# Casb # Applications ## List applications `client.zeroTrust.casb.applications.list(ApplicationListParamsparams, RequestOptionsoptions?): ApplicationListResponse` **get** `/accounts/{account_id}/one/applications` Returns a list of available applications with use cases and permissions. ### Parameters - `params: ApplicationListParams` - `account_id: string` Path param: Cloudflare account identifier. - `environment?: string` Query param: Filter by supported environment (standard, fedramp). ### Returns - `ApplicationListResponse = Array` - `id: "BITBUCKET" | "BOX" | "CONFLUENCE" | 7 more` Vendor identifier (e.g. microsoft_internal, google_workspace). * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `SALESFORCE` - SALESFORCE * `SLACK` - SLACK - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT_INTERNAL"` - `"SALESFORCE"` - `"SLACK"` - `auth_methods: Array` Available auth methods. - `id: string` Auth method identifier. - `display_name: string` Human-readable auth method name. - `category: string` Vendor category (e.g. Productivity, AI). - `description: string` Brief description of the integration. - `display_name: string` Human-readable vendor name. - `dlp_enabled: boolean` Whether DLP scanning is supported. - `logo: string | null` Logo path. - `permissions: Array` All permissions with severity. - `display_name: string` Human-readable permission name. - `scope: string` Vendor-native scope identifier. - `severity: "low" | "medium" | "high" | "critical"` Permission sensitivity level. * `low` - low * `medium` - medium * `high` - high * `critical` - critical - `"low"` - `"medium"` - `"high"` - `"critical"` - `supported_environments: Array` Environments this vendor supports (standard, fedramp). - `use_cases: Array` Supported use cases. - `id: string` Use case identifier (e.g. casb, ces). - `display_name: string` Human-readable use case name. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const applications = await client.zeroTrust.casb.applications.list({ account_id: '023e105f4ecef8ad9ca31a8372d0c353', }); console.log(applications); ``` #### Response ```json [ { "auth_methods": [ { "display_name": "OAuth 2.0 Admin Consent", "id": "oauth2_standard" } ], "category": "Productivity", "description": "Monitor OneDrive, SharePoint, Teams, and Outlook.", "display_name": "Microsoft", "dlp_enabled": true, "id": "MICROSOFT_INTERNAL", "logo": "/api/v4/accounts/12345678/casb/static/microsoft_internal.svg", "permissions": [ { "display_name": "Read all users' full profiles", "scope": "User.Read.All", "severity": "high" }, { "display_name": "Read all files", "scope": "Files.Read.All", "severity": "high" }, { "display_name": "Read and write mail", "scope": "Mail.ReadWrite", "severity": "critical" } ], "supported_environments": [ "standard", "fedramp" ], "use_cases": [ { "display_name": "Cloud Access Security Broker", "id": "casb" }, { "display_name": "Cloud Email Security", "id": "ces" } ] } ] ``` ## Get application details `client.zeroTrust.casb.applications.get("BITBUCKET" | "BOX" | "CONFLUENCE" | 7 moreapplicationID, ApplicationGetParamsparams, RequestOptionsoptions?): ApplicationGetResponse` **get** `/accounts/{account_id}/one/applications/{application_id}` Returns full application details including auth methods, use cases, and permissions. ### Parameters - `applicationID: "BITBUCKET" | "BOX" | "CONFLUENCE" | 7 more` - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT_INTERNAL"` - `"SALESFORCE"` - `"SLACK"` - `params: ApplicationGetParams` - `account_id: string` Cloudflare account identifier. ### Returns - `ApplicationGetResponse` Full application detail for onboarding UI. - `id: "BITBUCKET" | "BOX" | "CONFLUENCE" | 7 more` Vendor identifier. * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `SALESFORCE` - SALESFORCE * `SLACK` - SLACK - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT_INTERNAL"` - `"SALESFORCE"` - `"SLACK"` - `auth_methods: Array` Available authentication methods. - `id: string` Auth method identifier. - `display_name: string` Human-readable auth method name. - `is_default: boolean` Whether this is the default auth method. - `supported_environments: Array` Environments this auth method supports. - `category: string` Vendor category. - `description: string` Brief description. - `display_name: string` Human-readable vendor name. - `dlp_enabled: boolean` Whether DLP scanning is supported. - `instructions: string | null` Setup instructions for the user. - `logo: string | null` Logo path. - `use_cases: Array` Use cases with full scope details. - `id: string` Use case identifier. - `base_scopes: Array` Scopes always required for this use case. - `display_name: string` Human-readable permission name. - `scope: string` Vendor-native scope identifier. - `severity: "low" | "medium" | "high" | "critical"` Permission sensitivity level. * `low` - low * `medium` - medium * `high` - high * `critical` - critical - `"low"` - `"medium"` - `"high"` - `"critical"` - `description: string` Use case description. - `display_name: string` Human-readable use case name. - `features: Array` Optional features with extra scopes. - `id: string` Feature identifier. - `description: string` Feature description. - `display_name: string` Human-readable feature name. - `scopes: Array` Additional scopes when feature is enabled. - `display_name: string` Human-readable permission name. - `scope: string` Vendor-native scope identifier. - `severity: "low" | "medium" | "high" | "critical"` Permission sensitivity level. * `low` - low * `medium` - medium * `high` - high * `critical` - critical - `"low"` - `"medium"` - `"high"` - `"critical"` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const application = await client.zeroTrust.casb.applications.get('BITBUCKET', { account_id: '023e105f4ecef8ad9ca31a8372d0c353', }); console.log(application.id); ``` #### Response ```json { "auth_methods": [ { "display_name": "OAuth 2.0 Admin Consent", "id": "oauth2", "is_default": true, "supported_environments": [ "standard", "fedramp" ] } ], "category": "Productivity", "description": "Monitor OneDrive, SharePoint, Teams, and Outlook.", "display_name": "Microsoft", "dlp_enabled": true, "id": "MICROSOFT_INTERNAL", "instructions": "You'll need a Microsoft 365 admin account with Global Admin or Application Admin role.", "logo": "/api/v4/accounts/12345678/casb/static/microsoft_internal.svg", "use_cases": [ { "base_scopes": [ { "display_name": "Read all users' full profiles", "scope": "User.Read.All", "severity": "high" }, { "display_name": "Read all files", "scope": "Files.Read.All", "severity": "high" } ], "description": "Discover and secure SaaS applications", "display_name": "Cloud Access Security Broker", "features": [ { "description": "Automatically remediate security issues", "display_name": "Auto Remediation", "id": "auto_remediation", "scopes": [ { "display_name": "Read and write all files", "scope": "Files.ReadWrite.All", "severity": "critical" } ] } ], "id": "casb" } ] } ``` ## Domain Types ### Application List Response - `ApplicationListResponse = Array` - `id: "BITBUCKET" | "BOX" | "CONFLUENCE" | 7 more` Vendor identifier (e.g. microsoft_internal, google_workspace). * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `SALESFORCE` - SALESFORCE * `SLACK` - SLACK - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT_INTERNAL"` - `"SALESFORCE"` - `"SLACK"` - `auth_methods: Array` Available auth methods. - `id: string` Auth method identifier. - `display_name: string` Human-readable auth method name. - `category: string` Vendor category (e.g. Productivity, AI). - `description: string` Brief description of the integration. - `display_name: string` Human-readable vendor name. - `dlp_enabled: boolean` Whether DLP scanning is supported. - `logo: string | null` Logo path. - `permissions: Array` All permissions with severity. - `display_name: string` Human-readable permission name. - `scope: string` Vendor-native scope identifier. - `severity: "low" | "medium" | "high" | "critical"` Permission sensitivity level. * `low` - low * `medium` - medium * `high` - high * `critical` - critical - `"low"` - `"medium"` - `"high"` - `"critical"` - `supported_environments: Array` Environments this vendor supports (standard, fedramp). - `use_cases: Array` Supported use cases. - `id: string` Use case identifier (e.g. casb, ces). - `display_name: string` Human-readable use case name. ### Application Get Response - `ApplicationGetResponse` Full application detail for onboarding UI. - `id: "BITBUCKET" | "BOX" | "CONFLUENCE" | 7 more` Vendor identifier. * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `SALESFORCE` - SALESFORCE * `SLACK` - SLACK - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT_INTERNAL"` - `"SALESFORCE"` - `"SLACK"` - `auth_methods: Array` Available authentication methods. - `id: string` Auth method identifier. - `display_name: string` Human-readable auth method name. - `is_default: boolean` Whether this is the default auth method. - `supported_environments: Array` Environments this auth method supports. - `category: string` Vendor category. - `description: string` Brief description. - `display_name: string` Human-readable vendor name. - `dlp_enabled: boolean` Whether DLP scanning is supported. - `instructions: string | null` Setup instructions for the user. - `logo: string | null` Logo path. - `use_cases: Array` Use cases with full scope details. - `id: string` Use case identifier. - `base_scopes: Array` Scopes always required for this use case. - `display_name: string` Human-readable permission name. - `scope: string` Vendor-native scope identifier. - `severity: "low" | "medium" | "high" | "critical"` Permission sensitivity level. * `low` - low * `medium` - medium * `high` - high * `critical` - critical - `"low"` - `"medium"` - `"high"` - `"critical"` - `description: string` Use case description. - `display_name: string` Human-readable use case name. - `features: Array` Optional features with extra scopes. - `id: string` Feature identifier. - `description: string` Feature description. - `display_name: string` Human-readable feature name. - `scopes: Array` Additional scopes when feature is enabled. - `display_name: string` Human-readable permission name. - `scope: string` Vendor-native scope identifier. - `severity: "low" | "medium" | "high" | "critical"` Permission sensitivity level. * `low` - low * `medium` - medium * `high` - high * `critical` - critical - `"low"` - `"medium"` - `"high"` - `"critical"` # Auth Methods ## Get auth methods `client.zeroTrust.casb.applications.authMethods.list("BITBUCKET" | "BOX" | "CONFLUENCE" | 7 moreapplicationID, AuthMethodListParamsparams, RequestOptionsoptions?): AuthMethodListResponse` **get** `/accounts/{account_id}/one/applications/{application_id}/auth-methods` Returns available auth methods for the specified vendor, including credential schema, instructions, and example payloads. Use this to understand what credentials are required before calling POST /v2/integrations. ### Parameters - `applicationID: "BITBUCKET" | "BOX" | "CONFLUENCE" | 7 more` - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT_INTERNAL"` - `"SALESFORCE"` - `"SLACK"` - `params: AuthMethodListParams` - `account_id: string` Cloudflare account identifier. ### Returns - `AuthMethodListResponse = Array` - `id: string` Auth method identifier. - `display_name: string` Human-readable auth method name. - `human_interaction_required: boolean` Whether setup requires human interaction or integration can be created purely using API (e.g., For OAuth can not be created without user interaction). - `instructions: Instructions` Step-by-step instructions for obtaining credentials. - `markdown: string` Detailed instructions in markdown format. - `payload_example: Record | null` Example credentials payload with placeholder values. - `payload_schema: Record | null` JSON Schema for the credentials object in POST /v2/integrations request. - `redirect_url: string | null` OAuth redirect URL for vendors requiring human interaction. