare account identifier. - `Credentials param.Field[map[string, unknown]]` Body param: Partial credential fields to merge with existing. - `DLPProfiles param.Field[[]string]` Body param: List of DLP profile IDs to associate with the integration. - `Name param.Field[string]` Body param: Name of the integration. - `Permissions param.Field[[]string]` Body param: List of permission scopes granted to the integration. - `UseCases param.Field[[]CasbIntegrationUpdateParamsUseCase]` Body param: List of use case or feature slugs to enroll (e.g., ['casb', 'ces', 'auto_remediation']). - `const CasbIntegrationUpdateParamsUseCaseCasb CasbIntegrationUpdateParamsUseCase = "casb"` - `const CasbIntegrationUpdateParamsUseCaseCes CasbIntegrationUpdateParamsUseCase = "ces"` - `const CasbIntegrationUpdateParamsUseCaseAutoRemediation CasbIntegrationUpdateParamsUseCase = "auto_remediation"` ### Returns - `type CasbIntegrationUpdateResponse struct{…}` Serializer for v2 integration detail response with use cases. - `ID string` Integration ID. - `Application map[string, string]` - `AuthMethod map[string, string]` The integration's authentication method. - `AuthorizationLink CasbIntegrationUpdateResponseAuthorizationLink` Authorization link for the integration. - `Components map[string, unknown]` - `Link string` - `Created Time` When the integration was created. - `CredentialsExpiry Time` Credentials expiry time. - `DLPProfiles []string` DLP Profiles enabled for the integration. - `HealthDetails []map[string, unknown]` Health details with remediation hints. - `IsPaused bool` Whether the user paused the integration. - `LastHydrated Time` Last time the integration was hydrated. - `Name string` Name of the integration. - `OrganizationID int64` Organization ID. - `Status string` Integration status. - `Updated Time` When the integration was last updated. - `UseCases []map[string, unknown]` Use cases enabled for the integration. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) integration, err := client.ZeroTrust.Casb.Integrations.Update( context.TODO(), "id", zero_trust.CasbIntegrationUpdateParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), Credentials: cloudflare.F(map[string]interface{}{ "access_token": "new_access_token", "refresh_token": "new_refresh_token", }), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", integration.ID) } ``` #### Response ```json { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "application": { "foo": "string" }, "auth_method": { "foo": "string" }, "authorization_link": { "components": { "foo": "bar" }, "link": "link" }, "created": "2019-12-27T18:11:19.117Z", "credentials_expiry": "2019-12-27T18:11:19.117Z", "dlp_profiles": [ "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" ], "health_details": [ { "foo": "bar" } ], "is_paused": true, "last_hydrated": "2019-12-27T18:11:19.117Z", "name": "name", "organization_id": 0, "status": "status", "updated": "2019-12-27T18:11:19.117Z", "use_cases": [ { "foo": "bar" } ] } ``` ## Delete integration `client.ZeroTrust.Casb.Integrations.Delete(ctx, id, body) error` **delete** `/accounts/{account_id}/one/integrations/{id}` Delete an integration by soft-deleting it. ### Parameters - `id string` - `body CasbIntegrationDeleteParams` - `AccountID param.Field[string]` Cloudflare account identifier. ### Example ```go package main import ( "context" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) err := client.ZeroTrust.Casb.Integrations.Delete( context.TODO(), "id", zero_trust.CasbIntegrationDeleteParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } } ``` ## Pause integration `client.ZeroTrust.Casb.Integrations.Pause(ctx, id, body) (*CasbIntegrationPauseResponse, error)` **post** `/accounts/{account_id}/one/integrations/{id}/pause` Pauses an integration, stopping all crawlers. ### Parameters - `id string` - `body CasbIntegrationPauseParams` - `AccountID param.Field[string]` Cloudflare account identifier. ### Returns - `type CasbIntegrationPauseResponse struct{…}` Serializer for v2 integration detail response with use cases. - `ID string` Integration ID. - `Application map[string, string]` - `AuthMethod map[string, string]` The integration's authentication method. - `AuthorizationLink CasbIntegrationPauseResponseAuthorizationLink` Authorization link for the integration. - `Components map[string, unknown]` - `Link string` - `Created Time` When the integration was created. - `CredentialsExpiry Time` Credentials expiry time. - `DLPProfiles []string` DLP Profiles enabled for the integration. - `HealthDetails []map[string, unknown]` Health details with remediation hints. - `IsPaused bool` Whether the user paused the integration. - `LastHydrated Time` Last time the integration was hydrated. - `Name string` Name of the integration. - `OrganizationID int64` Organization ID. - `Status string` Integration status. - `Updated Time` When the integration was last updated. - `UseCases []map[string, unknown]` Use cases enabled for the integration. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.ZeroTrust.Casb.Integrations.Pause( context.TODO(), "id", zero_trust.CasbIntegrationPauseParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.ID) } ``` #### Response ```json { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "application": { "foo": "string" }, "auth_method": { "foo": "string" }, "authorization_link": { "components": { "foo": "bar" }, "link": "link" }, "created": "2019-12-27T18:11:19.117Z", "credentials_expiry": "2019-12-27T18:11:19.117Z", "dlp_profiles": [ "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" ], "health_details": [ { "foo": "bar" } ], "is_paused": true, "last_hydrated": "2019-12-27T18:11:19.117Z", "name": "name", "organization_id": 0, "status": "status", "updated": "2019-12-27T18:11:19.117Z", "use_cases": [ { "foo": "bar" } ] } ``` ## Resume integration `client.ZeroTrust.Casb.Integrations.Resume(ctx, id, body) (*CasbIntegrationResumeResponse, error)` **post** `/accounts/{account_id}/one/integrations/{id}/resume` Resumes a paused integration, restarting crawlers. ### Parameters - `id string` - `body CasbIntegrationResumeParams` - `AccountID param.Field[string]` Cloudflare account identifier. ### Returns - `type CasbIntegrationResumeResponse struct{…}` Serializer for v2 integration detail response with use cases. - `ID string` Integration ID. - `Application map[string, string]` - `AuthMethod map[string, string]` The integration's authentication method. - `AuthorizationLink CasbIntegrationResumeResponseAuthorizationLink` Authorization link for the integration. - `Components map[string, unknown]` - `Link string` - `Created Time` When the integration was created. - `CredentialsExpiry Time` Credentials expiry time. - `DLPProfiles []string` DLP Profiles enabled for the integration. - `HealthDetails []map[string, unknown]` Health details with remediation hints. - `IsPaused bool` Whether the user paused the integration. - `LastHydrated Time` Last time the integration was hydrated. - `Name string` Name of the integration. - `OrganizationID int64` Organization ID. - `Status string` Integration status. - `Updated Time` When the integration was last updated. - `UseCases []map[string, unknown]` Use cases enabled for the integration. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.ZeroTrust.Casb.Integrations.Resume( context.TODO(), "id", zero_trust.CasbIntegrationResumeParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.ID) } ``` #### Response ```json { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "application": { "foo": "string" }, "auth_method": { "foo": "string" }, "authorization_link": { "components": { "foo": "bar" }, "link": "link" }, "created": "2019-12-27T18:11:19.117Z", "credentials_expiry": "2019-12-27T18:11:19.117Z", "dlp_profiles": [ "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" ], "health_details": [ { "foo": "bar" } ], "is_paused": true, "last_hydrated": "2019-12-27T18:11:19.117Z", "name": "name", "organization_id": 0, "status": "status", "updated": "2019-12-27T18:11:19.117Z", "use_cases": [ { "foo": "bar" } ] } ``` # Posture # Findings ## List posture findings `client.ZeroTrust.Casb.Posture.Findings.List(ctx, params) (*V4PagePaginationArray[CasbPostureFindingListResponse], error)` **get** `/accounts/{account_id}/data-security/posture/findings` List all security findings that have been identified as being problematic. This will return a list of findings regardless if they have been ignored or not. ### Parameters - `params CasbPostureFindingListParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `Cursor param.Field[string]` Query param: A cursor for pagination. Obtained from the `result_info.cursor` field of a previous response. - `Direction param.Field[CasbPostureFindingListParamsDirection]` Query param: Direction to order results. - `const CasbPostureFindingListParamsDirectionAsc CasbPostureFindingListParamsDirection = "asc"` - `const CasbPostureFindingListParamsDirectionDesc CasbPostureFindingListParamsDirection = "desc"` - `FindingTypeIDs param.Field[string]` Query param: A comma separated list of UUIDs identifying the finding type(s). - `Ignored param.Field[bool]` Query param: Filter for only the ignored findings. Set to false to only see "active" items - `IntegrationID param.Field[string]` Query param: Filter by an integration ID - `MaxAfflictionDate param.Field[Time]` Query param: Filter to view findings that occurred on or before the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `MinAfflictionDate param.Field[Time]` Query param: Filter to view findings that occurred on or after the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `Observation param.Field[CasbPostureFindingListParamsObservation]` Query param: Filter by observation type of the finding - `const CasbPostureFindingListParamsObservationActivity CasbPostureFindingListParamsObservation = "Activity"` - `const CasbPostureFindingListParamsObservationInsight CasbPostureFindingListParamsObservation = "Insight"` - `const CasbPostureFindingListParamsObservationIssue CasbPostureFindingListParamsObservation = "Issue"` - `Order param.Field[CasbPostureFindingListParamsOrder]` Query param: Which field to use when ordering the findings. - `const CasbPostureFindingListParamsOrderFindingName CasbPostureFindingListParamsOrder = "finding.name"` - `const CasbPostureFindingListParamsOrderInstanceCount CasbPostureFindingListParamsOrder = "instance_count"` - `const CasbPostureFindingListParamsOrderIntegrationName CasbPostureFindingListParamsOrder = "integration.name"` - `const CasbPostureFindingListParamsOrderLatestAfflictionDate CasbPostureFindingListParamsOrder = "latest_affliction_date"` - `const CasbPostureFindingListParamsOrderSeverity CasbPostureFindingListParamsOrder = "severity"` - `Page param.Field[int64]` Query param: A page number within the paginated result set. - `PerPage param.Field[int64]` Query param: Number of results to return per page. - `Product param.Field[CasbPostureFindingListParamsProduct]` Query param: Filter by product category of the finding - `const CasbPostureFindingListParamsProductCloud CasbPostureFindingListParamsProduct = "Cloud"` - `const CasbPostureFindingListParamsProductSaaS CasbPostureFindingListParamsProduct = "Saas"` - `Search param.Field[string]` Query param: A search term. - `Severity param.Field[CasbPostureFindingListParamsSeverity]` Query param: Filter by severity - `const CasbPostureFindingListParamsSeverityCritical CasbPostureFindingListParamsSeverity = "Critical"` - `const CasbPostureFindingListParamsSeverityHigh CasbPostureFindingListParamsSeverity = "High"` - `const CasbPostureFindingListParamsSeverityMedium CasbPostureFindingListParamsSeverity = "Medium"` - `const CasbPostureFindingListParamsSeverityLow CasbPostureFindingListParamsSeverity = "Low"` - `Type param.Field[CasbPostureFindingListParamsType]` Query param: Filter by type of the finding - `const CasbPostureFindingListParamsTypeContent CasbPostureFindingListParamsType = "Content"` - `const CasbPostureFindingListParamsTypePosture CasbPostureFindingListParamsType = "Posture"` - `Vendor param.Field[CasbPostureFindingListParamsVendor]` Query param: Filter by vendor - `const CasbPostureFindingListParamsVendorAnthropic CasbPostureFindingListParamsVendor = "ANTHROPIC"` - `const CasbPostureFindingListParamsVendorAws CasbPostureFindingListParamsVendor = "AWS"` - `const CasbPostureFindingListParamsVendorBitbucket CasbPostureFindingListParamsVendor = "BITBUCKET"` - `const CasbPostureFindingListParamsVendorBox CasbPostureFindingListParamsVendor = "BOX"` - `const CasbPostureFindingListParamsVendorConfluence CasbPostureFindingListParamsVendor = "CONFLUENCE"` - `const CasbPostureFindingListParamsVendorDropbox CasbPostureFindingListParamsVendor = "DROPBOX"` - `const CasbPostureFindingListParamsVendorGitHub CasbPostureFindingListParamsVendor = "GITHUB"` - `const CasbPostureFindingListParamsVendorGoogleCloudPlatform CasbPostureFindingListParamsVendor = "GOOGLE_CLOUD_PLATFORM"` - `const CasbPostureFindingListParamsVendorGoogleWorkspace CasbPostureFindingListParamsVendor = "GOOGLE_WORKSPACE"` - `const CasbPostureFindingListParamsVendorJira CasbPostureFindingListParamsVendor = "JIRA"` - `const CasbPostureFindingListParamsVendorMicrosoft CasbPostureFindingListParamsVendor = "MICROSOFT"` - `const CasbPostureFindingListParamsVendorMicrosoftInternal CasbPostureFindingListParamsVendor = "MICROSOFT_INTERNAL"` - `const CasbPostureFindingListParamsVendorOpenAI CasbPostureFindingListParamsVendor = "OPENAI"` - `const CasbPostureFindingListParamsVendorSalesforce CasbPostureFindingListParamsVendor = "SALESFORCE"` - `const CasbPostureFindingListParamsVendorServicenow CasbPostureFindingListParamsVendor = "SERVICENOW"` - `const CasbPostureFindingListParamsVendorSlack CasbPostureFindingListParamsVendor = "SLACK"` ### Returns - `type CasbPostureFindingListResponse struct{…}` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `ID string` Base64 encoded identifier of the security finding. - `ActiveCount int64` Number of active problematic instances identified in the security finding. - `ArchivedCount int64` Number of archived instances identified in the security finding. - `Finding CasbPostureFindingListResponseFinding` Basic finding type information. - `ID string` The unique identifier of the finding. - `Category CasbPostureFindingListResponseFindingCategory` Category information for a finding. - `Observation CasbPostureFindingListResponseFindingCategoryObservation` The type of the observation. - `const CasbPostureFindingListResponseFindingCategoryObservationIssue CasbPostureFindingListResponseFindingCategoryObservation = "Issue"` - `const CasbPostureFindingListResponseFindingCategoryObservationInsight CasbPostureFindingListResponseFindingCategoryObservation = "Insight"` - `const CasbPostureFindingListResponseFindingCategoryObservationActivity CasbPostureFindingListResponseFindingCategoryObservation = "Activity"` - `Product CasbPostureFindingListResponseFindingCategoryProduct` The product category. - `const CasbPostureFindingListResponseFindingCategoryProductSaaS CasbPostureFindingListResponseFindingCategoryProduct = "SaaS"` - `const CasbPostureFindingListResponseFindingCategoryProductCloud CasbPostureFindingListResponseFindingCategoryProduct = "Cloud"` - `Type CasbPostureFindingListResponseFindingCategoryType` The type of the finding category. - `const CasbPostureFindingListResponseFindingCategoryTypeContent CasbPostureFindingListResponseFindingCategoryType = "Content"` - `const CasbPostureFindingListResponseFindingCategoryTypePosture CasbPostureFindingListResponseFindingCategoryType = "Posture"` - `Name string` The name of the finding. - `Severity CasbPostureFindingListResponseFindingSeverity` The severity level of a finding. - `const CasbPostureFindingListResponseFindingSeverityCritical CasbPostureFindingListResponseFindingSeverity = "Critical"` - `const CasbPostureFindingListResponseFindingSeverityHigh CasbPostureFindingListResponseFindingSeverity = "High"` - `const CasbPostureFindingListResponseFindingSeverityMedium CasbPostureFindingListResponseFindingSeverity = "Medium"` - `const CasbPostureFindingListResponseFindingSeverityLow CasbPostureFindingListResponseFindingSeverity = "Low"` - `Vendor string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `Description string` Detailed description of the finding. - `Remediation CasbPostureFindingListResponseFindingRemediation` Remediation guide information for a finding. - `ID string` Remediation Id. - `Frameworks []string` Relevant Compliance Frameworks. - `Guide string` Remediation guide text. - `Impact string` Description of the potential impact. - `Locale string` I18N Locale. - `Threat string` Description of the threat. - `Ignored bool` Determines if finding is currently ignored. - `InstanceCount int64` Number of total (Active or archived) problematic instances identified in the security finding. - `Integration CasbPostureFindingListResponseIntegration` Summary information about an integration. - `Created Time` When entity was created. - `LastHydrated Time` When were the integration credentials last updated. - `Name string` Name of the integration. - `Permissions []string` The vendor-specific permissions associated with the integration. - `Policy CasbPostureFindingListResponseIntegrationPolicy` Policy configuration for an integration. - `ID string` Policy identifier. - `ClientID string` OAuth client ID for the policy. - `ComplianceLevel string` Compliance level for the policy. - `DLPEnabled bool` Whether DLP is enabled for this policy. - `Link string` Link to policy documentation. - `Name string` Policy name. - `Permissions []string` List of permissions included in the policy. - `Status string` Current status of the integration. - `Updated Time` Last entity was updated. - `Upgradable bool` Whether the integrations permissions can be updated. - `Vendor CasbPostureFindingListResponseIntegrationVendor` Information about a vendor/service provider. - `ID string` The id of the vendor. - `Description string` Detailed information about what kinds of issues are detected for this vendor. - `DisplayName string` The display name of the vendor. - `Logo string` Logo URL for the vendor. - `Name string` The name of the vendor. - `StaticLogo string` Static logo URL for the vendor. - `ZtEnrollments []string` The vendor's compatible Zero Trust products. - `Policies []map[string, unknown]` The policies related to the vendor. - `ZtEnrollments []CasbPostureFindingListResponseIntegrationZtEnrollment` Zero Trust products associated with this integration. - `ID string` The internal identifier of the Zero Trust Product. - `Description string` Brief description of the Zero Trust Product. - `DisplayName string` The verbose name of the Zero Trust Product. - `Enabled bool` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `ID string` Integration ID. - `CredentialHealthStatus CasbPostureFindingListResponseIntegrationCredentialHealthStatus` Health status of integration credentials. - `const CasbPostureFindingListResponseIntegrationCredentialHealthStatusInitializing CasbPostureFindingListResponseIntegrationCredentialHealthStatus = "Initializing"` - `const CasbPostureFindingListResponseIntegrationCredentialHealthStatusHealthy CasbPostureFindingListResponseIntegrationCredentialHealthStatus = "Healthy"` - `const CasbPostureFindingListResponseIntegrationCredentialHealthStatusUnhealthy CasbPostureFindingListResponseIntegrationCredentialHealthStatus = "Unhealthy"` - `CredentialsExpiry Time` The date and time when the integration credentials will expire. - `IsPaused bool` Whether the given integration is paused by the user. - `UpgradeDismissed bool` UI State as to whether a potential permissions upgrade has been dismissed. - `LatestAfflictionDate Time` Timestamp of the latest affliction date of an active finding. - `SeverityOverride CasbPostureFindingListResponseSeverityOverride` Override information for finding severity. - `CreatedBy string` User ID who created the override. - `Severity CasbPostureFindingListResponseSeverityOverrideSeverity` The severity level of a finding. - `const CasbPostureFindingListResponseSeverityOverrideSeverityCritical CasbPostureFindingListResponseSeverityOverrideSeverity = "Critical"` - `const CasbPostureFindingListResponseSeverityOverrideSeverityHigh CasbPostureFindingListResponseSeverityOverrideSeverity = "High"` - `const CasbPostureFindingListResponseSeverityOverrideSeverityMedium CasbPostureFindingListResponseSeverityOverrideSeverity = "Medium"` - `const CasbPostureFindingListResponseSeverityOverrideSeverityLow CasbPostureFindingListResponseSeverityOverrideSeverity = "Low"` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.ZeroTrust.Casb.Posture.Findings.List(context.TODO(), zero_trust.CasbPostureFindingListParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } ] } ``` ## Get a finding type `client.ZeroTrust.Casb.Posture.Findings.Get(ctx, findingID, query) (*CasbPostureFindingGetResponse, error)` **get** `/accounts/{account_id}/data-security/posture/findings/{finding_id}` Gets a security Finding that has been identified as being problematic. ### Parameters - `findingID string` - `query CasbPostureFindingGetParams` - `AccountID param.Field[string]` Cloudflare account ID for the user making the request. ### Returns - `type CasbPostureFindingGetResponse struct{…}` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `ID string` Base64 encoded identifier of the security finding. - `ActiveCount int64` Number of active problematic instances identified in the security finding. - `ArchivedCount int64` Number of archived instances identified in the security finding. - `Finding CasbPostureFindingGetResponseFinding` Basic finding type information. - `ID string` The unique identifier of the finding. - `Category CasbPostureFindingGetResponseFindingCategory` Category information for a finding. - `Observation CasbPostureFindingGetResponseFindingCategoryObservation` The type of the observation. - `const CasbPostureFindingGetResponseFindingCategoryObservationIssue CasbPostureFindingGetResponseFindingCategoryObservation = "Issue"` - `const CasbPostureFindingGetResponseFindingCategoryObservationInsight CasbPostureFindingGetResponseFindingCategoryObservation = "Insight"` - `const CasbPostureFindingGetResponseFindingCategoryObservationActivity CasbPostureFindingGetResponseFindingCategoryObservation = "Activity"` - `Product CasbPostureFindingGetResponseFindingCategoryProduct` The product category. - `const