# Casb # Applications ## List applications `zero_trust.casb.applications.list(ApplicationListParams**kwargs) -> ApplicationListResponse` **get** `/accounts/{account_id}/one/applications` Returns a list of available applications with use cases and permissions. ### Parameters - `account_id: str` - `environment: Optional[str]` Filter by supported environment (standard, fedramp). ### Returns - `List[ApplicationListResponseItem]` - `id: Literal["BITBUCKET", "BOX", "CONFLUENCE", 7 more]` Vendor identifier (e.g. microsoft_internal, google_workspace). * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `SALESFORCE` - SALESFORCE * `SLACK` - SLACK - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT_INTERNAL"` - `"SALESFORCE"` - `"SLACK"` - `auth_methods: List[ApplicationListResponseItemAuthMethod]` Available auth methods. - `id: str` Auth method identifier. - `display_name: str` Human-readable auth method name. - `category: str` Vendor category (e.g. Productivity, AI). - `description: str` Brief description of the integration. - `display_name: str` Human-readable vendor name. - `dlp_enabled: bool` Whether DLP scanning is supported. - `logo: Optional[str]` Logo path. - `permissions: List[ApplicationListResponseItemPermission]` All permissions with severity. - `display_name: str` Human-readable permission name. - `scope: str` Vendor-native scope identifier. - `severity: Literal["low", "medium", "high", "critical"]` Permission sensitivity level. * `low` - low * `medium` - medium * `high` - high * `critical` - critical - `"low"` - `"medium"` - `"high"` - `"critical"` - `supported_environments: List[str]` Environments this vendor supports (standard, fedramp). - `use_cases: List[ApplicationListResponseItemUseCase]` Supported use cases. - `id: str` Use case identifier (e.g. casb, ces). - `display_name: str` Human-readable use case name. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) applications = client.zero_trust.casb.applications.list( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(applications) ``` #### Response ```json [ { "auth_methods": [ { "display_name": "OAuth 2.0 Admin Consent", "id": "oauth2_standard" } ], "category": "Productivity", "description": "Monitor OneDrive, SharePoint, Teams, and Outlook.", "display_name": "Microsoft", "dlp_enabled": true, "id": "MICROSOFT_INTERNAL", "logo": "/api/v4/accounts/12345678/casb/static/microsoft_internal.svg", "permissions": [ { "display_name": "Read all users' full profiles", "scope": "User.Read.All", "severity": "high" }, { "display_name": "Read all files", "scope": "Files.Read.All", "severity": "high" }, { "display_name": "Read and write mail", "scope": "Mail.ReadWrite", "severity": "critical" } ], "supported_environments": [ "standard", "fedramp" ], "use_cases": [ { "display_name": "Cloud Access Security Broker", "id": "casb" }, { "display_name": "Cloud Email Security", "id": "ces" } ] } ] ``` ## Get application details `zero_trust.casb.applications.get(Literal["BITBUCKET", "BOX", "CONFLUENCE", 7 more]application_id, ApplicationGetParams**kwargs) -> ApplicationGetResponse` **get** `/accounts/{account_id}/one/applications/{application_id}` Returns full application details including auth methods, use cases, and permissions. ### Parameters - `account_id: str` - `application_id: Literal["BITBUCKET", "BOX", "CONFLUENCE", 7 more]` - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT_INTERNAL"` - `"SALESFORCE"` - `"SLACK"` ### Returns - `class ApplicationGetResponse: …` Full application detail for onboarding UI. - `id: Literal["BITBUCKET", "BOX", "CONFLUENCE", 7 more]` Vendor identifier. * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `SALESFORCE` - SALESFORCE * `SLACK` - SLACK - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT_INTERNAL"` - `"SALESFORCE"` - `"SLACK"` - `auth_methods: List[AuthMethod]` Available authentication methods. - `id: str` Auth method identifier. - `display_name: str` Human-readable auth method name. - `is_default: bool` Whether this is the default auth method. - `supported_environments: List[str]` Environments this auth method supports. - `category: str` Vendor category. - `description: str` Brief description. - `display_name: str` Human-readable vendor name. - `dlp_enabled: bool` Whether DLP scanning is supported. - `instructions: Optional[str]` Setup instructions for the user. - `logo: Optional[str]` Logo path. - `use_cases: List[UseCase]` Use cases with full scope details. - `id: str` Use case identifier. - `base_scopes: List[UseCaseBaseScope]` Scopes always required for this use case. - `display_name: str` Human-readable permission name. - `scope: str` Vendor-native scope identifier. - `severity: Literal["low", "medium", "high", "critical"]` Permission sensitivity level. * `low` - low * `medium` - medium * `high` - high * `critical` - critical - `"low"` - `"medium"` - `"high"` - `"critical"` - `description: str` Use case description. - `display_name: str` Human-readable use case name. - `features: List[UseCaseFeature]` Optional features with extra scopes. - `id: str` Feature identifier. - `description: str` Feature description. - `display_name: str` Human-readable feature name. - `scopes: List[UseCaseFeatureScope]` Additional scopes when feature is enabled. - `display_name: str` Human-readable permission name. - `scope: str` Vendor-native scope identifier. - `severity: Literal["low", "medium", "high", "critical"]` Permission sensitivity level. * `low` - low * `medium` - medium * `high` - high * `critical` - critical - `"low"` - `"medium"` - `"high"` - `"critical"` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) application = client.zero_trust.casb.applications.get( application_id="BITBUCKET", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(application.id) ``` #### Response ```json { "auth_methods": [ { "display_name": "OAuth 2.0 Admin Consent", "id": "oauth2", "is_default": true, "supported_environments": [ "standard", "fedramp" ] } ], "category": "Productivity", "description": "Monitor OneDrive, SharePoint, Teams, and Outlook.", "display_name": "Microsoft", "dlp_enabled": true, "id": "MICROSOFT_INTERNAL", "instructions": "You'll need a Microsoft 365 admin account with Global Admin or Application Admin role.", "logo": "/api/v4/accounts/12345678/casb/static/microsoft_internal.svg", "use_cases": [ { "base_scopes": [ { "display_name": "Read all users' full profiles", "scope": "User.Read.All", "severity": "high" }, { "display_name": "Read all files", "scope": "Files.Read.All", "severity": "high" } ], "description": "Discover and secure SaaS applications", "display_name": "Cloud Access Security Broker", "features": [ { "description": "Automatically remediate security issues", "display_name": "Auto Remediation", "id": "auto_remediation", "scopes": [ { "display_name": "Read and write all files", "scope": "Files.ReadWrite.All", "severity": "critical" } ] } ], "id": "casb" } ] } ``` ## Domain Types ### Application List Response - `List[ApplicationListResponseItem]` - `id: Literal["BITBUCKET", "BOX", "CONFLUENCE", 7 more]` Vendor identifier (e.g. microsoft_internal, google_workspace). * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `SALESFORCE` - SALESFORCE * `SLACK` - SLACK - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT_INTERNAL"` - `"SALESFORCE"` - `"SLACK"` - `auth_methods: List[ApplicationListResponseItemAuthMethod]` Available auth methods. - `id: str` Auth method identifier. - `display_name: str` Human-readable auth method name. - `category: str` Vendor category (e.g. Productivity, AI). - `description: str` Brief description of the integration. - `display_name: str` Human-readable vendor name. - `dlp_enabled: bool` Whether DLP scanning is supported. - `logo: Optional[str]` Logo path. - `permissions: List[ApplicationListResponseItemPermission]` All permissions with severity. - `display_name: str` Human-readable permission name. - `scope: str` Vendor-native scope identifier. - `severity: Literal["low", "medium", "high", "critical"]` Permission sensitivity level. * `low` - low * `medium` - medium * `high` - high * `critical` - critical - `"low"` - `"medium"` - `"high"` - `"critical"` - `supported_environments: List[str]` Environments this vendor supports (standard, fedramp). - `use_cases: List[ApplicationListResponseItemUseCase]` Supported use cases. - `id: str` Use case identifier (e.g. casb, ces). - `display_name: str` Human-readable use case name. ### Application Get Response - `class ApplicationGetResponse: …` Full application detail for onboarding UI. - `id: Literal["BITBUCKET", "BOX", "CONFLUENCE", 7 more]` Vendor identifier. * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `SALESFORCE` - SALESFORCE * `SLACK` - SLACK - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT_INTERNAL"` - `"SALESFORCE"` - `"SLACK"` - `auth_methods: List[AuthMethod]` Available authentication methods. - `id: str` Auth method identifier. - `display_name: str` Human-readable auth method name. - `is_default: bool` Whether this is the default auth method. - `supported_environments: List[str]` Environments this auth method supports. - `category: str` Vendor category. - `description: str` Brief description. - `display_name: str` Human-readable vendor name. - `dlp_enabled: bool` Whether DLP scanning is supported. - `instructions: Optional[str]` Setup instructions for the user. - `logo: Optional[str]` Logo path. - `use_cases: List[UseCase]` Use cases with full scope details. - `id: str` Use case identifier. - `base_scopes: List[UseCaseBaseScope]` Scopes always required for this use case. - `display_name: str` Human-readable permission name. - `scope: str` Vendor-native scope identifier. - `severity: Literal["low", "medium", "high", "critical"]` Permission sensitivity level. * `low` - low * `medium` - medium * `high` - high * `critical` - critical - `"low"` - `"medium"` - `"high"` - `"critical"` - `description: str` Use case description. - `display_name: str` Human-readable use case name. - `features: List[UseCaseFeature]` Optional features with extra scopes. - `id: str` Feature identifier. - `description: str` Feature description. - `display_name: str` Human-readable feature name. - `scopes: List[UseCaseFeatureScope]` Additional scopes when feature is enabled. - `display_name: str` Human-readable permission name. - `scope: str` Vendor-native scope identifier. - `severity: Literal["low", "medium", "high", "critical"]` Permission sensitivity level. * `low` - low * `medium` - medium * `high` - high * `critical` - critical - `"low"` - `"medium"` - `"high"` - `"critical"` # Auth Methods ## Get auth methods `zero_trust.casb.applications.auth_methods.list(Literal["BITBUCKET", "BOX", "CONFLUENCE", 7 more]application_id, AuthMethodListParams**kwargs) -> AuthMethodListResponse` **get** `/accounts/{account_id}/one/applications/{application_id}/auth-methods` Returns available auth methods for the specified vendor, including credential schema, instructions, and example payloads. Use this to understand what credentials are required before calling POST /v2/integrations. ### Parameters - `account_id: str` - `application_id: Literal["BITBUCKET", "BOX", "CONFLUENCE", 7 more]` - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT_INTERNAL"` - `"SALESFORCE"` - `"SLACK"` ### Returns - `List[AuthMethodListResponseItem]` - `id: str` Auth method identifier. - `display_name: str` Human-readable auth method name. - `human_interaction_required: bool` Whether setup requires human interaction or integration can be created purely using API (e.g., For OAuth can not be created without user interaction). - `instructions: AuthMethodListResponseItemInstructions` Step-by-step instructions for obtaining credentials. - `markdown: str` Detailed instructions in markdown format. - `payload_example: Optional[Dict[str, object]]` Example credentials payload with placeholder values. - `payload_schema: Optional[Dict[str, object]]` JSON Schema for the credentials object in POST /v2/integrations request. - `redirect_url: Optional[str]` OAuth redirect URL for vendors requiring human interaction. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) auth_methods = client.zero_trust.casb.applications.auth_methods.list( application_id="BITBUCKET", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(auth_methods) ``` #### Response ```json [ { "id": "id", "display_name": "display_name", "human_interaction_required": true, "instructions": { "markdown": "markdown" }, "payload_example": { "foo": "bar" }, "payload_schema": { "foo": "bar" }, "redirect_url": "redirect_url" } ] ``` ## Domain Types ### Auth Method List Response - `List[AuthMethodListResponseItem]` - `id: str` Auth method identifier. - `display_name: str` Human-readable auth method name. - `human_interaction_required: bool` Whether setup requires human interaction or integration can be created purely using API (e.g., For OAuth can not be created without user interaction). - `instructions: AuthMethodListResponseItemInstructions` Step-by-step instructions for obtaining credentials. - `markdown: str` Detailed instructions in markdown format. - `payload_example: Optional[Dict[str, object]]` Example credentials payload with placeholder values. - `payload_schema: Optional[Dict[str, object]]` JSON Schema for the credentials object in POST /v2/integrations request. - `redirect_url: Optional[str]` OAuth redirect URL for vendors requiring human interaction. # Integrations ## List integrations `zero_trust.casb.integrations.list(IntegrationListParams**kwargs) -> object` **get** `/accounts/{account_id}/one/integrations` Returns a paginated list of integrations for the account. ### Parameters - `account_id: str` - `application: Optional[str]` Filter by application/vendor (e.g., GOOGLE_WORKSPACE, MICROSOFT_INTERNAL). - `direction: Optional[Literal["asc", "desc"]]` Direction to order results. - `"asc"` - `"desc"` - `dlp_enabled: Optional[bool]` Filter by DLP enabled status (true/false). - `order: Optional[Literal["application", "created", "name", "status"]]` Field to order results by. - `"application"` - `"created"` - `"name"` - `"status"` - `page: Optional[int]` Page number within the paginated result set. - `page_size: Optional[int]` Number of results per page. - `search: Optional[str]` Search integrations by name or application. - `status: Optional[Literal["Healthy", "Initializing", "Offline", "Unhealthy"]]` Filter by integration status. - `"Healthy"` - `"Initializing"` - `"Offline"` - `"Unhealthy"` - `use_cases: Optional[str]` Filter by enabled use cases (e.g., casb, ces). Matches integrations enrolled in any of the specified values. Can be specified multiple times. ### Returns - `object` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) integrations = client.zero_trust.casb.integrations.list( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(integrations) ``` #### Response ```json { "errors": [], "messages": [], "result": [ { "application": { "category": "Productivity", "display_name": "Google Workspace", "logo": "https://onprem.cloudflare.com/static/google_workspace.png" }, "created": "2025-01-15T10:00:00Z", "id": "019d2e6a-d995-7185-afbd-4feead9e42ec", "is_paused": false, "name": "My Google Workspace", "status": "Healthy", "updated": "2025-04-10T08:30:00Z" } ], "result_info": { "count": 1, "next": null, "page": 1, "per_page": 10, "previous": null, "total_count": 1 }, "success": true } ``` ## Get integration details `zero_trust.casb.integrations.get(strid, IntegrationGetParams**kwargs) -> IntegrationGetResponse` **get** `/accounts/{account_id}/one/integrations/{id}` Returns full integration details including use cases and permissions. ### Parameters - `account_id: str` - `id: str` ### Returns - `class IntegrationGetResponse: …` Serializer for v2 integration detail response with use cases. - `id: str` Integration ID. - `application: Dict[str, Optional[str]]` - `auth_method: Optional[Dict[str, str]]` The integration's authentication method. - `authorization_link: Optional[AuthorizationLink]` Authorization link for the integration. - `components: Optional[Dict[str, object]]` - `link: Optional[str]` - `created: datetime` When the integration was created. - `credentials_expiry: datetime` Credentials expiry time. - `dlp_profiles: List[str]` DLP Profiles enabled for the integration. - `health_details: List[Dict[str, object]]` Health details with remediation hints. - `is_paused: bool` Whether the user paused the integration. - `last_hydrated: datetime` Last time the integration was hydrated. - `name: str` Name of the integration. - `organization_id: int` Organization ID. - `status: str` Integration status. - `updated: datetime` When the integration was last updated. - `use_cases: List[Dict[str, object]]` Use cases enabled for the integration. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) integration = client.zero_trust.casb.integrations.get( id="id", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(integration.id) ``` #### Response ```json { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "application": { "foo": "string" }, "auth_method": { "foo": "string" }, "authorization_link": { "components": { "foo": "bar" }, "link": "link" }, "created": "2019-12-27T18:11:19.117Z", "credentials_expiry": "2019-12-27T18:11:19.117Z", "dlp_profiles": [ "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" ], "health_details": [ { "foo": "bar" } ], "is_paused": true, "last_hydrated": "2019-12-27T18:11:19.117Z", "name": "name", "organization_id": 0, "status": "status", "updated": "2019-12-27T18:11:19.117Z", "use_cases": [ { "foo": "bar" } ] } ``` ## Create integration `zero_trust.casb.integrations.create(IntegrationCreateParams**kwargs) -> IntegrationCreateResponse` **post** `/accounts/{account_id}/one/integrations` Creates a new integration for the specified application. Integration creation with OAuth is not supported by API at the moment. For other auth methods, use `GET /v2/applications/{application_id}/credential-guide` to see the required credential structure and example payloads for each vendor. ### Parameters - `account_id: str` - `application: Literal["BITBUCKET", "BOX", "CONFLUENCE", 7 more]` Vendor/application slug (e.g., GOOGLE_WORKSPACE). * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `SALESFORCE` - SALESFORCE * `SLACK` - SLACK - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT_INTERNAL"` - `"SALESFORCE"` - `"SLACK"` - `credentials: Dict[str, object]` Credentials for the integration. - `name: str` Name of the integration. - `auth_method: Optional[str]` Authentication method slug (uses default if omitted). - `dlp_profiles: Optional[Sequence[str]]` List of DLP profile IDs to associate. - `permissions: Optional[Sequence[str]]` List of permission scopes (uses policy defaults if empty). - `use_cases: Optional[List[Literal["casb", "ces", "auto_remediation"]]]` List of use case or feature slugs to enroll (e.g., ['casb', 'ces', 'auto_remediation']). - `"casb"` - `"ces"` - `"auto_remediation"` ### Returns - `class IntegrationCreateResponse: …` Serializer for v2 integration detail response with use cases. - `id: str` Integration ID. - `application: Dict[str, Optional[str]]` - `auth_method: Optional[Dict[str, str]]` The integration's authentication method. - `authorization_link: Optional[AuthorizationLink]` Authorization link for the integration. - `components: Optional[Dict[str, object]]` - `link: Optional[str]` - `created: datetime` When the integration was created. - `credentials_expiry: datetime` Credentials expiry time. - `dlp_profiles: List[str]` DLP Profiles enabled for the integration. - `health_details: List[Dict[str, object]]` Health details with remediation hints. - `is_paused: bool` Whether the user paused the integration. - `last_hydrated: datetime` Last time the integration was hydrated. - `name: str` Name of the integration. - `organization_id: int` Organization ID. - `status: str` Integration status. - `updated: datetime` When the integration was last updated. - `use_cases: List[Dict[str, object]]` Use cases enabled for the integration. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) integration = client.zero_trust.casb.integrations.create( account_id="023e105f4ecef8ad9ca31a8372d0c353", application="GOOGLE_WORKSPACE", credentials={ "admin_email": "admin@corp.com" }, name="My Google Workspace", auth_method="service_account", dlp_profiles=["e91a2360-da51-4fdf-9711-bcdecd462614"], permissions=["https://www.googleapis.com/auth/drive.readonly"], use_cases=["casb", "ces"], ) print(integration.id) ``` #### Response ```json { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "application": { "foo": "string" }, "auth_method": { "foo": "string" }, "authorization_link": { "components": { "foo": "bar" }, "link": "link" }, "created": "2019-12-27T18:11:19.117Z", "credentials_expiry": "2019-12-27T18:11:19.117Z", "dlp_profiles": [ "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" ], "health_details": [ { "foo": "bar" } ], "is_paused": true, "last_hydrated": "2019-12-27T18:11:19.117Z", "name": "name", "organization_id": 0, "status": "status", "updated": "2019-12-27T18:11:19.117Z", "use_cases": [ { "foo": "bar" } ] } ``` ## Update integration `zero_trust.casb.integrations.update(strid, IntegrationUpdateParams**kwargs) -> IntegrationUpdateResponse` **patch** `/accounts/{account_id}/one/integrations/{id}` Updates an integration's name, permissions, DLP profiles, use cases, or credentials. ### Parameters - `account_id: str` - `id: str` - `credentials: Optional[Dict[str, object]]` Partial credential fields to merge with existing. - `dlp_profiles: Optional[Sequence[str]]` List of DLP profile IDs to associate with the integration. - `name: Optional[str]` Name of the integration. - `permissions: Optional[Sequence[str]]` List of permission scopes granted to the integration. - `use_cases: Optional[List[Literal["casb", "ces", "auto_remediation"]]]` List of use case or feature slugs to enroll (e.g., ['casb', 'ces', 'auto_remediation']). - `"casb"` - `"ces"` - `"auto_remediation"` ### Returns - `class IntegrationUpdateResponse: …` Serializer for v2 integration detail response with use cases. - `id: str` Integration ID. - `application: Dict[str, Optional[str]]` - `auth_method: Optional[Dict[str, str]]` The integration's authentication method. - `authorization_link: Optional[AuthorizationLink]` Authorization link for the integration. - `components: Optional[Dict[str, object]]` - `link: Optional[str]` - `created: datetime` When the integration was created. - `credentials_expiry: datetime` Credentials expiry time. - `dlp_profiles: List[str]` DLP Profiles enabled for the integration. - `health_details: List[Dict[str, object]]` Health details with remediation hints. - `is_paused: bool` Whether the user paused the integration. - `last_hydrated: datetime` Last time the integration was hydrated. - `name: str` Name of the integration. - `organization_id: int` Organization ID. - `status: str` Integration status. - `updated: datetime` When the integration was last updated. - `use_cases: List[Dict[str, object]]` Use cases enabled for the integration. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) integration = client.zero_trust.casb.integrations.update( id="id", account_id="023e105f4ecef8ad9ca31a8372d0c353", credentials={ "access_token": "new_access_token", "refresh_token": "new_refresh_token", }, ) print(integration.id) ``` #### Response ```json { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "application": { "foo": "string" }, "auth_method": { "foo": "string" }, "authorization_link": { "components": { "foo": "bar" }, "link": "link" }, "created": "2019-12-27T18:11:19.117Z", "credentials_expiry": "2019-12-27T18:11:19.117Z", "dlp_profiles": [ "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" ], "health_details": [ { "foo": "bar" } ], "is_paused": true, "last_hydrated": "2019-12-27T18:11:19.117Z", "name": "name", "organization_id": 0, "status": "status", "updated": "2019-12-27T18:11:19.117Z", "use_cases": [ { "foo": "bar" } ] } ``` ## Delete integration `zero_trust.casb.integrations.delete(strid, IntegrationDeleteParams**kwargs)` **delete** `/accounts/{account_id}/one/integrations/{id}` Delete an integration by soft-deleting it. ### Parameters - `account_id: str` - `id: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) client.zero_trust.casb.integrations.delete( id="id", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) ``` ## Pause integration `zero_trust.casb.integrations.pause(strid, IntegrationPauseParams**kwargs) -> IntegrationPauseResponse` **post** `/accounts/{account_id}/one/integrations/{id}/pause` Pauses an integration, stopping all crawlers. ### Parameters - `account_id: str` - `id: str` ### Returns - `class IntegrationPauseResponse: …` Serializer for v2 integration detail response with use cases. - `id: str` Integration ID. - `application: Dict[str, Optional[str]]` - `auth_method: Optional[Dict[str, str]]` The integration's authentication method. - `authorization_link: Optional[AuthorizationLink]` Authorization link for the integration. - `components: Optional[Dict[str, object]]` - `link: Optional[str]` - `created: datetime` When the integration was created. - `credentials_expiry: datetime` Credentials expiry time. - `dlp_profiles: List[str]` DLP Profiles enabled for the integration. - `health_details: List[Dict[str, object]]` Health details with remediation hints. - `is_paused: bool` Whether the user paused the integration. - `last_hydrated: datetime` Last time the integration was hydrated. - `name: str` Name of the integration. - `organization_id: int` Organization ID. - `status: str` Integration status. - `updated: datetime` When the integration was last updated. - `use_cases: List[Dict[str, object]]` Use cases enabled for the integration. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.zero_trust.casb.integrations.pause( id="id", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(response.id) ``` #### Response ```json { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "application": { "foo": "string" }, "auth_method": { "foo": "string" }, "authorization_link": { "components": { "foo": "bar" }, "link": "link" }, "created": "2019-12-27T18:11:19.117Z", "credentials_expiry": "2019-12-27T18:11:19.117Z", "dlp_profiles": [ "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" ], "health_details": [ { "foo": "bar" } ], "is_paused": true, "last_hydrated": "2019-12-27T18:11:19.117Z", "name": "name", "organization_id": 0, "status": "status", "updated": "2019-12-27T18:11:19.117Z", "use_cases": [ { "foo": "bar" } ] } ``` ## Resume integration `zero_trust.casb.integrations.resume(strid, IntegrationResumeParams**kwargs) -> IntegrationResumeResponse` **post** `/accounts/{account_id}/one/integrations/{id}/resume` Resumes a paused integration, restarting crawlers. ### Parameters - `account_id: str` - `id: str` ### Returns - `class IntegrationResumeResponse: …` Serializer for v2 integration detail response with use cases. - `id: str` Integration ID. - `application: Dict[str, Optional[str]]` - `auth_method: Optional[Dict[str, str]]` The integration's authentication method. - `authorization_link: Optional[AuthorizationLink]` Authorization link for the integration. - `components: Optional[Dict[str, object]]` - `link: Optional[str]` - `created: datetime` When the integration was created. - `credentials_expiry: datetime` Credentials expiry time. - `dlp_profiles: List[str]` DLP Profiles enabled for the integration. - `health_details: List[Dict[str, object]]` Health details with remediation hints. - `is_paused: bool` Whether the user paused the integration. - `last_hydrated: datetime` Last time the integration was hydrated. - `name: str` Name of the integration. - `organization_id: int` Organization ID. - `status: str` Integration status. - `updated: datetime` When the integration was last updated. - `use_cases: List[Dict[str, object]]` Use cases enabled for the integration. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.zero_trust.casb.integrations.resume( id="id", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(response.id) ``` #### Response ```json { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "application": { "foo": "string" }, "auth_method": { "foo": "string" }, "authorization_link": { "components": { "foo": "bar" }, "link": "link" }, "created": "2019-12-27T18:11:19.117Z", "credentials_expiry": "2019-12-27T18:11:19.117Z", "dlp_profiles": [ "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" ], "health_details": [ { "foo": "bar" } ], "is_paused": true, "last_hydrated": "2019-12-27T18:11:19.117Z", "name": "name", "organization_id": 0, "status": "status", "updated": "2019-12-27T18:11:19.117Z", "use_cases": [ { "foo": "bar" } ] } ``` ## Domain Types ### Integration Get Response - `class IntegrationGetResponse: …` Serializer for v2 integration detail response with use cases. - `id: str` Integration ID. - `application: Dict[str, Optional[str]]` - `auth_method: Optional[Dict[str, str]]` The integration's authentication method. - `authorization_link: Optional[AuthorizationLink]` Authorization link for the integration. - `components: Optional[Dict[str, object]]` - `link: Optional[str]` - `created: datetime` When the integration was created. - `credentials_expiry: datetime` Credentials expiry time. - `dlp_profiles: List[str]` DLP Profiles enabled for the integration. - `health_details: List[Dict[str, object]]` Health details with remediation hints. - `is_paused: bool` Whether the user paused the integration. - `last_hydrated: datetime` Last time the integration was hydrated. - `name: str` Name of the integration. - `organization_id: int` Organization ID. - `status: str` Integration status. - `updated: datetime` When the integration was last updated. - `use_cases: List[Dict[str, object]]` Use cases enabled for the integration. ### Integration Create Response - `class IntegrationCreateResponse: …` Serializer for v2 integration detail response with use cases. - `id: str` Integration ID. - `application: Dict[str, Optional[str]]` - `auth_method: Optional[Dict[str, str]]` The integration's authentication method. - `authorization_link: Optional[AuthorizationLink]` Authorization link for the integration. - `components: Optional[Dict[str, object]]` - `link: Optional[str]` - `created: datetime` When the integration was created. - `credentials_expiry: datetime` Credentials expiry time. - `dlp_profiles: List[str]` DLP Profiles enabled for the integration. - `health_details: List[Dict[str, object]]` Health details with remediation hints. - `is_paused: bool` Whether the user paused the integration. - `last_hydrated: datetime` Last time the integration was hydrated. - `name: str` Name of the integration. - `organization_id: int` Organization ID. - `status: str` Integration status. - `updated: datetime` When the integration was last updated. - `use_cases: List[Dict[str, object]]` Use cases enabled for the integration. ### Integration Update Response - `class IntegrationUpdateResponse: …` Serializer for v2 integration detail response with use cases. - `id: str` Integration ID. - `application: Dict[str, Optional[str]]` - `auth_method: Optional[Dict[str, str]]` The integration's authentication method. - `authorization_link: Optional[AuthorizationLink]` Authorization link for the integration. - `components: Optional[Dict[str, object]]` - `link: Optional[str]` - `created: datetime` When the integration was created. - `credentials_expiry: datetime` Credentials expiry time. - `dlp_profiles: List[str]` DLP Profiles enabled for the integration. - `health_details: List[Dict[str, object]]` Health details with remediation hints. - `is_paused: bool` Whether the user paused the integration. - `last_hydrated: datetime` Last time the integration was hydrated. - `name: str` Name of the integration. - `organization_id: int` Organization ID. - `status: str` Integration status. - `updated: datetime` When the integration was last updated. - `use_cases: List[Dict[str, object]]` Use cases enabled for the integration. ### Integration Pause Response - `class IntegrationPauseResponse: …` Serializer for v2 integration detail response with use cases. - `id: str` Integration ID. - `application: Dict[str, Optional[str]]` - `auth_method: Optional[Dict[str, str]]` The integration's authentication method. - `authorization_link: Optional[AuthorizationLink]` Authorization link for the integration. - `components: Optional[Dict[str, object]]` - `link: Optional[str]` - `created: datetime` When the integration was created. - `credentials_expiry: datetime` Credentials expiry time. - `dlp_profiles: List[str]` DLP Profiles enabled for the integration. - `health_details: List[Dict[str, object]]` Health details with remediation hints. - `is_paused: bool` Whether the user paused the integration. - `last_hydrated: datetime` Last time the integration was hydrated. - `name: str` Name of the integration. - `organization_id: int` Organization ID. - `status: str` Integration status. - `updated: datetime` When the integration was last updated. - `use_cases: List[Dict[str, object]]` Use cases enabled for the integration. ### Integration Resume Response - `class IntegrationResumeResponse: …` Serializer for v2 integration detail response with use cases. - `id: str` Integration ID. - `application: Dict[str, Optional[str]]` - `auth_method: Optional[Dict[str, str]]` The integration's authentication method. - `authorization_link: Optional[AuthorizationLink]` Authorization link for the integration. - `components: Optional[Dict[str, object]]` - `link: Optional[str]` - `created: datetime` When the integration was created. - `credentials_expiry: datetime` Credentials expiry time. - `dlp_profiles: List[str]` DLP Profiles enabled for the integration. - `health_details: List[Dict[str, object]]` Health details with remediation hints. - `is_paused: bool` Whether the user paused the integration. - `last_hydrated: datetime` Last time the integration was hydrated. - `name: str` Name of the integration. - `organization_id: int` Organization ID. - `status: str` Integration status. - `updated: datetime` When the integration was last updated. - `use_cases: List[Dict[str, object]]` Use cases enabled for the integration. # Posture # Findings ## List posture findings `zero_trust.casb.posture.findings.list(FindingListParams**kwargs) -> SyncV4PagePaginationArray[FindingListResponse]` **get** `/accounts/{account_id}/data-security/posture/findings` List all security findings that have been identified as being problematic. This will return a list of findings regardless if they have been ignored or not. ### Parameters - `account_id: str` - `cursor: Optional[str]` A cursor for pagination. Obtained from the `result_info.cursor` field of a previous response. - `direction: Optional[Literal["asc", "desc"]]` Direction to order results. - `"asc"` - `"desc"` - `finding_type_ids: Optional[str]` A comma separated list of UUIDs identifying the finding type(s). - `ignored: Optional[bool]` Filter for only the ignored findings. Set to false to only see "active" items - `integration_id: Optional[str]` Filter by an integration ID - `max_affliction_date: Optional[Union[str, datetime]]` Filter to view findings that occurred on or before the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `min_affliction_date: Optional[Union[str, datetime]]` Filter to view findings that occurred on or after the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `observation: Optional[Literal["Activity", "Insight", "Issue"]]` Filter by observation type of the finding - `"Activity"` - `"Insight"` - `"Issue"` - `order: Optional[Literal["finding.name", "instance_count", "integration.name", 2 more]]` Which field to use when ordering the findings. - `"finding.name"` - `"instance_count"` - `"integration.name"` - `"latest_affliction_date"` - `"severity"` - `page: Optional[int]` A page number within the paginated result set. - `per_page: Optional[int]` Number of results to return per page. - `product: Optional[Literal["Cloud", "Saas"]]` Filter by product category of the finding - `"Cloud"` - `"Saas"` - `search: Optional[str]` A search term. - `severity: Optional[Literal["Critical", "High", "Medium", "Low"]]` Filter by severity - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `type: Optional[Literal["Content", "Posture"]]` Filter by type of the finding - `"Content"` - `"Posture"` - `vendor: Optional[Literal["ANTHROPIC", "AWS", "BITBUCKET", 13 more]]` Filter by vendor - `"ANTHROPIC"` - `"AWS"` - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_CLOUD_PLATFORM"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT"` - `"MICROSOFT_INTERNAL"` - `"OPENAI"` - `"SALESFORCE"` - `"SERVICENOW"` - `"SLACK"` ### Returns - `class FindingListResponse: …` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: str` Base64 encoded identifier of the security finding. - `active_count: int` Number of active problematic instances identified in the security finding. - `archived_count: int` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: FindingCategory` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description: Optional[str]` Detailed description of the finding. - `remediation: Optional[FindingRemediation]` Remediation guide information for a finding. - `id: str` Remediation Id. - `frameworks: List[str]` Relevant Compliance Frameworks. - `guide: str` Remediation guide text. - `impact: str` Description of the potential impact. - `locale: str` I18N Locale. - `threat: str` Description of the threat. - `ignored: bool` Determines if finding is currently ignored. - `instance_count: int` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: datetime` When entity was created. - `last_hydrated: datetime` When were the integration credentials last updated. - `name: str` Name of the integration. - `permissions: List[str]` The vendor-specific permissions associated with the integration. - `policy: IntegrationPolicy` Policy configuration for an integration. - `id: Optional[str]` Policy identifier. - `client_id: Optional[str]` OAuth client ID for the policy. - `compliance_level: Optional[str]` Compliance level for the policy. - `dlp_enabled: Optional[bool]` Whether DLP is enabled for this policy. - `link: Optional[str]` Link to policy documentation. - `name: Optional[str]` Policy name. - `permissions: Optional[List[str]]` List of permissions included in the policy. - `status: str` Current status of the integration. - `updated: datetime` Last entity was updated. - `upgradable: bool` Whether the integrations permissions can be updated. - `vendor: IntegrationVendor` Information about a vendor/service provider. - `id: str` The id of the vendor. - `description: Optional[str]` Detailed information about what kinds of issues are detected for this vendor. - `display_name: str` The display name of the vendor. - `logo: str` Logo URL for the vendor. - `name: str` The name of the vendor. - `static_logo: str` Static logo URL for the vendor. - `zt_enrollments: List[str]` The vendor's compatible Zero Trust products. - `policies: Optional[List[Dict[str, object]]]` The policies related to the vendor. - `zt_enrollments: List[IntegrationZtEnrollment]` Zero Trust products associated with this integration. - `id: Optional[str]` The internal identifier of the Zero Trust Product. - `description: Optional[str]` Brief description of the Zero Trust Product. - `display_name: Optional[str]` The verbose name of the Zero Trust Product. - `enabled: Optional[bool]` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id: Optional[str]` Integration ID. - `credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry: Optional[datetime]` The date and time when the integration credentials will expire. - `is_paused: Optional[bool]` Whether the given integration is paused by the user. - `upgrade_dismissed: Optional[bool]` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: datetime` Timestamp of the latest affliction date of an active finding. - `severity_override: Optional[SeverityOverride]` Override information for finding severity. - `created_by: str` User ID who created the override. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.zero_trust.casb.posture.findings.list( account_id="46148281d8a93d002ef242d8b0d5f9f6", ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } ] } ``` ## Get a finding type `zero_trust.casb.posture.findings.get(strfinding_id, FindingGetParams**kwargs) -> FindingGetResponse` **get** `/accounts/{account_id}/data-security/posture/findings/{finding_id}` Gets a security Finding that has been identified as being problematic. ### Parameters - `account_id: str` - `finding_id: Union[str, Base64FileInput]` ### Returns - `class FindingGetResponse: …` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: str` Base64 encoded identifier of the security finding. - `active_count: int` Number of active problematic instances identified in the security finding. - `archived_count: int` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: FindingCategory` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description: Optional[str]` Detailed description of the finding. - `remediation: Optional[FindingRemediation]` Remediation guide information for a finding. - `id: str` Remediation Id. - `frameworks: List[str]` Relevant Compliance Frameworks. - `guide: str` Remediation guide text. - `impact: str` Description of the potential impact. - `locale: str` I18N Locale. - `threat: str` Description of the threat. - `ignored: bool` Determines if finding is currently ignored. - `instance_count: int` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: datetime` When entity was created. - `last_hydrated: datetime` When were the integration credentials last updated. - `name: str` Name of the integration. - `permissions: List[str]` The vendor-specific permissions associated with the integration. - `policy: IntegrationPolicy` Policy configuration for an integration. - `id: Optional[str]` Policy identifier. - `client_id: Optional[str]` OAuth client ID for the policy. - `compliance_level: Optional[str]` Compliance level for the policy. - `dlp_enabled: Optional[bool]` Whether DLP is enabled for this policy. - `link: Optional[str]` Link to policy documentation. - `name: Optional[str]` Policy name. - `permissions: Optional[List[str]]` List of permissions included in the policy. - `status: str` Current status of the integration. - `updated: datetime` Last entity was updated. - `upgradable: bool` Whether the integrations permissions can be updated. - `vendor: IntegrationVendor` Information about a vendor/service provider. - `id: str` The id of the vendor. - `description: Optional[str]` Detailed information about what kinds of issues are detected for this vendor. - `display_name: str` The display name of the vendor. - `logo: str` Logo URL for the vendor. - `name: str` The name of the vendor. - `static_logo: str` Static logo URL for the vendor. - `zt_enrollments: List[str]` The vendor's compatible Zero Trust products. - `policies: Optional[List[Dict[str, object]]]` The policies related to the vendor. - `zt_enrollments: List[IntegrationZtEnrollment]` Zero Trust products associated with this integration. - `id: Optional[str]` The internal identifier of the Zero Trust Product. - `description: Optional[str]` Brief description of the Zero Trust Product. - `display_name: Optional[str]` The verbose name of the Zero Trust Product. - `enabled: Optional[bool]` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id: Optional[str]` Integration ID. - `credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry: Optional[datetime]` The date and time when the integration credentials will expire. - `is_paused: Optional[bool]` Whether the given integration is paused by the user. - `upgrade_dismissed: Optional[bool]` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: datetime` Timestamp of the latest affliction date of an active finding. - `severity_override: Optional[SeverityOverride]` Override information for finding severity. - `created_by: str` User ID who created the override. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) finding = client.zero_trust.casb.posture.findings.get( finding_id="U3RhaW5sZXNzIHJvY2tz", account_id="46148281d8a93d002ef242d8b0d5f9f6", ) print(finding.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } } ``` ## Create new findings export request `zero_trust.casb.posture.findings.export(FindingExportParams**kwargs) -> FindingExportResponse` **post** `/accounts/{account_id}/data-security/posture/findings/export` Creates a CSV export for findings and accepts optional filters in the payload. ### Parameters - `account_id: str` - `ignored: Optional[bool]` Filter for only the ignored findings. Set to false to only see active items. - `integration_id: Optional[Sequence[str]]` Filter by multiple integration IDs. - `max_affliction_date: Optional[Union[str, datetime]]` Filter to view findings that occurred on or before the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `min_affliction_date: Optional[Union[str, datetime]]` Filter to view findings that occurred on or after the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `orders: Optional[Iterable[Order]]` Which fields to use when ordering the findings. - `direction: Literal["asc", "desc"]` Sort direction. - `"asc"` - `"desc"` - `name: Literal["instance_count", "finding.name", "integration.name", 2 more]` Which field to use when ordering the findings. - `"instance_count"` - `"finding.name"` - `"integration.name"` - `"latest_affliction_date"` - `"severity"` - `product: Optional[Literal["SaaS", "Cloud"]]` Filter by finding's category product. - `"SaaS"` - `"Cloud"` - `search: Optional[str]` A search term. - `severities: Optional[List[Literal["CRITICAL", "HIGH", "MEDIUM", "LOW"]]]` Filter by severity levels. - `"CRITICAL"` - `"HIGH"` - `"MEDIUM"` - `"LOW"` - `vendors: Optional[List[Literal["ANTHROPIC", "AWS", "BITBUCKET", 13 more]]]` Filter by vendor types. - `"ANTHROPIC"` - `"AWS"` - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_CLOUD_PLATFORM"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT"` - `"MICROSOFT_INTERNAL"` - `"OPENAI"` - `"SALESFORCE"` - `"SERVICENOW"` - `"SLACK"` ### Returns - `class FindingExportResponse: …` Information about an export job. - `id: str` Unique identifier for the export job. - `status: Literal["Pending", "Success", "Failure", 2 more]` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: Literal["finding", "findingInstance", "content", "remediationJob"]` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: str` ID of the export-requesting user. - `download_url: Optional[str]` The URL by which the successfully created export can be downloaded by the end users. - `errors: Optional[str]` Contains information on errors which may have occurred during export creation. - `file_name: Optional[str]` The base name of the file that is/was generated by the export job. - `file_path: Optional[str]` The full path of the file that is stored within external storage (currently R2). ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.zero_trust.casb.posture.findings.export( account_id="46148281d8a93d002ef242d8b0d5f9f6", ) print(response.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } } ``` ## Mark a finding as ignored `zero_trust.casb.posture.findings.ignore(FindingIgnoreParams**kwargs) -> FindingIgnoreResponse` **post** `/accounts/{account_id}/data-security/posture/findings/ignore` Given a list of findings, mark as ignored. Does nothing if Finding is already ignored. ### Parameters - `account_id: str` - `checks: Sequence[str]` A list of finding IDs to pass along. ### Returns - `class FindingIgnoreResponse: …` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: str` Base64 encoded identifier of the security finding. - `active_count: int` Number of active problematic instances identified in the security finding. - `archived_count: int` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: FindingCategory` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description: Optional[str]` Detailed description of the finding. - `remediation: Optional[FindingRemediation]` Remediation guide information for a finding. - `id: str` Remediation Id. - `frameworks: List[str]` Relevant Compliance Frameworks. - `guide: str` Remediation guide text. - `impact: str` Description of the potential impact. - `locale: str` I18N Locale. - `threat: str` Description of the threat. - `ignored: bool` Determines if finding is currently ignored. - `instance_count: int` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: datetime` When entity was created. - `last_hydrated: datetime` When were the integration credentials last updated. - `name: str` Name of the integration. - `permissions: List[str]` The vendor-specific permissions associated with the integration. - `policy: IntegrationPolicy` Policy configuration for an integration. - `id: Optional[str]` Policy identifier. - `client_id: Optional[str]` OAuth client ID for the policy. - `compliance_level: Optional[str]` Compliance level for the policy. - `dlp_enabled: Optional[bool]` Whether DLP is enabled for this policy. - `link: Optional[str]` Link to policy documentation. - `name: Optional[str]` Policy name. - `permissions: Optional[List[str]]` List of permissions included in the policy. - `status: str` Current status of the integration. - `updated: datetime` Last entity was updated. - `upgradable: bool` Whether the integrations permissions can be updated. - `vendor: IntegrationVendor` Information about a vendor/service provider. - `id: str` The id of the vendor. - `description: Optional[str]` Detailed information about what kinds of issues are detected for this vendor. - `display_name: str` The display name of the vendor. - `logo: str` Logo URL for the vendor. - `name: str` The name of the vendor. - `static_logo: str` Static logo URL for the vendor. - `zt_enrollments: List[str]` The vendor's compatible Zero Trust products. - `policies: Optional[List[Dict[str, object]]]` The policies related to the vendor. - `zt_enrollments: List[IntegrationZtEnrollment]` Zero Trust products associated with this integration. - `id: Optional[str]` The internal identifier of the Zero Trust Product. - `description: Optional[str]` Brief description of the Zero Trust Product. - `display_name: Optional[str]` The verbose name of the Zero Trust Product. - `enabled: Optional[bool]` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id: Optional[str]` Integration ID. - `credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry: Optional[datetime]` The date and time when the integration credentials will expire. - `is_paused: Optional[bool]` Whether the given integration is paused by the user. - `upgrade_dismissed: Optional[bool]` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: datetime` Timestamp of the latest affliction date of an active finding. - `severity_override: Optional[SeverityOverride]` Override information for finding severity. - `created_by: str` User ID who created the override. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.zero_trust.casb.posture.findings.ignore( account_id="46148281d8a93d002ef242d8b0d5f9f6", checks=["MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo="], ) print(response.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } } ``` ## Remove ignore marker from a finding `zero_trust.casb.posture.findings.unignore(FindingUnignoreParams**kwargs) -> FindingUnignoreResponse` **post** `/accounts/{account_id}/data-security/posture/findings/unignore` Ability to un-ignore a Finding if it's previously been ignored. Does nothing if the Finding is not ignored. ### Parameters - `account_id: str` - `checks: Sequence[str]` A list of finding IDs to pass along. ### Returns - `class FindingUnignoreResponse: …` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: str` Base64 encoded identifier of the security finding. - `active_count: int` Number of active problematic instances identified in the security finding. - `archived_count: int` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: FindingCategory` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description: Optional[str]` Detailed description of the finding. - `remediation: Optional[FindingRemediation]` Remediation guide information for a finding. - `id: str` Remediation Id. - `frameworks: List[str]` Relevant Compliance Frameworks. - `guide: str` Remediation guide text. - `impact: str` Description of the potential impact. - `locale: str` I18N Locale. - `threat: str` Description of the threat. - `ignored: bool` Determines if finding is currently ignored. - `instance_count: int` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: datetime` When entity was created. - `last_hydrated: datetime` When were the integration credentials last updated. - `name: str` Name of the integration. - `permissions: List[str]` The vendor-specific permissions associated with the integration. - `policy: IntegrationPolicy` Policy configuration for an integration. - `id: Optional[str]` Policy identifier. - `client_id: Optional[str]` OAuth client ID for the policy. - `compliance_level: Optional[str]` Compliance level for the policy. - `dlp_enabled: Optional[bool]` Whether DLP is enabled for this policy. - `link: Optional[str]` Link to policy documentation. - `name: Optional[str]` Policy name. - `permissions: Optional[List[str]]` List of permissions included in the policy. - `status: str` Current status of the integration. - `updated: datetime` Last entity was updated. - `upgradable: bool` Whether the integrations permissions can be updated. - `vendor: IntegrationVendor` Information about a vendor/service provider. - `id: str` The id of the vendor. - `description: Optional[str]` Detailed information about what kinds of issues are detected for this vendor. - `display_name: str` The display name of the vendor. - `logo: str` Logo URL for the vendor. - `name: str` The name of the vendor. - `static_logo: str` Static logo URL for the vendor. - `zt_enrollments: List[str]` The vendor's compatible Zero Trust products. - `policies: Optional[List[Dict[str, object]]]` The policies related to the vendor. - `zt_enrollments: List[IntegrationZtEnrollment]` Zero Trust products associated with this integration. - `id: Optional[str]` The internal identifier of the Zero Trust Product. - `description: Optional[str]` Brief description of the Zero Trust Product. - `display_name: Optional[str]` The verbose name of the Zero Trust Product. - `enabled: Optional[bool]` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id: Optional[str]` Integration ID. - `credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry: Optional[datetime]` The date and time when the integration credentials will expire. - `is_paused: Optional[bool]` Whether the given integration is paused by the user. - `upgrade_dismissed: Optional[bool]` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: datetime` Timestamp of the latest affliction date of an active finding. - `severity_override: Optional[SeverityOverride]` Override information for finding severity. - `created_by: str` User ID who created the override. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.zero_trust.casb.posture.findings.unignore( account_id="46148281d8a93d002ef242d8b0d5f9f6", checks=["MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo="], ) print(response.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } } ``` ## Update the severity for a finding `zero_trust.casb.posture.findings.tune_severity(strfinding_id, FindingTuneSeverityParams**kwargs) -> FindingTuneSeverityResponse` **post** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/tune_finding_severity` Update the severity of a Finding. This will update the `severity_override` field on the Finding payload with the new severity value. ### Parameters - `account_id: str` - `finding_id: Union[str, Base64FileInput]` - `new_severity: Literal[1, 2, 3, 4]` The numeric severity value to apply to the finding. - `1` - `2` - `3` - `4` ### Returns - `class FindingTuneSeverityResponse: …` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: str` Base64 encoded identifier of the security finding. - `active_count: int` Number of active problematic instances identified in the security finding. - `archived_count: int` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: FindingCategory` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description: Optional[str]` Detailed description of the finding. - `remediation: Optional[FindingRemediation]` Remediation guide information for a finding. - `id: str` Remediation Id. - `frameworks: List[str]` Relevant Compliance Frameworks. - `guide: str` Remediation guide text. - `impact: str` Description of the potential impact. - `locale: str` I18N Locale. - `threat: str` Description of the threat. - `ignored: bool` Determines if finding is currently ignored. - `instance_count: int` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: datetime` When entity was created. - `last_hydrated: datetime` When were the integration credentials last updated. - `name: str` Name of the integration. - `permissions: List[str]` The vendor-specific permissions associated with the integration. - `policy: IntegrationPolicy` Policy configuration for an integration. - `id: Optional[str]` Policy identifier. - `client_id: Optional[str]` OAuth client ID for the policy. - `compliance_level: Optional[str]` Compliance level for the policy. - `dlp_enabled: Optional[bool]` Whether DLP is enabled for this policy. - `link: Optional[str]` Link to policy documentation. - `name: Optional[str]` Policy name. - `permissions: Optional[List[str]]` List of permissions included in the policy. - `status: str` Current status of the integration. - `updated: datetime` Last entity was updated. - `upgradable: bool` Whether the integrations permissions can be updated. - `vendor: IntegrationVendor` Information about a vendor/service provider. - `id: str` The id of the vendor. - `description: Optional[str]` Detailed information about what kinds of issues are detected for this vendor. - `display_name: str` The display name of the vendor. - `logo: str` Logo URL for the vendor. - `name: str` The name of the vendor. - `static_logo: str` Static logo URL for the vendor. - `zt_enrollments: List[str]` The vendor's compatible Zero Trust products. - `policies: Optional[List[Dict[str, object]]]` The policies related to the vendor. - `zt_enrollments: List[IntegrationZtEnrollment]` Zero Trust products associated with this integration. - `id: Optional[str]` The internal identifier of the Zero Trust Product. - `description: Optional[str]` Brief description of the Zero Trust Product. - `display_name: Optional[str]` The verbose name of the Zero Trust Product. - `enabled: Optional[bool]` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id: Optional[str]` Integration ID. - `credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry: Optional[datetime]` The date and time when the integration credentials will expire. - `is_paused: Optional[bool]` Whether the given integration is paused by the user. - `upgrade_dismissed: Optional[bool]` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: datetime` Timestamp of the latest affliction date of an active finding. - `severity_override: Optional[SeverityOverride]` Override information for finding severity. - `created_by: str` User ID who created the override. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.zero_trust.casb.posture.findings.tune_severity( finding_id="U3RhaW5sZXNzIHJvY2tz", account_id="46148281d8a93d002ef242d8b0d5f9f6", new_severity=1, ) print(response.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } } ``` ## Reset severity for a finding back to the default `zero_trust.casb.posture.findings.reset_severity(strfinding_id, FindingResetSeverityParams**kwargs) -> FindingResetSeverityResponse` **post** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/reset_finding_severity` If a Finding's severity has been changed, reset it back to default value. Does nothing if no override exists. ### Parameters - `account_id: str` - `finding_id: Union[str, Base64FileInput]` ### Returns - `class FindingResetSeverityResponse: …` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: str` Base64 encoded identifier of the security finding. - `active_count: int` Number of active problematic instances identified in the security finding. - `archived_count: int` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: FindingCategory` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description: Optional[str]` Detailed description of the finding. - `remediation: Optional[FindingRemediation]` Remediation guide information for a finding. - `id: str` Remediation Id. - `frameworks: List[str]` Relevant Compliance Frameworks. - `guide: str` Remediation guide text. - `impact: str` Description of the potential impact. - `locale: str` I18N Locale. - `threat: str` Description of the threat. - `ignored: bool` Determines if finding is currently ignored. - `instance_count: int` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: datetime` When entity was created. - `last_hydrated: datetime` When were the integration credentials last updated. - `name: str` Name of the integration. - `permissions: List[str]` The vendor-specific permissions associated with the integration. - `policy: IntegrationPolicy` Policy configuration for an integration. - `id: Optional[str]` Policy identifier. - `client_id: Optional[str]` OAuth client ID for the policy. - `compliance_level: Optional[str]` Compliance level for the policy. - `dlp_enabled: Optional[bool]` Whether DLP is enabled for this policy. - `link: Optional[str]` Link to policy documentation. - `name: Optional[str]` Policy name. - `permissions: Optional[List[str]]` List of permissions included in the policy. - `status: str` Current status of the integration. - `updated: datetime` Last entity was updated. - `upgradable: bool` Whether the integrations permissions can be updated. - `vendor: IntegrationVendor` Information about a vendor/service provider. - `id: str` The id of the vendor. - `description: Optional[str]` Detailed information about what kinds of issues are detected for this vendor. - `display_name: str` The display name of the vendor. - `logo: str` Logo URL for the vendor. - `name: str` The name of the vendor. - `static_logo: str` Static logo URL for the vendor. - `zt_enrollments: List[str]` The vendor's compatible Zero Trust products. - `policies: Optional[List[Dict[str, object]]]` The policies related to the vendor. - `zt_enrollments: List[IntegrationZtEnrollment]` Zero Trust products associated with this integration. - `id: Optional[str]` The internal identifier of the Zero Trust Product. - `description: Optional[str]` Brief description of the Zero Trust Product. - `display_name: Optional[str]` The verbose name of the Zero Trust Product. - `enabled: Optional[bool]` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id: Optional[str]` Integration ID. - `credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry: Optional[datetime]` The date and time when the integration credentials will expire. - `is_paused: Optional[bool]` Whether the given integration is paused by the user. - `upgrade_dismissed: Optional[bool]` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: datetime` Timestamp of the latest affliction date of an active finding. - `severity_override: Optional[SeverityOverride]` Override information for finding severity. - `created_by: str` User ID who created the override. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.zero_trust.casb.posture.findings.reset_severity( finding_id="U3RhaW5sZXNzIHJvY2tz", account_id="46148281d8a93d002ef242d8b0d5f9f6", ) print(response.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } } ``` ## Domain Types ### Finding List Response - `class FindingListResponse: …` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: str` Base64 encoded identifier of the security finding. - `active_count: int` Number of active problematic instances identified in the security finding. - `archived_count: int` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: FindingCategory` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description: Optional[str]` Detailed description of the finding. - `remediation: Optional[FindingRemediation]` Remediation guide information for a finding. - `id: str` Remediation Id. - `frameworks: List[str]` Relevant Compliance Frameworks. - `guide: str` Remediation guide text. - `impact: str` Description of the potential impact. - `locale: str` I18N Locale. - `threat: str` Description of the threat. - `ignored: bool` Determines if finding is currently ignored. - `instance_count: int` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: datetime` When entity was created. - `last_hydrated: datetime` When were the integration credentials last updated. - `name: str` Name of the integration. - `permissions: List[str]` The vendor-specific permissions associated with the integration. - `policy: IntegrationPolicy` Policy configuration for an integration. - `id: Optional[str]` Policy identifier. - `client_id: Optional[str]` OAuth client ID for the policy. - `compliance_level: Optional[str]` Compliance level for the policy. - `dlp_enabled: Optional[bool]` Whether DLP is enabled for this policy. - `link: Optional[str]` Link to policy documentation. - `name: Optional[str]` Policy name. - `permissions: Optional[List[str]]` List of permissions included in the policy. - `status: str` Current status of the integration. - `updated: datetime` Last entity was updated. - `upgradable: bool` Whether the integrations permissions can be updated. - `vendor: IntegrationVendor` Information about a vendor/service provider. - `id: str` The id of the vendor. - `description: Optional[str]` Detailed information about what kinds of issues are detected for this vendor. - `display_name: str` The display name of the vendor. - `logo: str` Logo URL for the vendor. - `name: str` The name of the vendor. - `static_logo: str` Static logo URL for the vendor. - `zt_enrollments: List[str]` The vendor's compatible Zero Trust products. - `policies: Optional[List[Dict[str, object]]]` The policies related to the vendor. - `zt_enrollments: List[IntegrationZtEnrollment]` Zero Trust products associated with this integration. - `id: Optional[str]` The internal identifier of the Zero Trust Product. - `description: Optional[str]` Brief description of the Zero Trust Product. - `display_name: Optional[str]` The verbose name of the Zero Trust Product. - `enabled: Optional[bool]` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id: Optional[str]` Integration ID. - `credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry: Optional[datetime]` The date and time when the integration credentials will expire. - `is_paused: Optional[bool]` Whether the given integration is paused by the user. - `upgrade_dismissed: Optional[bool]` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: datetime` Timestamp of the latest affliction date of an active finding. - `severity_override: Optional[SeverityOverride]` Override information for finding severity. - `created_by: str` User ID who created the override. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Finding Get Response - `class FindingGetResponse: …` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: str` Base64 encoded identifier of the security finding. - `active_count: int` Number of active problematic instances identified in the security finding. - `archived_count: int` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: FindingCategory` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description: Optional[str]` Detailed description of the finding. - `remediation: Optional[FindingRemediation]` Remediation guide information for a finding. - `id: str` Remediation Id. - `frameworks: List[str]` Relevant Compliance Frameworks. - `guide: str` Remediation guide text. - `impact: str` Description of the potential impact. - `locale: str` I18N Locale. - `threat: str` Description of the threat. - `ignored: bool` Determines if finding is currently ignored. - `instance_count: int` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: datetime` When entity was created. - `last_hydrated: datetime` When were the integration credentials last updated. - `name: str` Name of the integration. - `permissions: List[str]` The vendor-specific permissions associated with the integration. - `policy: IntegrationPolicy` Policy configuration for an integration. - `id: Optional[str]` Policy identifier. - `client_id: Optional[str]` OAuth client ID for the policy. - `compliance_level: Optional[str]` Compliance level for the policy. - `dlp_enabled: Optional[bool]` Whether DLP is enabled for this policy. - `link: Optional[str]` Link to policy documentation. - `name: Optional[str]` Policy name. - `permissions: Optional[List[str]]` List of permissions included in the policy. - `status: str` Current status of the integration. - `updated: datetime` Last entity was updated. - `upgradable: bool` Whether the integrations permissions can be updated. - `vendor: IntegrationVendor` Information about a vendor/service provider. - `id: str` The id of the vendor. - `description: Optional[str]` Detailed information about what kinds of issues are detected for this vendor. - `display_name: str` The display name of the vendor. - `logo: str` Logo URL for the vendor. - `name: str` The name of the vendor. - `static_logo: str` Static logo URL for the vendor. - `zt_enrollments: List[str]` The vendor's compatible Zero Trust products. - `policies: Optional[List[Dict[str, object]]]` The policies related to the vendor. - `zt_enrollments: List[IntegrationZtEnrollment]` Zero Trust products associated with this integration. - `id: Optional[str]` The internal identifier of the Zero Trust Product. - `description: Optional[str]` Brief description of the Zero Trust Product. - `display_name: Optional[str]` The verbose name of the Zero Trust Product. - `enabled: Optional[bool]` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id: Optional[str]` Integration ID. - `credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry: Optional[datetime]` The date and time when the integration credentials will expire. - `is_paused: Optional[bool]` Whether the given integration is paused by the user. - `upgrade_dismissed: Optional[bool]` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: datetime` Timestamp of the latest affliction date of an active finding. - `severity_override: Optional[SeverityOverride]` Override information for finding severity. - `created_by: str` User ID who created the override. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Finding Export Response - `class FindingExportResponse: …` Information about an export job. - `id: str` Unique identifier for the export job. - `status: Literal["Pending", "Success", "Failure", 2 more]` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: Literal["finding", "findingInstance", "content", "remediationJob"]` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: str` ID of the export-requesting user. - `download_url: Optional[str]` The URL by which the successfully created export can be downloaded by the end users. - `errors: Optional[str]` Contains information on errors which may have occurred during export creation. - `file_name: Optional[str]` The base name of the file that is/was generated by the export job. - `file_path: Optional[str]` The full path of the file that is stored within external storage (currently R2). ### Finding Ignore Response - `class FindingIgnoreResponse: …` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: str` Base64 encoded identifier of the security finding. - `active_count: int` Number of active problematic instances identified in the security finding. - `archived_count: int` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: FindingCategory` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description: Optional[str]` Detailed description of the finding. - `remediation: Optional[FindingRemediation]` Remediation guide information for a finding. - `id: str` Remediation Id. - `frameworks: List[str]` Relevant Compliance Frameworks. - `guide: str` Remediation guide text. - `impact: str` Description of the potential impact. - `locale: str` I18N Locale. - `threat: str` Description of the threat. - `ignored: bool` Determines if finding is currently ignored. - `instance_count: int` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: datetime` When entity was created. - `last_hydrated: datetime` When were the integration credentials last updated. - `name: str` Name of the integration. - `permissions: List[str]` The vendor-specific permissions associated with the integration. - `policy: IntegrationPolicy` Policy configuration for an integration. - `id: Optional[str]` Policy identifier. - `client_id: Optional[str]` OAuth client ID for the policy. - `compliance_level: Optional[str]` Compliance level for the policy. - `dlp_enabled: Optional[bool]` Whether DLP is enabled for this policy. - `link: Optional[str]` Link to policy documentation. - `name: Optional[str]` Policy name. - `permissions: Optional[List[str]]` List of permissions included in the policy. - `status: str` Current status of the integration. - `updated: datetime` Last entity was updated. - `upgradable: bool` Whether the integrations permissions can be updated. - `vendor: IntegrationVendor` Information about a vendor/service provider. - `id: str` The id of the vendor. - `description: Optional[str]` Detailed information about what kinds of issues are detected for this vendor. - `display_name: str` The display name of the vendor. - `logo: str` Logo URL for the vendor. - `name: str` The name of the vendor. - `static_logo: str` Static logo URL for the vendor. - `zt_enrollments: List[str]` The vendor's compatible Zero Trust products. - `policies: Optional[List[Dict[str, object]]]` The policies related to the vendor. - `zt_enrollments: List[IntegrationZtEnrollment]` Zero Trust products associated with this integration. - `id: Optional[str]` The internal identifier of the Zero Trust Product. - `description: Optional[str]` Brief description of the Zero Trust Product. - `display_name: Optional[str]` The verbose name of the Zero Trust Product. - `enabled: Optional[bool]` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id: Optional[str]` Integration ID. - `credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry: Optional[datetime]` The date and time when the integration credentials will expire. - `is_paused: Optional[bool]` Whether the given integration is paused by the user. - `upgrade_dismissed: Optional[bool]` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: datetime` Timestamp of the latest affliction date of an active finding. - `severity_override: Optional[SeverityOverride]` Override information for finding severity. - `created_by: str` User ID who created the override. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Finding Unignore Response - `class FindingUnignoreResponse: …` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: str` Base64 encoded identifier of the security finding. - `active_count: int` Number of active problematic instances identified in the security finding. - `archived_count: int` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: FindingCategory` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description: Optional[str]` Detailed description of the finding. - `remediation: Optional[FindingRemediation]` Remediation guide information for a finding. - `id: str` Remediation Id. - `frameworks: List[str]` Relevant Compliance Frameworks. - `guide: str` Remediation guide text. - `impact: str` Description of the potential impact. - `locale: str` I18N Locale. - `threat: str` Description of the threat. - `ignored: bool` Determines if finding is currently ignored. - `instance_count: int` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: datetime` When entity was created. - `last_hydrated: datetime` When were the integration credentials last updated. - `name: str` Name of the integration. - `permissions: List[str]` The vendor-specific permissions associated with the integration. - `policy: IntegrationPolicy` Policy configuration for an integration. - `id: Optional[str]` Policy identifier. - `client_id: Optional[str]` OAuth client ID for the policy. - `compliance_level: Optional[str]` Compliance level for the policy. - `dlp_enabled: Optional[bool]` Whether DLP is enabled for this policy. - `link: Optional[str]` Link to policy documentation. - `name: Optional[str]` Policy name. - `permissions: Optional[List[str]]` List of permissions included in the policy. - `status: str` Current status of the integration. - `updated: datetime` Last entity was updated. - `upgradable: bool` Whether the integrations permissions can be updated. - `vendor: IntegrationVendor` Information about a vendor/service provider. - `id: str` The id of the vendor. - `description: Optional[str]` Detailed information about what kinds of issues are detected for this vendor. - `display_name: str` The display name of the vendor. - `logo: str` Logo URL for the vendor. - `name: str` The name of the vendor. - `static_logo: str` Static logo URL for the vendor. - `zt_enrollments: List[str]` The vendor's compatible Zero Trust products. - `policies: Optional[List[Dict[str, object]]]` The policies related to the vendor. - `zt_enrollments: List[IntegrationZtEnrollment]` Zero Trust products associated with this integration. - `id: Optional[str]` The internal identifier of the Zero Trust Product. - `description: Optional[str]` Brief description of the Zero Trust Product. - `display_name: Optional[str]` The verbose name of the Zero Trust Product. - `enabled: Optional[bool]` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id: Optional[str]` Integration ID. - `credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry: Optional[datetime]` The date and time when the integration credentials will expire. - `is_paused: Optional[bool]` Whether the given integration is paused by the user. - `upgrade_dismissed: Optional[bool]` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: datetime` Timestamp of the latest affliction date of an active finding. - `severity_override: Optional[SeverityOverride]` Override information for finding severity. - `created_by: str` User ID who created the override. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Finding Tune Severity Response - `class FindingTuneSeverityResponse: …` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: str` Base64 encoded identifier of the security finding. - `active_count: int` Number of active problematic instances identified in the security finding. - `archived_count: int` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: FindingCategory` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description: Optional[str]` Detailed description of the finding. - `remediation: Optional[FindingRemediation]` Remediation guide information for a finding. - `id: str` Remediation Id. - `frameworks: List[str]` Relevant Compliance Frameworks. - `guide: str` Remediation guide text. - `impact: str` Description of the potential impact. - `locale: str` I18N Locale. - `threat: str` Description of the threat. - `ignored: bool` Determines if finding is currently ignored. - `instance_count: int` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: datetime` When entity was created. - `last_hydrated: datetime` When were the integration credentials last updated. - `name: str` Name of the integration. - `permissions: List[str]` The vendor-specific permissions associated with the integration. - `policy: IntegrationPolicy` Policy configuration for an integration. - `id: Optional[str]` Policy identifier. - `client_id: Optional[str]` OAuth client ID for the policy. - `compliance_level: Optional[str]` Compliance level for the policy. - `dlp_enabled: Optional[bool]` Whether DLP is enabled for this policy. - `link: Optional[str]` Link to policy documentation. - `name: Optional[str]` Policy name. - `permissions: Optional[List[str]]` List of permissions included in the policy. - `status: str` Current status of the integration. - `updated: datetime` Last entity was updated. - `upgradable: bool` Whether the integrations permissions can be updated. - `vendor: IntegrationVendor` Information about a vendor/service provider. - `id: str` The id of the vendor. - `description: Optional[str]` Detailed information about what kinds of issues are detected for this vendor. - `display_name: str` The display name of the vendor. - `logo: str` Logo URL for the vendor. - `name: str` The name of the vendor. - `static_logo: str` Static logo URL for the vendor. - `zt_enrollments: List[str]` The vendor's compatible Zero Trust products. - `policies: Optional[List[Dict[str, object]]]` The policies related to the vendor. - `zt_enrollments: List[IntegrationZtEnrollment]` Zero Trust products associated with this integration. - `id: Optional[str]` The internal identifier of the Zero Trust Product. - `description: Optional[str]` Brief description of the Zero Trust Product. - `display_name: Optional[str]` The verbose name of the Zero Trust Product. - `enabled: Optional[bool]` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id: Optional[str]` Integration ID. - `credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry: Optional[datetime]` The date and time when the integration credentials will expire. - `is_paused: Optional[bool]` Whether the given integration is paused by the user. - `upgrade_dismissed: Optional[bool]` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: datetime` Timestamp of the latest affliction date of an active finding. - `severity_override: Optional[SeverityOverride]` Override information for finding severity. - `created_by: str` User ID who created the override. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Finding Reset Severity Response - `class FindingResetSeverityResponse: …` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: str` Base64 encoded identifier of the security finding. - `active_count: int` Number of active problematic instances identified in the security finding. - `archived_count: int` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: FindingCategory` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description: Optional[str]` Detailed description of the finding. - `remediation: Optional[FindingRemediation]` Remediation guide information for a finding. - `id: str` Remediation Id. - `frameworks: List[str]` Relevant Compliance Frameworks. - `guide: str` Remediation guide text. - `impact: str` Description of the potential impact. - `locale: str` I18N Locale. - `threat: str` Description of the threat. - `ignored: bool` Determines if finding is currently ignored. - `instance_count: int` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: datetime` When entity was created. - `last_hydrated: datetime` When were the integration credentials last updated. - `name: str` Name of the integration. - `permissions: List[str]` The vendor-specific permissions associated with the integration. - `policy: IntegrationPolicy` Policy configuration for an integration. - `id: Optional[str]` Policy identifier. - `client_id: Optional[str]` OAuth client ID for the policy. - `compliance_level: Optional[str]` Compliance level for the policy. - `dlp_enabled: Optional[bool]` Whether DLP is enabled for this policy. - `link: Optional[str]` Link to policy documentation. - `name: Optional[str]` Policy name. - `permissions: Optional[List[str]]` List of permissions included in the policy. - `status: str` Current status of the integration. - `updated: datetime` Last entity was updated. - `upgradable: bool` Whether the integrations permissions can be updated. - `vendor: IntegrationVendor` Information about a vendor/service provider. - `id: str` The id of the vendor. - `description: Optional[str]` Detailed information about what kinds of issues are detected for this vendor. - `display_name: str` The display name of the vendor. - `logo: str` Logo URL for the vendor. - `name: str` The name of the vendor. - `static_logo: str` Static logo URL for the vendor. - `zt_enrollments: List[str]` The vendor's compatible Zero Trust products. - `policies: Optional[List[Dict[str, object]]]` The policies related to the vendor. - `zt_enrollments: List[IntegrationZtEnrollment]` Zero Trust products associated with this integration. - `id: Optional[str]` The internal identifier of the Zero Trust Product. - `description: Optional[str]` Brief description of the Zero Trust Product. - `display_name: Optional[str]` The verbose name of the Zero Trust Product. - `enabled: Optional[bool]` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id: Optional[str]` Integration ID. - `credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry: Optional[datetime]` The date and time when the integration credentials will expire. - `is_paused: Optional[bool]` Whether the given integration is paused by the user. - `upgrade_dismissed: Optional[bool]` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: datetime` Timestamp of the latest affliction date of an active finding. - `severity_override: Optional[SeverityOverride]` Override information for finding severity. - `created_by: str` User ID who created the override. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` # Instances ## List instances of a finding `zero_trust.casb.posture.findings.instances.list(strfinding_id, InstanceListParams**kwargs) -> SyncV4PagePaginationArray[InstanceListResponse]` **get** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances` Lists all security finding instances for a given security finding. ### Parameters - `account_id: str` - `finding_id: Union[str, Base64FileInput]` - `archived: Optional[bool]` Archived - `asset_ids: Optional[Sequence[str]]` Filter finding instances by an array of asset IDs. Supports multiple comma-separated values. - `cursor: Optional[str]` A cursor for pagination. Obtained from the `result_info.cursor` field of a previous response. - `direction: Optional[Literal["asc", "desc"]]` Direction to order results. - `"asc"` - `"desc"` - `finding_instance_ids: Optional[Sequence[str]]` Filter finding instances by an array of finding instance IDs. Supports multiple comma-separated values. - `max_affliction_date: Optional[Union[str, datetime]]` Filter to view findings that occurred on or before the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `min_affliction_date: Optional[Union[str, datetime]]` Filter to view findings that occurred on or after the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `order: Optional[Literal["affliction_date", "asset.name", "remediation.status"]]` Which field to use when ordering the Finding's instances. When ordering by 'remediation.status', only the most recent non-stale remediation job is considered. Stale jobs (created before the instance's affliction_date) are treated as having no status for ordering purposes. - `"affliction_date"` - `"asset.name"` - `"remediation.status"` - `page: Optional[int]` A page number within the paginated result set. - `per_page: Optional[int]` Number of results to return per page. - `remediation_statuses: Optional[List[Literal["none", "pending", "processing", 3 more]]]` Filter finding instances by most recent remediation job status. Supports multiple comma-separated values. Use 'none' to filter instances with no remediation jobs or instances where the most recent job is stale. Note: Stale jobs (created before the instance's affliction_date) are ignored for filtering purposes, but are still included in the 'remediations' array with stale=true. - `"none"` - `"pending"` - `"processing"` - `"validating"` - `"completed"` - `"failed"` - `search: Optional[str]` A search term. ### Returns - `class InstanceListResponse: …` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: datetime` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: AssetCategory` Category information for an asset. - `service: Optional[str]` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: str` The type of asset. - `vendor: str` The vendor the asset is part of. - `id: Optional[str]` Unique identifier for the asset category. - `external_id: str` External identifier from the source system. - `fields: List[AssetField]` The fields associated with the asset. - `name: str` The name of the field. - `value: str` The value of the field. - `link: Optional[str]` Optional link associated with the field. - `name: str` Human-readable name of the asset. - `id: Optional[str]` Unique identifier for the asset. - `link: Optional[str]` Direct link to the asset. - `dlp_contexts: List[DLPContext]` DLP context information if this is a content finding. - `created: datetime` When the DLP context was created. - `entry_ids: List[str]` DLP Entry IDs. - `profile_id: str` DLP Profile ID. - `updated: datetime` When the DLP context was last updated. - `id: Optional[str]` Unique identifier for the DLP context. - `deleted: Optional[datetime]` When the DLP context was deleted. - `match_context_max_extent: Optional[int]` DLP Right Boundary of match context. - `match_context_min_extent: Optional[int]` DLP Left Boundary of match context. - `match_context_payload: Optional[Dict[str, object]]` DLP Match context payload that matched the profile in question. - `remediations: List[Remediation]` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: str` Unique identifier for the remediation job. - `created_at: datetime` When the remediation job was created. - `stale: bool` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: Literal["pending", "processing", "completed", 2 more]` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: List[Webhook]` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: WebhookLatestJob` The most recent webhook job for this webhook configuration. - `id: str` Unique identifier for the webhook job. - `created_at: datetime` When the webhook job was created. - `stale: bool` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: Literal["pending", "processing", "completed"]` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: str` Unique identifier for the webhook configuration. - `webhook_label: str` Account-specified display label for the webhook configuration. - `id: Optional[str]` Unique identifier for the finding instance. - `is_archived: Optional[bool]` Whether this finding instance has been archived. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.zero_trust.casb.posture.findings.instances.list( finding_id="U3RhaW5sZXNzIHJvY2tz", account_id="46148281d8a93d002ef242d8b0d5f9f6", ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "affliction_date": "2025-03-18T17:25:38.700541Z", "asset": { "category": { "service": null, "type": "file", "vendor": "Slack", "id": "1a78cbf3-b98f-4289-b1f2-22db64130f4f" }, "external_id": "external-file-id-123", "fields": [ { "name": "Credential name", "value": "Test asset 2", "link": "https://example.com" } ], "name": "Public.svg", "id": "8a043daf-def4-403e-9d28-da2e93d9b824", "link": "https://slack-files.com/TYJH37DCK-E0238GG6B8-92fd5y5674" }, "dlp_contexts": [ { "created": "2025-03-18T17:25:38.695977Z", "entry_ids": [ "21befc68-a297-4090-ac10-17a051b901cd", "d6dd1e16-f78c-401a-b564-45c4e44aa467" ], "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e", "updated": "2025-03-18T17:25:38.695977Z", "id": "7653ff3a-d25e-4c10-8034-3460937c045b", "deleted": "2025-03-18T17:25:38.695977Z", "match_context_max_extent": 512, "match_context_min_extent": 1, "match_context_payload": {} } ], "remediations": [ { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" } ], "webhooks": [ { "latest_job": { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" }, "webhook_id": "550e8400-e29b-41d4-a716-446655440000", "webhook_label": "Send to Gmail" } ], "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "is_archived": false } ] } ``` ## Get a finding instance using an instance ID `zero_trust.casb.posture.findings.instances.get(strinstance_id, InstanceGetParams**kwargs) -> InstanceGetResponse` **get** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances/{instance_id}` Gets a security Finding instance by id. ### Parameters - `account_id: str` - `finding_id: Union[str, Base64FileInput]` - `instance_id: str` ### Returns - `class InstanceGetResponse: …` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: datetime` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: AssetCategory` Category information for an asset. - `service: Optional[str]` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: str` The type of asset. - `vendor: str` The vendor the asset is part of. - `id: Optional[str]` Unique identifier for the asset category. - `external_id: str` External identifier from the source system. - `fields: List[AssetField]` The fields associated with the asset. - `name: str` The name of the field. - `value: str` The value of the field. - `link: Optional[str]` Optional link associated with the field. - `name: str` Human-readable name of the asset. - `id: Optional[str]` Unique identifier for the asset. - `link: Optional[str]` Direct link to the asset. - `dlp_contexts: List[DLPContext]` DLP context information if this is a content finding. - `created: datetime` When the DLP context was created. - `entry_ids: List[str]` DLP Entry IDs. - `profile_id: str` DLP Profile ID. - `updated: datetime` When the DLP context was last updated. - `id: Optional[str]` Unique identifier for the DLP context. - `deleted: Optional[datetime]` When the DLP context was deleted. - `match_context_max_extent: Optional[int]` DLP Right Boundary of match context. - `match_context_min_extent: Optional[int]` DLP Left Boundary of match context. - `match_context_payload: Optional[Dict[str, object]]` DLP Match context payload that matched the profile in question. - `remediations: List[Remediation]` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: str` Unique identifier for the remediation job. - `created_at: datetime` When the remediation job was created. - `stale: bool` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: Literal["pending", "processing", "completed", 2 more]` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: List[Webhook]` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: WebhookLatestJob` The most recent webhook job for this webhook configuration. - `id: str` Unique identifier for the webhook job. - `created_at: datetime` When the webhook job was created. - `stale: bool` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: Literal["pending", "processing", "completed"]` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: str` Unique identifier for the webhook configuration. - `webhook_label: str` Account-specified display label for the webhook configuration. - `id: Optional[str]` Unique identifier for the finding instance. - `is_archived: Optional[bool]` Whether this finding instance has been archived. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) instance = client.zero_trust.casb.posture.findings.instances.get( instance_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="46148281d8a93d002ef242d8b0d5f9f6", finding_id="U3RhaW5sZXNzIHJvY2tz", ) print(instance.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "affliction_date": "2025-03-18T17:25:38.700541Z", "asset": { "category": { "service": null, "type": "file", "vendor": "Slack", "id": "1a78cbf3-b98f-4289-b1f2-22db64130f4f" }, "external_id": "external-file-id-123", "fields": [ { "name": "Credential name", "value": "Test asset 2", "link": "https://example.com" } ], "name": "Public.svg", "id": "8a043daf-def4-403e-9d28-da2e93d9b824", "link": "https://slack-files.com/TYJH37DCK-E0238GG6B8-92fd5y5674" }, "dlp_contexts": [ { "created": "2025-03-18T17:25:38.695977Z", "entry_ids": [ "21befc68-a297-4090-ac10-17a051b901cd", "d6dd1e16-f78c-401a-b564-45c4e44aa467" ], "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e", "updated": "2025-03-18T17:25:38.695977Z", "id": "7653ff3a-d25e-4c10-8034-3460937c045b", "deleted": "2025-03-18T17:25:38.695977Z", "match_context_max_extent": 512, "match_context_min_extent": 1, "match_context_payload": {} } ], "remediations": [ { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" } ], "webhooks": [ { "latest_job": { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" }, "webhook_id": "550e8400-e29b-41d4-a716-446655440000", "webhook_label": "Send to Gmail" } ], "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "is_archived": false } } ``` ## Create a finding instances export `zero_trust.casb.posture.findings.instances.export(strstorage_namespace_id, InstanceExportParams**kwargs) -> InstanceExportResponse` **post** `/accounts/{account_id}/data-security/posture/findings/{storage_namespace_id}/instances/export` Creates a CSV export for Finding instances and accepts optional filters in the payload. The `storage_namespace_id` path parameter is derived from the finding ID by base64-decoding it (which yields `integration_id:finding_type_id`) and replacing the colon with a hyphen. ### Parameters - `account_id: str` - `storage_namespace_id: str` - `archived: Optional[bool]` Filter for archived status. - `max_affliction_date: Optional[Union[str, datetime]]` Filter to view findings that occurred on or before the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `min_affliction_date: Optional[Union[str, datetime]]` Filter to view findings that occurred on or after the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `orders: Optional[Iterable[Order]]` Ordering specifications for the export. - `direction: Literal["asc", "desc"]` Sort direction. - `"asc"` - `"desc"` - `name: Literal["asset.name", "affliction_date"]` Which field to use when ordering the finding instances. - `"asset.name"` - `"affliction_date"` - `search: Optional[str]` A search term. ### Returns - `class InstanceExportResponse: …` Information about an export job. - `id: str` Unique identifier for the export job. - `status: Literal["Pending", "Success", "Failure", 2 more]` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: Literal["finding", "findingInstance", "content", "remediationJob"]` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: str` ID of the export-requesting user. - `download_url: Optional[str]` The URL by which the successfully created export can be downloaded by the end users. - `errors: Optional[str]` Contains information on errors which may have occurred during export creation. - `file_name: Optional[str]` The base name of the file that is/was generated by the export job. - `file_path: Optional[str]` The full path of the file that is stored within external storage (currently R2). ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.zero_trust.casb.posture.findings.instances.export( storage_namespace_id="00000000-0000-0000-0000-000000000001-00000000-0000-0000-0000-000000000002", account_id="46148281d8a93d002ef242d8b0d5f9f6", ) print(response.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } } ``` ## Archive a finding `zero_trust.casb.posture.findings.instances.archive(strfinding_id, InstanceArchiveParams**kwargs) -> InstanceArchiveResponse` **post** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances/archive` Archive one or more finding instances. ### Parameters - `account_id: str` - `finding_id: Union[str, Base64FileInput]` - `check_instances: Sequence[str]` A list of finding instance IDs to pass along. ### Returns - `class InstanceArchiveResponse: …` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: datetime` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: AssetCategory` Category information for an asset. - `service: Optional[str]` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: str` The type of asset. - `vendor: str` The vendor the asset is part of. - `id: Optional[str]` Unique identifier for the asset category. - `external_id: str` External identifier from the source system. - `fields: List[AssetField]` The fields associated with the asset. - `name: str` The name of the field. - `value: str` The value of the field. - `link: Optional[str]` Optional link associated with the field. - `name: str` Human-readable name of the asset. - `id: Optional[str]` Unique identifier for the asset. - `link: Optional[str]` Direct link to the asset. - `dlp_contexts: List[DLPContext]` DLP context information if this is a content finding. - `created: datetime` When the DLP context was created. - `entry_ids: List[str]` DLP Entry IDs. - `profile_id: str` DLP Profile ID. - `updated: datetime` When the DLP context was last updated. - `id: Optional[str]` Unique identifier for the DLP context. - `deleted: Optional[datetime]` When the DLP context was deleted. - `match_context_max_extent: Optional[int]` DLP Right Boundary of match context. - `match_context_min_extent: Optional[int]` DLP Left Boundary of match context. - `match_context_payload: Optional[Dict[str, object]]` DLP Match context payload that matched the profile in question. - `remediations: List[Remediation]` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: str` Unique identifier for the remediation job. - `created_at: datetime` When the remediation job was created. - `stale: bool` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: Literal["pending", "processing", "completed", 2 more]` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: List[Webhook]` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: WebhookLatestJob` The most recent webhook job for this webhook configuration. - `id: str` Unique identifier for the webhook job. - `created_at: datetime` When the webhook job was created. - `stale: bool` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: Literal["pending", "processing", "completed"]` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: str` Unique identifier for the webhook configuration. - `webhook_label: str` Account-specified display label for the webhook configuration. - `id: Optional[str]` Unique identifier for the finding instance. - `is_archived: Optional[bool]` Whether this finding instance has been archived. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.zero_trust.casb.posture.findings.instances.archive( finding_id="U3RhaW5sZXNzIHJvY2tz", account_id="46148281d8a93d002ef242d8b0d5f9f6", check_instances=["497f6eca-6276-4993-bfeb-53cbbbba6f08"], ) print(response.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "affliction_date": "2025-03-18T17:25:38.700541Z", "asset": { "category": { "service": null, "type": "file", "vendor": "Slack", "id": "1a78cbf3-b98f-4289-b1f2-22db64130f4f" }, "external_id": "external-file-id-123", "fields": [ { "name": "Credential name", "value": "Test asset 2", "link": "https://example.com" } ], "name": "Public.svg", "id": "8a043daf-def4-403e-9d28-da2e93d9b824", "link": "https://slack-files.com/TYJH37DCK-E0238GG6B8-92fd5y5674" }, "dlp_contexts": [ { "created": "2025-03-18T17:25:38.695977Z", "entry_ids": [ "21befc68-a297-4090-ac10-17a051b901cd", "d6dd1e16-f78c-401a-b564-45c4e44aa467" ], "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e", "updated": "2025-03-18T17:25:38.695977Z", "id": "7653ff3a-d25e-4c10-8034-3460937c045b", "deleted": "2025-03-18T17:25:38.695977Z", "match_context_max_extent": 512, "match_context_min_extent": 1, "match_context_payload": {} } ], "remediations": [ { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" } ], "webhooks": [ { "latest_job": { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" }, "webhook_id": "550e8400-e29b-41d4-a716-446655440000", "webhook_label": "Send to Gmail" } ], "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "is_archived": false } } ``` ## Remove the archive marking from a finding instance `zero_trust.casb.posture.findings.instances.unarchive(strfinding_id, InstanceUnarchiveParams**kwargs) -> InstanceUnarchiveResponse` **post** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances/unarchive` Remove the archive marking from one or more finding instances. ### Parameters - `account_id: str` - `finding_id: Union[str, Base64FileInput]` - `check_instances: Sequence[str]` A list of finding instance IDs to pass along. ### Returns - `class InstanceUnarchiveResponse: …` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: datetime` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: AssetCategory` Category information for an asset. - `service: Optional[str]` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: str` The type of asset. - `vendor: str` The vendor the asset is part of. - `id: Optional[str]` Unique identifier for the asset category. - `external_id: str` External identifier from the source system. - `fields: List[AssetField]` The fields associated with the asset. - `name: str` The name of the field. - `value: str` The value of the field. - `link: Optional[str]` Optional link associated with the field. - `name: str` Human-readable name of the asset. - `id: Optional[str]` Unique identifier for the asset. - `link: Optional[str]` Direct link to the asset. - `dlp_contexts: List[DLPContext]` DLP context information if this is a content finding. - `created: datetime` When the DLP context was created. - `entry_ids: List[str]` DLP Entry IDs. - `profile_id: str` DLP Profile ID. - `updated: datetime` When the DLP context was last updated. - `id: Optional[str]` Unique identifier for the DLP context. - `deleted: Optional[datetime]` When the DLP context was deleted. - `match_context_max_extent: Optional[int]` DLP Right Boundary of match context. - `match_context_min_extent: Optional[int]` DLP Left Boundary of match context. - `match_context_payload: Optional[Dict[str, object]]` DLP Match context payload that matched the profile in question. - `remediations: List[Remediation]` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: str` Unique identifier for the remediation job. - `created_at: datetime` When the remediation job was created. - `stale: bool` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: Literal["pending", "processing", "completed", 2 more]` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: List[Webhook]` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: WebhookLatestJob` The most recent webhook job for this webhook configuration. - `id: str` Unique identifier for the webhook job. - `created_at: datetime` When the webhook job was created. - `stale: bool` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: Literal["pending", "processing", "completed"]` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: str` Unique identifier for the webhook configuration. - `webhook_label: str` Account-specified display label for the webhook configuration. - `id: Optional[str]` Unique identifier for the finding instance. - `is_archived: Optional[bool]` Whether this finding instance has been archived. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.zero_trust.casb.posture.findings.instances.unarchive( finding_id="U3RhaW5sZXNzIHJvY2tz", account_id="46148281d8a93d002ef242d8b0d5f9f6", check_instances=["497f6eca-6276-4993-bfeb-53cbbbba6f08"], ) print(response.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "affliction_date": "2025-03-18T17:25:38.700541Z", "asset": { "category": { "service": null, "type": "file", "vendor": "Slack", "id": "1a78cbf3-b98f-4289-b1f2-22db64130f4f" }, "external_id": "external-file-id-123", "fields": [ { "name": "Credential name", "value": "Test asset 2", "link": "https://example.com" } ], "name": "Public.svg", "id": "8a043daf-def4-403e-9d28-da2e93d9b824", "link": "https://slack-files.com/TYJH37DCK-E0238GG6B8-92fd5y5674" }, "dlp_contexts": [ { "created": "2025-03-18T17:25:38.695977Z", "entry_ids": [ "21befc68-a297-4090-ac10-17a051b901cd", "d6dd1e16-f78c-401a-b564-45c4e44aa467" ], "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e", "updated": "2025-03-18T17:25:38.695977Z", "id": "7653ff3a-d25e-4c10-8034-3460937c045b", "deleted": "2025-03-18T17:25:38.695977Z", "match_context_max_extent": 512, "match_context_min_extent": 1, "match_context_payload": {} } ], "remediations": [ { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" } ], "webhooks": [ { "latest_job": { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" }, "webhook_id": "550e8400-e29b-41d4-a716-446655440000", "webhook_label": "Send to Gmail" } ], "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "is_archived": false } } ``` ## Domain Types ### Instance List Response - `class InstanceListResponse: …` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: datetime` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: AssetCategory` Category information for an asset. - `service: Optional[str]` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: str` The type of asset. - `vendor: str` The vendor the asset is part of. - `id: Optional[str]` Unique identifier for the asset category. - `external_id: str` External identifier from the source system. - `fields: List[AssetField]` The fields associated with the asset. - `name: str` The name of the field. - `value: str` The value of the field. - `link: Optional[str]` Optional link associated with the field. - `name: str` Human-readable name of the asset. - `id: Optional[str]` Unique identifier for the asset. - `link: Optional[str]` Direct link to the asset. - `dlp_contexts: List[DLPContext]` DLP context information if this is a content finding. - `created: datetime` When the DLP context was created. - `entry_ids: List[str]` DLP Entry IDs. - `profile_id: str` DLP Profile ID. - `updated: datetime` When the DLP context was last updated. - `id: Optional[str]` Unique identifier for the DLP context. - `deleted: Optional[datetime]` When the DLP context was deleted. - `match_context_max_extent: Optional[int]` DLP Right Boundary of match context. - `match_context_min_extent: Optional[int]` DLP Left Boundary of match context. - `match_context_payload: Optional[Dict[str, object]]` DLP Match context payload that matched the profile in question. - `remediations: List[Remediation]` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: str` Unique identifier for the remediation job. - `created_at: datetime` When the remediation job was created. - `stale: bool` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: Literal["pending", "processing", "completed", 2 more]` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: List[Webhook]` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: WebhookLatestJob` The most recent webhook job for this webhook configuration. - `id: str` Unique identifier for the webhook job. - `created_at: datetime` When the webhook job was created. - `stale: bool` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: Literal["pending", "processing", "completed"]` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: str` Unique identifier for the webhook configuration. - `webhook_label: str` Account-specified display label for the webhook configuration. - `id: Optional[str]` Unique identifier for the finding instance. - `is_archived: Optional[bool]` Whether this finding instance has been archived. ### Instance Get Response - `class InstanceGetResponse: …` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: datetime` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: AssetCategory` Category information for an asset. - `service: Optional[str]` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: str` The type of asset. - `vendor: str` The vendor the asset is part of. - `id: Optional[str]` Unique identifier for the asset category. - `external_id: str` External identifier from the source system. - `fields: List[AssetField]` The fields associated with the asset. - `name: str` The name of the field. - `value: str` The value of the field. - `link: Optional[str]` Optional link associated with the field. - `name: str` Human-readable name of the asset. - `id: Optional[str]` Unique identifier for the asset. - `link: Optional[str]` Direct link to the asset. - `dlp_contexts: List[DLPContext]` DLP context information if this is a content finding. - `created: datetime` When the DLP context was created. - `entry_ids: List[str]` DLP Entry IDs. - `profile_id: str` DLP Profile ID. - `updated: datetime` When the DLP context was last updated. - `id: Optional[str]` Unique identifier for the DLP context. - `deleted: Optional[datetime]` When the DLP context was deleted. - `match_context_max_extent: Optional[int]` DLP Right Boundary of match context. - `match_context_min_extent: Optional[int]` DLP Left Boundary of match context. - `match_context_payload: Optional[Dict[str, object]]` DLP Match context payload that matched the profile in question. - `remediations: List[Remediation]` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: str` Unique identifier for the remediation job. - `created_at: datetime` When the remediation job was created. - `stale: bool` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: Literal["pending", "processing", "completed", 2 more]` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: List[Webhook]` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: WebhookLatestJob` The most recent webhook job for this webhook configuration. - `id: str` Unique identifier for the webhook job. - `created_at: datetime` When the webhook job was created. - `stale: bool` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: Literal["pending", "processing", "completed"]` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: str` Unique identifier for the webhook configuration. - `webhook_label: str` Account-specified display label for the webhook configuration. - `id: Optional[str]` Unique identifier for the finding instance. - `is_archived: Optional[bool]` Whether this finding instance has been archived. ### Instance Export Response - `class InstanceExportResponse: …` Information about an export job. - `id: str` Unique identifier for the export job. - `status: Literal["Pending", "Success", "Failure", 2 more]` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: Literal["finding", "findingInstance", "content", "remediationJob"]` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: str` ID of the export-requesting user. - `download_url: Optional[str]` The URL by which the successfully created export can be downloaded by the end users. - `errors: Optional[str]` Contains information on errors which may have occurred during export creation. - `file_name: Optional[str]` The base name of the file that is/was generated by the export job. - `file_path: Optional[str]` The full path of the file that is stored within external storage (currently R2). ### Instance Archive Response - `class InstanceArchiveResponse: …` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: datetime` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: AssetCategory` Category information for an asset. - `service: Optional[str]` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: str` The type of asset. - `vendor: str` The vendor the asset is part of. - `id: Optional[str]` Unique identifier for the asset category. - `external_id: str` External identifier from the source system. - `fields: List[AssetField]` The fields associated with the asset. - `name: str` The name of the field. - `value: str` The value of the field. - `link: Optional[str]` Optional link associated with the field. - `name: str` Human-readable name of the asset. - `id: Optional[str]` Unique identifier for the asset. - `link: Optional[str]` Direct link to the asset. - `dlp_contexts: List[DLPContext]` DLP context information if this is a content finding. - `created: datetime` When the DLP context was created. - `entry_ids: List[str]` DLP Entry IDs. - `profile_id: str` DLP Profile ID. - `updated: datetime` When the DLP context was last updated. - `id: Optional[str]` Unique identifier for the DLP context. - `deleted: Optional[datetime]` When the DLP context was deleted. - `match_context_max_extent: Optional[int]` DLP Right Boundary of match context. - `match_context_min_extent: Optional[int]` DLP Left Boundary of match context. - `match_context_payload: Optional[Dict[str, object]]` DLP Match context payload that matched the profile in question. - `remediations: List[Remediation]` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: str` Unique identifier for the remediation job. - `created_at: datetime` When the remediation job was created. - `stale: bool` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: Literal["pending", "processing", "completed", 2 more]` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: List[Webhook]` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: WebhookLatestJob` The most recent webhook job for this webhook configuration. - `id: str` Unique identifier for the webhook job. - `created_at: datetime` When the webhook job was created. - `stale: bool` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: Literal["pending", "processing", "completed"]` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: str` Unique identifier for the webhook configuration. - `webhook_label: str` Account-specified display label for the webhook configuration. - `id: Optional[str]` Unique identifier for the finding instance. - `is_archived: Optional[bool]` Whether this finding instance has been archived. ### Instance Unarchive Response - `class InstanceUnarchiveResponse: …` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: datetime` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: AssetCategory` Category information for an asset. - `service: Optional[str]` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: str` The type of asset. - `vendor: str` The vendor the asset is part of. - `id: Optional[str]` Unique identifier for the asset category. - `external_id: str` External identifier from the source system. - `fields: List[AssetField]` The fields associated with the asset. - `name: str` The name of the field. - `value: str` The value of the field. - `link: Optional[str]` Optional link associated with the field. - `name: str` Human-readable name of the asset. - `id: Optional[str]` Unique identifier for the asset. - `link: Optional[str]` Direct link to the asset. - `dlp_contexts: List[DLPContext]` DLP context information if this is a content finding. - `created: datetime` When the DLP context was created. - `entry_ids: List[str]` DLP Entry IDs. - `profile_id: str` DLP Profile ID. - `updated: datetime` When the DLP context was last updated. - `id: Optional[str]` Unique identifier for the DLP context. - `deleted: Optional[datetime]` When the DLP context was deleted. - `match_context_max_extent: Optional[int]` DLP Right Boundary of match context. - `match_context_min_extent: Optional[int]` DLP Left Boundary of match context. - `match_context_payload: Optional[Dict[str, object]]` DLP Match context payload that matched the profile in question. - `remediations: List[Remediation]` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: str` Unique identifier for the remediation job. - `created_at: datetime` When the remediation job was created. - `stale: bool` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: Literal["pending", "processing", "completed", 2 more]` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: List[Webhook]` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: WebhookLatestJob` The most recent webhook job for this webhook configuration. - `id: str` Unique identifier for the webhook job. - `created_at: datetime` When the webhook job was created. - `stale: bool` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: Literal["pending", "processing", "completed"]` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: str` Unique identifier for the webhook configuration. - `webhook_label: str` Account-specified display label for the webhook configuration. - `id: Optional[str]` Unique identifier for the finding instance. - `is_archived: Optional[bool]` Whether this finding instance has been archived. # Exports ## List all export jobs `zero_trust.casb.posture.exports.list(ExportListParams**kwargs) -> SyncV4PagePaginationArray[ExportListResponse]` **get** `/accounts/{account_id}/data-security/posture/exports` List all export jobs for a given requestor's organization ### Parameters - `account_id: str` - `page: Optional[int]` A page number within the paginated result set. - `per_page: Optional[int]` Number of results to return per page. - `status: Optional[Literal["Pending", "Success", "Failure", 2 more]]` Filter on export job's status - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` ### Returns - `class ExportListResponse: …` Information about an export job. - `id: str` Unique identifier for the export job. - `status: Literal["Pending", "Success", "Failure", 2 more]` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: Literal["finding", "findingInstance", "content", "remediationJob"]` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: str` ID of the export-requesting user. - `download_url: Optional[str]` The URL by which the successfully created export can be downloaded by the end users. - `errors: Optional[str]` Contains information on errors which may have occurred during export creation. - `file_name: Optional[str]` The base name of the file that is/was generated by the export job. - `file_path: Optional[str]` The full path of the file that is stored within external storage (currently R2). ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.zero_trust.casb.posture.exports.list( account_id="46148281d8a93d002ef242d8b0d5f9f6", ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } ] } ``` ## Get a single export job `zero_trust.casb.posture.exports.get(strid, ExportGetParams**kwargs) -> ExportGetResponse` **get** `/accounts/{account_id}/data-security/posture/exports/{id}` Retrieves a single export job by its unique identifier ### Parameters - `account_id: str` - `id: str` ### Returns - `class ExportGetResponse: …` Information about an export job. - `id: str` Unique identifier for the export job. - `status: Literal["Pending", "Success", "Failure", 2 more]` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: Literal["finding", "findingInstance", "content", "remediationJob"]` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: str` ID of the export-requesting user. - `download_url: Optional[str]` The URL by which the successfully created export can be downloaded by the end users. - `errors: Optional[str]` Contains information on errors which may have occurred during export creation. - `file_name: Optional[str]` The base name of the file that is/was generated by the export job. - `file_path: Optional[str]` The full path of the file that is stored within external storage (currently R2). ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) export = client.zero_trust.casb.posture.exports.get( id="id", account_id="46148281d8a93d002ef242d8b0d5f9f6", ) print(export.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } } ``` ## Domain Types ### Export List Response - `class ExportListResponse: …` Information about an export job. - `id: str` Unique identifier for the export job. - `status: Literal["Pending", "Success", "Failure", 2 more]` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: Literal["finding", "findingInstance", "content", "remediationJob"]` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: str` ID of the export-requesting user. - `download_url: Optional[str]` The URL by which the successfully created export can be downloaded by the end users. - `errors: Optional[str]` Contains information on errors which may have occurred during export creation. - `file_name: Optional[str]` The base name of the file that is/was generated by the export job. - `file_path: Optional[str]` The full path of the file that is stored within external storage (currently R2). ### Export Get Response - `class ExportGetResponse: …` Information about an export job. - `id: str` Unique identifier for the export job. - `status: Literal["Pending", "Success", "Failure", 2 more]` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: Literal["finding", "findingInstance", "content", "remediationJob"]` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: str` ID of the export-requesting user. - `download_url: Optional[str]` The URL by which the successfully created export can be downloaded by the end users. - `errors: Optional[str]` Contains information on errors which may have occurred during export creation. - `file_name: Optional[str]` The base name of the file that is/was generated by the export job. - `file_path: Optional[str]` The full path of the file that is stored within external storage (currently R2). # Finding Types ## List all finding types `zero_trust.casb.posture.finding_types.list(FindingTypeListParams**kwargs) -> SyncV4PagePaginationArray[FindingTypeListResponse]` **get** `/accounts/{account_id}/data-security/posture/finding_types` List all available finding types with pagination support. ### Parameters - `account_id: str` - `page: Optional[int]` A page number within the paginated result set. - `per_page: Optional[int]` Number of results to return per page. ### Returns - `class FindingTypeListResponse: …` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.zero_trust.casb.posture.finding_types.list( account_id="46148281d8a93d002ef242d8b0d5f9f6", ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace" } ] } ``` ## Get finding by ID `zero_trust.casb.posture.finding_types.get(strfinding_type_id, FindingTypeGetParams**kwargs) -> FindingTypeGetResponse` **get** `/accounts/{account_id}/data-security/posture/finding_types/{finding_type_id}` Retrieve a specific finding type by its unique identifier. ### Parameters - `account_id: str` - `finding_type_id: str` ### Returns - `class FindingTypeGetResponse: …` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) finding_type = client.zero_trust.casb.posture.finding_types.get( finding_type_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="46148281d8a93d002ef242d8b0d5f9f6", ) print(finding_type.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace" } } ``` ## Domain Types ### Finding Type List Response - `class FindingTypeListResponse: …` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. ### Finding Type Get Response - `class FindingTypeGetResponse: …` Basic finding type information. - `id: str` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: Literal["Issue", "Insight", "Activity"]` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: Literal["SaaS", "Cloud"]` The product category. - `"SaaS"` - `"Cloud"` - `type: Literal["Content", "Posture"]` The type of the finding category. - `"Content"` - `"Posture"` - `name: str` The name of the finding. - `severity: Literal["Critical", "High", "Medium", "Low"]` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: str` The SaaS/Cloud vendor of the platform with which the finding is associated. # Remediation Types ## List remediation types for a finding type `zero_trust.casb.posture.finding_types.remediation_types.list(strfinding_type_id, RemediationTypeListParams**kwargs) -> SyncV4PagePaginationArray[RemediationTypeListResponse]` **get** `/accounts/{account_id}/data-security/posture/finding_types/{finding_type_id}/remediation_types` List all remediation types for a given finding type. This endpoint supports both cursor and offset pagination. Note that `cursor` and `page` are mutually exclusive. ### Parameters - `account_id: str` - `finding_type_id: str` - `cursor: Optional[str]` A cursor for pagination. - `integration_id: Optional[str]` Filter by an integration ID - `page: Optional[int]` A page number within the paginated result set. - `per_page: Optional[int]` Number of results to return per page. ### Returns - `class RemediationTypeListResponse: …` Information about a remediation type. - `id: str` The identifier for the remediation type. - `description: str` A description of the action(s) taken by the remediation type. - `display_name: str` The name of the remediation type as displayed in the cloudflare dashboard. - `finding_type_id: str` The identifier of the finding_type which this remediation type should remediate. - `remediation_type: str` The name of the remediation type. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.zero_trust.casb.posture.finding_types.remediation_types.list( finding_type_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="46148281d8a93d002ef242d8b0d5f9f6", ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "id": "7d736ac5-ed3b-46d5-9375-7025175ba1d9", "description": "Remove publicly accessible URL granting edit access", "display_name": "Remove Publicly Accessible URL - Edit Access", "finding_type_id": "6a790513-bbb5-4933-8971-76a744ec5448", "remediation_type": "Microsoft: Remove Publicly Accessible URL - Edit Access" } ] } ``` ## Domain Types ### Remediation Type List Response - `class RemediationTypeListResponse: …` Information about a remediation type. - `id: str` The identifier for the remediation type. - `description: str` A description of the action(s) taken by the remediation type. - `display_name: str` The name of the remediation type as displayed in the cloudflare dashboard. - `finding_type_id: str` The identifier of the finding_type which this remediation type should remediate. - `remediation_type: str` The name of the remediation type. # Content ## List DLP content findings `zero_trust.casb.posture.content.list(ContentListParams**kwargs) -> SyncV4PagePaginationArray[ContentListResponse]` **get** `/accounts/{account_id}/data-security/posture/content` List DLP content findings ### Parameters - `account_id: str` - `direction: Optional[Literal["asc", "desc"]]` Direction to order results. - `"asc"` - `"desc"` - `dlp_profile_id: Optional[str]` Filter by an DLP profile ID - `integration_id: Optional[str]` Filter by an integration ID - `max_affliction_date: Optional[Union[str, datetime]]` Filter to view findings that occurred on or before the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `min_affliction_date: Optional[Union[str, datetime]]` Filter to view findings that occurred on or after the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `order: Optional[Literal["asset_name", "dlp_profile_count", "integration_name", "latest_affliction_date"]]` Which field to use when ordering content assets. - `"asset_name"` - `"dlp_profile_count"` - `"integration_name"` - `"latest_affliction_date"` - `page: Optional[int]` A page number within the paginated result set. - `per_page: Optional[int]` Number of results to return per page. - `search: Optional[str]` A search term. - `vendor: Optional[Literal["ANTHROPIC", "AWS", "BITBUCKET", 13 more]]` Filter by vendor - `"ANTHROPIC"` - `"AWS"` - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_CLOUD_PLATFORM"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT"` - `"MICROSOFT_INTERNAL"` - `"OPENAI"` - `"SALESFORCE"` - `"SERVICENOW"` - `"SLACK"` ### Returns - `class ContentListResponse: …` Content asset with DLP information. - `asset_id: str` Unique identifier for the asset. - `asset_name: str` Name of the asset. - `dlp_contexts: List[DLPContext]` DLP context information for this asset. - `created: datetime` When the DLP context was created. - `entry_ids: List[str]` DLP Entry IDs. - `profile_id: str` DLP Profile ID. - `updated: datetime` When the DLP context was last updated. - `id: Optional[str]` Unique identifier for the DLP context. - `deleted: Optional[datetime]` When the DLP context was deleted. - `match_context_max_extent: Optional[int]` DLP Right Boundary of match context. - `match_context_min_extent: Optional[int]` DLP Left Boundary of match context. - `match_context_payload: Optional[Dict[str, object]]` DLP Match context payload that matched the profile in question. - `dlp_profile_count: int` Number of DLP profiles that flagged this asset. - `dlp_profile_ids: List[str]` IDs of DLP profiles that flagged this asset. - `integration: Integration` Summary information about an integration. - `created: datetime` When entity was created. - `last_hydrated: datetime` When were the integration credentials last updated. - `name: str` Name of the integration. - `permissions: List[str]` The vendor-specific permissions associated with the integration. - `policy: IntegrationPolicy` Policy configuration for an integration. - `id: Optional[str]` Policy identifier. - `client_id: Optional[str]` OAuth client ID for the policy. - `compliance_level: Optional[str]` Compliance level for the policy. - `dlp_enabled: Optional[bool]` Whether DLP is enabled for this policy. - `link: Optional[str]` Link to policy documentation. - `name: Optional[str]` Policy name. - `permissions: Optional[List[str]]` List of permissions included in the policy. - `status: str` Current status of the integration. - `updated: datetime` Last entity was updated. - `upgradable: bool` Whether the integrations permissions can be updated. - `vendor: IntegrationVendor` Information about a vendor/service provider. - `id: str` The id of the vendor. - `description: Optional[str]` Detailed information about what kinds of issues are detected for this vendor. - `display_name: str` The display name of the vendor. - `logo: str` Logo URL for the vendor. - `name: str` The name of the vendor. - `static_logo: str` Static logo URL for the vendor. - `zt_enrollments: List[str]` The vendor's compatible Zero Trust products. - `policies: Optional[List[Dict[str, object]]]` The policies related to the vendor. - `zt_enrollments: List[IntegrationZtEnrollment]` Zero Trust products associated with this integration. - `id: Optional[str]` The internal identifier of the Zero Trust Product. - `description: Optional[str]` Brief description of the Zero Trust Product. - `display_name: Optional[str]` The verbose name of the Zero Trust Product. - `enabled: Optional[bool]` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id: Optional[str]` Integration ID. - `credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry: Optional[datetime]` The date and time when the integration credentials will expire. - `is_paused: Optional[bool]` Whether the given integration is paused by the user. - `upgrade_dismissed: Optional[bool]` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: datetime` Most recent date this asset was flagged. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.zero_trust.casb.posture.content.list( account_id="46148281d8a93d002ef242d8b0d5f9f6", ) page = page.result[0] print(page.asset_id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "asset_id": "e6910838-4b91-45e9-b2b4-91bb23cb9762", "asset_name": "Test Asset Name", "dlp_contexts": [ { "created": "2025-03-18T17:25:38.695977Z", "entry_ids": [ "21befc68-a297-4090-ac10-17a051b901cd", "d6dd1e16-f78c-401a-b564-45c4e44aa467" ], "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e", "updated": "2025-03-18T17:25:38.695977Z", "id": "7653ff3a-d25e-4c10-8034-3460937c045b", "deleted": "2025-03-18T17:25:38.695977Z", "match_context_max_extent": 512, "match_context_min_extent": 1, "match_context_payload": {} } ], "dlp_profile_count": 2, "dlp_profile_ids": [ "c12f2059-8df4-43f8-9eb9-d27112d92b63", "822c051b-0bb4-4747-8929-471a1d506eef" ], "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2024-10-18T19:53:57.626659Z" } ] } ``` ## Create a content export `zero_trust.casb.posture.content.export(ContentExportParams**kwargs) -> ContentExportResponse` **post** `/accounts/{account_id}/data-security/posture/content/export` Creates a CSV export for content and accepts optional filters in the payload. ### Parameters - `account_id: str` - `dlp_profile_information: Iterable[DLPProfileInformation]` DLP profile metadata for the export. - `id: str` Unique identifier for the DLP profile. - `entries: Iterable[DLPProfileInformationEntry]` Entries contained within this DLP profile. - `id: str` Unique identifier for the DLP profile entry. - `name: str` Name of the DLP profile entry. - `profile_id: str` ID of the parent DLP profile. - `name: str` Name of the DLP profile. - `dlp_profile_id: Optional[Sequence[str]]` Filter by DLP profile IDs. - `integration_id: Optional[Sequence[str]]` Filter by integration IDs. - `max_affliction_date: Optional[Union[str, datetime]]` Filter to view content flagged on or before this date. - `min_affliction_date: Optional[Union[str, datetime]]` Filter to view content flagged on or after this date. - `orders: Optional[Iterable[Order]]` Ordering specifications for the export. - `direction: Literal["asc", "desc"]` Sort direction. - `"asc"` - `"desc"` - `name: Literal["asset_name", "dlp_profile_count", "integration_name", "latest_affliction_date"]` Content-specific field names for ordering. - `"asset_name"` - `"dlp_profile_count"` - `"integration_name"` - `"latest_affliction_date"` - `search: Optional[str]` Search term to filter content. - `vendors: Optional[List[Literal["ANTHROPIC", "AWS", "BITBUCKET", 13 more]]]` Filter by vendor types. - `"ANTHROPIC"` - `"AWS"` - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_CLOUD_PLATFORM"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT"` - `"MICROSOFT_INTERNAL"` - `"OPENAI"` - `"SALESFORCE"` - `"SERVICENOW"` - `"SLACK"` ### Returns - `class ContentExportResponse: …` Information about an export job. - `id: str` Unique identifier for the export job. - `status: Literal["Pending", "Success", "Failure", 2 more]` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: Literal["finding", "findingInstance", "content", "remediationJob"]` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: str` ID of the export-requesting user. - `download_url: Optional[str]` The URL by which the successfully created export can be downloaded by the end users. - `errors: Optional[str]` Contains information on errors which may have occurred during export creation. - `file_name: Optional[str]` The base name of the file that is/was generated by the export job. - `file_path: Optional[str]` The full path of the file that is stored within external storage (currently R2). ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.zero_trust.casb.posture.content.export( account_id="46148281d8a93d002ef242d8b0d5f9f6", dlp_profile_information=[{ "id": "e91a2360-da51-4fdf-9711-bcdecd462614", "entries": [{ "id": "55ba2c6c-8ef4-4b2e-9148-e75e8b6ccac1", "name": "Credit Card Numbers", "profile_id": "e91a2360-da51-4fdf-9711-bcdecd462614", }], "name": "Financial Information", }], ) print(response.