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const authMethods = await client.zeroTrust.casb.applications.authMethods.list('BITBUCKET', { account_id: '023e105f4ecef8ad9ca31a8372d0c353', }); console.log(authMethods); ``` #### Response ```json [ { "id": "id", "display_name": "display_name", "human_interaction_required": true, "instructions": { "markdown": "markdown" }, "payload_example": { "foo": "bar" }, "payload_schema": { "foo": "bar" }, "redirect_url": "redirect_url" } ] ``` ## Domain Types ### Auth Method List Response - `AuthMethodListResponse = Array` - `id: string` Auth method identifier. - `display_name: string` Human-readable auth method name. - `human_interaction_required: boolean` Whether setup requires human interaction or integration can be created purely using API (e.g., For OAuth can not be created without user interaction). - `instructions: Instructions` Step-by-step instructions for obtaining credentials. - `markdown: string` Detailed instructions in markdown format. - `payload_example: Record | null` Example credentials payload with placeholder values. - `payload_schema: Record | null` JSON Schema for the credentials object in POST /v2/integrations request. - `redirect_url: string | null` OAuth redirect URL for vendors requiring human interaction. # Integrations ## List integrations `client.zeroTrust.casb.integrations.list(IntegrationListParamsparams, RequestOptionsoptions?): IntegrationListResponse` **get** `/accounts/{account_id}/one/integrations` Returns a paginated list of integrations for the account. ### Parameters - `params: IntegrationListParams` - `account_id: string` Path param: Cloudflare account identifier. - `application?: string` Query param: Filter by application/vendor (e.g., GOOGLE_WORKSPACE, MICROSOFT_INTERNAL). - `direction?: "asc" | "desc"` Query param: Direction to order results. - `"asc"` - `"desc"` - `dlp_enabled?: boolean` Query param: Filter by DLP enabled status (true/false). - `order?: "application" | "created" | "name" | "status"` Query param: Field to order results by. - `"application"` - `"created"` - `"name"` - `"status"` - `page?: number` Query param: Page number within the paginated result set. - `page_size?: number` Query param: Number of results per page. - `search?: string` Query param: Search integrations by name or application. - `status?: "Healthy" | "Initializing" | "Offline" | "Unhealthy"` Query param: Filter by integration status. - `"Healthy"` - `"Initializing"` - `"Offline"` - `"Unhealthy"` - `use_cases?: string` Query param: Filter by enabled use cases (e.g., casb, ces). Matches integrations enrolled in any of the specified values. Can be specified multiple times. ### Returns - `IntegrationListResponse = unknown` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const integrations = await client.zeroTrust.casb.integrations.list({ account_id: '023e105f4ecef8ad9ca31a8372d0c353', }); console.log(integrations); ``` #### Response ```json { "errors": [], "messages": [], "result": [ { "application": { "category": "Productivity", "display_name": "Google Workspace", "logo": "https://onprem.cloudflare.com/static/google_workspace.png" }, "created": "2025-01-15T10:00:00Z", "id": "019d2e6a-d995-7185-afbd-4feead9e42ec", "is_paused": false, "name": "My Google Workspace", "status": "Healthy", "updated": "2025-04-10T08:30:00Z" } ], "result_info": { "count": 1, "next": null, "page": 1, "per_page": 10, "previous": null, "total_count": 1 }, "success": true } ``` ## Get integration details `client.zeroTrust.casb.integrations.get(stringid, IntegrationGetParamsparams, RequestOptionsoptions?): IntegrationGetResponse` **get** `/accounts/{account_id}/one/integrations/{id}` Returns full integration details including use cases and permissions. ### Parameters - `id: string` - `params: IntegrationGetParams` - `account_id: string` Cloudflare account identifier. ### Returns - `IntegrationGetResponse` Serializer for v2 integration detail response with use cases. - `id: string` Integration ID. - `application: Record` - `auth_method: Record | null` The integration's authentication method. - `authorization_link: AuthorizationLink | null` Authorization link for the integration. - `components: Record | null` - `link: string | null` - `created: string` When the integration was created. - `credentials_expiry: string` Credentials expiry time. - `dlp_profiles: Array` DLP Profiles enabled for the integration. - `health_details: Array>` Health details with remediation hints. - `is_paused: boolean` Whether the user paused the integration. - `last_hydrated: string` Last time the integration was hydrated. - `name: string` Name of the integration. - `organization_id: number` Organization ID. - `status: string` Integration status. - `updated: string` When the integration was last updated. - `use_cases: Array>` Use cases enabled for the integration. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const integration = await client.zeroTrust.casb.integrations.get('id', { account_id: '023e105f4ecef8ad9ca31a8372d0c353', }); console.log(integration.id); ``` #### Response ```json { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "application": { "foo": "string" }, "auth_method": { "foo": "string" }, "authorization_link": { "components": { "foo": "bar" }, "link": "link" }, "created": "2019-12-27T18:11:19.117Z", "credentials_expiry": "2019-12-27T18:11:19.117Z", "dlp_profiles": [ "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" ], "health_details": [ { "foo": "bar" } ], "is_paused": true, "last_hydrated": "2019-12-27T18:11:19.117Z", "name": "name", "organization_id": 0, "status": "status", "updated": "2019-12-27T18:11:19.117Z", "use_cases": [ { "foo": "bar" } ] } ``` ## Create integration `client.zeroTrust.casb.integrations.create(IntegrationCreateParamsparams, RequestOptionsoptions?): IntegrationCreateResponse` **post** `/accounts/{account_id}/one/integrations` Creates a new integration for the specified application. Integration creation with OAuth is not supported by API at the moment. For other auth methods, use `GET /v2/applications/{application_id}/credential-guide` to see the required credential structure and example payloads for each vendor. ### Parameters - `params: IntegrationCreateParams` - `account_id: string` Path param: Cloudflare account identifier. - `application: "BITBUCKET" | "BOX" | "CONFLUENCE" | 7 more` Body param: Vendor/application slug (e.g., GOOGLE_WORKSPACE). * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `SALESFORCE` - SALESFORCE * `SLACK` - SLACK - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT_INTERNAL"` - `"SALESFORCE"` - `"SLACK"` - `credentials: Record` Body param: Credentials for the integration. - `name: string` Body param: Name of the integration. - `auth_method?: string | null` Body param: Authentication method slug (uses default if omitted). - `dlp_profiles?: Array` Body param: List of DLP profile IDs to associate. - `permissions?: Array` Body param: List of permission scopes (uses policy defaults if empty). - `use_cases?: Array<"casb" | "ces" | "auto_remediation">` Body param: List of use case or feature slugs to enroll (e.g., ['casb', 'ces', 'auto_remediation']). - `"casb"` - `"ces"` - `"auto_remediation"` ### Returns - `IntegrationCreateResponse` Serializer for v2 integration detail response with use cases. - `id: string` Integration ID. - `application: Record` - `auth_method: Record | null` The integration's authentication method. - `authorization_link: AuthorizationLink | null` Authorization link for the integration. - `components: Record | null` - `link: string | null` - `created: string` When the integration was created. - `credentials_expiry: string` Credentials expiry time. - `dlp_profiles: Array` DLP Profiles enabled for the integration. - `health_details: Array>` Health details with remediation hints. - `is_paused: boolean` Whether the user paused the integration. - `last_hydrated: string` Last time the integration was hydrated. - `name: string` Name of the integration. - `organization_id: number` Organization ID. - `status: string` Integration status. - `updated: string` When the integration was last updated. - `use_cases: Array>` Use cases enabled for the integration. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const integration = await client.zeroTrust.casb.integrations.create({ account_id: '023e105f4ecef8ad9ca31a8372d0c353', application: 'GOOGLE_WORKSPACE', credentials: { admin_email: 'admin@corp.com' }, name: 'My Google Workspace', auth_method: 'service_account', dlp_profiles: ['e91a2360-da51-4fdf-9711-bcdecd462614'], permissions: ['https://www.googleapis.com/auth/drive.readonly'], use_cases: ['casb', 'ces'], }); console.log(integration.id); ``` #### Response ```json { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "application": { "foo": "string" }, "auth_method": { "foo": "string" }, "authorization_link": { "components": { "foo": "bar" }, "link": "link" }, "created": "2019-12-27T18:11:19.117Z", "credentials_expiry": "2019-12-27T18:11:19.117Z", "dlp_profiles": [ "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" ], "health_details": [ { "foo": "bar" } ], "is_paused": true, "last_hydrated": "2019-12-27T18:11:19.117Z", "name": "name", "organization_id": 0, "status": "status", "updated": "2019-12-27T18:11:19.117Z", "use_cases": [ { "foo": "bar" } ] } ``` ## Update integration `client.zeroTrust.casb.integrations.update(stringid, IntegrationUpdateParamsparams, RequestOptionsoptions?): IntegrationUpdateResponse` **patch** `/accounts/{account_id}/one/integrations/{id}` Updates an integration's name, permissions, DLP profiles, use cases, or credentials. ### Parameters - `id: string` - `params: IntegrationUpdateParams` - `account_id: string` Path param: Cloudflare account identifier. - `credentials?: Record` Body param: Partial credential fields to merge with existing. - `dlp_profiles?: Array` Body param: List of DLP profile IDs to associate with the integration. - `name?: string` Body param: Name of the integration. - `permissions?: Array` Body param: List of permission scopes granted to the integration. - `use_cases?: Array<"casb" | "ces" | "auto_remediation">` Body param: List of use case or feature slugs to enroll (e.g., ['casb', 'ces', 'auto_remediation']). - `"casb"` - `"ces"` - `"auto_remediation"` ### Returns - `IntegrationUpdateResponse` Serializer for v2 integration detail response with use cases. - `id: string` Integration ID. - `application: Record` - `auth_method: Record | null` The integration's authentication method. - `authorization_link: AuthorizationLink | null` Authorization link for the integration. - `components: Record | null` - `link: string | null` - `created: string` When the integration was created. - `credentials_expiry: string` Credentials expiry time. - `dlp_profiles: Array` DLP Profiles enabled for the integration. - `health_details: Array>` Health details with remediation hints. - `is_paused: boolean` Whether the user paused the integration. - `last_hydrated: string` Last time the integration was hydrated. - `name: string` Name of the integration. - `organization_id: number` Organization ID. - `status: string` Integration status. - `updated: string` When the integration was last updated. - `use_cases: Array>` Use cases enabled for the integration. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const integration = await client.zeroTrust.casb.integrations.update('id', { account_id: '023e105f4ecef8ad9ca31a8372d0c353', credentials: { access_token: 'new_access_token', refresh_token: 'new_refresh_token' }, }); console.log(integration.id); ``` #### Response ```json { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "application": { "foo": "string" }, "auth_method": { "foo": "string" }, "authorization_link": { "components": { "foo": "bar" }, "link": "link" }, "created": "2019-12-27T18:11:19.117Z", "credentials_expiry": "2019-12-27T18:11:19.117Z", "dlp_profiles": [ "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" ], "health_details": [ { "foo": "bar" } ], "is_paused": true, "last_hydrated": "2019-12-27T18:11:19.117Z", "name": "name", "organization_id": 0, "status": "status", "updated": "2019-12-27T18:11:19.117Z", "use_cases": [ { "foo": "bar" } ] } ``` ## Delete integration `client.zeroTrust.casb.integrations.delete(stringid, IntegrationDeleteParamsparams, RequestOptionsoptions?): void` **delete** `/accounts/{account_id}/one/integrations/{id}` Delete an integration by soft-deleting it. ### Parameters - `id: string` - `params: IntegrationDeleteParams` - `account_id: string` Cloudflare account identifier. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); await client.zeroTrust.casb.integrations.delete('id', { account_id: '023e105f4ecef8ad9ca31a8372d0c353', }); ``` ## Pause integration `client.zeroTrust.casb.integrations.pause(stringid, IntegrationPauseParamsparams, RequestOptionsoptions?): IntegrationPauseResponse` **post** `/accounts/{account_id}/one/integrations/{id}/pause` Pauses an integration, stopping all crawlers. ### Parameters - `id: string` - `params: IntegrationPauseParams` - `account_id: string` Cloudflare account identifier. ### Returns - `IntegrationPauseResponse` Serializer for v2 integration detail response with use cases. - `id: string` Integration ID. - `application: Record` - `auth_method: Record | null` The integration's authentication method. - `authorization_link: AuthorizationLink | null` Authorization link for the integration. - `components: Record | null` - `link: string | null` - `created: string` When the integration was created. - `credentials_expiry: string` Credentials expiry time. - `dlp_profiles: Array` DLP Profiles enabled for the integration. - `health_details: Array>` Health details with remediation hints. - `is_paused: boolean` Whether the user paused the integration. - `last_hydrated: string` Last time the integration was hydrated. - `name: string` Name of the integration. - `organization_id: number` Organization ID. - `status: string` Integration status. - `updated: string` When the integration was last updated. - `use_cases: Array>` Use cases enabled for the integration. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const response = await client.zeroTrust.casb.integrations.pause('id', { account_id: '023e105f4ecef8ad9ca31a8372d0c353', }); console.log(response.id); ``` #### Response ```json { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "application": { "foo": "string" }, "auth_method": { "foo": "string" }, "authorization_link": { "components": { "foo": "bar" }, "link": "link" }, "created": "2019-12-27T18:11:19.117Z", "credentials_expiry": "2019-12-27T18:11:19.117Z", "dlp_profiles": [ "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" ], "health_details": [ { "foo": "bar" } ], "is_paused": true, "last_hydrated": "2019-12-27T18:11:19.117Z", "name": "name", "organization_id": 0, "status": "status", "updated": "2019-12-27T18:11:19.117Z", "use_cases": [ { "foo": "bar" } ] } ``` ## Resume integration `client.zeroTrust.casb.integrations.resume(stringid, IntegrationResumeParamsparams, RequestOptionsoptions?): IntegrationResumeResponse` **post** `/accounts/{account_id}/one/integrations/{id}/resume` Resumes a paused integration, restarting crawlers. ### Parameters - `id: string` - `params: IntegrationResumeParams` - `account_id: string` Cloudflare account identifier. ### Returns - `IntegrationResumeResponse` Serializer for v2 integration detail response with use cases. - `id: string` Integration ID. - `application: Record` - `auth_method: Record | null` The integration's authentication method. - `authorization_link: AuthorizationLink | null` Authorization link for the integration. - `components: Record | null` - `link: string | null` - `created: string` When the integration was created. - `credentials_expiry: string` Credentials expiry time. - `dlp_profiles: Array` DLP Profiles enabled for the integration. - `health_details: Array>` Health details with remediation hints. - `is_paused: boolean` Whether the user paused the integration. - `last_hydrated: string` Last time the integration was hydrated. - `name: string` Name of the integration. - `organization_id: number` Organization ID. - `status: string` Integration status. - `updated: string` When the integration was last updated. - `use_cases: Array>` Use cases enabled for the integration. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const response = await client.zeroTrust.casb.integrations.resume('id', { account_id: '023e105f4ecef8ad9ca31a8372d0c353', }); console.log(response.id); ``` #### Response ```json { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "application": { "foo": "string" }, "auth_method": { "foo": "string" }, "authorization_link": { "components": { "foo": "bar" }, "link": "link" }, "created": "2019-12-27T18:11:19.117Z", "credentials_expiry": "2019-12-27T18:11:19.117Z", "dlp_profiles": [ "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" ], "health_details": [ { "foo": "bar" } ], "is_paused": true, "last_hydrated": "2019-12-27T18:11:19.117Z", "name": "name", "organization_id": 0, "status": "status", "updated": "2019-12-27T18:11:19.117Z", "use_cases": [ { "foo": "bar" } ] } ``` ## Domain Types ### Integration List Response - `IntegrationListResponse = unknown` ### Integration Get Response - `IntegrationGetResponse` Serializer for v2 integration detail response with use cases. - `id: string` Integration ID. - `application: Record` - `auth_method: Record | null` The integration's authentication method. - `authorization_link: AuthorizationLink | null` Authorization link for the integration. - `components: Record | null` - `link: string | null` - `created: string` When the integration was created. - `credentials_expiry: string` Credentials expiry time. - `dlp_profiles: Array` DLP Profiles enabled for the integration. - `health_details: Array>` Health details with remediation hints. - `is_paused: boolean` Whether the user paused the integration. - `last_hydrated: string` Last time the integration was hydrated. - `name: string` Name of the integration. - `organization_id: number` Organization ID. - `status: string` Integration status. - `updated: string` When the integration was last updated. - `use_cases: Array>` Use cases enabled for the integration. ### Integration Create Response - `IntegrationCreateResponse` Serializer for v2 integration detail response with use cases. - `id: string` Integration ID. - `application: Record` - `auth_method: Record | null` The integration's authentication method. - `authorization_link: AuthorizationLink | null` Authorization link for the integration. - `components: Record | null` - `link: string | null` - `created: string` When the integration was created. - `credentials_expiry: string` Credentials expiry time. - `dlp_profiles: Array` DLP Profiles enabled for the integration. - `health_details: Array>` Health details with remediation hints. - `is_paused: boolean` Whether the user paused the integration. - `last_hydrated: string` Last time the integration was hydrated. - `name: string` Name of the integration. - `organization_id: number` Organization ID. - `status: string` Integration status. - `updated: string` When the integration was last updated. - `use_cases: Array>` Use cases enabled for the integration. ### Integration Update Response - `IntegrationUpdateResponse` Serializer for v2 integration detail response with use cases. - `id: string` Integration ID. - `application: Record` - `auth_method: Record | null` The integration's authentication method. - `authorization_link: AuthorizationLink | null` Authorization link for the integration. - `components: Record | null` - `link: string | null` - `created: string` When the integration was created. - `credentials_expiry: string` Credentials expiry time. - `dlp_profiles: Array` DLP Profiles enabled for the integration. - `health_details: Array>` Health details with remediation hints. - `is_paused: boolean` Whether the user paused the integration. - `last_hydrated: string` Last time the integration was hydrated. - `name: string` Name of the integration. - `organization_id: number` Organization ID. - `status: string` Integration status. - `updated: string` When the integration was last updated. - `use_cases: Array>` Use cases enabled for the integration. ### Integration Pause Response - `IntegrationPauseResponse` Serializer for v2 integration detail response with use cases. - `id: string` Integration ID. - `application: Record` - `auth_method: Record | null` The integration's authentication method. - `authorization_link: AuthorizationLink | null` Authorization link for the integration. - `components: Record | null` - `link: string | null` - `created: string` When the integration was created. - `credentials_expiry: string` Credentials expiry time. - `dlp_profiles: Array` DLP Profiles enabled for the integration. - `health_details: Array>` Health details with remediation hints. - `is_paused: boolean` Whether the user paused the integration. - `last_hydrated: string` Last time the integration was hydrated. - `name: string` Name of the integration. - `organization_id: number` Organization ID. - `status: string` Integration status. - `updated: string` When the integration was last updated. - `use_cases: Array>` Use cases enabled for the integration. ### Integration Resume Response - `IntegrationResumeResponse` Serializer for v2 integration detail response with use cases. - `id: string` Integration ID. - `application: Record` - `auth_method: Record | null` The integration's authentication method. - `authorization_link: AuthorizationLink | null` Authorization link for the integration. - `components: Record | null` - `link: string | null` - `created: string` When the integration was created. - `credentials_expiry: string` Credentials expiry time. - `dlp_profiles: Array` DLP Profiles enabled for the integration. - `health_details: Array>` Health details with remediation hints. - `is_paused: boolean` Whether the user paused the integration. - `last_hydrated: string` Last time the integration was hydrated. - `name: string` Name of the integration. - `organization_id: number` Organization ID. - `status: string` Integration status. - `updated: string` When the integration was last updated. - `use_cases: Array>` Use cases enabled for the integration. # Posture # Findings ## List posture findings `client.zeroTrust.casb.posture.findings.list(FindingListParamsparams, RequestOptionsoptions?): V4PagePaginationArray` **get** `/accounts/{account_id}/data-security/posture/findings` List all security findings that have been identified as being problematic. This will return a list of findings regardless if they have been ignored or not. ### Parameters - `params: FindingListParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `cursor?: string` Query param: A cursor for pagination. Obtained from the `result_info.cursor` field of a previous response. - `direction?: "asc" | "desc"` Query param: Direction to order results. - `"asc"` - `"desc"` - `finding_type_ids?: string` Query param: A comma separated list of UUIDs identifying the finding type(s). - `ignored?: boolean` Query param: Filter for only the ignored findings. Set to false to only see "active" items - `integration_id?: string` Query param: Filter by an integration ID - `max_affliction_date?: string` Query param: Filter to view findings that occurred on or before the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `min_affliction_date?: string` Query param: Filter to view findings that occurred on or after the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `observation?: "Activity" | "Insight" | "Issue"` Query param: Filter by observation type of the finding - `"Activity"` - `"Insight"` - `"Issue"` - `order?: "finding.name" | "instance_count" | "integration.name" | 2 more` Query param: Which field to use when ordering the findings. - `"finding.name"` - `"instance_count"` - `"integration.name"` - `"latest_affliction_date"` - `"severity"` - `page?: number` Query param: A page number within the paginated result set. - `per_page?: number` Query param: Number of results to return per page. - `product?: "Cloud" | "Saas"` Query param: Filter by product category of the finding - `"Cloud"` - `"Saas"` - `search?: string` Query param: A search term. - `severity?: "Critical" | "High" | "Medium" | "Low"` Query param: Filter by severity - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `type?: "Content" | "Posture"` Query param: Filter by type of the finding - `"Content"` - `"Posture"` - `vendor?: "ANTHROPIC" | "AWS" | "BITBUCKET" | 13 more` Query param: Filter by vendor - `"ANTHROPIC"` - `"AWS"` - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_CLOUD_PLATFORM"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT"` - `"MICROSOFT_INTERNAL"` - `"OPENAI"` - `"SALESFORCE"` - `"SERVICENOW"` - `"SLACK"` ### Returns - `FindingListResponse` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: string` Base64 encoded identifier of the security finding. - `active_count: number` Number of active problematic instances identified in the security finding. - `archived_count: number` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description?: string | null` Detailed description of the finding. - `remediation?: Remediation` Remediation guide information for a finding. - `id: string` Remediation Id. - `frameworks: Array` Relevant Compliance Frameworks. - `guide: string` Remediation guide text. - `impact: string` Description of the potential impact. - `locale: string` I18N Locale. - `threat: string` Description of the threat. - `ignored: boolean` Determines if finding is currently ignored. - `instance_count: number` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: string` When entity was created. - `last_hydrated: string` When were the integration credentials last updated. - `name: string` Name of the integration. - `permissions: Array` The vendor-specific permissions associated with the integration. - `policy: Policy` Policy configuration for an integration. - `id?: string` Policy identifier. - `client_id?: string | null` OAuth client ID for the policy. - `compliance_level?: string` Compliance level for the policy. - `dlp_enabled?: boolean` Whether DLP is enabled for this policy. - `link?: string | null` Link to policy documentation. - `name?: string` Policy name. - `permissions?: Array` List of permissions included in the policy. - `status: string` Current status of the integration. - `updated: string` Last entity was updated. - `upgradable: boolean` Whether the integrations permissions can be updated. - `vendor: Vendor` Information about a vendor/service provider. - `id: string` The id of the vendor. - `description: string | null` Detailed information about what kinds of issues are detected for this vendor. - `display_name: string` The display name of the vendor. - `logo: string` Logo URL for the vendor. - `name: string` The name of the vendor. - `static_logo: string` Static logo URL for the vendor. - `zt_enrollments: Array` The vendor's compatible Zero Trust products. - `policies?: Array>` The policies related to the vendor. - `zt_enrollments: Array` Zero Trust products associated with this integration. - `id?: string` The internal identifier of the Zero Trust Product. - `description?: string` Brief description of the Zero Trust Product. - `display_name?: string` The verbose name of the Zero Trust Product. - `enabled?: boolean` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id?: string` Integration ID. - `credential_health_status?: "Initializing" | "Healthy" | "Unhealthy"` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry?: string | null` The date and time when the integration credentials will expire. - `is_paused?: boolean` Whether the given integration is paused by the user. - `upgrade_dismissed?: boolean` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: string` Timestamp of the latest affliction date of an active finding. - `severity_override?: SeverityOverride` Override information for finding severity. - `created_by: string` User ID who created the override. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); // Automatically fetches more pages as needed. for await (const findingListResponse of client.zeroTrust.casb.posture.findings.list({ account_id: '46148281d8a93d002ef242d8b0d5f9f6', })) { console.log(findingListResponse.id); } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } ] } ``` ## Get a finding type `client.zeroTrust.casb.posture.findings.get(stringfindingID, FindingGetParamsparams, RequestOptionsoptions?): FindingGetResponse` **get** `/accounts/{account_id}/data-security/posture/findings/{finding_id}` Gets a security Finding that has been identified as being problematic. ### Parameters - `findingID: string` - `params: FindingGetParams` - `account_id: string` Cloudflare account ID for the user making the request. ### Returns - `FindingGetResponse` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: string` Base64 encoded identifier of the security finding. - `active_count: number` Number of active problematic instances identified in the security finding. - `archived_count: number` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description?: string | null` Detailed description of the finding. - `remediation?: Remediation` Remediation guide information for a finding. - `id: string` Remediation Id. - `frameworks: Array` Relevant Compliance Frameworks. - `guide: string` Remediation guide text. - `impact: string` Description of the potential impact. - `locale: string` I18N Locale. - `threat: string` Description of the threat. - `ignored: boolean` Determines if finding is currently ignored. - `instance_count: number` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: string` When entity was created. - `last_hydrated: string` When were the integration credentials last updated. - `name: string` Name of the integration. - `permissions: Array` The vendor-specific permissions associated with the integration. - `policy: Policy` Policy configuration for an integration. - `id?: string` Policy identifier. - `client_id?: string | null` OAuth client ID for the policy. - `compliance_level?: string` Compliance level for the policy. - `dlp_enabled?: boolean` Whether DLP is enabled for this policy. - `link?: string | null` Link to policy documentation. - `name?: string` Policy name. - `permissions?: Array` List of permissions included in the policy. - `status: string` Current status of the integration. - `updated: string` Last entity was updated. - `upgradable: boolean` Whether the integrations permissions can be updated. - `vendor: Vendor` Information about a vendor/service provider. - `id: string` The id of the vendor. - `description: string | null` Detailed information about what kinds of issues are detected for this vendor. - `display_name: string` The display name of the vendor. - `logo: string` Logo URL for the vendor. - `name: string` The name of the vendor. - `static_logo: string` Static logo URL for the vendor. - `zt_enrollments: Array` The vendor's compatible Zero Trust products. - `policies?: Array>` The policies related to the vendor. - `zt_enrollments: Array` Zero Trust products associated with this integration. - `id?: string` The internal identifier of the Zero Trust Product. - `description?: string` Brief description of the Zero Trust Product. - `display_name?: string` The verbose name of the Zero Trust Product. - `enabled?: boolean` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id?: string` Integration ID. - `credential_health_status?: "Initializing" | "Healthy" | "Unhealthy"` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry?: string | null` The date and time when the integration credentials will expire. - `is_paused?: boolean` Whether the given integration is paused by the user. - `upgrade_dismissed?: boolean` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: string` Timestamp of the latest affliction date of an active finding. - `severity_override?: SeverityOverride` Override information for finding severity. - `created_by: string` User ID who created the override. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const finding = await client.zeroTrust.casb.posture.findings.get('U3RhaW5sZXNzIHJvY2tz', { account_id: '46148281d8a93d002ef242d8b0d5f9f6', }); console.log(finding.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } } ``` ## Create new findings export request `client.zeroTrust.casb.posture.findings.export(FindingExportParamsparams, RequestOptionsoptions?): FindingExportResponse` **post** `/accounts/{account_id}/data-security/posture/findings/export` Creates a CSV export for findings and accepts optional filters in the payload. ### Parameters - `params: FindingExportParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `ignored?: boolean` Body param: Filter for only the ignored findings. Set to false to only see active items. - `integration_id?: Array` Body param: Filter by multiple integration IDs. - `max_affliction_date?: string` Body param: Filter to view findings that occurred on or before the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `min_affliction_date?: string` Body param: Filter to view findings that occurred on or after the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `orders?: Array` Body param: Which fields to use when ordering the findings. - `direction: "asc" | "desc"` Sort direction. - `"asc"` - `"desc"` - `name: "instance_count" | "finding.name" | "integration.name" | 2 more` Which field to use when ordering the findings. - `"instance_count"` - `"finding.name"` - `"integration.name"` - `"latest_affliction_date"` - `"severity"` - `product?: "SaaS" | "Cloud" | null` Body param: Filter by finding's category product. - `"SaaS"` - `"Cloud"` - `search?: string` Body param: A search term. - `severities?: Array<"CRITICAL" | "HIGH" | "MEDIUM" | "LOW">` Body param: Filter by severity levels. - `"CRITICAL"` - `"HIGH"` - `"MEDIUM"` - `"LOW"` - `vendors?: Array<"ANTHROPIC" | "AWS" | "BITBUCKET" | 13 more>` Body param: Filter by vendor types. - `"ANTHROPIC"` - `"AWS"` - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_CLOUD_PLATFORM"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT"` - `"MICROSOFT_INTERNAL"` - `"OPENAI"` - `"SALESFORCE"` - `"SERVICENOW"` - `"SLACK"` ### Returns - `FindingExportResponse` Information about an export job. - `id: string` Unique identifier for the export job. - `status: "Pending" | "Success" | "Failure" | 2 more` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: "finding" | "findingInstance" | "content" | "remediationJob"` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: string` ID of the export-requesting user. - `download_url?: string | null` The URL by which the successfully created export can be downloaded by the end users. - `errors?: string | null` Contains information on errors which may have occurred during export creation. - `file_name?: string | null` The base name of the file that is/was generated by the export job. - `file_path?: string | null` The full path of the file that is stored within external storage (currently R2). ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const response = await client.zeroTrust.casb.posture.findings.export({ account_id: '46148281d8a93d002ef242d8b0d5f9f6', }); console.log(response.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } } ``` ## Mark a finding as ignored `client.zeroTrust.casb.posture.findings.ignore(FindingIgnoreParamsparams, RequestOptionsoptions?): FindingIgnoreResponse` **post** `/accounts/{account_id}/data-security/posture/findings/ignore` Given a list of findings, mark as ignored. Does nothing if Finding is already ignored. ### Parameters - `params: FindingIgnoreParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `checks: Array` Body param: A list of finding IDs to pass along. ### Returns - `FindingIgnoreResponse` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: string` Base64 encoded identifier of the security finding. - `active_count: number` Number of active problematic instances identified in the security finding. - `archived_count: number` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description?: string | null` Detailed description of the finding. - `remediation?: Remediation` Remediation guide information for a finding. - `id: string` Remediation Id. - `frameworks: Array` Relevant Compliance Frameworks. - `guide: string` Remediation guide text. - `impact: string` Description of the potential impact. - `locale: string` I18N Locale. - `threat: string` Description of the threat. - `ignored: boolean` Determines if finding is currently ignored. - `instance_count: number` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: string` When entity was created. - `last_hydrated: string` When were the integration credentials last updated. - `name: string` Name of the integration. - `permissions: Array` The vendor-specific permissions associated with the integration. - `policy: Policy` Policy configuration for an integration. - `id?: string` Policy identifier. - `client_id?: string | null` OAuth client ID for the policy. - `compliance_level?: string` Compliance level for the policy. - `dlp_enabled?: boolean` Whether DLP is enabled for this policy. - `link?: string | null` Link to policy documentation. - `name?: string` Policy name. - `permissions?: Array` List of permissions included in the policy. - `status: string` Current status of the integration. - `updated: string` Last entity was updated. - `upgradable: boolean` Whether the integrations permissions can be updated. - `vendor: Vendor` Information about a vendor/service provider. - `id: string` The id of the vendor. - `description: string | null` Detailed information about what kinds of issues are detected for this vendor. - `display_name: string` The display name of the vendor. - `logo: string` Logo URL for the vendor. - `name: string` The name of the vendor. - `static_logo: string` Static logo URL for the vendor. - `zt_enrollments: Array` The vendor's compatible Zero Trust products. - `policies?: Array>` The policies related to the vendor. - `zt_enrollments: Array` Zero Trust products associated with this integration. - `id?: string` The internal identifier of the Zero Trust Product. - `description?: string` Brief description of the Zero Trust Product. - `display_name?: string` The verbose name of the Zero Trust Product. - `enabled?: boolean` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id?: string` Integration ID. - `credential_health_status?: "Initializing" | "Healthy" | "Unhealthy"` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry?: string | null` The date and time when the integration credentials will expire. - `is_paused?: boolean` Whether the given integration is paused by the user. - `upgrade_dismissed?: boolean` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: string` Timestamp of the latest affliction date of an active finding. - `severity_override?: SeverityOverride` Override information for finding severity. - `created_by: string` User ID who created the override. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const response = await client.zeroTrust.casb.posture.findings.ignore({ account_id: '46148281d8a93d002ef242d8b0d5f9f6', checks: [ 'MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=', ], }); console.log(response.