CasbPostureFindingGetResponseFindingCategoryProductSaaS CasbPostureFindingGetResponseFindingCategoryProduct = "SaaS"` - `const CasbPostureFindingGetResponseFindingCategoryProductCloud CasbPostureFindingGetResponseFindingCategoryProduct = "Cloud"` - `Type CasbPostureFindingGetResponseFindingCategoryType` The type of the finding category. - `const CasbPostureFindingGetResponseFindingCategoryTypeContent CasbPostureFindingGetResponseFindingCategoryType = "Content"` - `const CasbPostureFindingGetResponseFindingCategoryTypePosture CasbPostureFindingGetResponseFindingCategoryType = "Posture"` - `Name string` The name of the finding. - `Severity CasbPostureFindingGetResponseFindingSeverity` The severity level of a finding. - `const CasbPostureFindingGetResponseFindingSeverityCritical CasbPostureFindingGetResponseFindingSeverity = "Critical"` - `const CasbPostureFindingGetResponseFindingSeverityHigh CasbPostureFindingGetResponseFindingSeverity = "High"` - `const CasbPostureFindingGetResponseFindingSeverityMedium CasbPostureFindingGetResponseFindingSeverity = "Medium"` - `const CasbPostureFindingGetResponseFindingSeverityLow CasbPostureFindingGetResponseFindingSeverity = "Low"` - `Vendor string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `Description string` Detailed description of the finding. - `Remediation CasbPostureFindingGetResponseFindingRemediation` Remediation guide information for a finding. - `ID string` Remediation Id. - `Frameworks []string` Relevant Compliance Frameworks. - `Guide string` Remediation guide text. - `Impact string` Description of the potential impact. - `Locale string` I18N Locale. - `Threat string` Description of the threat. - `Ignored bool` Determines if finding is currently ignored. - `InstanceCount int64` Number of total (Active or archived) problematic instances identified in the security finding. - `Integration CasbPostureFindingGetResponseIntegration` Summary information about an integration. - `Created Time` When entity was created. - `LastHydrated Time` When were the integration credentials last updated. - `Name string` Name of the integration. - `Permissions []string` The vendor-specific permissions associated with the integration. - `Policy CasbPostureFindingGetResponseIntegrationPolicy` Policy configuration for an integration. - `ID string` Policy identifier. - `ClientID string` OAuth client ID for the policy. - `ComplianceLevel string` Compliance level for the policy. - `DLPEnabled bool` Whether DLP is enabled for this policy. - `Link string` Link to policy documentation. - `Name string` Policy name. - `Permissions []string` List of permissions included in the policy. - `Status string` Current status of the integration. - `Updated Time` Last entity was updated. - `Upgradable bool` Whether the integrations permissions can be updated. - `Vendor CasbPostureFindingGetResponseIntegrationVendor` Information about a vendor/service provider. - `ID string` The id of the vendor. - `Description string` Detailed information about what kinds of issues are detected for this vendor. - `DisplayName string` The display name of the vendor. - `Logo string` Logo URL for the vendor. - `Name string` The name of the vendor. - `StaticLogo string` Static logo URL for the vendor. - `ZtEnrollments []string` The vendor's compatible Zero Trust products. - `Policies []map[string, unknown]` The policies related to the vendor. - `ZtEnrollments []CasbPostureFindingGetResponseIntegrationZtEnrollment` Zero Trust products associated with this integration. - `ID string` The internal identifier of the Zero Trust Product. - `Description string` Brief description of the Zero Trust Product. - `DisplayName string` The verbose name of the Zero Trust Product. - `Enabled bool` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `ID string` Integration ID. - `CredentialHealthStatus CasbPostureFindingGetResponseIntegrationCredentialHealthStatus` Health status of integration credentials. - `const CasbPostureFindingGetResponseIntegrationCredentialHealthStatusInitializing CasbPostureFindingGetResponseIntegrationCredentialHealthStatus = "Initializing"` - `const CasbPostureFindingGetResponseIntegrationCredentialHealthStatusHealthy CasbPostureFindingGetResponseIntegrationCredentialHealthStatus = "Healthy"` - `const CasbPostureFindingGetResponseIntegrationCredentialHealthStatusUnhealthy CasbPostureFindingGetResponseIntegrationCredentialHealthStatus = "Unhealthy"` - `CredentialsExpiry Time` The date and time when the integration credentials will expire. - `IsPaused bool` Whether the given integration is paused by the user. - `UpgradeDismissed bool` UI State as to whether a potential permissions upgrade has been dismissed. - `LatestAfflictionDate Time` Timestamp of the latest affliction date of an active finding. - `SeverityOverride CasbPostureFindingGetResponseSeverityOverride` Override information for finding severity. - `CreatedBy string` User ID who created the override. - `Severity CasbPostureFindingGetResponseSeverityOverrideSeverity` The severity level of a finding. - `const CasbPostureFindingGetResponseSeverityOverrideSeverityCritical CasbPostureFindingGetResponseSeverityOverrideSeverity = "Critical"` - `const CasbPostureFindingGetResponseSeverityOverrideSeverityHigh CasbPostureFindingGetResponseSeverityOverrideSeverity = "High"` - `const CasbPostureFindingGetResponseSeverityOverrideSeverityMedium CasbPostureFindingGetResponseSeverityOverrideSeverity = "Medium"` - `const CasbPostureFindingGetResponseSeverityOverrideSeverityLow CasbPostureFindingGetResponseSeverityOverrideSeverity = "Low"` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) finding, err := client.ZeroTrust.Casb.Posture.Findings.Get( context.TODO(), "U3RhaW5sZXNzIHJvY2tz", zero_trust.CasbPostureFindingGetParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", finding.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } } ``` ## Create new findings export request `client.ZeroTrust.Casb.Posture.Findings.Export(ctx, params) (*CasbPostureFindingExportResponse, error)` **post** `/accounts/{account_id}/data-security/posture/findings/export` Creates a CSV export for findings and accepts optional filters in the payload. ### Parameters - `params CasbPostureFindingExportParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `Ignored param.Field[bool]` Body param: Filter for only the ignored findings. Set to false to only see active items. - `IntegrationID param.Field[[]string]` Body param: Filter by multiple integration IDs. - `MaxAfflictionDate param.Field[Time]` Body param: Filter to view findings that occurred on or before the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `MinAfflictionDate param.Field[Time]` Body param: Filter to view findings that occurred on or after the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `Orders param.Field[[]CasbPostureFindingExportParamsOrder]` Body param: Which fields to use when ordering the findings. - `Direction CasbPostureFindingExportParamsOrdersDirection` Sort direction. - `const CasbPostureFindingExportParamsOrdersDirectionAsc CasbPostureFindingExportParamsOrdersDirection = "asc"` - `const CasbPostureFindingExportParamsOrdersDirectionDesc CasbPostureFindingExportParamsOrdersDirection = "desc"` - `Name CasbPostureFindingExportParamsOrdersName` Which field to use when ordering the findings. - `const CasbPostureFindingExportParamsOrdersNameInstanceCount CasbPostureFindingExportParamsOrdersName = "instance_count"` - `const CasbPostureFindingExportParamsOrdersNameFindingName CasbPostureFindingExportParamsOrdersName = "finding.name"` - `const CasbPostureFindingExportParamsOrdersNameIntegrationName CasbPostureFindingExportParamsOrdersName = "integration.name"` - `const CasbPostureFindingExportParamsOrdersNameLatestAfflictionDate CasbPostureFindingExportParamsOrdersName = "latest_affliction_date"` - `const CasbPostureFindingExportParamsOrdersNameSeverity CasbPostureFindingExportParamsOrdersName = "severity"` - `Product param.Field[CasbPostureFindingExportParamsProduct]` Body param: Filter by finding's category product. - `const CasbPostureFindingExportParamsProductSaaS CasbPostureFindingExportParamsProduct = "SaaS"` - `const CasbPostureFindingExportParamsProductCloud CasbPostureFindingExportParamsProduct = "Cloud"` - `Search param.Field[string]` Body param: A search term. - `Severities param.Field[[]CasbPostureFindingExportParamsSeverity]` Body param: Filter by severity levels. - `const CasbPostureFindingExportParamsSeverityCritical CasbPostureFindingExportParamsSeverity = "CRITICAL"` - `const CasbPostureFindingExportParamsSeverityHigh CasbPostureFindingExportParamsSeverity = "HIGH"` - `const CasbPostureFindingExportParamsSeverityMedium CasbPostureFindingExportParamsSeverity = "MEDIUM"` - `const CasbPostureFindingExportParamsSeverityLow CasbPostureFindingExportParamsSeverity = "LOW"` - `Vendors param.Field[[]CasbPostureFindingExportParamsVendor]` Body param: Filter by vendor types. - `const CasbPostureFindingExportParamsVendorAnthropic CasbPostureFindingExportParamsVendor = "ANTHROPIC"` - `const CasbPostureFindingExportParamsVendorAws CasbPostureFindingExportParamsVendor = "AWS"` - `const CasbPostureFindingExportParamsVendorBitbucket CasbPostureFindingExportParamsVendor = "BITBUCKET"` - `const CasbPostureFindingExportParamsVendorBox CasbPostureFindingExportParamsVendor = "BOX"` - `const CasbPostureFindingExportParamsVendorConfluence CasbPostureFindingExportParamsVendor = "CONFLUENCE"` - `const CasbPostureFindingExportParamsVendorDropbox CasbPostureFindingExportParamsVendor = "DROPBOX"` - `const CasbPostureFindingExportParamsVendorGitHub CasbPostureFindingExportParamsVendor = "GITHUB"` - `const CasbPostureFindingExportParamsVendorGoogleCloudPlatform CasbPostureFindingExportParamsVendor = "GOOGLE_CLOUD_PLATFORM"` - `const CasbPostureFindingExportParamsVendorGoogleWorkspace CasbPostureFindingExportParamsVendor = "GOOGLE_WORKSPACE"` - `const CasbPostureFindingExportParamsVendorJira CasbPostureFindingExportParamsVendor = "JIRA"` - `const CasbPostureFindingExportParamsVendorMicrosoft CasbPostureFindingExportParamsVendor = "MICROSOFT"` - `const CasbPostureFindingExportParamsVendorMicrosoftInternal CasbPostureFindingExportParamsVendor = "MICROSOFT_INTERNAL"` - `const CasbPostureFindingExportParamsVendorOpenAI CasbPostureFindingExportParamsVendor = "OPENAI"` - `const CasbPostureFindingExportParamsVendorSalesforce CasbPostureFindingExportParamsVendor = "SALESFORCE"` - `const CasbPostureFindingExportParamsVendorServicenow CasbPostureFindingExportParamsVendor = "SERVICENOW"` - `const CasbPostureFindingExportParamsVendorSlack CasbPostureFindingExportParamsVendor = "SLACK"` ### Returns - `type CasbPostureFindingExportResponse struct{…}` Information about an export job. - `ID string` Unique identifier for the export job. - `Status CasbPostureFindingExportResponseStatus` Status of an export job. - `const CasbPostureFindingExportResponseStatusPending CasbPostureFindingExportResponseStatus = "Pending"` - `const CasbPostureFindingExportResponseStatusSuccess CasbPostureFindingExportResponseStatus = "Success"` - `const CasbPostureFindingExportResponseStatusFailure CasbPostureFindingExportResponseStatus = "Failure"` - `const CasbPostureFindingExportResponseStatusRescheduled CasbPostureFindingExportResponseStatus = "Rescheduled"` - `const CasbPostureFindingExportResponseStatusInProgress CasbPostureFindingExportResponseStatus = "In-Progress"` - `Type CasbPostureFindingExportResponseType` Type of export job. - `const CasbPostureFindingExportResponseTypeFinding CasbPostureFindingExportResponseType = "finding"` - `const CasbPostureFindingExportResponseTypeFindingInstance CasbPostureFindingExportResponseType = "findingInstance"` - `const CasbPostureFindingExportResponseTypeContent CasbPostureFindingExportResponseType = "content"` - `const CasbPostureFindingExportResponseTypeRemediationJob CasbPostureFindingExportResponseType = "remediationJob"` - `UserID string` ID of the export-requesting user. - `DownloadURL string` The URL by which the successfully created export can be downloaded by the end users. - `Errors string` Contains information on errors which may have occurred during export creation. - `FileName string` The base name of the file that is/was generated by the export job. - `FilePath string` The full path of the file that is stored within external storage (currently R2). ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.ZeroTrust.Casb.Posture.Findings.Export(context.TODO(), zero_trust.CasbPostureFindingExportParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } } ``` ## Mark a finding as ignored `client.ZeroTrust.Casb.Posture.Findings.Ignore(ctx, params) (*CasbPostureFindingIgnoreResponse, error)` **post** `/accounts/{account_id}/data-security/posture/findings/ignore` Given a list of findings, mark as ignored. Does nothing if Finding is already ignored. ### Parameters - `params CasbPostureFindingIgnoreParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `Checks param.Field[[]string]` Body param: A list of finding IDs to pass along. ### Returns - `type CasbPostureFindingIgnoreResponse struct{…}` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `ID string` Base64 encoded identifier of the security finding. - `ActiveCount int64` Number of active problematic instances identified in the security finding. - `ArchivedCount int64` Number of archived instances identified in the security finding. - `Finding CasbPostureFindingIgnoreResponseFinding` Basic finding type information. - `ID string` The unique identifier of the finding. - `Category CasbPostureFindingIgnoreResponseFindingCategory` Category information for a finding. - `Observation CasbPostureFindingIgnoreResponseFindingCategoryObservation` The type of the observation. - `const CasbPostureFindingIgnoreResponseFindingCategoryObservationIssue CasbPostureFindingIgnoreResponseFindingCategoryObservation = "Issue"` - `const CasbPostureFindingIgnoreResponseFindingCategoryObservationInsight CasbPostureFindingIgnoreResponseFindingCategoryObservation = "Insight"` - `const CasbPostureFindingIgnoreResponseFindingCategoryObservationActivity CasbPostureFindingIgnoreResponseFindingCategoryObservation = "Activity"` - `Product CasbPostureFindingIgnoreResponseFindingCategoryProduct` The product category. - `const CasbPostureFindingIgnoreResponseFindingCategoryProductSaaS CasbPostureFindingIgnoreResponseFindingCategoryProduct = "SaaS"` - `const CasbPostureFindingIgnoreResponseFindingCategoryProductCloud CasbPostureFindingIgnoreResponseFindingCategoryProduct = "Cloud"` - `Type CasbPostureFindingIgnoreResponseFindingCategoryType` The type of the finding category. - `const CasbPostureFindingIgnoreResponseFindingCategoryTypeContent CasbPostureFindingIgnoreResponseFindingCategoryType = "Content"` - `const CasbPostureFindingIgnoreResponseFindingCategoryTypePosture CasbPostureFindingIgnoreResponseFindingCategoryType = "Posture"` - `Name string` The name of the finding. - `Severity CasbPostureFindingIgnoreResponseFindingSeverity` The severity level of a finding. - `const CasbPostureFindingIgnoreResponseFindingSeverityCritical CasbPostureFindingIgnoreResponseFindingSeverity = "Critical"` - `const CasbPostureFindingIgnoreResponseFindingSeverityHigh CasbPostureFindingIgnoreResponseFindingSeverity = "High"` - `const CasbPostureFindingIgnoreResponseFindingSeverityMedium CasbPostureFindingIgnoreResponseFindingSeverity = "Medium"` - `const CasbPostureFindingIgnoreResponseFindingSeverityLow CasbPostureFindingIgnoreResponseFindingSeverity = "Low"` - `Vendor string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `Description string` Detailed description of the finding. - `Remediation CasbPostureFindingIgnoreResponseFindingRemediation` Remediation guide information for a finding. - `ID string` Remediation Id. - `Frameworks []string` Relevant Compliance Frameworks. - `Guide string` Remediation guide text. - `Impact string` Description of the potential impact. - `Locale string` I18N Locale. - `Threat string` Description of the threat. - `Ignored bool` Determines if finding is currently ignored. - `InstanceCount int64` Number of total (Active or archived) problematic instances identified in the security finding. - `Integration CasbPostureFindingIgnoreResponseIntegration` Summary information about an integration. - `Created Time` When entity was created. - `LastHydrated Time` When were the integration credentials last updated. - `Name string` Name of the integration. - `Permissions []string` The vendor-specific permissions associated with the integration. - `Policy CasbPostureFindingIgnoreResponseIntegrationPolicy` Policy configuration for an integration. - `ID string` Policy identifier. - `ClientID string` OAuth client ID for the policy. - `ComplianceLevel string` Compliance level for the policy. - `DLPEnabled bool` Whether DLP is enabled for this policy. - `Link string` Link to policy documentation. - `Name string` Policy name. - `Permissions []string` List of permissions included in the policy. - `Status string` Current status of the integration. - `Updated Time` Last entity was updated. - `Upgradable bool` Whether the integrations permissions can be updated. - `Vendor CasbPostureFindingIgnoreResponseIntegrationVendor` Information about a vendor/service provider. - `ID string` The id of the vendor. - `Description string` Detailed information about what kinds of issues are detected for this vendor. - `DisplayName string` The display name of the vendor. - `Logo string` Logo URL for the vendor. - `Name string` The name of the vendor. - `StaticLogo string` Static logo URL for the vendor. - `ZtEnrollments []string` The vendor's compatible Zero Trust products. - `Policies []map[string, unknown]` The policies related to the vendor. - `ZtEnrollments []CasbPostureFindingIgnoreResponseIntegrationZtEnrollment` Zero Trust products associated with this integration. - `ID string` The internal identifier of the Zero Trust Product. - `Description string` Brief description of the Zero Trust Product. - `DisplayName string` The verbose name of the Zero Trust Product. - `Enabled bool` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `ID string` Integration ID. - `CredentialHealthStatus CasbPostureFindingIgnoreResponseIntegrationCredentialHealthStatus` Health status of integration credentials. - `const CasbPostureFindingIgnoreResponseIntegrationCredentialHealthStatusInitializing CasbPostureFindingIgnoreResponseIntegrationCredentialHealthStatus = "Initializing"` - `const CasbPostureFindingIgnoreResponseIntegrationCredentialHealthStatusHealthy CasbPostureFindingIgnoreResponseIntegrationCredentialHealthStatus = "Healthy"` - `const CasbPostureFindingIgnoreResponseIntegrationCredentialHealthStatusUnhealthy CasbPostureFindingIgnoreResponseIntegrationCredentialHealthStatus = "Unhealthy"` - `CredentialsExpiry Time` The date and time when the integration credentials will expire. - `IsPaused bool` Whether the given integration is paused by the user. - `UpgradeDismissed bool` UI State as to whether a potential permissions upgrade has been dismissed. - `LatestAfflictionDate Time` Timestamp of the latest affliction date of an active finding. - `SeverityOverride CasbPostureFindingIgnoreResponseSeverityOverride` Override information for finding severity. - `CreatedBy string` User ID who created the override. - `Severity CasbPostureFindingIgnoreResponseSeverityOverrideSeverity` The severity level of a finding. - `const CasbPostureFindingIgnoreResponseSeverityOverrideSeverityCritical CasbPostureFindingIgnoreResponseSeverityOverrideSeverity = "Critical"` - `const CasbPostureFindingIgnoreResponseSeverityOverrideSeverityHigh CasbPostureFindingIgnoreResponseSeverityOverrideSeverity = "High"` - `const CasbPostureFindingIgnoreResponseSeverityOverrideSeverityMedium CasbPostureFindingIgnoreResponseSeverityOverrideSeverity = "Medium"` - `const CasbPostureFindingIgnoreResponseSeverityOverrideSeverityLow CasbPostureFindingIgnoreResponseSeverityOverrideSeverity = "Low"` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.ZeroTrust.Casb.Posture.Findings.Ignore(context.TODO(), zero_trust.CasbPostureFindingIgnoreParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), Checks: cloudflare.F([]string{"MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo="}), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } } ``` ## Remove ignore marker from a finding `client.ZeroTrust.Casb.Posture.Findings.Unignore(ctx, params) (*CasbPostureFindingUnignoreResponse, error)` **post** `/accounts/{account_id}/data-security/posture/findings/unignore` Ability to un-ignore a Finding if it's previously been ignored. Does nothing if the Finding is not ignored. ### Parameters - `params CasbPostureFindingUnignoreParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `Checks param.Field[[]string]` Body param: A list of finding IDs to pass along. ### Returns - `type CasbPostureFindingUnignoreResponse struct{…}` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `ID string` Base64 encoded identifier of the security finding. - `ActiveCount int64` Number of active problematic instances identified in the security finding. - `ArchivedCount int64` Number of archived instances identified in the security finding. - `Finding CasbPostureFindingUnignoreResponseFinding` Basic finding type information. - `ID string` The unique identifier of the finding. - `Category CasbPostureFindingUnignoreResponseFindingCategory` Category information for a finding. - `Observation CasbPostureFindingUnignoreResponseFindingCategoryObservation` The type of the observation. - `const CasbPostureFindingUnignoreResponseFindingCategoryObservationIssue CasbPostureFindingUnignoreResponseFindingCategoryObservation = "Issue"` - `const CasbPostureFindingUnignoreResponseFindingCategoryObservationInsight CasbPostureFindingUnignoreResponseFindingCategoryObservation = "Insight"` - `const CasbPostureFindingUnignoreResponseFindingCategoryObservationActivity CasbPostureFindingUnignoreResponseFindingCategoryObservation = "Activity"` - `Product CasbPostureFindingUnignoreResponseFindingCategoryProduct` The product category. - `const CasbPostureFindingUnignoreResponseFindingCategoryProductSaaS CasbPostureFindingUnignoreResponseFindingCategoryProduct = "SaaS"` - `const CasbPostureFindingUnignoreResponseFindingCategoryProductCloud CasbPostureFindingUnignoreResponseFindingCategoryProduct = "Cloud"` - `Type CasbPostureFindingUnignoreResponseFindingCategoryType` The type of the