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } } ``` ## Domain Types ### Content List Response - `class ContentListResponse: …` Content asset with DLP information. - `asset_id: str` Unique identifier for the asset. - `asset_name: str` Name of the asset. - `dlp_contexts: List[DLPContext]` DLP context information for this asset. - `created: datetime` When the DLP context was created. - `entry_ids: List[str]` DLP Entry IDs. - `profile_id: str` DLP Profile ID. - `updated: datetime` When the DLP context was last updated. - `id: Optional[str]` Unique identifier for the DLP context. - `deleted: Optional[datetime]` When the DLP context was deleted. - `match_context_max_extent: Optional[int]` DLP Right Boundary of match context. - `match_context_min_extent: Optional[int]` DLP Left Boundary of match context. - `match_context_payload: Optional[Dict[str, object]]` DLP Match context payload that matched the profile in question. - `dlp_profile_count: int` Number of DLP profiles that flagged this asset. - `dlp_profile_ids: List[str]` IDs of DLP profiles that flagged this asset. - `integration: Integration` Summary information about an integration. - `created: datetime` When entity was created. - `last_hydrated: datetime` When were the integration credentials last updated. - `name: str` Name of the integration. - `permissions: List[str]` The vendor-specific permissions associated with the integration. - `policy: IntegrationPolicy` Policy configuration for an integration. - `id: Optional[str]` Policy identifier. - `client_id: Optional[str]` OAuth client ID for the policy. - `compliance_level: Optional[str]` Compliance level for the policy. - `dlp_enabled: Optional[bool]` Whether DLP is enabled for this policy. - `link: Optional[str]` Link to policy documentation. - `name: Optional[str]` Policy name. - `permissions: Optional[List[str]]` List of permissions included in the policy. - `status: str` Current status of the integration. - `updated: datetime` Last entity was updated. - `upgradable: bool` Whether the integrations permissions can be updated. - `vendor: IntegrationVendor` Information about a vendor/service provider. - `id: str` The id of the vendor. - `description: Optional[str]` Detailed information about what kinds of issues are detected for this vendor. - `display_name: str` The display name of the vendor. - `logo: str` Logo URL for the vendor. - `name: str` The name of the vendor. - `static_logo: str` Static logo URL for the vendor. - `zt_enrollments: List[str]` The vendor's compatible Zero Trust products. - `policies: Optional[List[Dict[str, object]]]` The policies related to the vendor. - `zt_enrollments: List[IntegrationZtEnrollment]` Zero Trust products associated with this integration. - `id: Optional[str]` The internal identifier of the Zero Trust Product. - `description: Optional[str]` Brief description of the Zero Trust Product. - `display_name: Optional[str]` The verbose name of the Zero Trust Product. - `enabled: Optional[bool]` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id: Optional[str]` Integration ID. - `credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry: Optional[datetime]` The date and time when the integration credentials will expire. - `is_paused: Optional[bool]` Whether the given integration is paused by the user. - `upgrade_dismissed: Optional[bool]` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: datetime` Most recent date this asset was flagged. ### Content Export Response - `class ContentExportResponse: …` Information about an export job. - `id: str` Unique identifier for the export job. - `status: Literal["Pending", "Success", "Failure", 2 more]` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: Literal["finding", "findingInstance", "content", "remediationJob"]` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: str` ID of the export-requesting user. - `download_url: Optional[str]` The URL by which the successfully created export can be downloaded by the end users. - `errors: Optional[str]` Contains information on errors which may have occurred during export creation. - `file_name: Optional[str]` The base name of the file that is/was generated by the export job. - `file_path: Optional[str]` The full path of the file that is stored within external storage (currently R2). # Remediations # Jobs ## List remediation jobs `zero_trust.casb.posture.remediations.jobs.list(JobListParams**kwargs) -> SyncV4PagePaginationArray[JobListResponse]` **get** `/accounts/{account_id}/data-security/posture/remediations/jobs` List all remediation jobs tied to a specific Cloudflare Account. Note that `cursor` and `page` are mutually exclusive. ### Parameters - `account_id: str` - `cursor: Optional[str]` A cursor for pagination. - `direction: Optional[Literal["asc", "desc"]]` Direction to order results. - `"asc"` - `"desc"` - `integration_id: Optional[str]` Filter by an integration ID - `max_updated_at: Optional[Union[str, datetime]]` Filter to view remediations updated on or before the max updated datetime. Can be a date-time in ISO 8601 format or an epoch timestamp. - `min_updated_at: Optional[Union[str, datetime]]` Filter to view remediations updated on or after the min updated datetime. Can be a date-time in ISO 8601 format or an epoch timestamp. - `order: Optional[Literal["created_at", "affliction_date", "integration_name", 4 more]]` An optional param to sort the results by the given field. - `"created_at"` - `"affliction_date"` - `"integration_name"` - `"status"` - `"last_updated_at"` - `"asset_name"` - `"finding_type_name"` - `page: Optional[int]` A page number within the paginated result set. - `per_page: Optional[int]` Number of results to return per page. - `search: Optional[str]` A search term. - `status: Optional[Literal["pending", "processing", "completed", 2 more]]` Filter to view remediations with the given status. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `triggered_by_actor: Optional[List[Literal["user", "account_token"]]]` Filter remediations by what kind of actor triggered them. Supports multiple comma-separated values. - `"user"` - `"account_token"` ### Returns - `class JobListResponse: …` Information about a remediation job. - `id: str` Unique identifier for the remediation job. - `asset: Asset` Asset information for a remediation job. - `id: str` Unique identifier for the asset. - `category: AssetCategory` Category information for a remediation job asset. - `service: str` Specific service within the vendor. - `type: str` Asset type. - `vendor: Literal["AWS", "Anthropic", "Bitbucket", 16 more]` Display names for vendor types. - `"AWS"` - `"Anthropic"` - `"Bitbucket"` - `"Box"` - `"Confluence"` - `"Dropbox"` - `"GitHub"` - `"Google Cloud Platform"` - `"Google Workspace"` - `"Jira"` - `"Microsoft"` - `"Microsoft Internal"` - `"Okta"` - `"OpenAI"` - `"Slack"` - `"Salesforce"` - `"ServiceNow"` - `"Workday"` - `"Zoom"` - `external_id: str` External identifier from the source system. - `fields: List[AssetField]` Additional fields associated with the asset. - `name: str` Field name. - `value: Union[str, float, bool]` Field value (can be string, number, or boolean). - `str` - `float` - `bool` - `link: Optional[str]` Optional link associated with the field. - `name: str` Human-readable name of the asset. - `link: Optional[str]` Direct link to the asset. - `created_at: datetime` When the remediation job was created. - `finding_id: str` Encoded finding ID. - `finding_instance_id: str` ID of the finding instance being remediated. - `finding_type_id: str` ID of the finding type. - `finding_type_name: str` Name of the finding type. - `integration_name: str` Name of the integration. - `last_updated: datetime` When the remediation job was last updated. - `remediation_type: str` Type of remediation being performed. - `status: Literal["pending", "processing", "completed", 2 more]` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `triggered_by_user: str` Email of the user who triggered the remediation. For account-token actors this is the literal "Account API Token"; for policy actors this is empty. - `triggered_by_actor: Optional[Literal["user", "account_token"]]` Type of actor that triggered the remediation job. Null on legacy rows created before this column was populated. - `"user"` - `"account_token"` - `triggered_by_id: Optional[str]` ID of the actor that triggered the job. Meaning depends on triggered_by_actor. Null on legacy rows. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.zero_trust.casb.posture.remediations.jobs.list( account_id="46148281d8a93d002ef242d8b0d5f9f6", ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ {} ], "messages": [ {} ], "result": [ { "id": "c416bc38-75db-425f-ae25-c37b5df5c37f", "asset": { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "category": { "service": "OneDrive", "type": "SaaS", "vendor": "Google Workspace" }, "external_id": "c416bc38-75db-425f-ae25-c37b5df5c37f", "fields": [ { "name": "File Name", "value": "sensitive-document.xlsx", "link": "https://dashboard.microsoft.com/files/details" } ], "name": "Microsoft File Publicly Accessible", "link": "https://dashboard.microsoft.com/files/details" }, "created_at": "2025-07-07T18:39:13.123456Z", "finding_id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "finding_instance_id": "3f7b8c9d-6e5a-4f3b-9c2d-1e0a8b7c6d5e", "finding_type_id": "775c5f38-efcf-4b2b-93db-8428979eb6a2", "finding_type_name": "Microsoft: File publicly accessible with edit access", "integration_name": "Microsoft", "last_updated": "2025-07-07T18:39:13.123456Z", "remediation_type": "Remove publicly accessible edit url", "status": "pending", "triggered_by_user": "user@example.com", "triggered_by_actor": "user", "triggered_by_id": "0123456789abcdef0123456789abcdef" } ], "result_info": { "count": 2, "cursor": "next_cursor_value", "page": 1, "per_page": 10, "total_count": 2 }, "success": true } ``` ## Creates remediation jobs `zero_trust.casb.posture.remediations.jobs.create(JobCreateParams**kwargs) -> JobCreateResponse` **post** `/accounts/{account_id}/data-security/posture/remediations/jobs` Create one or more remediation jobs tied to a specific Cloudflare Account. ### Parameters - `account_id: str` - `finding_instance_ids: Sequence[str]` UUIDs identifying Finding Instances. - `remediation_type_id: str` A UUID identifying this Remediation Type. ### Returns - `class JobCreateResponse: …` - `created: List[Created]` Successfully created remediation jobs. - `id: str` Unique identifier for the remediation job. - `asset: CreatedAsset` Asset information for a remediation job. - `id: str` Unique identifier for the asset. - `category: CreatedAssetCategory` Category information for a remediation job asset. - `service: str` Specific service within the vendor. - `type: str` Asset type. - `vendor: Literal["AWS", "Anthropic", "Bitbucket", 16 more]` Display names for vendor types. - `"AWS"` - `"Anthropic"` - `"Bitbucket"` - `"Box"` - `"Confluence"` - `"Dropbox"` - `"GitHub"` - `"Google Cloud Platform"` - `"Google Workspace"` - `"Jira"` - `"Microsoft"` - `"Microsoft Internal"` - `"Okta"` - `"OpenAI"` - `"Slack"` - `"Salesforce"` - `"ServiceNow"` - `"Workday"` - `"Zoom"` - `external_id: str` External identifier from the source system. - `fields: List[CreatedAssetField]` Additional fields associated with the asset. - `name: str` Field name. - `value: Union[str, float, bool]` Field value (can be string, number, or boolean). - `str` - `float` - `bool` - `link: Optional[str]` Optional link associated with the field. - `name: str` Human-readable name of the asset. - `link: Optional[str]` Direct link to the asset. - `created_at: datetime` When the remediation job was created. - `finding_id: str` Encoded finding ID. - `finding_instance_id: str` ID of the finding instance being remediated. - `finding_type_id: str` ID of the finding type. - `finding_type_name: str` Name of the finding type. - `integration_name: str` Name of the integration. - `last_updated: datetime` When the remediation job was last updated. - `remediation_type: str` Type of remediation being performed. - `status: Literal["pending", "processing", "completed", 2 more]` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `triggered_by_user: str` Email of the user who triggered the remediation. For account-token actors this is the literal "Account API Token"; for policy actors this is empty. - `triggered_by_actor: Optional[Literal["user", "account_token"]]` Type of actor that triggered the remediation job. Null on legacy rows created before this column was populated. - `"user"` - `"account_token"` - `triggered_by_id: Optional[str]` ID of the actor that triggered the job. Meaning depends on triggered_by_actor. Null on legacy rows. - `failed: List[Failed]` Failed remediation job creation attempts. - `error: str` Error message describing the failure. - `finding_instance_id: str` ID of the finding instance that failed to create a remediation job. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) job = client.zero_trust.casb.posture.remediations.jobs.create( account_id="46148281d8a93d002ef242d8b0d5f9f6", finding_instance_ids=["182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"], remediation_type_id="5a7d9e2f-1b3c-4d5e-8f6a-7b8c9d0e1f2a", ) print(job.created) ``` #### Response ```json { "errors": [ {} ], "messages": [ {} ], "result": { "created": [ { "id": "c416bc38-75db-425f-ae25-c37b5df5c37f", "asset": { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "category": { "service": "OneDrive", "type": "SaaS", "vendor": "Google Workspace" }, "external_id": "c416bc38-75db-425f-ae25-c37b5df5c37f", "fields": [ { "name": "File Name", "value": "sensitive-document.xlsx", "link": "https://dashboard.microsoft.com/files/details" } ], "name": "Microsoft File Publicly Accessible", "link": "https://dashboard.microsoft.com/files/details" }, "created_at": "2025-07-07T18:39:13.123456Z", "finding_id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "finding_instance_id": "3f7b8c9d-6e5a-4f3b-9c2d-1e0a8b7c6d5e", "finding_type_id": "775c5f38-efcf-4b2b-93db-8428979eb6a2", "finding_type_name": "Microsoft: File publicly accessible with edit access", "integration_name": "Microsoft", "last_updated": "2025-07-07T18:39:13.123456Z", "remediation_type": "Remove publicly accessible edit url", "status": "pending", "triggered_by_user": "user@example.com", "triggered_by_actor": "user", "triggered_by_id": "0123456789abcdef0123456789abcdef" } ], "failed": [ { "error": "Failed to create remediation job", "finding_instance_id": "2e6b4c8a-9d1f-4e3b-8c7a-5f9e2d1a6b4c" } ] }, "success": true } ``` ## Create a remediation jobs export `zero_trust.casb.posture.remediations.jobs.export(JobExportParams**kwargs) -> JobExportResponse` **post** `/accounts/{account_id}/data-security/posture/remediations/jobs/export` Creates a CSV export for remediation jobs and accepts optional filters in the payload. ### Parameters - `account_id: str` - `integration_id: Optional[Sequence[str]]` Filter by multiple integration IDs. - `max_updated_at: Optional[Union[str, datetime]]` Filter to view remediation jobs updated on or before this datetime. Can be a date-time in ISO 8601 format or an epoch timestamp. - `min_updated_at: Optional[Union[str, datetime]]` Filter to view remediation jobs updated on or after this datetime. Can be a date-time in ISO 8601 format or an epoch timestamp. - `orders: Optional[Iterable[Order]]` Ordering specifications for the export. - `direction: Literal["asc", "desc"]` Sort direction. - `"asc"` - `"desc"` - `name: Literal["asset_name", "finding_type_name", "integration_name", 3 more]` Which field to use when ordering the remediation jobs. - `"asset_name"` - `"finding_type_name"` - `"integration_name"` - `"status"` - `"last_updated_at"` - `"affliction_date"` - `search: Optional[str]` A search term. - `status: Optional[List[Literal["pending", "processing", "completed", 2 more]]]` Filter by remediation job status. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` ### Returns - `class JobExportResponse: …` Information about an export job. - `id: str` Unique identifier for the export job. - `status: Literal["Pending", "Success", "Failure", 2 more]` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: Literal["finding", "findingInstance", "content", "remediationJob"]` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: str` ID of the export-requesting user. - `download_url: Optional[str]` The URL by which the successfully created export can be downloaded by the end users. - `errors: Optional[str]` Contains information on errors which may have occurred during export creation. - `file_name: Optional[str]` The base name of the file that is/was generated by the export job. - `file_path: Optional[str]` The full path of the file that is stored within external storage (currently R2). ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.zero_trust.casb.posture.remediations.jobs.export( account_id="46148281d8a93d002ef242d8b0d5f9f6", ) print(response.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } } ``` ## Domain Types ### Job List Response - `class JobListResponse: …` Information about a remediation job. - `id: str` Unique identifier for the remediation job. - `asset: Asset` Asset information for a remediation job. - `id: str` Unique identifier for the asset. - `category: AssetCategory` Category information for a remediation job asset. - `service: str` Specific service within the vendor. - `type: str` Asset type. - `vendor: Literal["AWS", "Anthropic", "Bitbucket", 16 more]` Display names for vendor types. - `"AWS"` - `"Anthropic"` - `"Bitbucket"` - `"Box"` - `"Confluence"` - `"Dropbox"` - `"GitHub"` - `"Google Cloud Platform"` - `"Google Workspace"` - `"Jira"` - `"Microsoft"` - `"Microsoft Internal"` - `"Okta"` - `"OpenAI"` - `"Slack"` - `"Salesforce"` - `"ServiceNow"` - `"Workday"` - `"Zoom"` - `external_id: str` External identifier from the source system. - `fields: List[AssetField]` Additional fields associated with the asset. - `name: str` Field name. - `value: Union[str, float, bool]` Field value (can be string, number, or boolean). - `str` - `float` - `bool` - `link: Optional[str]` Optional link associated with the field. - `name: str` Human-readable name of the asset. - `link: Optional[str]` Direct link to the asset. - `created_at: datetime` When the remediation job was created. - `finding_id: str` Encoded finding ID. - `finding_instance_id: str` ID of the finding instance being remediated. - `finding_type_id: str` ID of the finding type. - `finding_type_name: str` Name of the finding type. - `integration_name: str` Name of the integration. - `last_updated: datetime` When the remediation job was last updated. - `remediation_type: str` Type of remediation being performed. - `status: Literal["pending", "processing", "completed", 2 more]` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `triggered_by_user: str` Email of the user who triggered the remediation. For account-token actors this is the literal "Account API Token"; for policy actors this is empty. - `triggered_by_actor: Optional[Literal["user", "account_token"]]` Type of actor that triggered the remediation job. Null on legacy rows created before this column was populated. - `"user"` - `"account_token"` - `triggered_by_id: Optional[str]` ID of the actor that triggered the job. Meaning depends on triggered_by_actor. Null on legacy rows. ### Job Create Response - `class JobCreateResponse: …` - `created: List[Created]` Successfully created remediation jobs. - `id: str` Unique identifier for the remediation job. - `asset: CreatedAsset` Asset information for a remediation job. - `id: str` Unique identifier for the asset. - `category: CreatedAssetCategory` Category information for a remediation job asset. - `service: str` Specific service within the vendor. - `type: str` Asset type. - `vendor: Literal["AWS", "Anthropic", "Bitbucket", 16 more]` Display names for vendor types. - `"AWS"` - `"Anthropic"` - `"Bitbucket"` - `"Box"` - `"Confluence"` - `"Dropbox"` - `"GitHub"` - `"Google Cloud Platform"` - `"Google Workspace"` - `"Jira"` - `"Microsoft"` - `"Microsoft Internal"` - `"Okta"` - `"OpenAI"` - `"Slack"` - `"Salesforce"` - `"ServiceNow"` - `"Workday"` - `"Zoom"` - `external_id: str` External identifier from the source system. - `fields: List[CreatedAssetField]` Additional fields associated with the asset. - `name: str` Field name. - `value: Union[str, float, bool]` Field value (can be string, number, or boolean). - `str` - `float` - `bool` - `link: Optional[str]` Optional link associated with the field. - `name: str` Human-readable name of the asset. - `link: Optional[str]` Direct link to the asset. - `created_at: datetime` When the remediation job was created. - `finding_id: str` Encoded finding ID. - `finding_instance_id: str` ID of the finding instance being remediated. - `finding_type_id: str` ID of the finding type. - `finding_type_name: str` Name of the finding type. - `integration_name: str` Name of the integration. - `last_updated: datetime` When the remediation job was last updated. - `remediation_type: str` Type of remediation being performed. - `status: Literal["pending", "processing", "completed", 2 more]` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `triggered_by_user: str` Email of the user who triggered the remediation. For account-token actors this is the literal "Account API Token"; for policy actors this is empty. - `triggered_by_actor: Optional[Literal["user", "account_token"]]` Type of actor that triggered the remediation job. Null on legacy rows created before this column was populated. - `"user"` - `"account_token"` - `triggered_by_id: Optional[str]` ID of the actor that triggered the job. Meaning depends on triggered_by_actor. Null on legacy rows. - `failed: List[Failed]` Failed remediation job creation attempts. - `error: str` Error message describing the failure. - `finding_instance_id: str` ID of the finding instance that failed to create a remediation job. ### Job Export Response - `class JobExportResponse: …` Information about an export job. - `id: str` Unique identifier for the export job. - `status: Literal["Pending", "Success", "Failure", 2 more]` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: Literal["finding", "findingInstance", "content", "remediationJob"]` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: str` ID of the export-requesting user. - `download_url: Optional[str]` The URL by which the successfully created export can be downloaded by the end users. - `errors: Optional[str]` Contains information on errors which may have occurred during export creation. - `file_name: Optional[str]` The base name of the file that is/was generated by the export job. - `file_path: Optional[str]` The full path of the file that is stored within external storage (currently R2). # Webhooks ## List webhook configurations `zero_trust.casb.posture.webhooks.list(WebhookListParams**kwargs) -> SyncSinglePage[WebhookListResponse]` **get** `/accounts/{account_id}/data-security/posture/webhooks` Retrieves all webhook configurations for the authenticated account. Returns an array of webhook configurations that can be used to send finding notifications. ### Parameters - `account_id: str` ### Returns - `class WebhookListResponse: …` Webhook configuration for sending finding notifications. - `id: str` Unique identifier for the specific webhook configuration. - `authentication_type: Literal["Basic Auth", "None", "Bearer Auth", 2 more]` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: datetime` Timestamp when the webhook configuration was created. - `destination_url: str` Target URL for the webhook configuration. Where resulting data will be sent. - `label: str` Account-specified display label for the webhook configuration. - `status: Literal["enabled", "disabled"]` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: datetime` Timestamp when the webhook configuration was last updated. - `version: int` Version number of the configuration. - `headers: Optional[List[Header]]` List of header keys configured for this webhook. Values are not included for security reasons. - `key: Optional[str]` Header key name (lowercase). - `value: Optional[str]` Header value. This field is never returned in API responses for security reasons. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.zero_trust.casb.posture.webhooks.list( account_id="46148281d8a93d002ef242d8b0d5f9f6", ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": [ { "id": "550e8400-e29b-41d4-a716-446655440000", "authentication_type": "Bearer Auth", "created_at": "2024-01-15T10:30:00Z", "destination_url": "https://example.com/webhook", "label": "Send to Gmail", "status": "enabled", "updated_at": "2024-01-20T14:45:00Z", "version": 1, "headers": [ { "key": "authorization" } ] } ] } ``` ## Create a new webhook configuration `zero_trust.casb.posture.webhooks.create(WebhookCreateParams**kwargs) -> WebhookCreateResponse` **post** `/accounts/{account_id}/data-security/posture/webhooks` Creates a new webhook configuration for sending finding notifications to external endpoints. ### Parameters - `account_id: str` - `authentication_type: Literal["Basic Auth", "None", "Bearer Auth", 2 more]` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `destination_url: str` Target URL for the webhook configuration. Where resulting data will be sent. - `label: str` Account-specified display label for the webhook configuration. - `headers: Optional[Iterable[Header]]` List of custom headers to include in webhook requests. - `key: str` Header key name. - `value: Optional[str]` Header value. Required on Create and Evaluate. On Update, omit or set to null to keep existing value. - `signing_secret: Optional[str]` Secret key used for HMAC signing when authentication_type is "HMAC-Signing". ### Returns - `class WebhookCreateResponse: …` Webhook configuration for sending finding notifications. - `id: str` Unique identifier for the specific webhook configuration. - `authentication_type: Literal["Basic Auth", "None", "Bearer Auth", 2 more]` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: datetime` Timestamp when the webhook configuration was created. - `destination_url: str` Target URL for the webhook configuration. Where resulting data will be sent. - `label: str` Account-specified display label for the webhook configuration. - `status: Literal["enabled", "disabled"]` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: datetime` Timestamp when the webhook configuration was last updated. - `version: int` Version number of the configuration. - `headers: Optional[List[Header]]` List of header keys configured for this webhook. Values are not included for security reasons. - `key: Optional[str]` Header key name (lowercase). - `value: Optional[str]` Header value. This field is never returned in API responses for security reasons. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) webhook = client.zero_trust.casb.posture.webhooks.create( account_id="46148281d8a93d002ef242d8b0d5f9f6", authentication_type="Bearer Auth", destination_url="https://example.com/webhook", label="Send to Slack", ) print(webhook.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "550e8400-e29b-41d4-a716-446655440000", "authentication_type": "Bearer Auth", "created_at": "2024-01-15T10:30:00Z", "destination_url": "https://example.com/webhook", "label": "Send to Gmail", "status": "enabled", "updated_at": "2024-01-20T14:45:00Z", "version": 1, "headers": [ { "key": "authorization" } ] } } ``` ## Get webhook configuration by ID `zero_trust.casb.posture.webhooks.get(strwebhook_id, WebhookGetParams**kwargs) -> WebhookGetResponse` **get** `/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}` Retrieves a specific webhook configuration by its unique identifier. ### Parameters - `account_id: str` - `webhook_id: str` ### Returns - `class WebhookGetResponse: …` Webhook configuration for sending finding notifications. - `id: str` Unique identifier for the specific webhook configuration. - `authentication_type: Literal["Basic Auth", "None", "Bearer Auth", 2 more]` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: datetime` Timestamp when the webhook configuration was created. - `destination_url: str` Target URL for the webhook configuration. Where resulting data will be sent. - `label: str` Account-specified display label for the webhook configuration. - `status: Literal["enabled", "disabled"]` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: datetime` Timestamp when the webhook configuration was last updated. - `version: int` Version number of the configuration. - `headers: Optional[List[Header]]` List of header keys configured for this webhook. Values are not included for security reasons. - `key: Optional[str]` Header key name (lowercase). - `value: Optional[str]` Header value. This field is never returned in API responses for security reasons. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) webhook = client.zero_trust.casb.posture.webhooks.get( webhook_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="46148281d8a93d002ef242d8b0d5f9f6", ) print(webhook.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "550e8400-e29b-41d4-a716-446655440000", "authentication_type": "Bearer Auth", "created_at": "2024-01-15T10:30:00Z", "destination_url": "https://example.com/webhook", "label": "Send to Gmail", "status": "enabled", "updated_at": "2024-01-20T14:45:00Z", "version": 1, "headers": [ { "key": "authorization" } ] } } ``` ## Update an existing webhook configuration `zero_trust.casb.posture.webhooks.update(strwebhook_id, WebhookUpdateParams**kwargs) -> WebhookUpdateResponse` **put** `/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}` Updates an existing webhook configuration with new settings. ### Parameters - `account_id: str` - `webhook_id: str` - `authentication_type: Literal["Basic Auth", "None", "Bearer Auth", 2 more]` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `destination_url: str` Target URL for the webhook configuration. Where resulting data will be sent. - `label: str` Account-specified display label for the webhook configuration. - `status: Literal["enabled", "disabled"]` Status of the webhook configuration. - `"enabled"` - `"disabled"` - `headers: Optional[Iterable[Header]]` List of custom headers to include in webhook requests. - `key: str` Header key name. - `value: Optional[str]` Header value. Required on Create and Evaluate. On Update, omit or set to null to keep existing value. - `signing_secret: Optional[str]` Secret key used for HMAC signing when authentication_type is "HMAC-Signing". ### Returns - `class WebhookUpdateResponse: …` Webhook configuration for sending finding notifications. - `id: str` Unique identifier for the specific webhook configuration. - `authentication_type: Literal["Basic Auth", "None", "Bearer Auth", 2 more]` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: datetime` Timestamp when the webhook configuration was created. - `destination_url: str` Target URL for the webhook configuration. Where resulting data will be sent. - `label: str` Account-specified display label for the webhook configuration. - `status: Literal["enabled", "disabled"]` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: datetime` Timestamp when the webhook configuration was last updated. - `version: int` Version number of the configuration. - `headers: Optional[List[Header]]` List of header keys configured for this webhook. Values are not included for security reasons. - `key: Optional[str]` Header key name (lowercase). - `value: Optional[str]` Header value. This field is never returned in API responses for security reasons. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) webhook = client.zero_trust.casb.posture.webhooks.update( webhook_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="46148281d8a93d002ef242d8b0d5f9f6", authentication_type="Bearer Auth", destination_url="https://example.com/webhook", label="Send to Slack", status="enabled", ) print(webhook.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "550e8400-e29b-41d4-a716-446655440000", "authentication_type": "Bearer Auth", "created_at": "2024-01-15T10:30:00Z", "destination_url": "https://example.com/webhook", "label": "Send to Gmail", "status": "enabled", "updated_at": "2024-01-20T14:45:00Z", "version": 1, "headers": [ { "key": "authorization" } ] } } ``` ## Delete a webhook configuration `zero_trust.casb.posture.webhooks.delete(strwebhook_id, WebhookDeleteParams**kwargs) -> WebhookDeleteResponse` **delete** `/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}` Soft deletes a webhook configuration by its unique identifier. The webhook will be marked as deleted and will no longer be available for use. ### Parameters - `account_id: str` - `webhook_id: str` ### Returns - `class WebhookDeleteResponse: …` Common response structure for all API endpoints. - `errors: List[Error]` - `code: int` Error or message code. - `message: str` Human-readable message. - `documentation_url: Optional[str]` Link to relevant documentation. - `source: Optional[ErrorSource]` - `pointer: Optional[str]` JSON pointer to the source of the error. - `messages: List[Message]` - `code: int` Error or message code. - `message: str` Human-readable message. - `documentation_url: Optional[str]` Link to relevant documentation. - `source: Optional[MessageSource]` - `pointer: Optional[str]` JSON pointer to the source of the error. - `success: bool` Whether the API call was successful. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) webhook = client.zero_trust.casb.posture.webhooks.delete( webhook_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="46148281d8a93d002ef242d8b0d5f9f6", ) print(webhook.errors) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true } ``` ## Test a webhook configuration before creating it `zero_trust.casb.posture.webhooks.evaluate(WebhookEvaluateParams**kwargs) -> WebhookEvaluateResponse` **post** `/accounts/{account_id}/data-security/posture/webhooks/evaluate` Sends a test webhook event to the specified destination URL to verify the webhook endpoint is reachable and properly configured. This allows customers to validate their webhook configuration before creating the actual webhook resource. The test payload includes: - event_type: "webhook.test" - timestamp: Current UTC timestamp - message: Test message indicating this is from Cloudflare CASB - data: Object with test: true ### Parameters - `account_id: str` - `authentication_type: Literal["Basic Auth", "None", "Bearer Auth", 2 more]` Type of authentication to use for the test webhook request. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `destination_url: str` Target URL to send the test webhook event to. - `headers: Optional[Iterable[Header]]` List of custom headers to include in the test webhook request. - `key: str` Header key name. - `value: Optional[str]` Header value. Required on Create and Evaluate. On Update, omit or set to null to keep existing value. - `signing_secret: Optional[str]` Secret key used for HMAC signing when authentication_type is "HMAC-Signing". ### Returns - `class WebhookEvaluateResponse: …` Response body for webhook evaluation test results. - `message: str` Human-readable message describing the test result. - `status_code: int` HTTP status code returned by the webhook endpoint. 0 if connection failed. - `success: bool` Whether the webhook test was successful (received 2xx response). ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.zero_trust.casb.posture.webhooks.evaluate( account_id="46148281d8a93d002ef242d8b0d5f9f6", authentication_type="Bearer Auth", destination_url="https://example.com/webhook", ) print(response.message) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "message": "Webhook test successful", "status_code": 200, "success": true } } ``` ## Test an existing webhook configuration `zero_trust.casb.posture.webhooks.evaluate_existing(strwebhook_id, WebhookEvaluateExistingParams**kwargs) -> WebhookEvaluateExistingResponse` **post** `/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}/evaluate` Sends a test webhook event using an existing webhook configuration. This allows customers to verify their webhook endpoint is still reachable and properly configured after creating the webhook resource. The test payload includes: - event_type: "webhook.test" - timestamp: Current UTC timestamp - message: Test message indicating this is from Cloudflare CASB - data: Object with test: true ### Parameters - `account_id: str` - `webhook_id: str` ### Returns - `class WebhookEvaluateExistingResponse: …` Response body for webhook evaluation test results. - `message: str` Human-readable message describing the test result. - `status_code: int` HTTP status code returned by the webhook endpoint. 0 if connection failed. - `success: bool` Whether the webhook test was successful (received 2xx response). ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.zero_trust.casb.posture.webhooks.evaluate_existing( webhook_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="46148281d8a93d002ef242d8b0d5f9f6", ) print(response.message) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "message": "Webhook test successful", "status_code": 200, "success": true } } ``` ## Domain Types ### Webhook List Response - `class WebhookListResponse: …` Webhook configuration for sending finding notifications. - `id: str` Unique identifier for the specific webhook configuration. - `authentication_type: Literal["Basic Auth", "None", "Bearer Auth", 2 more]` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: datetime` Timestamp when the webhook configuration was created. - `destination_url: str` Target URL for the webhook configuration. Where resulting data will be sent. - `label: str` Account-specified display label for the webhook configuration. - `status: Literal["enabled", "disabled"]` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: datetime` Timestamp when the webhook configuration was last updated. - `version: int` Version number of the configuration. - `headers: Optional[List[Header]]` List of header keys configured for this webhook. Values are not included for security reasons. - `key: Optional[str]` Header key name (lowercase). - `value: Optional[str]` Header value. This field is never returned in API responses for security reasons. ### Webhook Create Response - `class WebhookCreateResponse: …` Webhook configuration for sending finding notifications. - `id: str` Unique identifier for the specific webhook configuration. - `authentication_type: Literal["Basic Auth", "None", "Bearer Auth", 2 more]` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: datetime` Timestamp when the webhook configuration was created. - `destination_url: str` Target URL for the webhook configuration. Where resulting data will be sent. - `label: str` Account-specified display label for the webhook configuration. - `status: Literal["enabled", "disabled"]` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: datetime` Timestamp when the webhook configuration was last updated. - `version: int` Version number of the configuration. - `headers: Optional[List[Header]]` List of header keys configured for this webhook. Values are not included for security reasons. - `key: Optional[str]` Header key name (lowercase). - `value: Optional[str]` Header value. This field is never returned in API responses for security reasons. ### Webhook Get Response - `class WebhookGetResponse: …` Webhook configuration for sending finding notifications. - `id: str` Unique identifier for the specific webhook configuration. - `authentication_type: Literal["Basic Auth", "None", "Bearer Auth", 2 more]` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: datetime` Timestamp when the webhook configuration was created. - `destination_url: str` Target URL for the webhook configuration. Where resulting data will be sent. - `label: str` Account-specified display label for the webhook configuration. - `status: Literal["enabled", "disabled"]` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: datetime` Timestamp when the webhook configuration was last updated. - `version: int` Version number of the configuration. - `headers: Optional[List[Header]]` List of header keys configured for this webhook. Values are not included for security reasons. - `key: Optional[str]` Header key name (lowercase). - `value: Optional[str]` Header value. This field is never returned in API responses for security reasons. ### Webhook Update Response - `class WebhookUpdateResponse: …` Webhook configuration for sending finding notifications. - `id: str` Unique identifier for the specific webhook configuration. - `authentication_type: Literal["Basic Auth", "None", "Bearer Auth", 2 more]` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: datetime` Timestamp when the webhook configuration was created. - `destination_url: str` Target URL for the webhook configuration. Where resulting data will be sent. - `label: str` Account-specified display label for the webhook configuration. - `status: Literal["enabled", "disabled"]` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: datetime` Timestamp when the webhook configuration was last updated. - `version: int` Version number of the configuration. - `headers: Optional[List[Header]]` List of header keys configured for this webhook. Values are not included for security reasons. - `key: Optional[str]` Header key name (lowercase). - `value: Optional[str]` Header value. This field is never returned in API responses for security reasons. ### Webhook Delete Response - `class WebhookDeleteResponse: …` Common response structure for all API endpoints. - `errors: List[Error]` - `code: int` Error or message code. - `message: str` Human-readable message. - `documentation_url: Optional[str]` Link to relevant documentation. - `source: Optional[ErrorSource]` - `pointer: Optional[str]` JSON pointer to the source of the error. - `messages: List[Message]` - `code: int` Error or message code. - `message: str` Human-readable message. - `documentation_url: Optional[str]` Link to relevant documentation. - `source: Optional[MessageSource]` - `pointer: Optional[str]` JSON pointer to the source of the error. - `success: bool` Whether the API call was successful. ### Webhook Evaluate Response - `class WebhookEvaluateResponse: …` Response body for webhook evaluation test results. - `message: str` Human-readable message describing the test result. - `status_code: int` HTTP status code returned by the webhook endpoint. 0 if connection failed. - `success: bool` Whether the webhook test was successful (received 2xx response). ### Webhook Evaluate Existing Response - `class WebhookEvaluateExistingResponse: …` Response body for webhook evaluation test results. - `message: str` Human-readable message describing the test result. - `status_code: int` HTTP status code returned by the webhook endpoint. 0 if connection failed. - `success: bool` Whether the webhook test was successful (received 2xx response). # Jobs ## Create webhook jobs `zero_trust.casb.posture.webhooks.jobs.create(JobCreateParams**kwargs) -> JobCreateResponse` **post** `/accounts/{account_id}/data-security/posture/webhooks/jobs` Creates webhook jobs to send a finding instance to one or more configured webhooks. ### Parameters - `account_id: str` - `finding_instance_ids: Sequence[str]` Array of finding instance IDs to send to the webhooks - `webhook_ids: Sequence[str]` Array of webhook IDs to trigger jobs for ### Returns - `class JobCreateResponse: …` - `created: List[Created]` Successfully created webhook jobs. - `id: str` Unique identifier for the webhook job. - `asset_data: Dict[str, object]` Asset data associated with this webhook job. - `created_at: datetime` When the webhook job was created. - `integration_id: str` ID of the integration. - `last_updated_at: datetime` When the webhook job was last updated. - `parameters: CreatedParameters` Parameters for a webhook job. - `finding_instance_id: str` ID of the finding instance. - `status: Literal["pending", "processing", "completed", "failed"]` Status of a webhook job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `triggered_by_actor: Literal["user", "account_token"]` Type of actor that triggered the webhook job. - `"user"` - `"account_token"` - `triggered_by_id: str` ID of the actor that triggered the job. - `webhook_id: str` ID of the webhook configuration. - `failure_details: Optional[Dict[str, object]]` Additional details about the failure. - `failure_reason: Optional[Literal["Permission Denied", "Integration Unavailable", "Service Temporarily Unavailable", "System Error"]]` Reason for webhook job failure. - `"Permission Denied"` - `"Integration Unavailable"` - `"Service Temporarily Unavailable"` - `"System Error"` - `failed: List[Failed]` Failed webhook job creation attempts. - `error: str` Error message describing the failure. - `finding_instance_id: str` ID of the finding instance that failed to create a webhook job. - `webhook_id: str` ID of the webhook configuration. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) job = client.zero_trust.casb.posture.webhooks.jobs.create( account_id="46148281d8a93d002ef242d8b0d5f9f6", finding_instance_ids=["770e8400-e29b-41d4-a716-446655440002", "660e8400-e29b-41d4-a716-446655440001"], webhook_ids=["550e8400-e29b-41d4-a716-446655440000", "660e8400-e29b-41d4-a716-446655440001"], ) print(job.created) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result": { "created": [ { "id": "c416bc38-75db-425f-ae25-c37b5df5c37f", "asset_data": { "foo": "bar" }, "created_at": "2025-07-07T18:39:13.123456Z", "integration_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "last_updated_at": "2025-07-07T18:39:13.123456Z", "parameters": { "finding_instance_id": "3f7b8c9d-6e5a-4f3b-9c2d-1e0a8b7c6d5e" }, "status": "pending", "triggered_by_actor": "user", "triggered_by_id": "user@example.com", "webhook_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "failure_details": { "foo": "bar" }, "failure_reason": "Permission Denied" } ], "failed": [ { "error": "Failed to create webhook job", "finding_instance_id": "2e6b4c8a-9d1f-4e3b-8c7a-5f9e2d1a6b4c", "webhook_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" } ] }, "success": true } ``` ## Domain Types ### Job Create Response - `class JobCreateResponse: …` - `created: List[Created]` Successfully created webhook jobs. - `id: str` Unique identifier for the webhook job. - `asset_data: Dict[str, object]` Asset data associated with this webhook job. - `created_at: datetime` When the webhook job was created. - `integration_id: str` ID of the integration. - `last_updated_at: datetime` When the webhook job was last updated. - `parameters: CreatedParameters` Parameters for a webhook job. - `finding_instance_id: str` ID of the finding instance. - `status: Literal["pending", "processing", "completed", "failed"]` Status of a webhook job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `triggered_by_actor: Literal["user", "account_token"]` Type of actor that triggered the webhook job. - `"user"` - `"account_token"` - `triggered_by_id: str` ID of the actor that triggered the job. - `webhook_id: str` ID of the webhook configuration. - `failure_details: Optional[Dict[str, object]]` Additional details about the failure. - `failure_reason: Optional[Literal["Permission Denied", "Integration Unavailable", "Service Temporarily Unavailable", "System Error"]]` Reason for webhook job failure. - `"Permission Denied"` - `"Integration Unavailable"` - `"Service Temporarily Unavailable"` - `"System Error"` - `failed: List[Failed]` Failed webhook job creation attempts. - `error: str` Error message describing the failure. - `finding_instance_id: str` ID of the finding instance that failed to create a webhook job. - `webhook_id: str` ID of the webhook configuration.