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } } ``` ## Remove ignore marker from a finding `client.zeroTrust.casb.posture.findings.unignore(FindingUnignoreParamsparams, RequestOptionsoptions?): FindingUnignoreResponse` **post** `/accounts/{account_id}/data-security/posture/findings/unignore` Ability to un-ignore a Finding if it's previously been ignored. Does nothing if the Finding is not ignored. ### Parameters - `params: FindingUnignoreParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `checks: Array` Body param: A list of finding IDs to pass along. ### Returns - `FindingUnignoreResponse` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: string` Base64 encoded identifier of the security finding. - `active_count: number` Number of active problematic instances identified in the security finding. - `archived_count: number` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description?: string | null` Detailed description of the finding. - `remediation?: Remediation` Remediation guide information for a finding. - `id: string` Remediation Id. - `frameworks: Array` Relevant Compliance Frameworks. - `guide: string` Remediation guide text. - `impact: string` Description of the potential impact. - `locale: string` I18N Locale. - `threat: string` Description of the threat. - `ignored: boolean` Determines if finding is currently ignored. - `instance_count: number` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: string` When entity was created. - `last_hydrated: string` When were the integration credentials last updated. - `name: string` Name of the integration. - `permissions: Array` The vendor-specific permissions associated with the integration. - `policy: Policy` Policy configuration for an integration. - `id?: string` Policy identifier. - `client_id?: string | null` OAuth client ID for the policy. - `compliance_level?: string` Compliance level for the policy. - `dlp_enabled?: boolean` Whether DLP is enabled for this policy. - `link?: string | null` Link to policy documentation. - `name?: string` Policy name. - `permissions?: Array` List of permissions included in the policy. - `status: string` Current status of the integration. - `updated: string` Last entity was updated. - `upgradable: boolean` Whether the integrations permissions can be updated. - `vendor: Vendor` Information about a vendor/service provider. - `id: string` The id of the vendor. - `description: string | null` Detailed information about what kinds of issues are detected for this vendor. - `display_name: string` The display name of the vendor. - `logo: string` Logo URL for the vendor. - `name: string` The name of the vendor. - `static_logo: string` Static logo URL for the vendor. - `zt_enrollments: Array` The vendor's compatible Zero Trust products. - `policies?: Array>` The policies related to the vendor. - `zt_enrollments: Array` Zero Trust products associated with this integration. - `id?: string` The internal identifier of the Zero Trust Product. - `description?: string` Brief description of the Zero Trust Product. - `display_name?: string` The verbose name of the Zero Trust Product. - `enabled?: boolean` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id?: string` Integration ID. - `credential_health_status?: "Initializing" | "Healthy" | "Unhealthy"` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry?: string | null` The date and time when the integration credentials will expire. - `is_paused?: boolean` Whether the given integration is paused by the user. - `upgrade_dismissed?: boolean` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: string` Timestamp of the latest affliction date of an active finding. - `severity_override?: SeverityOverride` Override information for finding severity. - `created_by: string` User ID who created the override. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const response = await client.zeroTrust.casb.posture.findings.unignore({ account_id: '46148281d8a93d002ef242d8b0d5f9f6', checks: [ 'MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=', ], }); console.log(response.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } } ``` ## Update the severity for a finding `client.zeroTrust.casb.posture.findings.tuneSeverity(stringfindingID, FindingTuneSeverityParamsparams, RequestOptionsoptions?): FindingTuneSeverityResponse` **post** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/tune_finding_severity` Update the severity of a Finding. This will update the `severity_override` field on the Finding payload with the new severity value. ### Parameters - `findingID: string` - `params: FindingTuneSeverityParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `new_severity: 1 | 2 | 3 | 4` Body param: The numeric severity value to apply to the finding. - `1` - `2` - `3` - `4` ### Returns - `FindingTuneSeverityResponse` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: string` Base64 encoded identifier of the security finding. - `active_count: number` Number of active problematic instances identified in the security finding. - `archived_count: number` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description?: string | null` Detailed description of the finding. - `remediation?: Remediation` Remediation guide information for a finding. - `id: string` Remediation Id. - `frameworks: Array` Relevant Compliance Frameworks. - `guide: string` Remediation guide text. - `impact: string` Description of the potential impact. - `locale: string` I18N Locale. - `threat: string` Description of the threat. - `ignored: boolean` Determines if finding is currently ignored. - `instance_count: number` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: string` When entity was created. - `last_hydrated: string` When were the integration credentials last updated. - `name: string` Name of the integration. - `permissions: Array` The vendor-specific permissions associated with the integration. - `policy: Policy` Policy configuration for an integration. - `id?: string` Policy identifier. - `client_id?: string | null` OAuth client ID for the policy. - `compliance_level?: string` Compliance level for the policy. - `dlp_enabled?: boolean` Whether DLP is enabled for this policy. - `link?: string | null` Link to policy documentation. - `name?: string` Policy name. - `permissions?: Array` List of permissions included in the policy. - `status: string` Current status of the integration. - `updated: string` Last entity was updated. - `upgradable: boolean` Whether the integrations permissions can be updated. - `vendor: Vendor` Information about a vendor/service provider. - `id: string` The id of the vendor. - `description: string | null` Detailed information about what kinds of issues are detected for this vendor. - `display_name: string` The display name of the vendor. - `logo: string` Logo URL for the vendor. - `name: string` The name of the vendor. - `static_logo: string` Static logo URL for the vendor. - `zt_enrollments: Array` The vendor's compatible Zero Trust products. - `policies?: Array>` The policies related to the vendor. - `zt_enrollments: Array` Zero Trust products associated with this integration. - `id?: string` The internal identifier of the Zero Trust Product. - `description?: string` Brief description of the Zero Trust Product. - `display_name?: string` The verbose name of the Zero Trust Product. - `enabled?: boolean` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id?: string` Integration ID. - `credential_health_status?: "Initializing" | "Healthy" | "Unhealthy"` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry?: string | null` The date and time when the integration credentials will expire. - `is_paused?: boolean` Whether the given integration is paused by the user. - `upgrade_dismissed?: boolean` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: string` Timestamp of the latest affliction date of an active finding. - `severity_override?: SeverityOverride` Override information for finding severity. - `created_by: string` User ID who created the override. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const response = await client.zeroTrust.casb.posture.findings.tuneSeverity('U3RhaW5sZXNzIHJvY2tz', { account_id: '46148281d8a93d002ef242d8b0d5f9f6', new_severity: 1, }); console.log(response.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } } ``` ## Reset severity for a finding back to the default `client.zeroTrust.casb.posture.findings.resetSeverity(stringfindingID, FindingResetSeverityParamsparams, RequestOptionsoptions?): FindingResetSeverityResponse` **post** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/reset_finding_severity` If a Finding's severity has been changed, reset it back to default value. Does nothing if no override exists. ### Parameters - `findingID: string` - `params: FindingResetSeverityParams` - `account_id: string` Cloudflare account ID for the user making the request. ### Returns - `FindingResetSeverityResponse` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: string` Base64 encoded identifier of the security finding. - `active_count: number` Number of active problematic instances identified in the security finding. - `archived_count: number` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description?: string | null` Detailed description of the finding. - `remediation?: Remediation` Remediation guide information for a finding. - `id: string` Remediation Id. - `frameworks: Array` Relevant Compliance Frameworks. - `guide: string` Remediation guide text. - `impact: string` Description of the potential impact. - `locale: string` I18N Locale. - `threat: string` Description of the threat. - `ignored: boolean` Determines if finding is currently ignored. - `instance_count: number` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: string` When entity was created. - `last_hydrated: string` When were the integration credentials last updated. - `name: string` Name of the integration. - `permissions: Array` The vendor-specific permissions associated with the integration. - `policy: Policy` Policy configuration for an integration. - `id?: string` Policy identifier. - `client_id?: string | null` OAuth client ID for the policy. - `compliance_level?: string` Compliance level for the policy. - `dlp_enabled?: boolean` Whether DLP is enabled for this policy. - `link?: string | null` Link to policy documentation. - `name?: string` Policy name. - `permissions?: Array` List of permissions included in the policy. - `status: string` Current status of the integration. - `updated: string` Last entity was updated. - `upgradable: boolean` Whether the integrations permissions can be updated. - `vendor: Vendor` Information about a vendor/service provider. - `id: string` The id of the vendor. - `description: string | null` Detailed information about what kinds of issues are detected for this vendor. - `display_name: string` The display name of the vendor. - `logo: string` Logo URL for the vendor. - `name: string` The name of the vendor. - `static_logo: string` Static logo URL for the vendor. - `zt_enrollments: Array` The vendor's compatible Zero Trust products. - `policies?: Array>` The policies related to the vendor. - `zt_enrollments: Array` Zero Trust products associated with this integration. - `id?: string` The internal identifier of the Zero Trust Product. - `description?: string` Brief description of the Zero Trust Product. - `display_name?: string` The verbose name of the Zero Trust Product. - `enabled?: boolean` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id?: string` Integration ID. - `credential_health_status?: "Initializing" | "Healthy" | "Unhealthy"` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry?: string | null` The date and time when the integration credentials will expire. - `is_paused?: boolean` Whether the given integration is paused by the user. - `upgrade_dismissed?: boolean` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: string` Timestamp of the latest affliction date of an active finding. - `severity_override?: SeverityOverride` Override information for finding severity. - `created_by: string` User ID who created the override. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const response = await client.zeroTrust.casb.posture.findings.resetSeverity( 'U3RhaW5sZXNzIHJvY2tz', { account_id: '46148281d8a93d002ef242d8b0d5f9f6' }, ); console.log(response.