finding category. - `const CasbPostureFindingUnignoreResponseFindingCategoryTypeContent CasbPostureFindingUnignoreResponseFindingCategoryType = "Content"` - `const CasbPostureFindingUnignoreResponseFindingCategoryTypePosture CasbPostureFindingUnignoreResponseFindingCategoryType = "Posture"` - `Name string` The name of the finding. - `Severity CasbPostureFindingUnignoreResponseFindingSeverity` The severity level of a finding. - `const CasbPostureFindingUnignoreResponseFindingSeverityCritical CasbPostureFindingUnignoreResponseFindingSeverity = "Critical"` - `const CasbPostureFindingUnignoreResponseFindingSeverityHigh CasbPostureFindingUnignoreResponseFindingSeverity = "High"` - `const CasbPostureFindingUnignoreResponseFindingSeverityMedium CasbPostureFindingUnignoreResponseFindingSeverity = "Medium"` - `const CasbPostureFindingUnignoreResponseFindingSeverityLow CasbPostureFindingUnignoreResponseFindingSeverity = "Low"` - `Vendor string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `Description string` Detailed description of the finding. - `Remediation CasbPostureFindingUnignoreResponseFindingRemediation` Remediation guide information for a finding. - `ID string` Remediation Id. - `Frameworks []string` Relevant Compliance Frameworks. - `Guide string` Remediation guide text. - `Impact string` Description of the potential impact. - `Locale string` I18N Locale. - `Threat string` Description of the threat. - `Ignored bool` Determines if finding is currently ignored. - `InstanceCount int64` Number of total (Active or archived) problematic instances identified in the security finding. - `Integration CasbPostureFindingUnignoreResponseIntegration` Summary information about an integration. - `Created Time` When entity was created. - `LastHydrated Time` When were the integration credentials last updated. - `Name string` Name of the integration. - `Permissions []string` The vendor-specific permissions associated with the integration. - `Policy CasbPostureFindingUnignoreResponseIntegrationPolicy` Policy configuration for an integration. - `ID string` Policy identifier. - `ClientID string` OAuth client ID for the policy. - `ComplianceLevel string` Compliance level for the policy. - `DLPEnabled bool` Whether DLP is enabled for this policy. - `Link string` Link to policy documentation. - `Name string` Policy name. - `Permissions []string` List of permissions included in the policy. - `Status string` Current status of the integration. - `Updated Time` Last entity was updated. - `Upgradable bool` Whether the integrations permissions can be updated. - `Vendor CasbPostureFindingUnignoreResponseIntegrationVendor` Information about a vendor/service provider. - `ID string` The id of the vendor. - `Description string` Detailed information about what kinds of issues are detected for this vendor. - `DisplayName string` The display name of the vendor. - `Logo string` Logo URL for the vendor. - `Name string` The name of the vendor. - `StaticLogo string` Static logo URL for the vendor. - `ZtEnrollments []string` The vendor's compatible Zero Trust products. - `Policies []map[string, unknown]` The policies related to the vendor. - `ZtEnrollments []CasbPostureFindingUnignoreResponseIntegrationZtEnrollment` Zero Trust products associated with this integration. - `ID string` The internal identifier of the Zero Trust Product. - `Description string` Brief description of the Zero Trust Product. - `DisplayName string` The verbose name of the Zero Trust Product. - `Enabled bool` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `ID string` Integration ID. - `CredentialHealthStatus CasbPostureFindingUnignoreResponseIntegrationCredentialHealthStatus` Health status of integration credentials. - `const CasbPostureFindingUnignoreResponseIntegrationCredentialHealthStatusInitializing CasbPostureFindingUnignoreResponseIntegrationCredentialHealthStatus = "Initializing"` - `const CasbPostureFindingUnignoreResponseIntegrationCredentialHealthStatusHealthy CasbPostureFindingUnignoreResponseIntegrationCredentialHealthStatus = "Healthy"` - `const CasbPostureFindingUnignoreResponseIntegrationCredentialHealthStatusUnhealthy CasbPostureFindingUnignoreResponseIntegrationCredentialHealthStatus = "Unhealthy"` - `CredentialsExpiry Time` The date and time when the integration credentials will expire. - `IsPaused bool` Whether the given integration is paused by the user. - `UpgradeDismissed bool` UI State as to whether a potential permissions upgrade has been dismissed. - `LatestAfflictionDate Time` Timestamp of the latest affliction date of an active finding. - `SeverityOverride CasbPostureFindingUnignoreResponseSeverityOverride` Override information for finding severity. - `CreatedBy string` User ID who created the override. - `Severity CasbPostureFindingUnignoreResponseSeverityOverrideSeverity` The severity level of a finding. - `const CasbPostureFindingUnignoreResponseSeverityOverrideSeverityCritical CasbPostureFindingUnignoreResponseSeverityOverrideSeverity = "Critical"` - `const CasbPostureFindingUnignoreResponseSeverityOverrideSeverityHigh CasbPostureFindingUnignoreResponseSeverityOverrideSeverity = "High"` - `const CasbPostureFindingUnignoreResponseSeverityOverrideSeverityMedium CasbPostureFindingUnignoreResponseSeverityOverrideSeverity = "Medium"` - `const CasbPostureFindingUnignoreResponseSeverityOverrideSeverityLow CasbPostureFindingUnignoreResponseSeverityOverrideSeverity = "Low"` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.ZeroTrust.Casb.Posture.Findings.Unignore(context.TODO(), zero_trust.CasbPostureFindingUnignoreParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), Checks: cloudflare.F([]string{"MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo="}), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } } ``` ## Update the severity for a finding `client.ZeroTrust.Casb.Posture.Findings.TuneSeverity(ctx, findingID, params) (*CasbPostureFindingTuneSeverityResponse, error)` **post** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/tune_finding_severity` Update the severity of a Finding. This will update the `severity_override` field on the Finding payload with the new severity value. ### Parameters - `findingID string` - `params CasbPostureFindingTuneSeverityParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `NewSeverity param.Field[CasbPostureFindingTuneSeverityParamsNewSeverity]` Body param: The numeric severity value to apply to the finding. - `const CasbPostureFindingTuneSeverityParamsNewSeverity1 CasbPostureFindingTuneSeverityParamsNewSeverity = 1` - `const CasbPostureFindingTuneSeverityParamsNewSeverity2 CasbPostureFindingTuneSeverityParamsNewSeverity = 2` - `const CasbPostureFindingTuneSeverityParamsNewSeverity3 CasbPostureFindingTuneSeverityParamsNewSeverity = 3` - `const CasbPostureFindingTuneSeverityParamsNewSeverity4 CasbPostureFindingTuneSeverityParamsNewSeverity = 4` ### Returns - `type CasbPostureFindingTuneSeverityResponse struct{…}` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `ID string` Base64 encoded identifier of the security finding. - `ActiveCount int64` Number of active problematic instances identified in the security finding. - `ArchivedCount int64` Number of archived instances identified in the security finding. - `Finding CasbPostureFindingTuneSeverityResponseFinding` Basic finding type information. - `ID string` The unique identifier of the finding. - `Category CasbPostureFindingTuneSeverityResponseFindingCategory` Category information for a finding. - `Observation CasbPostureFindingTuneSeverityResponseFindingCategoryObservation` The type of the observation. - `const CasbPostureFindingTuneSeverityResponseFindingCategoryObservationIssue CasbPostureFindingTuneSeverityResponseFindingCategoryObservation = "Issue"` - `const CasbPostureFindingTuneSeverityResponseFindingCategoryObservationInsight CasbPostureFindingTuneSeverityResponseFindingCategoryObservation = "Insight"` - `const CasbPostureFindingTuneSeverityResponseFindingCategoryObservationActivity CasbPostureFindingTuneSeverityResponseFindingCategoryObservation = "Activity"` - `Product CasbPostureFindingTuneSeverityResponseFindingCategoryProduct` The product category. - `const CasbPostureFindingTuneSeverityResponseFindingCategoryProductSaaS CasbPostureFindingTuneSeverityResponseFindingCategoryProduct = "SaaS"` - `const CasbPostureFindingTuneSeverityResponseFindingCategoryProductCloud CasbPostureFindingTuneSeverityResponseFindingCategoryProduct = "Cloud"` - `Type CasbPostureFindingTuneSeverityResponseFindingCategoryType` The type of the finding category. - `const CasbPostureFindingTuneSeverityResponseFindingCategoryTypeContent CasbPostureFindingTuneSeverityResponseFindingCategoryType = "Content"` - `const CasbPostureFindingTuneSeverityResponseFindingCategoryTypePosture CasbPostureFindingTuneSeverityResponseFindingCategoryType = "Posture"` - `Name string` The name of the finding. - `Severity CasbPostureFindingTuneSeverityResponseFindingSeverity` The severity level of a finding. - `const CasbPostureFindingTuneSeverityResponseFindingSeverityCritical CasbPostureFindingTuneSeverityResponseFindingSeverity = "Critical"` - `const CasbPostureFindingTuneSeverityResponseFindingSeverityHigh CasbPostureFindingTuneSeverityResponseFindingSeverity = "High"` - `const CasbPostureFindingTuneSeverityResponseFindingSeverityMedium CasbPostureFindingTuneSeverityResponseFindingSeverity = "Medium"` - `const CasbPostureFindingTuneSeverityResponseFindingSeverityLow CasbPostureFindingTuneSeverityResponseFindingSeverity = "Low"` - `Vendor string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `Description string` Detailed description of the finding. - `Remediation CasbPostureFindingTuneSeverityResponseFindingRemediation` Remediation guide information for a finding. - `ID string` Remediation Id. - `Frameworks []string` Relevant Compliance Frameworks. - `Guide string` Remediation guide text. - `Impact string` Description of the potential impact. - `Locale string` I18N Locale. - `Threat string` Description of the threat. - `Ignored bool` Determines if finding is currently ignored. - `InstanceCount int64` Number of total (Active or archived) problematic instances identified in the security finding. - `Integration CasbPostureFindingTuneSeverityResponseIntegration` Summary information about an integration. - `Created Time` When entity was created. - `LastHydrated Time` When were the integration credentials last updated. - `Name string` Name of the integration. - `Permissions []string` The vendor-specific permissions associated with the integration. - `Policy CasbPostureFindingTuneSeverityResponseIntegrationPolicy` Policy configuration for an integration. - `ID string` Policy identifier. - `ClientID string` OAuth client ID for the policy. - `ComplianceLevel string` Compliance level for the policy. - `DLPEnabled bool` Whether DLP is enabled for this policy. - `Link string` Link to policy documentation. - `Name string` Policy name. - `Permissions []string` List of permissions included in the policy. - `Status string` Current status of the integration. - `Updated Time` Last entity was updated. - `Upgradable bool` Whether the integrations permissions can be updated. - `Vendor CasbPostureFindingTuneSeverityResponseIntegrationVendor` Information about a vendor/service provider. - `ID string` The id of the vendor. - `Description string` Detailed information about what kinds of issues are detected for this vendor. - `DisplayName string` The display name of the vendor. - `Logo string` Logo URL for the vendor. - `Name string` The name of the vendor. - `StaticLogo string` Static logo URL for the vendor. - `ZtEnrollments []string` The vendor's compatible Zero Trust products. - `Policies []map[string, unknown]` The policies related to the vendor. - `ZtEnrollments []CasbPostureFindingTuneSeverityResponseIntegrationZtEnrollment` Zero Trust products associated with this integration. - `ID string` The internal identifier of the Zero Trust Product. - `Description string` Brief description of the Zero Trust Product. - `DisplayName string` The verbose name of the Zero Trust Product. - `Enabled bool` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `ID string` Integration ID. - `CredentialHealthStatus CasbPostureFindingTuneSeverityResponseIntegrationCredentialHealthStatus` Health status of integration credentials. - `const CasbPostureFindingTuneSeverityResponseIntegrationCredentialHealthStatusInitializing CasbPostureFindingTuneSeverityResponseIntegrationCredentialHealthStatus = "Initializing"` - `const CasbPostureFindingTuneSeverityResponseIntegrationCredentialHealthStatusHealthy CasbPostureFindingTuneSeverityResponseIntegrationCredentialHealthStatus = "Healthy"` - `const CasbPostureFindingTuneSeverityResponseIntegrationCredentialHealthStatusUnhealthy CasbPostureFindingTuneSeverityResponseIntegrationCredentialHealthStatus = "Unhealthy"` - `CredentialsExpiry Time` The date and time when the integration credentials will expire. - `IsPaused bool` Whether the given integration is paused by the user. - `UpgradeDismissed bool` UI State as to whether a potential permissions upgrade has been dismissed. - `LatestAfflictionDate Time` Timestamp of the latest affliction date of an active finding. - `SeverityOverride CasbPostureFindingTuneSeverityResponseSeverityOverride` Override information for finding severity. - `CreatedBy string` User ID who created the override. - `Severity CasbPostureFindingTuneSeverityResponseSeverityOverrideSeverity` The severity level of a finding. - `const CasbPostureFindingTuneSeverityResponseSeverityOverrideSeverityCritical CasbPostureFindingTuneSeverityResponseSeverityOverrideSeverity = "Critical"` - `const CasbPostureFindingTuneSeverityResponseSeverityOverrideSeverityHigh CasbPostureFindingTuneSeverityResponseSeverityOverrideSeverity = "High"` - `const CasbPostureFindingTuneSeverityResponseSeverityOverrideSeverityMedium CasbPostureFindingTuneSeverityResponseSeverityOverrideSeverity = "Medium"` - `const CasbPostureFindingTuneSeverityResponseSeverityOverrideSeverityLow CasbPostureFindingTuneSeverityResponseSeverityOverrideSeverity = "Low"` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.ZeroTrust.Casb.Posture.Findings.TuneSeverity( context.TODO(), "U3RhaW5sZXNzIHJvY2tz", zero_trust.CasbPostureFindingTuneSeverityParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), NewSeverity: cloudflare.F(zero_trust.CasbPostureFindingTuneSeverityParamsNewSeverity1), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } } ``` ## Reset severity for a finding back to the default `client.ZeroTrust.Casb.Posture.Findings.ResetSeverity(ctx, findingID, body) (*CasbPostureFindingResetSeverityResponse, error)` **post** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/reset_finding_severity` If a Finding's severity has been changed, reset it back to default value. Does nothing if no override exists. ### Parameters - `findingID string` - `body CasbPostureFindingResetSeverityParams` - `AccountID param.Field[string]` Cloudflare account ID for the user making the request. ### Returns - `type CasbPostureFindingResetSeverityResponse struct{…}` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `ID string` Base64 encoded identifier of the security finding. - `ActiveCount int64` Number of active problematic instances identified in the security finding. - `ArchivedCount int64` Number of archived instances identified in the security finding. - `Finding CasbPostureFindingResetSeverityResponseFinding` Basic finding type information. - `ID string` The unique identifier of the finding. - `Category CasbPostureFindingResetSeverityResponseFindingCategory` Category information for a finding. - `Observation CasbPostureFindingResetSeverityResponseFindingCategoryObservation` The type of the observation. - `const CasbPostureFindingResetSeverityResponseFindingCategoryObservationIssue CasbPostureFindingResetSeverityResponseFindingCategoryObservation = "Issue"` - `const CasbPostureFindingResetSeverityResponseFindingCategoryObservationInsight CasbPostureFindingResetSeverityResponseFindingCategoryObservation = "Insight"` - `const CasbPostureFindingResetSeverityResponseFindingCategoryObservationActivity CasbPostureFindingResetSeverityResponseFindingCategoryObservation = "Activity"` - `Product CasbPostureFindingResetSeverityResponseFindingCategoryProduct` The product category. - `const CasbPostureFindingResetSeverityResponseFindingCategoryProductSaaS CasbPostureFindingResetSeverityResponseFindingCategoryProduct = "SaaS"` - `const CasbPostureFindingResetSeverityResponseFindingCategoryProductCloud CasbPostureFindingResetSeverityResponseFindingCategoryProduct = "Cloud"` - `Type CasbPostureFindingResetSeverityResponseFindingCategoryType` The type of the finding category. - `const CasbPostureFindingResetSeverityResponseFindingCategoryTypeContent CasbPostureFindingResetSeverityResponseFindingCategoryType = "Content"` - `const CasbPostureFindingResetSeverityResponseFindingCategoryTypePosture CasbPostureFindingResetSeverityResponseFindingCategoryType = "Posture"` - `Name string` The name of the finding. - `Severity CasbPostureFindingResetSeverityResponseFindingSeverity` The severity level of a finding. - `const CasbPostureFindingResetSeverityResponseFindingSeverityCritical CasbPostureFindingResetSeverityResponseFindingSeverity = "Critical"` - `const CasbPostureFindingResetSeverityResponseFindingSeverityHigh CasbPostureFindingResetSeverityResponseFindingSeverity = "High"` - `const CasbPostureFindingResetSeverityResponseFindingSeverityMedium CasbPostureFindingResetSeverityResponseFindingSeverity = "Medium"` - `const CasbPostureFindingResetSeverityResponseFindingSeverityLow CasbPostureFindingResetSeverityResponseFindingSeverity = "Low"` - `Vendor string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `Description string` Detailed description of the finding. - `Remediation CasbPostureFindingResetSeverityResponseFindingRemediation` Remediation guide information for a finding. - `ID string` Remediation Id. - `Frameworks []string` Relevant Compliance Frameworks. - `Guide string` Remediation guide text. - `Impact string` Description of the potential impact. - `Locale string` I18N Locale. - `Threat string` Description of the threat. - `Ignored bool` Determines if finding is currently ignored. - `InstanceCount int64` Number of total (Active or archived) problematic instances identified in the security finding. - `Integration CasbPostureFindingResetSeverityResponseIntegration` Summary information about an integration. - `Created Time` When entity was created. - `LastHydrated Time` When were the integration credentials last updated. - `Name string` Name of the integration. - `Permissions []string` The vendor-specific permissions associated with the integration. - `Policy CasbPostureFindingResetSeverityResponseIntegrationPolicy` Policy configuration for an integration. - `ID string` Policy identifier. - `ClientID string` OAuth client ID for the policy. - `ComplianceLevel string` Compliance level for the policy. - `DLPEnabled bool` Whether DLP is enabled for this policy. - `Link string` Link to policy documentation. - `Name string` Policy name. - `Permissions []string` List of permissions included in the policy. - `Status string` Current status of the integration. - `Updated Time` Last entity was updated. - `Upgradable bool` Whether the integrations permissions can be updated. - `Vendor CasbPostureFindingResetSeverityResponseIntegrationVendor` Information about a vendor/service provider. - `ID string` The id of the vendor. - `Description string` Detailed information about what kinds of issues are detected for this vendor. - `DisplayName string` The display name of the vendor. - `Logo string` Logo URL for the vendor. - `Name string` The name of the vendor. - `StaticLogo string` Static logo URL for the vendor. - `ZtEnrollments []string` The vendor's compatible Zero Trust products. - `Policies []map[string, unknown]` The policies related to the vendor. - `ZtEnrollments []CasbPostureFindingResetSeverityResponseIntegrationZtEnrollment` Zero Trust products associated with this integration. - `ID string` The internal identifier of the Zero Trust Product. - `Description string` Brief description of the Zero Trust Product. - `DisplayName string` The verbose name of the Zero Trust Product. - `Enabled bool` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `ID string` Integration ID. - `CredentialHealthStatus CasbPostureFindingResetSeverityResponseIntegrationCredentialHealthStatus` Health status of integration credentials. - `const CasbPostureFindingResetSeverityResponseIntegrationCredentialHealthStatusInitializing CasbPostureFindingResetSeverityResponseIntegrationCredentialHealthStatus = "Initializing"` - `const CasbPostureFindingResetSeverityResponseIntegrationCredentialHealthStatusHealthy CasbPostureFindingResetSeverityResponseIntegrationCredentialHealthStatus = "Healthy"` - `const CasbPostureFindingResetSeverityResponseIntegrationCredentialHealthStatusUnhealthy CasbPostureFindingResetSeverityResponseIntegrationCredentialHealthStatus = "Unhealthy"` - `CredentialsExpiry Time` The date and time when the integration credentials will expire. - `IsPaused bool` Whether the given integration is paused by the user. - `UpgradeDismissed bool` UI State as to whether a potential permissions upgrade has been dismissed. - `LatestAfflictionDate Time` Timestamp of the latest affliction date of an active finding. - `SeverityOverride CasbPostureFindingResetSeverityResponseSeverityOverride` Override information for finding severity. - `CreatedBy string` User ID who created the override. - `Severity CasbPostureFindingResetSeverityResponseSeverityOverrideSeverity` The severity level of a finding. - `const CasbPostureFindingResetSeverityResponseSeverityOverrideSeverityCritical CasbPostureFindingResetSeverityResponseSeverityOverrideSeverity = "Critical"` - `const CasbPostureFindingResetSeverityResponseSeverityOverrideSeverityHigh CasbPostureFindingResetSeverityResponseSeverityOverrideSeverity = "High"` - `const CasbPostureFindingResetSeverityResponseSeverityOverrideSeverityMedium CasbPostureFindingResetSeverityResponseSeverityOverrideSeverity = "Medium"` - `const CasbPostureFindingResetSeverityResponseSeverityOverrideSeverityLow CasbPostureFindingResetSeverityResponseSeverityOverrideSeverity = "Low"` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.ZeroTrust.Casb.Posture.Findings.ResetSeverity( context.TODO(), "U3RhaW5sZXNzIHJvY2tz", zero_trust.CasbPostureFindingResetSeverityParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } } ``` # Instances ## List instances of a finding `client.ZeroTrust.Casb.Posture.Findings.Instances.List(ctx, findingID, params) (*V4PagePaginationArray[CasbPostureFindingInstanceListResponse], error)` **get** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances` Lists all security finding instances for a given security finding. ### Parameters - `findingID string` - `params CasbPostureFindingInstanceListParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `Archived param.Field[bool]` Query param: Archived - `AssetIDs param.Field[[]string]` Query param: Filter finding instances by an array of asset IDs. Supports multiple comma-separated values. - `Cursor param.Field[string]` Query param: A cursor for pagination. Obtained from the `result_info.cursor` field of a previous response. - `Direction param.Field[CasbPostureFindingInstanceListParamsDirection]` Query param: Direction to order results. - `const CasbPostureFindingInstanceListParamsDirectionAsc CasbPostureFindingInstanceListParamsDirection = "asc"` - `const CasbPostureFindingInstanceListParamsDirectionDesc CasbPostureFindingInstanceListParamsDirection = "desc"` - `FindingInstanceIDs param.Field[[]string]` Query param: Filter finding instances by an array of finding instance IDs. Supports multiple comma-separated values. - `MaxAfflictionDate param.Field[Time]` Query param: Filter to view findings that occurred on or before the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `MinAfflictionDate param.Field[Time]` Query param: Filter to view findings that occurred on or after the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `Order param.Field[CasbPostureFindingInstanceListParamsOrder]` Query param: Which field to use when ordering the Finding's instances. When ordering by 'remediation.status', only the most recent non-stale remediation job is considered. Stale jobs (created before the instance's affliction_date) are treated as having no status for ordering purposes. - `const CasbPostureFindingInstanceListParamsOrderAfflictionDate CasbPostureFindingInstanceListParamsOrder = "affliction_date"` - `const CasbPostureFindingInstanceListParamsOrderAssetName CasbPostureFindingInstanceListParamsOrder = "asset.name"` - `const CasbPostureFindingInstanceListParamsOrderRemediationStatus CasbPostureFindingInstanceListParamsOrder = "remediation.status"` - `Page param.Field[int64]` Query param: A page number within the paginated result set. - `PerPage param.Field[int64]` Query param: Number of results to return per page. - `RemediationStatuses param.Field[[]CasbPostureFindingInstanceListParamsRemediationStatus]` Query param: Filter finding instances by most recent remediation job status. Supports multiple comma-separated values. Use 'none' to filter instances with no remediation jobs or instances where the most recent job is stale. Note: Stale jobs (created before the instance's affliction_date) are ignored for filtering purposes, but are still included in the 'remediations' array with stale=true. - `const CasbPostureFindingInstanceListParamsRemediationStatusNone CasbPostureFindingInstanceListParamsRemediationStatus = "none"` - `const CasbPostureFindingInstanceListParamsRemediationStatusPending CasbPostureFindingInstanceListParamsRemediationStatus = "pending"` - `const CasbPostureFindingInstanceListParamsRemediationStatusProcessing CasbPostureFindingInstanceListParamsRemediationStatus = "processing"` - `const CasbPostureFindingInstanceListParamsRemediationStatusValidating CasbPostureFindingInstanceListParamsRemediationStatus = "validating"` - `const CasbPostureFindingInstanceListParamsRemediationStatusCompleted CasbPostureFindingInstanceListParamsRemediationStatus = "completed"` - `const CasbPostureFindingInstanceListParamsRemediationStatusFailed CasbPostureFindingInstanceListParamsRemediationStatus = "failed"` - `Search param.Field[string]` Query param: A search term. ### Returns - `type CasbPostureFindingInstanceListResponse struct{…}` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `AfflictionDate Time` When this specific instance was identified. - `Asset CasbPostureFindingInstanceListResponseAsset` Asset information including metadata and categorization. - `Category CasbPostureFindingInstanceListResponseAssetCategory` Category information for an asset. - `Service string` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `Type string` The type of asset. - `Vendor string` The vendor the asset is part of. - `ID string` Unique identifier for the asset category. - `ExternalID string` External identifier from the source system. - `Fields []CasbPostureFindingInstanceListResponseAssetField` The fields associated with the asset. - `Name string` The name of the field. - `Value string` The value of the field. - `Link string` Optional link associated with the field. - `Name string` Human-readable name of the asset. - `ID string` Unique identifier for the asset. - `Link string` Direct link to the asset. - `DLPContexts []CasbPostureFindingInstanceListResponseDLPContext` DLP context information if this is a content finding. - `Created Time` When the DLP context was created. - `EntryIDs []string` DLP Entry IDs. - `ProfileID string` DLP Profile ID. - `Updated Time` When the DLP context was last updated. - `ID string` Unique identifier for the DLP context. - `Deleted Time` When the DLP context was deleted. - `MatchContextMaxExtent int64` DLP Right Boundary of match context. - `MatchContextMinExtent int64` DLP Left Boundary of match context. - `MatchContextPayload map[string, unknown]` DLP Match context payload that matched the profile in question. - `Remediations []CasbPostureFindingInstanceListResponseRemediation` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `ID string` Unique identifier for the remediation job. - `CreatedAt Time` When the remediation job was created. - `Stale bool` Whether this remediation job is stale (created before the finding instance's affliction_date). - `Status CasbPostureFindingInstanceListResponseRemediationsStatus` Status of a remediation job. - `const CasbPostureFindingInstanceListResponseRemediationsStatusPending CasbPostureFindingInstanceListResponseRemediationsStatus = "pending"` - `const CasbPostureFindingInstanceListResponseRemediationsStatusProcessing CasbPostureFindingInstanceListResponseRemediationsStatus = "processing"` - `const CasbPostureFindingInstanceListResponseRemediationsStatusCompleted CasbPostureFindingInstanceListResponseRemediationsStatus = "completed"` - `const CasbPostureFindingInstanceListResponseRemediationsStatusFailed CasbPostureFindingInstanceListResponseRemediationsStatus = "failed"` - `const CasbPostureFindingInstanceListResponseRemediationsStatusValidating CasbPostureFindingInstanceListResponseRemediationsStatus = "validating"` - `Webhooks []CasbPostureFindingInstanceListResponseWebhook` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `LatestJob CasbPostureFindingInstanceListResponseWebhooksLatestJob` The most recent webhook job for this webhook configuration. - `ID string` Unique identifier for the webhook job. - `CreatedAt Time` When the webhook job was created. - `Stale bool` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `Status CasbPostureFindingInstanceListResponseWebhooksLatestJobStatus` Current status of the webhook job. - `const CasbPostureFindingInstanceListResponseWebhooksLatestJobStatusPending CasbPostureFindingInstanceListResponseWebhooksLatestJobStatus = "pending"` - `const CasbPostureFindingInstanceListResponseWebhooksLatestJobStatusProcessing CasbPostureFindingInstanceListResponseWebhooksLatestJobStatus = "processing"` - `const CasbPostureFindingInstanceListResponseWebhooksLatestJobStatusCompleted CasbPostureFindingInstanceListResponseWebhooksLatestJobStatus = "completed"` - `WebhookID string` Unique identifier for the webhook configuration. - `WebhookLabel string` Account-specified display label for the webhook configuration. - `ID string` Unique identifier for the finding instance. - `IsArchived bool` Whether this finding instance has been archived. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.ZeroTrust.Casb.Posture.Findings.Instances.List( context.TODO(), "U3RhaW5sZXNzIHJvY2tz", zero_trust.CasbPostureFindingInstanceListParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "affliction_date": "2025-03-18T17:25:38.700541Z", "asset": { "category": { "service": null, "type": "file", "vendor": "Slack", "id": "1a78cbf3-b98f-4289-b1f2-22db64130f4f" }, "external_id": "external-file-id-123", "fields": [ { "name": "Credential name", "value": "Test asset 2", "link": "https://example.com" } ], "name": "Public.svg", "id": "8a043daf-def4-403e-9d28-da2e93d9b824", "link": "https://slack-files.com/TYJH37DCK-E0238GG6B8-92fd5y5674" }, "dlp_contexts": [ { "created": "2025-03-18T17:25:38.695977Z", "entry_ids": [ "21befc68-a297-4090-ac10-17a051b901cd", "d6dd1e16-f78c-401a-b564-45c4e44aa467" ], "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e", "updated": "2025-03-18T17:25:38.695977Z", "id": "7653ff3a-d25e-4c10-8034-3460937c045b", "deleted": "2025-03-18T17:25:38.695977Z", "match_context_max_extent": 512, "match_context_min_extent": 1, "match_context_payload": {} } ], "remediations": [ { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" } ], "webhooks": [ { "latest_job": { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" }, "webhook_id": "550e8400-e29b-41d4-a716-446655440000", "webhook_label": "Send to Gmail" } ], "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "is_archived": false } ] } ``` ## Get a finding instance using an instance ID `client.ZeroTrust.Casb.Posture.Findings.Instances.Get(ctx, findingID, instanceID, query) (*CasbPostureFindingInstanceGetResponse, error)` **get** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances/{instance_id}` Gets a security Finding instance by id. ### Parameters - `findingID string` - `instanceID string` - `query CasbPostureFindingInstanceGetParams` - `AccountID param.Field[string]` Cloudflare account ID for the user making the request. ### Returns - `type CasbPostureFindingInstanceGetResponse struct{…}` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `AfflictionDate Time` When this specific instance was identified. - `Asset CasbPostureFindingInstanceGetResponseAsset` Asset information including metadata and categorization. - `Category CasbPostureFindingInstanceGetResponseAssetCategory` Category information for an asset. - `Service string` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `Type string` The type of asset. - `Vendor string` The vendor the asset is part of. - `ID string` Unique identifier for the asset category. - `ExternalID string` External identifier from the source system. - `Fields []CasbPostureFindingInstanceGetResponseAssetField` The fields associated with the asset. - `Name string` The name of the field. - `Value string` The value of the field. - `Link string` Optional link associated with the field. - `Name string` Human-readable name of the asset. - `ID string` Unique identifier for the asset. - `Link string` Direct link to the asset. - `DLPContexts []CasbPostureFindingInstanceGetResponseDLPContext` DLP context information if this is a content finding. - `Created Time` When the DLP context was created. - `EntryIDs []string` DLP Entry IDs. - `ProfileID string` DLP Profile ID. - `Updated Time` When the DLP context was last updated. - `ID string` Unique identifier for the DLP context. - `Deleted Time` When the DLP context was deleted. - `MatchContextMaxExtent int64` DLP Right Boundary of match context. - `MatchContextMinExtent int64` DLP Left Boundary of match context. - `MatchContextPayload map[string, unknown]` DLP Match context payload that matched the profile in question. - `Remediations []CasbPostureFindingInstanceGetResponseRemediation` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `ID string` Unique identifier for the remediation job. - `CreatedAt Time` When the remediation job was created. - `Stale bool` Whether this remediation job is stale (created before the finding instance's affliction_date). - `Status CasbPostureFindingInstanceGetResponseRemediationsStatus` Status of a remediation job. - `const CasbPostureFindingInstanceGetResponseRemediationsStatusPending CasbPostureFindingInstanceGetResponseRemediationsStatus = "pending"` - `const CasbPostureFindingInstanceGetResponseRemediationsStatusProcessing CasbPostureFindingInstanceGetResponseRemediationsStatus = "processing"` - `const CasbPostureFindingInstanceGetResponseRemediationsStatusCompleted CasbPostureFindingInstanceGetResponseRemediationsStatus = "completed"` - `const CasbPostureFindingInstanceGetResponseRemediationsStatusFailed CasbPostureFindingInstanceGetResponseRemediationsStatus = "failed"` - `const CasbPostureFindingInstanceGetResponseRemediationsStatusValidating CasbPostureFindingInstanceGetResponseRemediationsStatus = "validating"` - `Webhooks []CasbPostureFindingInstanceGetResponseWebhook` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `LatestJob CasbPostureFindingInstanceGetResponseWebhooksLatestJob` The most recent webhook job for this webhook configuration. - `ID string` Unique identifier for the webhook job. - `CreatedAt Time` When the webhook job was created. - `Stale bool` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `Status CasbPostureFindingInstanceGetResponseWebhooksLatestJobStatus` Current status of the webhook job. - `const CasbPostureFindingInstanceGetResponseWebhooksLatestJobStatusPending CasbPostureFindingInstanceGetResponseWebhooksLatestJobStatus = "pending"` - `const CasbPostureFindingInstanceGetResponseWebhooksLatestJobStatusProcessing CasbPostureFindingInstanceGetResponseWebhooksLatestJobStatus = "processing"` - `const CasbPostureFindingInstanceGetResponseWebhooksLatestJobStatusCompleted CasbPostureFindingInstanceGetResponseWebhooksLatestJobStatus = "completed"` - `WebhookID string` Unique identifier for the webhook configuration. - `WebhookLabel string` Account-specified display label for the webhook configuration. - `ID string` Unique identifier for the finding instance. - `IsArchived bool` Whether this finding instance has been archived. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) instance, err := client.ZeroTrust.Casb.Posture.Findings.Instances.Get( context.TODO(), "U3RhaW5sZXNzIHJvY2tz", "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", zero_trust.CasbPostureFindingInstanceGetParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", instance.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "affliction_date": "2025-03-18T17:25:38.700541Z", "asset": { "category": { "service": null, "type": "file", "vendor": "Slack", "id": "1a78cbf3-b98f-4289-b1f2-22db64130f4f" }, "external_id": "external-file-id-123", "fields": [ { "name": "Credential name", "value": "Test asset 2", "link": "https://example.com" } ], "name": "Public.svg", "id": "8a043daf-def4-403e-9d28-da2e93d9b824", "link": "https://slack-files.com/TYJH37DCK-E0238GG6B8-92fd5y5674" }, "dlp_contexts": [ { "created": "2025-03-18T17:25:38.695977Z", "entry_ids": [ "21befc68-a297-4090-ac10-17a051b901cd", "d6dd1e16-f78c-401a-b564-45c4e44aa467" ], "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e", "updated": "2025-03-18T17:25:38.695977Z", "id": "7653ff3a-d25e-4c10-8034-3460937c045b", "deleted": "2025-03-18T17:25:38.695977Z", "match_context_max_extent": 512, "match_context_min_extent": 1, "match_context_payload": {} } ], "remediations": [ { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" } ], "webhooks": [ { "latest_job": { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" }, "webhook_id": "550e8400-e29b-41d4-a716-446655440000", "webhook_label": "Send to Gmail" } ], "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "is_archived": false } } ``` ## Create a finding instances export `client.ZeroTrust.Casb.Posture.Findings.Instances.Export(ctx, storageNamespaceID, params) (*CasbPostureFindingInstanceExportResponse, error)` **post** `/accounts/{account_id}/data-security/posture/findings/{storage_namespace_id}/instances/export` Creates a CSV export for Finding instances and accepts optional filters in the payload. The `storage_namespace_id` path parameter is derived from the finding ID by base64-decoding it (which yields `integration_id:finding_type_id`) and replacing the colon with a hyphen. ### Parameters - `storageNamespaceID string` - `params CasbPostureFindingInstanceExportParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `Archived param.Field[bool]` Body param: Filter for archived status. - `MaxAfflictionDate param.Field[Time]` Body param: Filter to view findings that occurred on or before the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `MinAfflictionDate param.Field[Time]` Body param: Filter to view findings that occurred on or after the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `Orders param.Field[[]CasbPostureFindingInstanceExportParamsOrder]` Body param: Ordering specifications for the export. - `Direction CasbPostureFindingInstanceExportParamsOrdersDirection` Sort direction. - `const CasbPostureFindingInstanceExportParamsOrdersDirectionAsc CasbPostureFindingInstanceExportParamsOrdersDirection = "asc"` - `const CasbPostureFindingInstanceExportParamsOrdersDirectionDesc CasbPostureFindingInstanceExportParamsOrdersDirection = "desc"` - `Name CasbPostureFindingInstanceExportParamsOrdersName` Which field to use when ordering the finding instances. - `const CasbPostureFindingInstanceExportParamsOrdersNameAssetName CasbPostureFindingInstanceExportParamsOrdersName = "asset.name"` - `const CasbPostureFindingInstanceExportParamsOrdersNameAfflictionDate CasbPostureFindingInstanceExportParamsOrdersName = "affliction_date"` - `Search param.Field[string]` Body param: A search term. ### Returns - `type CasbPostureFindingInstanceExportResponse struct{…}` Information about an export job. - `ID string` Unique identifier for the export job. - `Status CasbPostureFindingInstanceExportResponseStatus` Status of an export job. - `const CasbPostureFindingInstanceExportResponseStatusPending CasbPostureFindingInstanceExportResponseStatus = "Pending"` - `const CasbPostureFindingInstanceExportResponseStatusSuccess CasbPostureFindingInstanceExportResponseStatus = "Success"` - `const CasbPostureFindingInstanceExportResponseStatusFailure CasbPostureFindingInstanceExportResponseStatus = "Failure"` - `const CasbPostureFindingInstanceExportResponseStatusRescheduled CasbPostureFindingInstanceExportResponseStatus = "Rescheduled"` - `const CasbPostureFindingInstanceExportResponseStatusInProgress CasbPostureFindingInstanceExportResponseStatus = "In-Progress"` - `Type CasbPostureFindingInstanceExportResponseType` Type of export job. - `const CasbPostureFindingInstanceExportResponseTypeFinding CasbPostureFindingInstanceExportResponseType = "finding"` - `const CasbPostureFindingInstanceExportResponseTypeFindingInstance CasbPostureFindingInstanceExportResponseType = "findingInstance"` - `const CasbPostureFindingInstanceExportResponseTypeContent CasbPostureFindingInstanceExportResponseType = "content"` - `const CasbPostureFindingInstanceExportResponseTypeRemediationJob CasbPostureFindingInstanceExportResponseType = "remediationJob"` - `UserID string` ID of the export-requesting user. - `DownloadURL string` The URL by which the successfully created export can be downloaded by the end users. - `Errors string` Contains information on errors which may have occurred during export creation. - `FileName string` The base name of the file that is/was generated by the export job. - `FilePath string` The full path of the file that is stored within external storage (currently R2). ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.ZeroTrust.Casb.Posture.Findings.Instances.Export( context.TODO(), "00000000-0000-0000-0000-000000000001-00000000-0000-0000-0000-000000000002", zero_trust.CasbPostureFindingInstanceExportParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } } ``` ## Archive a finding `client.ZeroTrust.Casb.Posture.Findings.Instances.Archive(ctx, findingID, params) (*CasbPostureFindingInstanceArchiveResponse, error)` **post** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances/archive` Archive one or more finding instances. ### Parameters - `findingID string` - `params CasbPostureFindingInstanceArchiveParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `CheckInstances param.Field[[]string]` Body param: A list of finding instance IDs to pass along. ### Returns - `type CasbPostureFindingInstanceArchiveResponse struct{…}` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `AfflictionDate Time` When this specific instance was identified. - `Asset CasbPostureFindingInstanceArchiveResponseAsset` Asset information including metadata and categorization. - `Category CasbPostureFindingInstanceArchiveResponseAssetCategory` Category information for an asset. - `Service string` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `Type string` The type of asset. - `Vendor string` The vendor the asset is part of. - `ID string` Unique identifier for the asset category. - `ExternalID string` External identifier from the source system. - `Fields []CasbPostureFindingInstanceArchiveResponseAssetField` The fields associated with the asset. - `Name string` The name of the field. - `Value string` The value of the field. - `Link string` Optional link associated with the field. - `Name string` Human-readable name of the asset. - `ID string` Unique identifier for the asset. - `Link string` Direct link to the asset. - `DLPContexts []CasbPostureFindingInstanceArchiveResponseDLPContext` DLP context information if this is a content finding. - `Created Time` When the DLP context was created. - `EntryIDs []string` DLP Entry IDs. - `ProfileID string` DLP Profile ID. - `Updated Time` When the DLP context was last updated. - `ID string` Unique identifier for the DLP context. - `Deleted Time` When the DLP context was deleted. - `MatchContextMaxExtent int64` DLP Right Boundary of match context. - `MatchContextMinExtent int64` DLP Left Boundary of match context. - `MatchContextPayload map[string, unknown]` DLP Match context payload that matched the profile in question. - `Remediations []CasbPostureFindingInstanceArchiveResponseRemediation` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `ID string` Unique identifier for the remediation job. - `CreatedAt Time` When the remediation job was created. - `Stale bool` Whether this remediation job is stale (created before the finding instance's affliction_date). - `Status CasbPostureFindingInstanceArchiveResponseRemediationsStatus` Status of a remediation job. - `const CasbPostureFindingInstanceArchiveResponseRemediationsStatusPending CasbPostureFindingInstanceArchiveResponseRemediationsStatus = "pending"` - `const CasbPostureFindingInstanceArchiveResponseRemediationsStatusProcessing CasbPostureFindingInstanceArchiveResponseRemediationsStatus = "processing"` - `const CasbPostureFindingInstanceArchiveResponseRemediationsStatusCompleted CasbPostureFindingInstanceArchiveResponseRemediationsStatus = "completed"` - `const CasbPostureFindingInstanceArchiveResponseRemediationsStatusFailed CasbPostureFindingInstanceArchiveResponseRemediationsStatus = "failed"` - `const CasbPostureFindingInstanceArchiveResponseRemediationsStatusValidating CasbPostureFindingInstanceArchiveResponseRemediationsStatus = "validating"` - `Webhooks []CasbPostureFindingInstanceArchiveResponseWebhook` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `LatestJob CasbPostureFindingInstanceArchiveResponseWebhooksLatestJob` The most recent webhook job for this webhook configuration. - `ID string` Unique identifier for the webhook job. - `CreatedAt Time` When the webhook job was created. - `Stale bool` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `Status CasbPostureFindingInstanceArchiveResponseWebhooksLatestJobStatus` Current status of the webhook job. - `const CasbPostureFindingInstanceArchiveResponseWebhooksLatestJobStatusPending CasbPostureFindingInstanceArchiveResponseWebhooksLatestJobStatus = "pending"` - `const CasbPostureFindingInstanceArchiveResponseWebhooksLatestJobStatusProcessing CasbPostureFindingInstanceArchiveResponseWebhooksLatestJobStatus = "processing"` - `const CasbPostureFindingInstanceArchiveResponseWebhooksLatestJobStatusCompleted CasbPostureFindingInstanceArchiveResponseWebhooksLatestJobStatus = "completed"` - `WebhookID string` Unique identifier for the webhook configuration. - `WebhookLabel string` Account-specified display label for the webhook configuration. - `ID string` Unique identifier for the finding instance. - `IsArchived bool` Whether this finding instance has been archived. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.ZeroTrust.Casb.Posture.Findings.Instances.Archive( context.TODO(), "U3RhaW5sZXNzIHJvY2tz", zero_trust.CasbPostureFindingInstanceArchiveParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), CheckInstances: cloudflare.F([]string{"497f6eca-6276-4993-bfeb-53cbbbba6f08"}), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "affliction_date": "2025-03-18T17:25:38.700541Z", "asset": { "category": { "service": null, "type": "file", "vendor": "Slack", "id": "1a78cbf3-b98f-4289-b1f2-22db64130f4f" }, "external_id": "external-file-id-123", "fields": [ { "name": "Credential name", "value": "Test asset 2", "link": "https://example.com" } ], "name": "Public.svg", "id": "8a043daf-def4-403e-9d28-da2e93d9b824", "link": "https://slack-files.com/TYJH37DCK-E0238GG6B8-92fd5y5674" }, "dlp_contexts": [ { "created": "2025-03-18T17:25:38.695977Z", "entry_ids": [ "21befc68-a297-4090-ac10-17a051b901cd", "d6dd1e16-f78c-401a-b564-45c4e44aa467" ], "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e", "updated": "2025-03-18T17:25:38.695977Z", "id": "7653ff3a-d25e-4c10-8034-3460937c045b", "deleted": "2025-03-18T17:25:38.695977Z", "match_context_max_extent": 512, "match_context_min_extent": 1, "match_context_payload": {} } ], "remediations": [ { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" } ], "webhooks": [ { "latest_job": { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" }, "webhook_id": "550e8400-e29b-41d4-a716-446655440000", "webhook_label": "Send to Gmail" } ], "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "is_archived": false } } ``` ## Remove the archive marking from a finding instance `client.ZeroTrust.Casb.Posture.Findings.Instances.Unarchive(ctx, findingID, params) (*CasbPostureFindingInstanceUnarchiveResponse, error)` **post** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances/unarchive` Remove the archive marking from one or more finding instances. ### Parameters - `findingID string` - `params CasbPostureFindingInstanceUnarchiveParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `CheckInstances param.Field[[]string]` Body param: A list of finding instance IDs to pass along. ### Returns - `type CasbPostureFindingInstanceUnarchiveResponse struct{…}` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `AfflictionDate Time` When this specific instance was identified. - `Asset CasbPostureFindingInstanceUnarchiveResponseAsset` Asset information including metadata and categorization. - `Category CasbPostureFindingInstanceUnarchiveResponseAssetCategory` Category information for an asset. - `Service string` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `Type string` The type of asset. - `Vendor string` The vendor the asset is part of. - `ID string` Unique identifier for the asset category. - `ExternalID string` External identifier from the source system. - `Fields []CasbPostureFindingInstanceUnarchiveResponseAssetField` The fields associated with the asset. - `Name string` The name of the field. - `Value string` The value of the field. - `Link string` Optional link associated with the field. - `Name string` Human-readable name of the asset. - `ID string` Unique identifier for the asset. - `Link string` Direct link to the asset. - `DLPContexts []CasbPostureFindingInstanceUnarchiveResponseDLPContext` DLP context information if this is a content finding. - `Created Time` When the DLP context was created. - `EntryIDs []string` DLP Entry IDs. - `ProfileID string` DLP Profile ID. - `Updated Time` When the DLP context was last updated. - `ID string` Unique identifier for the DLP context. - `Deleted Time` When the DLP context was deleted. - `MatchContextMaxExtent int64` DLP Right Boundary of match context. - `MatchContextMinExtent int64` DLP Left Boundary of match context. - `MatchContextPayload map[string, unknown]` DLP Match context payload that matched the profile in question. - `Remediations []CasbPostureFindingInstanceUnarchiveResponseRemediation` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `ID string` Unique identifier for the remediation job. - `CreatedAt Time` When the remediation job was created. - `Stale bool` Whether this remediation job is stale (created before the finding instance's affliction_date). - `Status CasbPostureFindingInstanceUnarchiveResponseRemediationsStatus` Status of a remediation job. - `const CasbPostureFindingInstanceUnarchiveResponseRemediationsStatusPending CasbPostureFindingInstanceUnarchiveResponseRemediationsStatus = "pending"` - `const CasbPostureFindingInstanceUnarchiveResponseRemediationsStatusProcessing CasbPostureFindingInstanceUnarchiveResponseRemediationsStatus = "processing"` - `const CasbPostureFindingInstanceUnarchiveResponseRemediationsStatusCompleted CasbPostureFindingInstanceUnarchiveResponseRemediationsStatus = "completed"` - `const CasbPostureFindingInstanceUnarchiveResponseRemediationsStatusFailed CasbPostureFindingInstanceUnarchiveResponseRemediationsStatus = "failed"` - `const CasbPostureFindingInstanceUnarchiveResponseRemediationsStatusValidating CasbPostureFindingInstanceUnarchiveResponseRemediationsStatus = "validating"` - `Webhooks []CasbPostureFindingInstanceUnarchiveResponseWebhook` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `LatestJob CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJob` The most recent webhook job for this webhook configuration. - `ID string` Unique identifier for the webhook job. - `CreatedAt Time` When the webhook job was created. - `Stale bool` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `Status CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJobStatus` Current status of the webhook job. - `const CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJobStatusPending CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJobStatus = "pending"` - `const CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJobStatusProcessing CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJobStatus = "processing"` - `const CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJobStatusCompleted CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJobStatus = "completed"` - `WebhookID string` Unique identifier for the webhook configuration. - `WebhookLabel string` Account-specified display label for the webhook configuration. - `ID string` Unique identifier for the finding instance. - `IsArchived bool` Whether this finding instance has been archived. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.ZeroTrust.Casb.Posture.Findings.Instances.Unarchive( context.TODO(), "U3RhaW5sZXNzIHJvY2tz", zero_trust.CasbPostureFindingInstanceUnarchiveParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), CheckInstances: cloudflare.F([]string{"497f6eca-6276-4993-bfeb-53cbbbba6f08"}), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "affliction_date": "2025-03-18T17:25:38.700541Z", "asset": { "category": { "service": null, "type": "file", "vendor": "Slack", "id": "1a78cbf3-b98f-4289-b1f2-22db64130f4f" }, "external_id": "external-file-id-123", "fields": [ { "name": "Credential name", "value": "Test asset 2", "link": "https://example.com" } ], "name": "Public.svg", "id": "8a043daf-def4-403e-9d28-da2e93d9b824", "link": "https://slack-files.com/TYJH37DCK-E0238GG6B8-92fd5y5674" }, "dlp_contexts": [ { "created": "2025-03-18T17:25:38.695977Z", "entry_ids": [ "21befc68-a297-4090-ac10-17a051b901cd", "d6dd1e16-f78c-401a-b564-45c4e44aa467" ], "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e", "updated": "2025-03-18T17:25:38.695977Z", "id": "7653ff3a-d25e-4c10-8034-3460937c045b", "deleted": "2025-03-18T17:25:38.695977Z", "match_context_max_extent": 512, "match_context_min_extent": 1, "match_context_payload": {} } ], "remediations": [ { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" } ], "webhooks": [ { "latest_job": { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" }, "webhook_id": "550e8400-e29b-41d4-a716-446655440000", "webhook_label": "Send to Gmail" } ], "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "is_archived": false } } ``` # Exports ## List all export jobs `client.ZeroTrust.Casb.Posture.Exports.List(ctx, params) (*V4PagePaginationArray[CasbPostureExportListResponse], error)` **get** `/accounts/{account_id}/data-security/posture/exports` List all export jobs for a given requestor's organization ### Parameters - `params CasbPostureExportListParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `Page param.Field[int64]` Query param: A page number within the paginated result set. - `PerPage param.Field[int64]` Query param: Number of results to return per page. - `Status param.Field[CasbPostureExportListParamsStatus]` Query param: Filter on export job's status - `const CasbPostureExportListParamsStatusPending CasbPostureExportListParamsStatus = "Pending"` - `const CasbPostureExportListParamsStatusSuccess CasbPostureExportListParamsStatus = "Success"` - `const CasbPostureExportListParamsStatusFailure CasbPostureExportListParamsStatus = "Failure"` - `const CasbPostureExportListParamsStatusRescheduled CasbPostureExportListParamsStatus = "Rescheduled"` - `const CasbPostureExportListParamsStatusInProgress CasbPostureExportListParamsStatus = "In-Progress"` ### Returns - `type CasbPostureExportListResponse struct{…}` Information about an export job. - `ID string` Unique identifier for the export job. - `Status CasbPostureExportListResponseStatus` Status of an export job. - `const CasbPostureExportListResponseStatusPending CasbPostureExportListResponseStatus = "Pending"` - `const CasbPostureExportListResponseStatusSuccess CasbPostureExportListResponseStatus = "Success"` - `const CasbPostureExportListResponseStatusFailure CasbPostureExportListResponseStatus = "Failure"` - `const CasbPostureExportListResponseStatusRescheduled CasbPostureExportListResponseStatus = "Rescheduled"` - `const CasbPostureExportListResponseStatusInProgress CasbPostureExportListResponseStatus = "In-Progress"` - `Type CasbPostureExportListResponseType` Type of export job. - `const CasbPostureExportListResponseTypeFinding CasbPostureExportListResponseType = "finding"` - `const CasbPostureExportListResponseTypeFindingInstance CasbPostureExportListResponseType = "findingInstance"` - `const CasbPostureExportListResponseTypeContent CasbPostureExportListResponseType = "content"` - `const CasbPostureExportListResponseTypeRemediationJob CasbPostureExportListResponseType = "remediationJob"` - `UserID string` ID of the export-requesting user. - `DownloadURL string` The URL by which the successfully created export can be downloaded by the end users. - `Errors string` Contains information on errors which may have occurred during export creation. - `FileName string` The base name of the file that is/was generated by the export job. - `FilePath string` The full path of the file that is stored within external storage (currently R2). ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.ZeroTrust.Casb.Posture.Exports.List(context.TODO(), zero_trust.CasbPostureExportListParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } ] } ``` ## Get a single export job `client.ZeroTrust.Casb.Posture.Exports.Get(ctx, id, query) (*CasbPostureExportGetResponse, error)` **get** `/accounts/{account_id}/data-security/posture/exports/{id}` Retrieves a single export job by its unique identifier ### Parameters - `id string` - `query CasbPostureExportGetParams` - `AccountID param.Field[string]` Cloudflare account ID for the user making the request. ### Returns - `type CasbPostureExportGetResponse struct{…}` Information about an export job. - `ID string` Unique identifier for the export job. - `Status CasbPostureExportGetResponseStatus` Status of an export job. - `const CasbPostureExportGetResponseStatusPending CasbPostureExportGetResponseStatus = "Pending"` - `const CasbPostureExportGetResponseStatusSuccess CasbPostureExportGetResponseStatus = "Success"` - `const CasbPostureExportGetResponseStatusFailure CasbPostureExportGetResponseStatus = "Failure"` - `const CasbPostureExportGetResponseStatusRescheduled CasbPostureExportGetResponseStatus = "Rescheduled"` - `const CasbPostureExportGetResponseStatusInProgress CasbPostureExportGetResponseStatus = "In-Progress"` - `Type CasbPostureExportGetResponseType` Type of export job. - `const CasbPostureExportGetResponseTypeFinding CasbPostureExportGetResponseType = "finding"` - `const CasbPostureExportGetResponseTypeFindingInstance CasbPostureExportGetResponseType = "findingInstance"` - `const CasbPostureExportGetResponseTypeContent CasbPostureExportGetResponseType = "content"` - `const CasbPostureExportGetResponseTypeRemediationJob CasbPostureExportGetResponseType = "remediationJob"` - `UserID string` ID of the export-requesting user. - `DownloadURL string` The URL by which the successfully created export can be downloaded by the end users. - `Errors string` Contains information on errors which may have occurred during export creation. - `FileName string` The base name of the file that is/was generated by the export job. - `FilePath string` The full path of the file that is stored within external storage (currently R2). ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) export, err := client.ZeroTrust.Casb.Posture.Exports.Get( context.TODO(), "id", zero_trust.CasbPostureExportGetParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", export.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } } ``` # Finding Types ## List all finding types `client.ZeroTrust.Casb.Posture.FindingTypes.List(ctx, params) (*V4PagePaginationArray[CasbPostureFindingTypeListResponse], error)` **get** `/accounts/{account_id}/data-security/posture/finding_types` List all available finding types with pagination support. ### Parameters - `params CasbPostureFindingTypeListParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `Page param.Field[int64]` Query param: A page number within the paginated result set. - `PerPage param.Field[int64]` Query param: Number of results to return per page. ### Returns - `type CasbPostureFindingTypeListResponse struct{…}` Basic finding type information. - `ID string` The unique identifier of the finding. - `Category CasbPostureFindingTypeListResponseCategory` Category information for a finding. - `Observation CasbPostureFindingTypeListResponseCategoryObservation` The type of the observation. - `const CasbPostureFindingTypeListResponseCategoryObservationIssue CasbPostureFindingTypeListResponseCategoryObservation = "Issue"` - `const CasbPostureFindingTypeListResponseCategoryObservationInsight CasbPostureFindingTypeListResponseCategoryObservation = "Insight"` - `const CasbPostureFindingTypeListResponseCategoryObservationActivity CasbPostureFindingTypeListResponseCategoryObservation = "Activity"` - `Product CasbPostureFindingTypeListResponseCategoryProduct` The product category. - `const CasbPostureFindingTypeListResponseCategoryProductSaaS CasbPostureFindingTypeListResponseCategoryProduct = "SaaS"` - `const CasbPostureFindingTypeListResponseCategoryProductCloud CasbPostureFindingTypeListResponseCategoryProduct = "Cloud"` - `Type CasbPostureFindingTypeListResponseCategoryType` The type of the finding category. - `const CasbPostureFindingTypeListResponseCategoryTypeContent CasbPostureFindingTypeListResponseCategoryType = "Content"` - `const CasbPostureFindingTypeListResponseCategoryTypePosture CasbPostureFindingTypeListResponseCategoryType = "Posture"` - `Name string` The name of the finding. - `Severity CasbPostureFindingTypeListResponseSeverity` The severity level of a finding. - `const CasbPostureFindingTypeListResponseSeverityCritical CasbPostureFindingTypeListResponseSeverity = "Critical"` - `const CasbPostureFindingTypeListResponseSeverityHigh CasbPostureFindingTypeListResponseSeverity = "High"` - `const CasbPostureFindingTypeListResponseSeverityMedium CasbPostureFindingTypeListResponseSeverity = "Medium"` - `const CasbPostureFindingTypeListResponseSeverityLow CasbPostureFindingTypeListResponseSeverity = "Low"` - `Vendor string` The SaaS/Cloud vendor of the platform with which the finding is associated. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.ZeroTrust.Casb.Posture.FindingTypes.List(context.TODO(), zero_trust.CasbPostureFindingTypeListParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace" } ] } ``` ## Get finding by ID `client.ZeroTrust.Casb.Posture.FindingTypes.Get(ctx, findingTypeID, query) (*CasbPostureFindingTypeGetResponse, error)` **get** `/accounts/{account_id}/data-security/posture/finding_types/{finding_type_id}` Retrieve a specific finding type by its unique identifier. ### Parameters - `findingTypeID string` - `query CasbPostureFindingTypeGetParams` - `AccountID param.Field[string]` Cloudflare account ID for the user making the request. ### Returns - `type CasbPostureFindingTypeGetResponse struct{…}` Basic finding type information. - `ID string` The unique identifier of the finding. - `Category CasbPostureFindingTypeGetResponseCategory` Category information for a finding. - `Observation CasbPostureFindingTypeGetResponseCategoryObservation` The type of the observation. - `const CasbPostureFindingTypeGetResponseCategoryObservationIssue CasbPostureFindingTypeGetResponseCategoryObservation = "Issue"` - `const CasbPostureFindingTypeGetResponseCategoryObservationInsight CasbPostureFindingTypeGetResponseCategoryObservation = "Insight"` - `const CasbPostureFindingTypeGetResponseCategoryObservationActivity CasbPostureFindingTypeGetResponseCategoryObservation = "Activity"` - `Product CasbPostureFindingTypeGetResponseCategoryProduct` The product category. - `const CasbPostureFindingTypeGetResponseCategoryProductSaaS CasbPostureFindingTypeGetResponseCategoryProduct = "SaaS"` - `const CasbPostureFindingTypeGetResponseCategoryProductCloud CasbPostureFindingTypeGetResponseCategoryProduct = "Cloud"` - `Type CasbPostureFindingTypeGetResponseCategoryType` The type of the finding category. - `const CasbPostureFindingTypeGetResponseCategoryTypeContent CasbPostureFindingTypeGetResponseCategoryType = "Content"` - `const CasbPostureFindingTypeGetResponseCategoryTypePosture CasbPostureFindingTypeGetResponseCategoryType = "Posture"` - `Name string` The name of the finding. - `Severity CasbPostureFindingTypeGetResponseSeverity` The severity level of a finding. - `const CasbPostureFindingTypeGetResponseSeverityCritical CasbPostureFindingTypeGetResponseSeverity = "Critical"` - `const CasbPostureFindingTypeGetResponseSeverityHigh CasbPostureFindingTypeGetResponseSeverity = "High"` - `const CasbPostureFindingTypeGetResponseSeverityMedium CasbPostureFindingTypeGetResponseSeverity = "Medium"` - `const CasbPostureFindingTypeGetResponseSeverityLow CasbPostureFindingTypeGetResponseSeverity = "Low"` - `Vendor string` The SaaS/Cloud vendor of the platform with which the finding is associated. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) findingType, err := client.ZeroTrust.Casb.Posture.FindingTypes.Get( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", zero_trust.CasbPostureFindingTypeGetParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", findingType.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace" } } ``` # Remediation Types ## List remediation types for a finding type `client.ZeroTrust.Casb.Posture.FindingTypes.RemediationTypes.List(ctx, findingTypeID, params) (*V4PagePaginationArray[CasbPostureFindingTypeRemediationTypeListResponse], error)` **get** `/accounts/{account_id}/data-security/posture/finding_types/{finding_type_id}/remediation_types` List all remediation types for a given finding type. This endpoint supports both cursor and offset pagination. Note that `cursor` and `page` are mutually exclusive. ### Parameters - `findingTypeID string` - `params CasbPostureFindingTypeRemediationTypeListParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `Cursor param.Field[string]` Query param: A cursor for pagination. - `IntegrationID param.Field[string]` Query param: Filter by an integration ID - `Page param.Field[int64]` Query param: A page number within the paginated result set. - `PerPage param.Field[int64]` Query param: Number of results to return per page. ### Returns - `type CasbPostureFindingTypeRemediationTypeListResponse struct{…}` Information about a remediation type. - `ID string` The identifier for the remediation type. - `Description string` A description of the action(s) taken by the remediation type. - `DisplayName string` The name of the remediation type as displayed in the cloudflare dashboard. - `FindingTypeID string` The identifier of the finding_type which this remediation type should remediate. - `RemediationType string` The name of the remediation type. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.ZeroTrust.Casb.Posture.FindingTypes.RemediationTypes.List( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", zero_trust.CasbPostureFindingTypeRemediationTypeListParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "id": "7d736ac5-ed3b-46d5-9375-7025175ba1d9", "description": "Remove publicly accessible URL granting edit access", "display_name": "Remove Publicly Accessible URL - Edit Access", "finding_type_id": "6a790513-bbb5-4933-8971-76a744ec5448", "remediation_type": "Microsoft: Remove Publicly Accessible URL - Edit Access" } ] } ``` # Content ## List DLP content findings `client.ZeroTrust.Casb.Posture.Content.List(ctx, params) (*V4PagePaginationArray[CasbPostureContentListResponse], error)` **get** `/accounts/{account_id}/data-security/posture/content` List DLP content findings ### Parameters - `params CasbPostureContentListParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `Direction param.Field[CasbPostureContentListParamsDirection]` Query param: Direction to order results. - `const CasbPostureContentListParamsDirectionAsc CasbPostureContentListParamsDirection = "asc"` - `const CasbPostureContentListParamsDirectionDesc CasbPostureContentListParamsDirection = "desc"` - `DLPProfileID param.Field[string]` Query param: Filter by an DLP profile ID - `IntegrationID param.Field[string]` Query param: Filter by an integration ID - `MaxAfflictionDate param.Field[Time]` Query param: Filter to view findings that occurred on or before the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `MinAfflictionDate param.Field[Time]` Query param: Filter to view findings that occurred on or after the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `Order param.Field[CasbPostureContentListParamsOrder]` Query param: Which field to use when ordering content assets. - `const CasbPostureContentListParamsOrderAssetName CasbPostureContentListParamsOrder = "asset_name"` - `const CasbPostureContentListParamsOrderDLPProfileCount CasbPostureContentListParamsOrder = "dlp_profile_count"` - `const CasbPostureContentListParamsOrderIntegrationName CasbPostureContentListParamsOrder = "integration_name"` - `const CasbPostureContentListParamsOrderLatestAfflictionDate CasbPostureContentListParamsOrder = "latest_affliction_date"` - `Page param.Field[int64]` Query param: A page number within the paginated result set. - `PerPage param.Field[int64]` Query param: Number of results to return per page. - `Search param.Field[string]` Query param: A search term. - `Vendor param.Field[CasbPostureContentListParamsVendor]` Query param: Filter by vendor - `const CasbPostureContentListParamsVendorAnthropic CasbPostureContentListParamsVendor = "ANTHROPIC"` - `const CasbPostureContentListParamsVendorAws CasbPostureContentListParamsVendor = "AWS"` - `const CasbPostureContentListParamsVendorBitbucket CasbPostureContentListParamsVendor = "BITBUCKET"` - `const CasbPostureContentListParamsVendorBox CasbPostureContentListParamsVendor = "BOX"` - `const CasbPostureContentListParamsVendorConfluence CasbPostureContentListParamsVendor = "CONFLUENCE"` - `const CasbPostureContentListParamsVendorDropbox CasbPostureContentListParamsVendor = "DROPBOX"` - `const CasbPostureContentListParamsVendorGitHub CasbPostureContentListParamsVendor = "GITHUB"` - `const CasbPostureContentListParamsVendorGoogleCloudPlatform CasbPostureContentListParamsVendor = "GOOGLE_CLOUD_PLATFORM"` - `const CasbPostureContentListParamsVendorGoogleWorkspace CasbPostureContentListParamsVendor = "GOOGLE_WORKSPACE"` - `const CasbPostureContentListParamsVendorJira CasbPostureContentListParamsVendor = "JIRA"` - `const CasbPostureContentListParamsVendorMicrosoft CasbPostureContentListParamsVendor = "MICROSOFT"` - `const CasbPostureContentListParamsVendorMicrosoftInternal CasbPostureContentListParamsVendor = "MICROSOFT_INTERNAL"` - `const CasbPostureContentListParamsVendorOpenAI CasbPostureContentListParamsVendor = "OPENAI"` - `const CasbPostureContentListParamsVendorSalesforce CasbPostureContentListParamsVendor = "SALESFORCE"` - `const CasbPostureContentListParamsVendorServicenow CasbPostureContentListParamsVendor = "SERVICENOW"` - `const CasbPostureContentListParamsVendorSlack CasbPostureContentListParamsVendor = "SLACK"` ### Returns - `type CasbPostureContentListResponse struct{…}` Content asset with DLP information. - `AssetID string` Unique identifier for the asset. - `AssetName string` Name of the asset. - `DLPContexts []CasbPostureContentListResponseDLPContext` DLP context information for this asset. - `Created Time` When the DLP context was created. - `EntryIDs []string` DLP Entry IDs. - `ProfileID string` DLP Profile ID. - `Updated Time` When the DLP context was last updated. - `ID string` Unique identifier for the DLP context. - `Deleted Time` When the DLP context was deleted. - `MatchContextMaxExtent int64` DLP Right Boundary of match context. - `MatchContextMinExtent int64` DLP Left Boundary of match context. - `MatchContextPayload map[string, unknown]` DLP Match context payload that matched the profile in question. - `DLPProfileCount int64` Number of DLP profiles that flagged this asset. - `DLPProfileIDs []string` IDs of DLP profiles that flagged this asset. - `Integration CasbPostureContentListResponseIntegration` Summary information about an integration. - `Created Time` When entity was created. - `LastHydrated Time` When were the integration credentials last updated. - `Name string` Name of the integration. - `Permissions []string` The vendor-specific permissions associated with the integration. - `Policy CasbPostureContentListResponseIntegrationPolicy` Policy configuration for an integration. - `ID string` Policy identifier. - `ClientID string` OAuth client ID for the policy. - `ComplianceLevel string` Compliance level for the policy. - `DLPEnabled bool` Whether DLP is enabled for this policy. - `Link string` Link to policy documentation. - `Name string` Policy name. - `Permissions []string` List of permissions included in the policy. - `Status string` Current status of the integration. - `Updated Time` Last entity was updated. - `Upgradable bool` Whether the integrations permissions can be updated. - `Vendor CasbPostureContentListResponseIntegrationVendor` Information about a vendor/service provider. - `ID string` The id of the vendor. - `Description string` Detailed information about what kinds of issues are detected for this vendor. - `DisplayName string` The display name of the vendor. - `Logo string` Logo URL for the vendor. - `Name string` The name of the vendor. - `StaticLogo string` Static logo URL for the vendor. - `ZtEnrollments []string` The vendor's compatible Zero Trust products. - `Policies []map[string, unknown]` The policies related to the vendor. - `ZtEnrollments []CasbPostureContentListResponseIntegrationZtEnrollment` Zero Trust products associated with this integration. - `ID string` The internal identifier of the Zero Trust Product. - `Description string` Brief description of the Zero Trust Product. - `DisplayName string` The verbose name of the Zero Trust Product. - `Enabled bool` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `ID string` Integration ID. - `CredentialHealthStatus CasbPostureContentListResponseIntegrationCredentialHealthStatus` Health status of integration credentials. - `const CasbPostureContentListResponseIntegrationCredentialHealthStatusInitializing CasbPostureContentListResponseIntegrationCredentialHealthStatus = "Initializing"` - `const CasbPostureContentListResponseIntegrationCredentialHealthStatusHealthy CasbPostureContentListResponseIntegrationCredentialHealthStatus = "Healthy"` - `const CasbPostureContentListResponseIntegrationCredentialHealthStatusUnhealthy CasbPostureContentListResponseIntegrationCredentialHealthStatus = "Unhealthy"` - `CredentialsExpiry Time` The date and time when the integration credentials will expire. - `IsPaused bool` Whether the given integration is paused by the user. - `UpgradeDismissed bool` UI State as to whether a potential permissions upgrade has been dismissed. - `LatestAfflictionDate Time` Most recent date this asset was flagged. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.ZeroTrust.Casb.Posture.Content.List(context.TODO(), zero_trust.CasbPostureContentListParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "asset_id": "e6910838-4b91-45e9-b2b4-91bb23cb9762", "asset_name": "Test Asset Name", "dlp_contexts": [ { "created": "2025-03-18T17:25:38.695977Z", "entry_ids": [ "21befc68-a297-4090-ac10-17a051b901cd", "d6dd1e16-f78c-401a-b564-45c4e44aa467" ], "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e", "updated": "2025-03-18T17:25:38.695977Z", "id": "7653ff3a-d25e-4c10-8034-3460937c045b", "deleted": "2025-03-18T17:25:38.695977Z", "match_context_max_extent": 512, "match_context_min_extent": 1, "match_context_payload": {} } ], "dlp_profile_count": 2, "dlp_profile_ids": [ "c12f2059-8df4-43f8-9eb9-d27112d92b63", "822c051b-0bb4-4747-8929-471a1d506eef" ], "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2024-10-18T19:53:57.626659Z" } ] } ``` ## Create a content export `client.ZeroTrust.Casb.Posture.Content.Export(ctx, params) (*CasbPostureContentExportResponse, error)` **post** `/accounts/{account_id}/data-security/posture/content/export` Creates a CSV export for content and accepts optional filters in the payload. ### Parameters - `params CasbPostureContentExportParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `DLPProfileInformation param.Field[[]CasbPostureContentExportParamsDLPProfileInformation]` Body param: DLP profile metadata for the export. - `ID string` Unique identifier for the DLP profile. - `Entries []CasbPostureContentExportParamsDLPProfileInformationEntry` Entries contained within this DLP profile. - `ID string` Unique identifier for the DLP profile entry. - `Name string` Name of the DLP profile entry. - `ProfileID string` ID of the parent DLP profile. - `Name string` Name of the DLP profile. - `DLPProfileID param.Field[[]string]` Body param: Filter by DLP profile IDs. - `IntegrationID param.Field[[]string]` Body param: Filter by integration IDs. - `MaxAfflictionDate param.Field[Time]` Body param: Filter to view content flagged on or before this date. - `MinAfflictionDate param.Field[Time]` Body param: Filter to view content flagged on or after this date. - `Orders param.Field[[]CasbPostureContentExportParamsOrder]` Body param: Ordering specifications for the export. - `Direction CasbPostureContentExportParamsOrdersDirection` Sort direction. - `const CasbPostureContentExportParamsOrdersDirectionAsc CasbPostureContentExportParamsOrdersDirection = "asc"` - `const CasbPostureContentExportParamsOrdersDirectionDesc CasbPostureContentExportParamsOrdersDirection = "desc"` - `Name CasbPostureContentExportParamsOrdersName` Content-specific field names for ordering. - `const CasbPostureContentExportParamsOrdersNameAssetName CasbPostureContentExportParamsOrdersName = "asset_name"` - `const CasbPostureContentExportParamsOrdersNameDLPProfileCount CasbPostureContentExportParamsOrdersName = "dlp_profile_count"` - `const CasbPostureContentExportParamsOrdersNameIntegrationName CasbPostureContentExportParamsOrdersName = "integration_name"` - `const CasbPostureContentExportParamsOrdersNameLatestAfflictionDate CasbPostureContentExportParamsOrdersName = "latest_affliction_date"` - `Search param.Field[string]` Body param: Search term to filter content. - `Vendors param.Field[[]CasbPostureContentExportParamsVendor]` Body param: Filter by vendor types. - `const CasbPostureContentExportParamsVendorAnthropic CasbPostureContentExportParamsVendor = "ANTHROPIC"` - `const CasbPostureContentExportParamsVendorAws CasbPostureContentExportParamsVendor = "AWS"` - `const CasbPostureContentExportParamsVendorBitbucket CasbPostureContentExportParamsVendor = "BITBUCKET"` - `const CasbPostureContentExportParamsVendorBox CasbPostureContentExportParamsVendor = "BOX"` - `const CasbPostureContentExportParamsVendorConfluence CasbPostureContentExportParamsVendor = "CONFLUENCE"` - `const CasbPostureContentExportParamsVendorDropbox CasbPostureContentExportParamsVendor = "DROPBOX"` - `const CasbPostureContentExportParamsVendorGitHub CasbPostureContentExportParamsVendor = "GITHUB"` - `const CasbPostureContentExportParamsVendorGoogleCloudPlatform CasbPostureContentExportParamsVendor = "GOOGLE_CLOUD_PLATFORM"` - `const CasbPostureContentExportParamsVendorGoogleWorkspace CasbPostureContentExportParamsVendor = "GOOGLE_WORKSPACE"` - `const CasbPostureContentExportParamsVendorJira CasbPostureContentExportParamsVendor = "JIRA"` - `const CasbPostureContentExportParamsVendorMicrosoft CasbPostureContentExportParamsVendor = "MICROSOFT"` - `const CasbPostureContentExportParamsVendorMicrosoftInternal CasbPostureContentExportParamsVendor = "MICROSOFT_INTERNAL"` - `const CasbPostureContentExportParamsVendorOpenAI CasbPostureContentExportParamsVendor = "OPENAI"` - `const CasbPostureContentExportParamsVendorSalesforce CasbPostureContentExportParamsVendor = "SALESFORCE"` - `const CasbPostureContentExportParamsVendorServicenow CasbPostureContentExportParamsVendor = "SERVICENOW"` - `const CasbPostureContentExportParamsVendorSlack CasbPostureContentExportParamsVendor = "SLACK"` ### Returns - `type CasbPostureContentExportResponse struct{…}` Information about an export job. - `ID string` Unique identifier for the export job. - `Status CasbPostureContentExportResponseStatus` Status of an export job. - `const CasbPostureContentExportResponseStatusPending CasbPostureContentExportResponseStatus = "Pending"` - `const CasbPostureContentExportResponseStatusSuccess CasbPostureContentExportResponseStatus = "Success"` - `const CasbPostureContentExportResponseStatusFailure CasbPostureContentExportResponseStatus = "Failure"` - `const CasbPostureContentExportResponseStatusRescheduled CasbPostureContentExportResponseStatus = "Rescheduled"` - `const CasbPostureContentExportResponseStatusInProgress CasbPostureContentExportResponseStatus = "In-Progress"` - `Type CasbPostureContentExportResponseType` Type of export job. - `const CasbPostureContentExportResponseTypeFinding CasbPostureContentExportResponseType = "finding"` - `const CasbPostureContentExportResponseTypeFindingInstance CasbPostureContentExportResponseType = "findingInstance"` - `const CasbPostureContentExportResponseTypeContent CasbPostureContentExportResponseType = "content"` - `const CasbPostureContentExportResponseTypeRemediationJob CasbPostureContentExportResponseType = "remediationJob"` - `UserID string` ID of the export-requesting user. - `DownloadURL string` The URL by which the successfully created export can be downloaded by the end users. - `Errors string` Contains information on errors which may have occurred during export creation. - `FileName string` The base name of the file that is/was generated by the export job. - `FilePath string` The full path of the file that is stored within external storage (currently R2). ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.ZeroTrust.Casb.Posture.Content.Export(context.TODO(), zero_trust.CasbPostureContentExportParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), DLPProfileInformation: cloudflare.F([]zero_trust.CasbPostureContentExportParamsDLPProfileInformation{zero_trust.CasbPostureContentExportParamsDLPProfileInformation{ ID: cloudflare.F("e91a2360-da51-4fdf-9711-bcdecd462614"), Entries: cloudflare.F([]zero_trust.CasbPostureContentExportParamsDLPProfileInformationEntry{zero_trust.CasbPostureContentExportParamsDLPProfileInformationEntry{ ID: cloudflare.F("55ba2c6c-8ef4-4b2e-9148-e75e8b6ccac1"), Name: cloudflare.F("Credit Card Numbers"), ProfileID: cloudflare.F("e91a2360-da51-4fdf-9711-bcdecd462614"), }}), Name: cloudflare.F("Financial Information"), }}), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } } ``` # Remediations # Jobs ## List remediation jobs `client.ZeroTrust.Casb.Posture.Remediations.Jobs.List(ctx, params) (*V4PagePaginationArray[CasbPostureRemediationJobListResponse], error)` **get** `/accounts/{account_id}/data-security/posture/remediations/jobs` List all remediation jobs tied to a specific Cloudflare Account. Note that `cursor` and `page` are mutually exclusive. ### Parameters - `params CasbPostureRemediationJobListParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `Cursor param.Field[string]` Query param: A cursor for pagination. - `Direction param.Field[CasbPostureRemediationJobListParamsDirection]` Query param: Direction to order results. - `const CasbPostureRemediationJobListParamsDirectionAsc CasbPostureRemediationJobListParamsDirection = "asc"` - `const CasbPostureRemediationJobListParamsDirectionDesc CasbPostureRemediationJobListParamsDirection = "desc"` - `IntegrationID param.Field[string]` Query param: Filter by an integration ID - `MaxUpdatedAt param.Field[Time]` Query param: Filter to view remediations updated on or before the max updated datetime. Can be a date-time in ISO 8601 format or an epoch timestamp. - `MinUpdatedAt param.Field[Time]` Query param: Filter to view remediations updated on or after the min updated datetime. Can be a date-time in ISO 8601 format or an epoch timestamp. - `Order param.Field[CasbPostureRemediationJobListParamsOrder]` Query param: An optional param to sort the results by the given field. - `const CasbPostureRemediationJobListParamsOrderCreatedAt CasbPostureRemediationJobListParamsOrder = "created_at"` - `const CasbPostureRemediationJobListParamsOrderAfflictionDate CasbPostureRemediationJobListParamsOrder = "affliction_date"` - `const CasbPostureRemediationJobListParamsOrderIntegrationName CasbPostureRemediationJobListParamsOrder = "integration_name"` - `const CasbPostureRemediationJobListParamsOrderStatus CasbPostureRemediationJobListParamsOrder = "status"` - `const CasbPostureRemediationJobListParamsOrderLastUpdatedAt CasbPostureRemediationJobListParamsOrder = "last_updated_at"` - `const CasbPostureRemediationJobListParamsOrderAssetName CasbPostureRemediationJobListParamsOrder = "asset_name"` - `const CasbPostureRemediationJobListParamsOrderFindingTypeName CasbPostureRemediationJobListParamsOrder = "finding_type_name"` - `Page param.Field[int64]` Query param: A page number within the paginated result set. - `PerPage param.Field[int64]` Query param: Number of results to return per page. - `Search param.Field[string]` Query param: A search term. - `Status param.Field[CasbPostureRemediationJobListParamsStatus]` Query param: Filter to view remediations with the given status. - `const CasbPostureRemediationJobListParamsStatusPending CasbPostureRemediationJobListParamsStatus = "pending"` - `const CasbPostureRemediationJobListParamsStatusProcessing CasbPostureRemediationJobListParamsStatus = "processing"` - `const CasbPostureRemediationJobListParamsStatusCompleted CasbPostureRemediationJobListParamsStatus = "completed"` - `const CasbPostureRemediationJobListParamsStatusFailed CasbPostureRemediationJobListParamsStatus = "failed"` - `const CasbPostureRemediationJobListParamsStatusValidating CasbPostureRemediationJobListParamsStatus = "validating"` - `TriggeredByActor param.Field[[]CasbPostureRemediationJobListParamsTriggeredByActor]` Query param: Filter remediations by what kind of actor triggered them. Supports multiple comma-separated values. - `const CasbPostureRemediationJobListParamsTriggeredByActorUser CasbPostureRemediationJobListParamsTriggeredByActor = "user"` - `const CasbPostureRemediationJobListParamsTriggeredByActorAccountToken CasbPostureRemediationJobListParamsTriggeredByActor = "account_token"` ### Returns - `type CasbPostureRemediationJobListResponse struct{…}` Information about a remediation job. - `ID string` Unique identifier for the remediation job. - `Asset CasbPostureRemediationJobListResponseAsset` Asset information for a remediation job. - `ID string` Unique identifier for the asset. - `Category CasbPostureRemediationJobListResponseAssetCategory` Category information for a remediation job asset. - `Service string` Specific service within the vendor. - `Type string` Asset type. - `Vendor CasbPostureRemediationJobListResponseAssetCategoryVendor` Display names for vendor types. - `const CasbPostureRemediationJobListResponseAssetCategoryVendorAws CasbPostureRemediationJobListResponseAssetCategoryVendor = "AWS"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorAnthropic CasbPostureRemediationJobListResponseAssetCategoryVendor = "Anthropic"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorBitbucket CasbPostureRemediationJobListResponseAssetCategoryVendor = "Bitbucket"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorBox CasbPostureRemediationJobListResponseAssetCategoryVendor = "Box"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorConfluence CasbPostureRemediationJobListResponseAssetCategoryVendor = "Confluence"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorDropbox CasbPostureRemediationJobListResponseAssetCategoryVendor = "Dropbox"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorGitHub CasbPostureRemediationJobListResponseAssetCategoryVendor = "GitHub"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorGoogleCloudPlatform CasbPostureRemediationJobListResponseAssetCategoryVendor = "Google Cloud Platform"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorGoogleWorkspace CasbPostureRemediationJobListResponseAssetCategoryVendor = "Google Workspace"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorJira CasbPostureRemediationJobListResponseAssetCategoryVendor = "Jira"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorMicrosoft CasbPostureRemediationJobListResponseAssetCategoryVendor = "Microsoft"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorMicrosoftInternal CasbPostureRemediationJobListResponseAssetCategoryVendor = "Microsoft Internal"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorOkta CasbPostureRemediationJobListResponseAssetCategoryVendor = "Okta"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorOpenAI CasbPostureRemediationJobListResponseAssetCategoryVendor = "OpenAI"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorSlack CasbPostureRemediationJobListResponseAssetCategoryVendor = "Slack"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorSalesforce CasbPostureRemediationJobListResponseAssetCategoryVendor = "Salesforce"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorServiceNow CasbPostureRemediationJobListResponseAssetCategoryVendor = "ServiceNow"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorWorkday CasbPostureRemediationJobListResponseAssetCategoryVendor = "Workday"` - `const CasbPostureRemediationJobListResponseAssetCategoryVendorZoom CasbPostureRemediationJobListResponseAssetCategoryVendor = "Zoom"` - `ExternalID string` External identifier from the source system. - `Fields []CasbPostureRemediationJobListResponseAssetField` Additional fields associated with the asset. - `Name string` Field name. - `Value CasbPostureRemediationJobListResponseAssetFieldsValueUnion` Field value (can be string, number, or boolean). - `UnionString` - `UnionFloat` - `UnionBool` - `Link string` Optional link associated with the field. - `Name string` Human-readable name of the asset. - `Link string` Direct link to the asset. - `CreatedAt Time` When the remediation job was created. - `FindingID string` Encoded finding ID. - `FindingInstanceID string` ID of the finding instance being remediated. - `FindingTypeID string` ID of the finding type. - `FindingTypeName string` Name of the finding type. - `IntegrationName string` Name of the integration. - `LastUpdated Time` When the remediation job was last updated. - `RemediationType string` Type of remediation being performed. - `Status CasbPostureRemediationJobListResponseStatus` Status of a remediation job. - `const CasbPostureRemediationJobListResponseStatusPending CasbPostureRemediationJobListResponseStatus = "pending"` - `const CasbPostureRemediationJobListResponseStatusProcessing CasbPostureRemediationJobListResponseStatus = "processing"` - `const CasbPostureRemediationJobListResponseStatusCompleted CasbPostureRemediationJobListResponseStatus = "completed"` - `const CasbPostureRemediationJobListResponseStatusFailed CasbPostureRemediationJobListResponseStatus = "failed"` - `const CasbPostureRemediationJobListResponseStatusValidating CasbPostureRemediationJobListResponseStatus = "validating"` - `TriggeredByUser string` Email of the user who triggered the remediation. For account-token actors this is the literal "Account API Token"; for policy actors this is empty. - `TriggeredByActor CasbPostureRemediationJobListResponseTriggeredByActor` Type of actor that triggered the remediation job. Null on legacy rows created before this column was populated. - `const CasbPostureRemediationJobListResponseTriggeredByActorUser CasbPostureRemediationJobListResponseTriggeredByActor = "user"` - `const CasbPostureRemediationJobListResponseTriggeredByActorAccountToken CasbPostureRemediationJobListResponseTriggeredByActor = "account_token"` - `TriggeredByID string` ID of the actor that triggered the job. Meaning depends on triggered_by_actor. Null on legacy rows. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.ZeroTrust.Casb.Posture.Remediations.Jobs.List(context.TODO(), zero_trust.CasbPostureRemediationJobListParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "errors": [ {} ], "messages": [ {} ], "result": [ { "id": "c416bc38-75db-425f-ae25-c37b5df5c37f", "asset": { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "category": { "service": "OneDrive", "type": "SaaS", "vendor": "Google Workspace" }, "external_id": "c416bc38-75db-425f-ae25-c37b5df5c37f", "fields": [ { "name": "File Name", "value": "sensitive-document.xlsx", "link": "https://dashboard.microsoft.com/files/details" } ], "name": "Microsoft File Publicly Accessible", "link": "https://dashboard.microsoft.com/files/details" }, "created_at": "2025-07-07T18:39:13.123456Z", "finding_id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "finding_instance_id": "3f7b8c9d-6e5a-4f3b-9c2d-1e0a8b7c6d5e", "finding_type_id": "775c5f38-efcf-4b2b-93db-8428979eb6a2", "finding_type_name": "Microsoft: File publicly accessible with edit access", "integration_name": "Microsoft", "last_updated": "2025-07-07T18:39:13.123456Z", "remediation_type": "Remove publicly accessible edit url", "status": "pending", "triggered_by_user": "user@example.com", "triggered_by_actor": "user", "triggered_by_id": "0123456789abcdef0123456789abcdef" } ], "result_info": { "count": 2, "cursor": "next_cursor_value", "page": 1, "per_page": 10, "total_count": 2 }, "success": true } ``` ## Creates remediation jobs `client.ZeroTrust.Casb.Posture.Remediations.Jobs.New(ctx, params) (*CasbPostureRemediationJobNewResponse, error)` **post** `/accounts/{account_id}/data-security/posture/remediations/jobs` Create one or more remediation jobs tied to a specific Cloudflare Account. ### Parameters - `params CasbPostureRemediationJobNewParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `FindingInstanceIDs param.Field[[]string]` Body param: UUIDs identifying Finding Instances. - `RemediationTypeID param.Field[string]` Body param: A UUID identifying this Remediation Type. ### Returns - `type CasbPostureRemediationJobNewResponse struct{…}` - `Created []CasbPostureRemediationJobNewResponseCreated` Successfully created remediation jobs. - `ID string` Unique identifier for the remediation job. - `Asset CasbPostureRemediationJobNewResponseCreatedAsset` Asset information for a remediation job. - `ID string` Unique identifier for the asset. - `Category CasbPostureRemediationJobNewResponseCreatedAssetCategory` Category information for a remediation job asset. - `Service string` Specific service within the vendor. - `Type string` Asset type. - `Vendor CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor` Display names for vendor types. - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorAws CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "AWS"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorAnthropic CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "Anthropic"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorBitbucket CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "Bitbucket"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorBox CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "Box"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorConfluence CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "Confluence"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorDropbox CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "Dropbox"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorGitHub CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "GitHub"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorGoogleCloudPlatform CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "Google Cloud Platform"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorGoogleWorkspace CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "Google Workspace"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorJira CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "Jira"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorMicrosoft CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "Microsoft"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorMicrosoftInternal CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "Microsoft Internal"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorOkta CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "Okta"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorOpenAI CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "OpenAI"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorSlack CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "Slack"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorSalesforce CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "Salesforce"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorServiceNow CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "ServiceNow"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorWorkday CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "Workday"` - `const CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendorZoom CasbPostureRemediationJobNewResponseCreatedAssetCategoryVendor = "Zoom"` - `ExternalID string` External identifier from the source system. - `Fields []CasbPostureRemediationJobNewResponseCreatedAssetField` Additional fields associated with the asset. - `Name string` Field name. - `Value CasbPostureRemediationJobNewResponseCreatedAssetFieldsValueUnion` Field value (can be string, number, or boolean). - `UnionString` - `UnionFloat` - `UnionBool` - `Link string` Optional link associated with the field. - `Name string` Human-readable name of the asset. - `Link string` Direct link to the asset. - `CreatedAt Time` When the remediation job was created. - `FindingID string` Encoded finding ID. - `FindingInstanceID string` ID of the finding instance being remediated. - `FindingTypeID string` ID of the finding type. - `FindingTypeName string` Name of the finding type. - `IntegrationName string` Name of the integration. - `LastUpdated Time` When the remediation job was last updated. - `RemediationType string` Type of remediation being performed. - `Status CasbPostureRemediationJobNewResponseCreatedStatus` Status of a remediation job. - `const CasbPostureRemediationJobNewResponseCreatedStatusPending CasbPostureRemediationJobNewResponseCreatedStatus = "pending"` - `const CasbPostureRemediationJobNewResponseCreatedStatusProcessing CasbPostureRemediationJobNewResponseCreatedStatus = "processing"` - `const CasbPostureRemediationJobNewResponseCreatedStatusCompleted CasbPostureRemediationJobNewResponseCreatedStatus = "completed"` - `const CasbPostureRemediationJobNewResponseCreatedStatusFailed CasbPostureRemediationJobNewResponseCreatedStatus = "failed"` - `const CasbPostureRemediationJobNewResponseCreatedStatusValidating CasbPostureRemediationJobNewResponseCreatedStatus = "validating"` - `TriggeredByUser string` Email of the user who triggered the remediation. For account-token actors this is the literal "Account API Token"; for policy actors this is empty. - `TriggeredByActor CasbPostureRemediationJobNewResponseCreatedTriggeredByActor` Type of actor that triggered the remediation job. Null on legacy rows created before this column was populated. - `const CasbPostureRemediationJobNewResponseCreatedTriggeredByActorUser CasbPostureRemediationJobNewResponseCreatedTriggeredByActor = "user"` - `const CasbPostureRemediationJobNewResponseCreatedTriggeredByActorAccountToken CasbPostureRemediationJobNewResponseCreatedTriggeredByActor = "account_token"` - `TriggeredByID string` ID of the actor that triggered the job. Meaning depends on triggered_by_actor. Null on legacy rows. - `Failed []CasbPostureRemediationJobNewResponseFailed` Failed remediation job creation attempts. - `Error string` Error message describing the failure. - `FindingInstanceID string` ID of the finding instance that failed to create a remediation job. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) job, err := client.ZeroTrust.Casb.Posture.Remediations.Jobs.New(context.TODO(), zero_trust.CasbPostureRemediationJobNewParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), FindingInstanceIDs: cloudflare.F([]string{"182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"}), RemediationTypeID: cloudflare.F("5a7d9e2f-1b3c-4d5e-8f6a-7b8c9d0e1f2a"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", job.Created) } ``` #### Response ```json { "errors": [ {} ], "messages": [ {} ], "result": { "created": [ { "id": "c416bc38-75db-425f-ae25-c37b5df5c37f", "asset": { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "category": { "service": "OneDrive", "type": "SaaS", "vendor": "Google Workspace" }, "external_id": "c416bc38-75db-425f-ae25-c37b5df5c37f", "fields": [ { "name": "File Name", "value": "sensitive-document.xlsx", "link": "https://dashboard.microsoft.com/files/details" } ], "name": "Microsoft File Publicly Accessible", "link": "https://dashboard.microsoft.com/files/details" }, "created_at": "2025-07-07T18:39:13.123456Z", "finding_id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "finding_instance_id": "3f7b8c9d-6e5a-4f3b-9c2d-1e0a8b7c6d5e", "finding_type_id": "775c5f38-efcf-4b2b-93db-8428979eb6a2", "finding_type_name": "Microsoft: File publicly accessible with edit access", "integration_name": "Microsoft", "last_updated": "2025-07-07T18:39:13.123456Z", "remediation_type": "Remove publicly accessible edit url", "status": "pending", "triggered_by_user": "user@example.com", "triggered_by_actor": "user", "triggered_by_id": "0123456789abcdef0123456789abcdef" } ], "failed": [ { "error": "Failed to create remediation job", "finding_instance_id": "2e6b4c8a-9d1f-4e3b-8c7a-5f9e2d1a6b4c" } ] }, "success": true } ``` ## Create a remediation jobs export `client.ZeroTrust.Casb.Posture.Remediations.Jobs.Export(ctx, params) (*CasbPostureRemediationJobExportResponse, error)` **post** `/accounts/{account_id}/data-security/posture/remediations/jobs/export` Creates a CSV export for remediation jobs and accepts optional filters in the payload. ### Parameters - `params CasbPostureRemediationJobExportParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `IntegrationID param.Field[[]string]` Body param: Filter by multiple integration IDs. - `MaxUpdatedAt param.Field[Time]` Body param: Filter to view remediation jobs updated on or before this datetime. Can be a date-time in ISO 8601 format or an epoch timestamp. - `MinUpdatedAt param.Field[Time]` Body param: Filter to view remediation jobs updated on or after this datetime. Can be a date-time in ISO 8601 format or an epoch timestamp. - `Orders param.Field[[]CasbPostureRemediationJobExportParamsOrder]` Body param: Ordering specifications for the export. - `Direction CasbPostureRemediationJobExportParamsOrdersDirection` Sort direction. - `const CasbPostureRemediationJobExportParamsOrdersDirectionAsc CasbPostureRemediationJobExportParamsOrdersDirection = "asc"` - `const CasbPostureRemediationJobExportParamsOrdersDirectionDesc CasbPostureRemediationJobExportParamsOrdersDirection = "desc"` - `Name CasbPostureRemediationJobExportParamsOrdersName` Which field to use when ordering the remediation jobs. - `const CasbPostureRemediationJobExportParamsOrdersNameAssetName CasbPostureRemediationJobExportParamsOrdersName = "asset_name"` - `const CasbPostureRemediationJobExportParamsOrdersNameFindingTypeName CasbPostureRemediationJobExportParamsOrdersName = "finding_type_name"` - `const CasbPostureRemediationJobExportParamsOrdersNameIntegrationName CasbPostureRemediationJobExportParamsOrdersName = "integration_name"` - `const CasbPostureRemediationJobExportParamsOrdersNameStatus CasbPostureRemediationJobExportParamsOrdersName = "status"` - `const CasbPostureRemediationJobExportParamsOrdersNameLastUpdatedAt CasbPostureRemediationJobExportParamsOrdersName = "last_updated_at"` - `const CasbPostureRemediationJobExportParamsOrdersNameAfflictionDate CasbPostureRemediationJobExportParamsOrdersName = "affliction_date"` - `Search param.Field[string]` Body param: A search term. - `Status param.Field[[]CasbPostureRemediationJobExportParamsStatus]` Body param: Filter by remediation job status. - `const CasbPostureRemediationJobExportParamsStatusPending CasbPostureRemediationJobExportParamsStatus = "pending"` - `const CasbPostureRemediationJobExportParamsStatusProcessing CasbPostureRemediationJobExportParamsStatus = "processing"` - `const CasbPostureRemediationJobExportParamsStatusCompleted CasbPostureRemediationJobExportParamsStatus = "completed"` - `const CasbPostureRemediationJobExportParamsStatusFailed CasbPostureRemediationJobExportParamsStatus = "failed"` - `const CasbPostureRemediationJobExportParamsStatusValidating CasbPostureRemediationJobExportParamsStatus = "validating"` ### Returns - `type CasbPostureRemediationJobExportResponse struct{…}` Information about an export job. - `ID string` Unique identifier for the export job. - `Status CasbPostureRemediationJobExportResponseStatus` Status of an export job. - `const CasbPostureRemediationJobExportResponseStatusPending CasbPostureRemediationJobExportResponseStatus = "Pending"` - `const CasbPostureRemediationJobExportResponseStatusSuccess CasbPostureRemediationJobExportResponseStatus = "Success"` - `const CasbPostureRemediationJobExportResponseStatusFailure CasbPostureRemediationJobExportResponseStatus = "Failure"` - `const CasbPostureRemediationJobExportResponseStatusRescheduled CasbPostureRemediationJobExportResponseStatus = "Rescheduled"` - `const CasbPostureRemediationJobExportResponseStatusInProgress CasbPostureRemediationJobExportResponseStatus = "In-Progress"` - `Type CasbPostureRemediationJobExportResponseType` Type of export job. - `const CasbPostureRemediationJobExportResponseTypeFinding CasbPostureRemediationJobExportResponseType = "finding"` - `const CasbPostureRemediationJobExportResponseTypeFindingInstance CasbPostureRemediationJobExportResponseType = "findingInstance"` - `const CasbPostureRemediationJobExportResponseTypeContent CasbPostureRemediationJobExportResponseType = "content"` - `const CasbPostureRemediationJobExportResponseTypeRemediationJob CasbPostureRemediationJobExportResponseType = "remediationJob"` - `UserID string` ID of the export-requesting user. - `DownloadURL string` The URL by which the successfully created export can be downloaded by the end users. - `Errors string` Contains information on errors which may have occurred during export creation. - `FileName string` The base name of the file that is/was generated by the export job. - `FilePath string` The full path of the file that is stored within external storage (currently R2). ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.ZeroTrust.Casb.Posture.Remediations.Jobs.Export(context.TODO(), zero_trust.CasbPostureRemediationJobExportParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } } ``` # Webhooks ## List webhook configurations `client.ZeroTrust.Casb.Posture.Webhooks.List(ctx, query) (*SinglePage[CasbPostureWebhookListResponse], error)` **get** `/accounts/{account_id}/data-security/posture/webhooks` Retrieves all webhook configurations for the authenticated account. Returns an array of webhook configurations that can be used to send finding notifications. ### Parameters - `query CasbPostureWebhookListParams` - `AccountID param.Field[string]` Cloudflare account ID for the user making the request. ### Returns - `type CasbPostureWebhookListResponse struct{…}` Webhook configuration for sending finding notifications. - `ID string` Unique identifier for the specific webhook configuration. - `AuthenticationType CasbPostureWebhookListResponseAuthenticationType` Type of authentication used for the webhook. - `const CasbPostureWebhookListResponseAuthenticationTypeBasicAuth CasbPostureWebhookListResponseAuthenticationType = "Basic Auth"` - `const CasbPostureWebhookListResponseAuthenticationTypeNone CasbPostureWebhookListResponseAuthenticationType = "None"` - `const CasbPostureWebhookListResponseAuthenticationTypeBearerAuth CasbPostureWebhookListResponseAuthenticationType = "Bearer Auth"` - `const CasbPostureWebhookListResponseAuthenticationTypeStaticHeaders CasbPostureWebhookListResponseAuthenticationType = "Static Headers"` - `const CasbPostureWebhookListResponseAuthenticationTypeHmacSigning CasbPostureWebhookListResponseAuthenticationType = "HMAC-Signing"` - `CreatedAt Time` Timestamp when the webhook configuration was created. - `DestinationURL string` Target URL for the webhook configuration. Where resulting data will be sent. - `Label string` Account-specified display label for the webhook configuration. - `Status CasbPostureWebhookListResponseStatus` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `const CasbPostureWebhookListResponseStatusEnabled CasbPostureWebhookListResponseStatus = "enabled"` - `const CasbPostureWebhookListResponseStatusDisabled CasbPostureWebhookListResponseStatus = "disabled"` - `UpdatedAt Time` Timestamp when the webhook configuration was last updated. - `Version int64` Version number of the configuration. - `Headers []CasbPostureWebhookListResponseHeader` List of header keys configured for this webhook. Values are not included for security reasons. - `Key string` Header key name (lowercase). - `Value string` Header value. This field is never returned in API responses for security reasons. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) page, err := client.ZeroTrust.Casb.Posture.Webhooks.List(context.TODO(), zero_trust.CasbPostureWebhookListParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": [ { "id": "550e8400-e29b-41d4-a716-446655440000", "authentication_type": "Bearer Auth", "created_at": "2024-01-15T10:30:00Z", "destination_url": "https://example.com/webhook", "label": "Send to Gmail", "status": "enabled", "updated_at": "2024-01-20T14:45:00Z", "version": 1, "headers": [ { "key": "authorization" } ] } ] } ``` ## Create a new webhook configuration `client.ZeroTrust.Casb.Posture.Webhooks.New(ctx, params) (*CasbPostureWebhookNewResponse, error)` **post** `/accounts/{account_id}/data-security/posture/webhooks` Creates a new webhook configuration for sending finding notifications to external endpoints. ### Parameters - `params CasbPostureWebhookNewParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `AuthenticationType param.Field[CasbPostureWebhookNewParamsAuthenticationType]` Body param: Type of authentication used for the webhook. - `const CasbPostureWebhookNewParamsAuthenticationTypeBasicAuth CasbPostureWebhookNewParamsAuthenticationType = "Basic Auth"` - `const CasbPostureWebhookNewParamsAuthenticationTypeNone CasbPostureWebhookNewParamsAuthenticationType = "None"` - `const CasbPostureWebhookNewParamsAuthenticationTypeBearerAuth CasbPostureWebhookNewParamsAuthenticationType = "Bearer Auth"` - `const CasbPostureWebhookNewParamsAuthenticationTypeStaticHeaders CasbPostureWebhookNewParamsAuthenticationType = "Static Headers"` - `const CasbPostureWebhookNewParamsAuthenticationTypeHmacSigning CasbPostureWebhookNewParamsAuthenticationType = "HMAC-Signing"` - `DestinationURL param.Field[string]` Body param: Target URL for the webhook configuration. Where resulting data will be sent. - `Label param.Field[string]` Body param: Account-specified display label for the webhook configuration. - `Headers param.Field[[]CasbPostureWebhookNewParamsHeader]` Body param: List of custom headers to include in webhook requests. - `Key string` Header key name. - `Value string` Header value. Required on Create and Evaluate. On Update, omit or set to null to keep existing value. - `SigningSecret param.Field[string]` Body param: Secret key used for HMAC signing when authentication_type is "HMAC-Signing". ### Returns - `type CasbPostureWebhookNewResponse struct{…}` Webhook configuration for sending finding notifications. - `ID string` Unique identifier for the specific webhook configuration. - `AuthenticationType CasbPostureWebhookNewResponseAuthenticationType` Type of authentication used for the webhook. - `const CasbPostureWebhookNewResponseAuthenticationTypeBasicAuth CasbPostureWebhookNewResponseAuthenticationType = "Basic Auth"` - `const CasbPostureWebhookNewResponseAuthenticationTypeNone CasbPostureWebhookNewResponseAuthenticationType = "None"` - `const CasbPostureWebhookNewResponseAuthenticationTypeBearerAuth CasbPostureWebhookNewResponseAuthenticationType = "Bearer Auth"` - `const CasbPostureWebhookNewResponseAuthenticationTypeStaticHeaders CasbPostureWebhookNewResponseAuthenticationType = "Static Headers"` - `const CasbPostureWebhookNewResponseAuthenticationTypeHmacSigning CasbPostureWebhookNewResponseAuthenticationType = "HMAC-Signing"` - `CreatedAt Time` Timestamp when the webhook configuration was created. - `DestinationURL string` Target URL for the webhook configuration. Where resulting data will be sent. - `Label string` Account-specified display label for the webhook configuration. - `Status CasbPostureWebhookNewResponseStatus` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `const CasbPostureWebhookNewResponseStatusEnabled CasbPostureWebhookNewResponseStatus = "enabled"` - `const CasbPostureWebhookNewResponseStatusDisabled CasbPostureWebhookNewResponseStatus = "disabled"` - `UpdatedAt Time` Timestamp when the webhook configuration was last updated. - `Version int64` Version number of the configuration. - `Headers []CasbPostureWebhookNewResponseHeader` List of header keys configured for this webhook. Values are not included for security reasons. - `Key string` Header key name (lowercase). - `Value string` Header value. This field is never returned in API responses for security reasons. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) webhook, err := client.ZeroTrust.Casb.Posture.Webhooks.New(context.TODO(), zero_trust.CasbPostureWebhookNewParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), AuthenticationType: cloudflare.F(zero_trust.CasbPostureWebhookNewParamsAuthenticationTypeBearerAuth), DestinationURL: cloudflare.F("https://example.com/webhook"), Label: cloudflare.F("Send to Slack"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", webhook.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "550e8400-e29b-41d4-a716-446655440000", "authentication_type": "Bearer Auth", "created_at": "2024-01-15T10:30:00Z", "destination_url": "https://example.com/webhook", "label": "Send to Gmail", "status": "enabled", "updated_at": "2024-01-20T14:45:00Z", "version": 1, "headers": [ { "key": "authorization" } ] } } ``` ## Get webhook configuration by ID `client.ZeroTrust.Casb.Posture.Webhooks.Get(ctx, webhookID, query) (*CasbPostureWebhookGetResponse, error)` **get** `/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}` Retrieves a specific webhook configuration by its unique identifier. ### Parameters - `webhookID string` - `query CasbPostureWebhookGetParams` - `AccountID param.Field[string]` Cloudflare account ID for the user making the request. ### Returns - `type CasbPostureWebhookGetResponse struct{…}` Webhook configuration for sending finding notifications. - `ID string` Unique identifier for the specific webhook configuration. - `AuthenticationType CasbPostureWebhookGetResponseAuthenticationType` Type of authentication used for the webhook. - `const CasbPostureWebhookGetResponseAuthenticationTypeBasicAuth CasbPostureWebhookGetResponseAuthenticationType = "Basic Auth"` - `const CasbPostureWebhookGetResponseAuthenticationTypeNone CasbPostureWebhookGetResponseAuthenticationType = "None"` - `const CasbPostureWebhookGetResponseAuthenticationTypeBearerAuth CasbPostureWebhookGetResponseAuthenticationType = "Bearer Auth"` - `const CasbPostureWebhookGetResponseAuthenticationTypeStaticHeaders CasbPostureWebhookGetResponseAuthenticationType = "Static Headers"` - `const CasbPostureWebhookGetResponseAuthenticationTypeHmacSigning CasbPostureWebhookGetResponseAuthenticationType = "HMAC-Signing"` - `CreatedAt Time` Timestamp when the webhook configuration was created. - `DestinationURL string` Target URL for the webhook configuration. Where resulting data will be sent. - `Label string` Account-specified display label for the webhook configuration. - `Status CasbPostureWebhookGetResponseStatus` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `const CasbPostureWebhookGetResponseStatusEnabled CasbPostureWebhookGetResponseStatus = "enabled"` - `const CasbPostureWebhookGetResponseStatusDisabled CasbPostureWebhookGetResponseStatus = "disabled"` - `UpdatedAt Time` Timestamp when the webhook configuration was last updated. - `Version int64` Version number of the configuration. - `Headers []CasbPostureWebhookGetResponseHeader` List of header keys configured for this webhook. Values are not included for security reasons. - `Key string` Header key name (lowercase). - `Value string` Header value. This field is never returned in API responses for security reasons. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) webhook, err := client.ZeroTrust.Casb.Posture.Webhooks.Get( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", zero_trust.CasbPostureWebhookGetParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", webhook.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "550e8400-e29b-41d4-a716-446655440000", "authentication_type": "Bearer Auth", "created_at": "2024-01-15T10:30:00Z", "destination_url": "https://example.com/webhook", "label": "Send to Gmail", "status": "enabled", "updated_at": "2024-01-20T14:45:00Z", "version": 1, "headers": [ { "key": "authorization" } ] } } ``` ## Update an existing webhook configuration `client.ZeroTrust.Casb.Posture.Webhooks.Update(ctx, webhookID, params) (*CasbPostureWebhookUpdateResponse, error)` **put** `/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}` Updates an existing webhook configuration with new settings. ### Parameters - `webhookID string` - `params CasbPostureWebhookUpdateParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `AuthenticationType param.Field[CasbPostureWebhookUpdateParamsAuthenticationType]` Body param: Type of authentication used for the webhook. - `const CasbPostureWebhookUpdateParamsAuthenticationTypeBasicAuth CasbPostureWebhookUpdateParamsAuthenticationType = "Basic Auth"` - `const CasbPostureWebhookUpdateParamsAuthenticationTypeNone CasbPostureWebhookUpdateParamsAuthenticationType = "None"` - `const CasbPostureWebhookUpdateParamsAuthenticationTypeBearerAuth CasbPostureWebhookUpdateParamsAuthenticationType = "Bearer Auth"` - `const CasbPostureWebhookUpdateParamsAuthenticationTypeStaticHeaders CasbPostureWebhookUpdateParamsAuthenticationType = "Static Headers"` - `const CasbPostureWebhookUpdateParamsAuthenticationTypeHmacSigning CasbPostureWebhookUpdateParamsAuthenticationType = "HMAC-Signing"` - `DestinationURL param.Field[string]` Body param: Target URL for the webhook configuration. Where resulting data will be sent. - `Label param.Field[string]` Body param: Account-specified display label for the webhook configuration. - `Status param.Field[CasbPostureWebhookUpdateParamsStatus]` Body param: Status of the webhook configuration. - `const CasbPostureWebhookUpdateParamsStatusEnabled CasbPostureWebhookUpdateParamsStatus = "enabled"` - `const CasbPostureWebhookUpdateParamsStatusDisabled CasbPostureWebhookUpdateParamsStatus = "disabled"` - `Headers param.Field[[]CasbPostureWebhookUpdateParamsHeader]` Body param: List of custom headers to include in webhook requests. - `Key string` Header key name. - `Value string` Header value. Required on Create and Evaluate. On Update, omit or set to null to keep existing value. - `SigningSecret param.Field[string]` Body param: Secret key used for HMAC signing when authentication_type is "HMAC-Signing". ### Returns - `type CasbPostureWebhookUpdateResponse struct{…}` Webhook configuration for sending finding notifications. - `ID string` Unique identifier for the specific webhook configuration. - `AuthenticationType CasbPostureWebhookUpdateResponseAuthenticationType` Type of authentication used for the webhook. - `const CasbPostureWebhookUpdateResponseAuthenticationTypeBasicAuth CasbPostureWebhookUpdateResponseAuthenticationType = "Basic Auth"` - `const CasbPostureWebhookUpdateResponseAuthenticationTypeNone CasbPostureWebhookUpdateResponseAuthenticationType = "None"` - `const CasbPostureWebhookUpdateResponseAuthenticationTypeBearerAuth CasbPostureWebhookUpdateResponseAuthenticationType = "Bearer Auth"` - `const CasbPostureWebhookUpdateResponseAuthenticationTypeStaticHeaders CasbPostureWebhookUpdateResponseAuthenticationType = "Static Headers"` - `const CasbPostureWebhookUpdateResponseAuthenticationTypeHmacSigning CasbPostureWebhookUpdateResponseAuthenticationType = "HMAC-Signing"` - `CreatedAt Time` Timestamp when the webhook configuration was created. - `DestinationURL string` Target URL for the webhook configuration. Where resulting data will be sent. - `Label string` Account-specified display label for the webhook configuration. - `Status CasbPostureWebhookUpdateResponseStatus` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `const CasbPostureWebhookUpdateResponseStatusEnabled CasbPostureWebhookUpdateResponseStatus = "enabled"` - `const CasbPostureWebhookUpdateResponseStatusDisabled CasbPostureWebhookUpdateResponseStatus = "disabled"` - `UpdatedAt Time` Timestamp when the webhook configuration was last updated. - `Version int64` Version number of the configuration. - `Headers []CasbPostureWebhookUpdateResponseHeader` List of header keys configured for this webhook. Values are not included for security reasons. - `Key string` Header key name (lowercase). - `Value string` Header value. This field is never returned in API responses for security reasons. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) webhook, err := client.ZeroTrust.Casb.Posture.Webhooks.Update( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", zero_trust.CasbPostureWebhookUpdateParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), AuthenticationType: cloudflare.F(zero_trust.CasbPostureWebhookUpdateParamsAuthenticationTypeBearerAuth), DestinationURL: cloudflare.F("https://example.com/webhook"), Label: cloudflare.F("Send to Slack"), Status: cloudflare.F(zero_trust.CasbPostureWebhookUpdateParamsStatusEnabled), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", webhook.ID) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "550e8400-e29b-41d4-a716-446655440000", "authentication_type": "Bearer Auth", "created_at": "2024-01-15T10:30:00Z", "destination_url": "https://example.com/webhook", "label": "Send to Gmail", "status": "enabled", "updated_at": "2024-01-20T14:45:00Z", "version": 1, "headers": [ { "key": "authorization" } ] } } ``` ## Delete a webhook configuration `client.ZeroTrust.Casb.Posture.Webhooks.Delete(ctx, webhookID, body) (*CasbPostureWebhookDeleteResponse, error)` **delete** `/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}` Soft deletes a webhook configuration by its unique identifier. The webhook will be marked as deleted and will no longer be available for use. ### Parameters - `webhookID string` - `body CasbPostureWebhookDeleteParams` - `AccountID param.Field[string]` Cloudflare account ID for the user making the request. ### Returns - `type CasbPostureWebhookDeleteResponse struct{…}` Common response structure for all API endpoints. - `Errors []CasbPostureWebhookDeleteResponseError` - `Code int64` Error or message code. - `Message string` Human-readable message. - `DocumentationURL string` Link to relevant documentation. - `Source CasbPostureWebhookDeleteResponseErrorsSource` - `Pointer string` JSON pointer to the source of the error. - `Messages []CasbPostureWebhookDeleteResponseMessage` - `Code int64` Error or message code. - `Message string` Human-readable message. - `DocumentationURL string` Link to relevant documentation. - `Source CasbPostureWebhookDeleteResponseMessagesSource` - `Pointer string` JSON pointer to the source of the error. - `Success bool` Whether the API call was successful. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) webhook, err := client.ZeroTrust.Casb.Posture.Webhooks.Delete( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", zero_trust.CasbPostureWebhookDeleteParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", webhook.Errors) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true } ``` ## Test a webhook configuration before creating it `client.ZeroTrust.Casb.Posture.Webhooks.Evaluate(ctx, params) (*CasbPostureWebhookEvaluateResponse, error)` **post** `/accounts/{account_id}/data-security/posture/webhooks/evaluate` Sends a test webhook event to the specified destination URL to verify the webhook endpoint is reachable and properly configured. This allows customers to validate their webhook configuration before creating the actual webhook resource. The test payload includes: - event_type: "webhook.test" - timestamp: Current UTC timestamp - message: Test message indicating this is from Cloudflare CASB - data: Object with test: true ### Parameters - `params CasbPostureWebhookEvaluateParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `AuthenticationType param.Field[CasbPostureWebhookEvaluateParamsAuthenticationType]` Body param: Type of authentication to use for the test webhook request. - `const CasbPostureWebhookEvaluateParamsAuthenticationTypeBasicAuth CasbPostureWebhookEvaluateParamsAuthenticationType = "Basic Auth"` - `const CasbPostureWebhookEvaluateParamsAuthenticationTypeNone CasbPostureWebhookEvaluateParamsAuthenticationType = "None"` - `const CasbPostureWebhookEvaluateParamsAuthenticationTypeBearerAuth CasbPostureWebhookEvaluateParamsAuthenticationType = "Bearer Auth"` - `const CasbPostureWebhookEvaluateParamsAuthenticationTypeStaticHeaders CasbPostureWebhookEvaluateParamsAuthenticationType = "Static Headers"` - `const CasbPostureWebhookEvaluateParamsAuthenticationTypeHmacSigning CasbPostureWebhookEvaluateParamsAuthenticationType = "HMAC-Signing"` - `DestinationURL param.Field[string]` Body param: Target URL to send the test webhook event to. - `Headers param.Field[[]CasbPostureWebhookEvaluateParamsHeader]` Body param: List of custom headers to include in the test webhook request. - `Key string` Header key name. - `Value string` Header value. Required on Create and Evaluate. On Update, omit or set to null to keep existing value. - `SigningSecret param.Field[string]` Body param: Secret key used for HMAC signing when authentication_type is "HMAC-Signing". ### Returns - `type CasbPostureWebhookEvaluateResponse struct{…}` Response body for webhook evaluation test results. - `Message string` Human-readable message describing the test result. - `StatusCode int64` HTTP status code returned by the webhook endpoint. 0 if connection failed. - `Success bool` Whether the webhook test was successful (received 2xx response). ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.ZeroTrust.Casb.Posture.Webhooks.Evaluate(context.TODO(), zero_trust.CasbPostureWebhookEvaluateParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), AuthenticationType: cloudflare.F(zero_trust.CasbPostureWebhookEvaluateParamsAuthenticationTypeBearerAuth), DestinationURL: cloudflare.F("https://example.com/webhook"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.Message) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "message": "Webhook test successful", "status_code": 200, "success": true } } ``` ## Test an existing webhook configuration `client.ZeroTrust.Casb.Posture.Webhooks.EvaluateExisting(ctx, webhookID, body) (*CasbPostureWebhookEvaluateExistingResponse, error)` **post** `/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}/evaluate` Sends a test webhook event using an existing webhook configuration. This allows customers to verify their webhook endpoint is still reachable and properly configured after creating the webhook resource. The test payload includes: - event_type: "webhook.test" - timestamp: Current UTC timestamp - message: Test message indicating this is from Cloudflare CASB - data: Object with test: true ### Parameters - `webhookID string` - `body CasbPostureWebhookEvaluateExistingParams` - `AccountID param.Field[string]` Cloudflare account ID for the user making the request. ### Returns - `type CasbPostureWebhookEvaluateExistingResponse struct{…}` Response body for webhook evaluation test results. - `Message string` Human-readable message describing the test result. - `StatusCode int64` HTTP status code returned by the webhook endpoint. 0 if connection failed. - `Success bool` Whether the webhook test was successful (received 2xx response). ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.ZeroTrust.Casb.Posture.Webhooks.EvaluateExisting( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", zero_trust.CasbPostureWebhookEvaluateExistingParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.Message) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "message": "Webhook test successful", "status_code": 200, "success": true } } ``` # Jobs ## Create webhook jobs `client.ZeroTrust.Casb.Posture.Webhooks.Jobs.New(ctx, params) (*CasbPostureWebhookJobNewResponse, error)` **post** `/accounts/{account_id}/data-security/posture/webhooks/jobs` Creates webhook jobs to send a finding instance to one or more configured webhooks. ### Parameters - `params CasbPostureWebhookJobNewParams` - `AccountID param.Field[string]` Path param: Cloudflare account ID for the user making the request. - `FindingInstanceIDs param.Field[[]string]` Body param: Array of finding instance IDs to send to the webhooks - `WebhookIDs param.Field[[]string]` Body param: Array of webhook IDs to trigger jobs for ### Returns - `type CasbPostureWebhookJobNewResponse struct{…}` - `Created []CasbPostureWebhookJobNewResponseCreated` Successfully created webhook jobs. - `ID string` Unique identifier for the webhook job. - `AssetData map[string, unknown]` Asset data associated with this webhook job. - `CreatedAt Time` When the webhook job was created. - `IntegrationID string` ID of the integration. - `LastUpdatedAt Time` When the webhook job was last updated. - `Parameters CasbPostureWebhookJobNewResponseCreatedParameters` Parameters for a webhook job. - `FindingInstanceID string` ID of the finding instance. - `Status CasbPostureWebhookJobNewResponseCreatedStatus` Status of a webhook job. - `const CasbPostureWebhookJobNewResponseCreatedStatusPending CasbPostureWebhookJobNewResponseCreatedStatus = "pending"` - `const CasbPostureWebhookJobNewResponseCreatedStatusProcessing CasbPostureWebhookJobNewResponseCreatedStatus = "processing"` - `const CasbPostureWebhookJobNewResponseCreatedStatusCompleted CasbPostureWebhookJobNewResponseCreatedStatus = "completed"` - `const CasbPostureWebhookJobNewResponseCreatedStatusFailed CasbPostureWebhookJobNewResponseCreatedStatus = "failed"` - `TriggeredByActor CasbPostureWebhookJobNewResponseCreatedTriggeredByActor` Type of actor that triggered the webhook job. - `const CasbPostureWebhookJobNewResponseCreatedTriggeredByActorUser CasbPostureWebhookJobNewResponseCreatedTriggeredByActor = "user"` - `const CasbPostureWebhookJobNewResponseCreatedTriggeredByActorAccountToken CasbPostureWebhookJobNewResponseCreatedTriggeredByActor = "account_token"` - `TriggeredByID string` ID of the actor that triggered the job. - `WebhookID string` ID of the webhook configuration. - `FailureDetails map[string, unknown]` Additional details about the failure. - `FailureReason CasbPostureWebhookJobNewResponseCreatedFailureReason` Reason for webhook job failure. - `const CasbPostureWebhookJobNewResponseCreatedFailureReasonPermissionDenied CasbPostureWebhookJobNewResponseCreatedFailureReason = "Permission Denied"` - `const CasbPostureWebhookJobNewResponseCreatedFailureReasonIntegrationUnavailable CasbPostureWebhookJobNewResponseCreatedFailureReason = "Integration Unavailable"` - `const CasbPostureWebhookJobNewResponseCreatedFailureReasonServiceTemporarilyUnavailable CasbPostureWebhookJobNewResponseCreatedFailureReason = "Service Temporarily Unavailable"` - `const CasbPostureWebhookJobNewResponseCreatedFailureReasonSystemError CasbPostureWebhookJobNewResponseCreatedFailureReason = "System Error"` - `Failed []CasbPostureWebhookJobNewResponseFailed` Failed webhook job creation attempts. - `Error string` Error message describing the failure. - `FindingInstanceID string` ID of the finding instance that failed to create a webhook job. - `WebhookID string` ID of the webhook configuration. ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/zero_trust" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) job, err := client.ZeroTrust.Casb.Posture.Webhooks.Jobs.New(context.TODO(), zero_trust.CasbPostureWebhookJobNewParams{ AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"), FindingInstanceIDs: cloudflare.F([]string{"770e8400-e29b-41d4-a716-446655440002", "660e8400-e29b-41d4-a716-446655440001"}), WebhookIDs: cloudflare.F([]string{"550e8400-e29b-41d4-a716-446655440000", "660e8400-e29b-41d4-a716-446655440001"}), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", job.Created) } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result": { "created": [ { "id": "c416bc38-75db-425f-ae25-c37b5df5c37f", "asset_data": { "foo": "bar" }, "created_at": "2025-07-07T18:39:13.123456Z", "integration_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "last_updated_at": "2025-07-07T18:39:13.123456Z", "parameters": { "finding_instance_id": "3f7b8c9d-6e5a-4f3b-9c2d-1e0a8b7c6d5e" }, "status": "pending", "triggered_by_actor": "user", "triggered_by_id": "user@example.com", "webhook_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "failure_details": { "foo": "bar" }, "failure_reason": "Permission Denied" } ], "failed": [ { "error": "Failed to create webhook job", "finding_instance_id": "2e6b4c8a-9d1f-4e3b-8c7a-5f9e2d1a6b4c", "webhook_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" } ] }, "success": true } ```