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "active_count": 5, "archived_count": 2, "finding": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace", "description": "This finding indicates that a file in your Slack workspace is publicly accessible.", "remediation": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "frameworks": [ "SOC2", "ISO27001" ], "guide": "To fix this issue, update the file permissions to remove public access.", "impact": "Publicly accessible files may expose sensitive information.", "locale": "en-US", "threat": "Data exposure and potential compliance violations." } }, "ignored": false, "instance_count": 7, "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2025-03-18T17:25:38.700131Z", "severity_override": { "created_by": "1234", "severity": "Critical" } } } ``` ## Domain Types ### Finding List Response - `FindingListResponse` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: string` Base64 encoded identifier of the security finding. - `active_count: number` Number of active problematic instances identified in the security finding. - `archived_count: number` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description?: string | null` Detailed description of the finding. - `remediation?: Remediation` Remediation guide information for a finding. - `id: string` Remediation Id. - `frameworks: Array` Relevant Compliance Frameworks. - `guide: string` Remediation guide text. - `impact: string` Description of the potential impact. - `locale: string` I18N Locale. - `threat: string` Description of the threat. - `ignored: boolean` Determines if finding is currently ignored. - `instance_count: number` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: string` When entity was created. - `last_hydrated: string` When were the integration credentials last updated. - `name: string` Name of the integration. - `permissions: Array` The vendor-specific permissions associated with the integration. - `policy: Policy` Policy configuration for an integration. - `id?: string` Policy identifier. - `client_id?: string | null` OAuth client ID for the policy. - `compliance_level?: string` Compliance level for the policy. - `dlp_enabled?: boolean` Whether DLP is enabled for this policy. - `link?: string | null` Link to policy documentation. - `name?: string` Policy name. - `permissions?: Array` List of permissions included in the policy. - `status: string` Current status of the integration. - `updated: string` Last entity was updated. - `upgradable: boolean` Whether the integrations permissions can be updated. - `vendor: Vendor` Information about a vendor/service provider. - `id: string` The id of the vendor. - `description: string | null` Detailed information about what kinds of issues are detected for this vendor. - `display_name: string` The display name of the vendor. - `logo: string` Logo URL for the vendor. - `name: string` The name of the vendor. - `static_logo: string` Static logo URL for the vendor. - `zt_enrollments: Array` The vendor's compatible Zero Trust products. - `policies?: Array>` The policies related to the vendor. - `zt_enrollments: Array` Zero Trust products associated with this integration. - `id?: string` The internal identifier of the Zero Trust Product. - `description?: string` Brief description of the Zero Trust Product. - `display_name?: string` The verbose name of the Zero Trust Product. - `enabled?: boolean` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id?: string` Integration ID. - `credential_health_status?: "Initializing" | "Healthy" | "Unhealthy"` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry?: string | null` The date and time when the integration credentials will expire. - `is_paused?: boolean` Whether the given integration is paused by the user. - `upgrade_dismissed?: boolean` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: string` Timestamp of the latest affliction date of an active finding. - `severity_override?: SeverityOverride` Override information for finding severity. - `created_by: string` User ID who created the override. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Finding Get Response - `FindingGetResponse` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: string` Base64 encoded identifier of the security finding. - `active_count: number` Number of active problematic instances identified in the security finding. - `archived_count: number` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description?: string | null` Detailed description of the finding. - `remediation?: Remediation` Remediation guide information for a finding. - `id: string` Remediation Id. - `frameworks: Array` Relevant Compliance Frameworks. - `guide: string` Remediation guide text. - `impact: string` Description of the potential impact. - `locale: string` I18N Locale. - `threat: string` Description of the threat. - `ignored: boolean` Determines if finding is currently ignored. - `instance_count: number` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: string` When entity was created. - `last_hydrated: string` When were the integration credentials last updated. - `name: string` Name of the integration. - `permissions: Array` The vendor-specific permissions associated with the integration. - `policy: Policy` Policy configuration for an integration. - `id?: string` Policy identifier. - `client_id?: string | null` OAuth client ID for the policy. - `compliance_level?: string` Compliance level for the policy. - `dlp_enabled?: boolean` Whether DLP is enabled for this policy. - `link?: string | null` Link to policy documentation. - `name?: string` Policy name. - `permissions?: Array` List of permissions included in the policy. - `status: string` Current status of the integration. - `updated: string` Last entity was updated. - `upgradable: boolean` Whether the integrations permissions can be updated. - `vendor: Vendor` Information about a vendor/service provider. - `id: string` The id of the vendor. - `description: string | null` Detailed information about what kinds of issues are detected for this vendor. - `display_name: string` The display name of the vendor. - `logo: string` Logo URL for the vendor. - `name: string` The name of the vendor. - `static_logo: string` Static logo URL for the vendor. - `zt_enrollments: Array` The vendor's compatible Zero Trust products. - `policies?: Array>` The policies related to the vendor. - `zt_enrollments: Array` Zero Trust products associated with this integration. - `id?: string` The internal identifier of the Zero Trust Product. - `description?: string` Brief description of the Zero Trust Product. - `display_name?: string` The verbose name of the Zero Trust Product. - `enabled?: boolean` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id?: string` Integration ID. - `credential_health_status?: "Initializing" | "Healthy" | "Unhealthy"` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry?: string | null` The date and time when the integration credentials will expire. - `is_paused?: boolean` Whether the given integration is paused by the user. - `upgrade_dismissed?: boolean` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: string` Timestamp of the latest affliction date of an active finding. - `severity_override?: SeverityOverride` Override information for finding severity. - `created_by: string` User ID who created the override. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Finding Export Response - `FindingExportResponse` Information about an export job. - `id: string` Unique identifier for the export job. - `status: "Pending" | "Success" | "Failure" | 2 more` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: "finding" | "findingInstance" | "content" | "remediationJob"` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: string` ID of the export-requesting user. - `download_url?: string | null` The URL by which the successfully created export can be downloaded by the end users. - `errors?: string | null` Contains information on errors which may have occurred during export creation. - `file_name?: string | null` The base name of the file that is/was generated by the export job. - `file_path?: string | null` The full path of the file that is stored within external storage (currently R2). ### Finding Ignore Response - `FindingIgnoreResponse` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: string` Base64 encoded identifier of the security finding. - `active_count: number` Number of active problematic instances identified in the security finding. - `archived_count: number` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description?: string | null` Detailed description of the finding. - `remediation?: Remediation` Remediation guide information for a finding. - `id: string` Remediation Id. - `frameworks: Array` Relevant Compliance Frameworks. - `guide: string` Remediation guide text. - `impact: string` Description of the potential impact. - `locale: string` I18N Locale. - `threat: string` Description of the threat. - `ignored: boolean` Determines if finding is currently ignored. - `instance_count: number` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: string` When entity was created. - `last_hydrated: string` When were the integration credentials last updated. - `name: string` Name of the integration. - `permissions: Array` The vendor-specific permissions associated with the integration. - `policy: Policy` Policy configuration for an integration. - `id?: string` Policy identifier. - `client_id?: string | null` OAuth client ID for the policy. - `compliance_level?: string` Compliance level for the policy. - `dlp_enabled?: boolean` Whether DLP is enabled for this policy. - `link?: string | null` Link to policy documentation. - `name?: string` Policy name. - `permissions?: Array` List of permissions included in the policy. - `status: string` Current status of the integration. - `updated: string` Last entity was updated. - `upgradable: boolean` Whether the integrations permissions can be updated. - `vendor: Vendor` Information about a vendor/service provider. - `id: string` The id of the vendor. - `description: string | null` Detailed information about what kinds of issues are detected for this vendor. - `display_name: string` The display name of the vendor. - `logo: string` Logo URL for the vendor. - `name: string` The name of the vendor. - `static_logo: string` Static logo URL for the vendor. - `zt_enrollments: Array` The vendor's compatible Zero Trust products. - `policies?: Array>` The policies related to the vendor. - `zt_enrollments: Array` Zero Trust products associated with this integration. - `id?: string` The internal identifier of the Zero Trust Product. - `description?: string` Brief description of the Zero Trust Product. - `display_name?: string` The verbose name of the Zero Trust Product. - `enabled?: boolean` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id?: string` Integration ID. - `credential_health_status?: "Initializing" | "Healthy" | "Unhealthy"` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry?: string | null` The date and time when the integration credentials will expire. - `is_paused?: boolean` Whether the given integration is paused by the user. - `upgrade_dismissed?: boolean` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: string` Timestamp of the latest affliction date of an active finding. - `severity_override?: SeverityOverride` Override information for finding severity. - `created_by: string` User ID who created the override. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Finding Unignore Response - `FindingUnignoreResponse` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: string` Base64 encoded identifier of the security finding. - `active_count: number` Number of active problematic instances identified in the security finding. - `archived_count: number` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description?: string | null` Detailed description of the finding. - `remediation?: Remediation` Remediation guide information for a finding. - `id: string` Remediation Id. - `frameworks: Array` Relevant Compliance Frameworks. - `guide: string` Remediation guide text. - `impact: string` Description of the potential impact. - `locale: string` I18N Locale. - `threat: string` Description of the threat. - `ignored: boolean` Determines if finding is currently ignored. - `instance_count: number` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: string` When entity was created. - `last_hydrated: string` When were the integration credentials last updated. - `name: string` Name of the integration. - `permissions: Array` The vendor-specific permissions associated with the integration. - `policy: Policy` Policy configuration for an integration. - `id?: string` Policy identifier. - `client_id?: string | null` OAuth client ID for the policy. - `compliance_level?: string` Compliance level for the policy. - `dlp_enabled?: boolean` Whether DLP is enabled for this policy. - `link?: string | null` Link to policy documentation. - `name?: string` Policy name. - `permissions?: Array` List of permissions included in the policy. - `status: string` Current status of the integration. - `updated: string` Last entity was updated. - `upgradable: boolean` Whether the integrations permissions can be updated. - `vendor: Vendor` Information about a vendor/service provider. - `id: string` The id of the vendor. - `description: string | null` Detailed information about what kinds of issues are detected for this vendor. - `display_name: string` The display name of the vendor. - `logo: string` Logo URL for the vendor. - `name: string` The name of the vendor. - `static_logo: string` Static logo URL for the vendor. - `zt_enrollments: Array` The vendor's compatible Zero Trust products. - `policies?: Array>` The policies related to the vendor. - `zt_enrollments: Array` Zero Trust products associated with this integration. - `id?: string` The internal identifier of the Zero Trust Product. - `description?: string` Brief description of the Zero Trust Product. - `display_name?: string` The verbose name of the Zero Trust Product. - `enabled?: boolean` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id?: string` Integration ID. - `credential_health_status?: "Initializing" | "Healthy" | "Unhealthy"` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry?: string | null` The date and time when the integration credentials will expire. - `is_paused?: boolean` Whether the given integration is paused by the user. - `upgrade_dismissed?: boolean` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: string` Timestamp of the latest affliction date of an active finding. - `severity_override?: SeverityOverride` Override information for finding severity. - `created_by: string` User ID who created the override. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Finding Tune Severity Response - `FindingTuneSeverityResponse` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: string` Base64 encoded identifier of the security finding. - `active_count: number` Number of active problematic instances identified in the security finding. - `archived_count: number` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description?: string | null` Detailed description of the finding. - `remediation?: Remediation` Remediation guide information for a finding. - `id: string` Remediation Id. - `frameworks: Array` Relevant Compliance Frameworks. - `guide: string` Remediation guide text. - `impact: string` Description of the potential impact. - `locale: string` I18N Locale. - `threat: string` Description of the threat. - `ignored: boolean` Determines if finding is currently ignored. - `instance_count: number` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: string` When entity was created. - `last_hydrated: string` When were the integration credentials last updated. - `name: string` Name of the integration. - `permissions: Array` The vendor-specific permissions associated with the integration. - `policy: Policy` Policy configuration for an integration. - `id?: string` Policy identifier. - `client_id?: string | null` OAuth client ID for the policy. - `compliance_level?: string` Compliance level for the policy. - `dlp_enabled?: boolean` Whether DLP is enabled for this policy. - `link?: string | null` Link to policy documentation. - `name?: string` Policy name. - `permissions?: Array` List of permissions included in the policy. - `status: string` Current status of the integration. - `updated: string` Last entity was updated. - `upgradable: boolean` Whether the integrations permissions can be updated. - `vendor: Vendor` Information about a vendor/service provider. - `id: string` The id of the vendor. - `description: string | null` Detailed information about what kinds of issues are detected for this vendor. - `display_name: string` The display name of the vendor. - `logo: string` Logo URL for the vendor. - `name: string` The name of the vendor. - `static_logo: string` Static logo URL for the vendor. - `zt_enrollments: Array` The vendor's compatible Zero Trust products. - `policies?: Array>` The policies related to the vendor. - `zt_enrollments: Array` Zero Trust products associated with this integration. - `id?: string` The internal identifier of the Zero Trust Product. - `description?: string` Brief description of the Zero Trust Product. - `display_name?: string` The verbose name of the Zero Trust Product. - `enabled?: boolean` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id?: string` Integration ID. - `credential_health_status?: "Initializing" | "Healthy" | "Unhealthy"` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry?: string | null` The date and time when the integration credentials will expire. - `is_paused?: boolean` Whether the given integration is paused by the user. - `upgrade_dismissed?: boolean` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: string` Timestamp of the latest affliction date of an active finding. - `severity_override?: SeverityOverride` Override information for finding severity. - `created_by: string` User ID who created the override. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` ### Finding Reset Severity Response - `FindingResetSeverityResponse` Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics. - `id: string` Base64 encoded identifier of the security finding. - `active_count: number` Number of active problematic instances identified in the security finding. - `archived_count: number` Number of archived instances identified in the security finding. - `finding: Finding` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. - `description?: string | null` Detailed description of the finding. - `remediation?: Remediation` Remediation guide information for a finding. - `id: string` Remediation Id. - `frameworks: Array` Relevant Compliance Frameworks. - `guide: string` Remediation guide text. - `impact: string` Description of the potential impact. - `locale: string` I18N Locale. - `threat: string` Description of the threat. - `ignored: boolean` Determines if finding is currently ignored. - `instance_count: number` Number of total (Active or archived) problematic instances identified in the security finding. - `integration: Integration` Summary information about an integration. - `created: string` When entity was created. - `last_hydrated: string` When were the integration credentials last updated. - `name: string` Name of the integration. - `permissions: Array` The vendor-specific permissions associated with the integration. - `policy: Policy` Policy configuration for an integration. - `id?: string` Policy identifier. - `client_id?: string | null` OAuth client ID for the policy. - `compliance_level?: string` Compliance level for the policy. - `dlp_enabled?: boolean` Whether DLP is enabled for this policy. - `link?: string | null` Link to policy documentation. - `name?: string` Policy name. - `permissions?: Array` List of permissions included in the policy. - `status: string` Current status of the integration. - `updated: string` Last entity was updated. - `upgradable: boolean` Whether the integrations permissions can be updated. - `vendor: Vendor` Information about a vendor/service provider. - `id: string` The id of the vendor. - `description: string | null` Detailed information about what kinds of issues are detected for this vendor. - `display_name: string` The display name of the vendor. - `logo: string` Logo URL for the vendor. - `name: string` The name of the vendor. - `static_logo: string` Static logo URL for the vendor. - `zt_enrollments: Array` The vendor's compatible Zero Trust products. - `policies?: Array>` The policies related to the vendor. - `zt_enrollments: Array` Zero Trust products associated with this integration. - `id?: string` The internal identifier of the Zero Trust Product. - `description?: string` Brief description of the Zero Trust Product. - `display_name?: string` The verbose name of the Zero Trust Product. - `enabled?: boolean` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id?: string` Integration ID. - `credential_health_status?: "Initializing" | "Healthy" | "Unhealthy"` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry?: string | null` The date and time when the integration credentials will expire. - `is_paused?: boolean` Whether the given integration is paused by the user. - `upgrade_dismissed?: boolean` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: string` Timestamp of the latest affliction date of an active finding. - `severity_override?: SeverityOverride` Override information for finding severity. - `created_by: string` User ID who created the override. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` # Instances ## List instances of a finding `client.zeroTrust.casb.posture.findings.instances.list(stringfindingID, InstanceListParamsparams, RequestOptionsoptions?): V4PagePaginationArray` **get** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances` Lists all security finding instances for a given security finding. ### Parameters - `findingID: string` - `params: InstanceListParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `archived?: boolean` Query param: Archived - `asset_ids?: Array` Query param: Filter finding instances by an array of asset IDs. Supports multiple comma-separated values. - `cursor?: string` Query param: A cursor for pagination. Obtained from the `result_info.cursor` field of a previous response. - `direction?: "asc" | "desc"` Query param: Direction to order results. - `"asc"` - `"desc"` - `finding_instance_ids?: Array` Query param: Filter finding instances by an array of finding instance IDs. Supports multiple comma-separated values. - `max_affliction_date?: string` Query param: Filter to view findings that occurred on or before the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `min_affliction_date?: string` Query param: Filter to view findings that occurred on or after the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `order?: "affliction_date" | "asset.name" | "remediation.status"` Query param: Which field to use when ordering the Finding's instances. When ordering by 'remediation.status', only the most recent non-stale remediation job is considered. Stale jobs (created before the instance's affliction_date) are treated as having no status for ordering purposes. - `"affliction_date"` - `"asset.name"` - `"remediation.status"` - `page?: number` Query param: A page number within the paginated result set. - `per_page?: number` Query param: Number of results to return per page. - `remediation_statuses?: Array<"none" | "pending" | "processing" | 3 more>` Query param: Filter finding instances by most recent remediation job status. Supports multiple comma-separated values. Use 'none' to filter instances with no remediation jobs or instances where the most recent job is stale. Note: Stale jobs (created before the instance's affliction_date) are ignored for filtering purposes, but are still included in the 'remediations' array with stale=true. - `"none"` - `"pending"` - `"processing"` - `"validating"` - `"completed"` - `"failed"` - `search?: string` Query param: A search term. ### Returns - `InstanceListResponse` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: string` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: Category` Category information for an asset. - `service: string | null` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: string` The type of asset. - `vendor: string` The vendor the asset is part of. - `id?: string` Unique identifier for the asset category. - `external_id: string` External identifier from the source system. - `fields: Array` The fields associated with the asset. - `name: string` The name of the field. - `value: string` The value of the field. - `link?: string | null` Optional link associated with the field. - `name: string` Human-readable name of the asset. - `id?: string` Unique identifier for the asset. - `link?: string | null` Direct link to the asset. - `dlp_contexts: Array` DLP context information if this is a content finding. - `created: string` When the DLP context was created. - `entry_ids: Array` DLP Entry IDs. - `profile_id: string` DLP Profile ID. - `updated: string` When the DLP context was last updated. - `id?: string` Unique identifier for the DLP context. - `deleted?: string | null` When the DLP context was deleted. - `match_context_max_extent?: number | null` DLP Right Boundary of match context. - `match_context_min_extent?: number | null` DLP Left Boundary of match context. - `match_context_payload?: Record | null` DLP Match context payload that matched the profile in question. - `remediations: Array` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: string` Unique identifier for the remediation job. - `created_at: string` When the remediation job was created. - `stale: boolean` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: "pending" | "processing" | "completed" | 2 more` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: Array` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: LatestJob` The most recent webhook job for this webhook configuration. - `id: string` Unique identifier for the webhook job. - `created_at: string` When the webhook job was created. - `stale: boolean` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: "pending" | "processing" | "completed"` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: string` Unique identifier for the webhook configuration. - `webhook_label: string` Account-specified display label for the webhook configuration. - `id?: string` Unique identifier for the finding instance. - `is_archived?: boolean` Whether this finding instance has been archived. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); // Automatically fetches more pages as needed. for await (const instanceListResponse of client.zeroTrust.casb.posture.findings.instances.list( 'U3RhaW5sZXNzIHJvY2tz', { account_id: '46148281d8a93d002ef242d8b0d5f9f6' }, )) { console.log(instanceListResponse.id); } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "affliction_date": "2025-03-18T17:25:38.700541Z", "asset": { "category": { "service": null, "type": "file", "vendor": "Slack", "id": "1a78cbf3-b98f-4289-b1f2-22db64130f4f" }, "external_id": "external-file-id-123", "fields": [ { "name": "Credential name", "value": "Test asset 2", "link": "https://example.com" } ], "name": "Public.svg", "id": "8a043daf-def4-403e-9d28-da2e93d9b824", "link": "https://slack-files.com/TYJH37DCK-E0238GG6B8-92fd5y5674" }, "dlp_contexts": [ { "created": "2025-03-18T17:25:38.695977Z", "entry_ids": [ "21befc68-a297-4090-ac10-17a051b901cd", "d6dd1e16-f78c-401a-b564-45c4e44aa467" ], "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e", "updated": "2025-03-18T17:25:38.695977Z", "id": "7653ff3a-d25e-4c10-8034-3460937c045b", "deleted": "2025-03-18T17:25:38.695977Z", "match_context_max_extent": 512, "match_context_min_extent": 1, "match_context_payload": {} } ], "remediations": [ { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" } ], "webhooks": [ { "latest_job": { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" }, "webhook_id": "550e8400-e29b-41d4-a716-446655440000", "webhook_label": "Send to Gmail" } ], "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "is_archived": false } ] } ``` ## Get a finding instance using an instance ID `client.zeroTrust.casb.posture.findings.instances.get(stringinstanceID, InstanceGetParamsparams, RequestOptionsoptions?): InstanceGetResponse` **get** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances/{instance_id}` Gets a security Finding instance by id. ### Parameters - `instanceID: string` - `params: InstanceGetParams` - `account_id: string` Cloudflare account ID for the user making the request. - `finding_id: string` A base64-encoded ID identifying this Finding. ### Returns - `InstanceGetResponse` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: string` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: Category` Category information for an asset. - `service: string | null` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: string` The type of asset. - `vendor: string` The vendor the asset is part of. - `id?: string` Unique identifier for the asset category. - `external_id: string` External identifier from the source system. - `fields: Array` The fields associated with the asset. - `name: string` The name of the field. - `value: string` The value of the field. - `link?: string | null` Optional link associated with the field. - `name: string` Human-readable name of the asset. - `id?: string` Unique identifier for the asset. - `link?: string | null` Direct link to the asset. - `dlp_contexts: Array` DLP context information if this is a content finding. - `created: string` When the DLP context was created. - `entry_ids: Array` DLP Entry IDs. - `profile_id: string` DLP Profile ID. - `updated: string` When the DLP context was last updated. - `id?: string` Unique identifier for the DLP context. - `deleted?: string | null` When the DLP context was deleted. - `match_context_max_extent?: number | null` DLP Right Boundary of match context. - `match_context_min_extent?: number | null` DLP Left Boundary of match context. - `match_context_payload?: Record | null` DLP Match context payload that matched the profile in question. - `remediations: Array` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: string` Unique identifier for the remediation job. - `created_at: string` When the remediation job was created. - `stale: boolean` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: "pending" | "processing" | "completed" | 2 more` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: Array` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: LatestJob` The most recent webhook job for this webhook configuration. - `id: string` Unique identifier for the webhook job. - `created_at: string` When the webhook job was created. - `stale: boolean` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: "pending" | "processing" | "completed"` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: string` Unique identifier for the webhook configuration. - `webhook_label: string` Account-specified display label for the webhook configuration. - `id?: string` Unique identifier for the finding instance. - `is_archived?: boolean` Whether this finding instance has been archived. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const instance = await client.zeroTrust.casb.posture.findings.instances.get( '182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e', { account_id: '46148281d8a93d002ef242d8b0d5f9f6', finding_id: 'U3RhaW5sZXNzIHJvY2tz' }, ); console.log(instance.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "affliction_date": "2025-03-18T17:25:38.700541Z", "asset": { "category": { "service": null, "type": "file", "vendor": "Slack", "id": "1a78cbf3-b98f-4289-b1f2-22db64130f4f" }, "external_id": "external-file-id-123", "fields": [ { "name": "Credential name", "value": "Test asset 2", "link": "https://example.com" } ], "name": "Public.svg", "id": "8a043daf-def4-403e-9d28-da2e93d9b824", "link": "https://slack-files.com/TYJH37DCK-E0238GG6B8-92fd5y5674" }, "dlp_contexts": [ { "created": "2025-03-18T17:25:38.695977Z", "entry_ids": [ "21befc68-a297-4090-ac10-17a051b901cd", "d6dd1e16-f78c-401a-b564-45c4e44aa467" ], "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e", "updated": "2025-03-18T17:25:38.695977Z", "id": "7653ff3a-d25e-4c10-8034-3460937c045b", "deleted": "2025-03-18T17:25:38.695977Z", "match_context_max_extent": 512, "match_context_min_extent": 1, "match_context_payload": {} } ], "remediations": [ { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" } ], "webhooks": [ { "latest_job": { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" }, "webhook_id": "550e8400-e29b-41d4-a716-446655440000", "webhook_label": "Send to Gmail" } ], "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "is_archived": false } } ``` ## Create a finding instances export `client.zeroTrust.casb.posture.findings.instances.export(stringstorageNamespaceID, InstanceExportParamsparams, RequestOptionsoptions?): InstanceExportResponse` **post** `/accounts/{account_id}/data-security/posture/findings/{storage_namespace_id}/instances/export` Creates a CSV export for Finding instances and accepts optional filters in the payload. The `storage_namespace_id` path parameter is derived from the finding ID by base64-decoding it (which yields `integration_id:finding_type_id`) and replacing the colon with a hyphen. ### Parameters - `storageNamespaceID: string` - `params: InstanceExportParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `archived?: boolean` Body param: Filter for archived status. - `max_affliction_date?: string` Body param: Filter to view findings that occurred on or before the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `min_affliction_date?: string` Body param: Filter to view findings that occurred on or after the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `orders?: Array` Body param: Ordering specifications for the export. - `direction: "asc" | "desc"` Sort direction. - `"asc"` - `"desc"` - `name: "asset.name" | "affliction_date"` Which field to use when ordering the finding instances. - `"asset.name"` - `"affliction_date"` - `search?: string` Body param: A search term. ### Returns - `InstanceExportResponse` Information about an export job. - `id: string` Unique identifier for the export job. - `status: "Pending" | "Success" | "Failure" | 2 more` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: "finding" | "findingInstance" | "content" | "remediationJob"` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: string` ID of the export-requesting user. - `download_url?: string | null` The URL by which the successfully created export can be downloaded by the end users. - `errors?: string | null` Contains information on errors which may have occurred during export creation. - `file_name?: string | null` The base name of the file that is/was generated by the export job. - `file_path?: string | null` The full path of the file that is stored within external storage (currently R2). ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const response = await client.zeroTrust.casb.posture.findings.instances.export( '00000000-0000-0000-0000-000000000001-00000000-0000-0000-0000-000000000002', { account_id: '46148281d8a93d002ef242d8b0d5f9f6' }, ); console.log(response.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } } ``` ## Archive a finding `client.zeroTrust.casb.posture.findings.instances.archive(stringfindingID, InstanceArchiveParamsparams, RequestOptionsoptions?): InstanceArchiveResponse` **post** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances/archive` Archive one or more finding instances. ### Parameters - `findingID: string` - `params: InstanceArchiveParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `check_instances: Array` Body param: A list of finding instance IDs to pass along. ### Returns - `InstanceArchiveResponse` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: string` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: Category` Category information for an asset. - `service: string | null` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: string` The type of asset. - `vendor: string` The vendor the asset is part of. - `id?: string` Unique identifier for the asset category. - `external_id: string` External identifier from the source system. - `fields: Array` The fields associated with the asset. - `name: string` The name of the field. - `value: string` The value of the field. - `link?: string | null` Optional link associated with the field. - `name: string` Human-readable name of the asset. - `id?: string` Unique identifier for the asset. - `link?: string | null` Direct link to the asset. - `dlp_contexts: Array` DLP context information if this is a content finding. - `created: string` When the DLP context was created. - `entry_ids: Array` DLP Entry IDs. - `profile_id: string` DLP Profile ID. - `updated: string` When the DLP context was last updated. - `id?: string` Unique identifier for the DLP context. - `deleted?: string | null` When the DLP context was deleted. - `match_context_max_extent?: number | null` DLP Right Boundary of match context. - `match_context_min_extent?: number | null` DLP Left Boundary of match context. - `match_context_payload?: Record | null` DLP Match context payload that matched the profile in question. - `remediations: Array` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: string` Unique identifier for the remediation job. - `created_at: string` When the remediation job was created. - `stale: boolean` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: "pending" | "processing" | "completed" | 2 more` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: Array` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: LatestJob` The most recent webhook job for this webhook configuration. - `id: string` Unique identifier for the webhook job. - `created_at: string` When the webhook job was created. - `stale: boolean` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: "pending" | "processing" | "completed"` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: string` Unique identifier for the webhook configuration. - `webhook_label: string` Account-specified display label for the webhook configuration. - `id?: string` Unique identifier for the finding instance. - `is_archived?: boolean` Whether this finding instance has been archived. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const response = await client.zeroTrust.casb.posture.findings.instances.archive( 'U3RhaW5sZXNzIHJvY2tz', { account_id: '46148281d8a93d002ef242d8b0d5f9f6', check_instances: ['497f6eca-6276-4993-bfeb-53cbbbba6f08'], }, ); console.log(response.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "affliction_date": "2025-03-18T17:25:38.700541Z", "asset": { "category": { "service": null, "type": "file", "vendor": "Slack", "id": "1a78cbf3-b98f-4289-b1f2-22db64130f4f" }, "external_id": "external-file-id-123", "fields": [ { "name": "Credential name", "value": "Test asset 2", "link": "https://example.com" } ], "name": "Public.svg", "id": "8a043daf-def4-403e-9d28-da2e93d9b824", "link": "https://slack-files.com/TYJH37DCK-E0238GG6B8-92fd5y5674" }, "dlp_contexts": [ { "created": "2025-03-18T17:25:38.695977Z", "entry_ids": [ "21befc68-a297-4090-ac10-17a051b901cd", "d6dd1e16-f78c-401a-b564-45c4e44aa467" ], "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e", "updated": "2025-03-18T17:25:38.695977Z", "id": "7653ff3a-d25e-4c10-8034-3460937c045b", "deleted": "2025-03-18T17:25:38.695977Z", "match_context_max_extent": 512, "match_context_min_extent": 1, "match_context_payload": {} } ], "remediations": [ { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" } ], "webhooks": [ { "latest_job": { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" }, "webhook_id": "550e8400-e29b-41d4-a716-446655440000", "webhook_label": "Send to Gmail" } ], "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "is_archived": false } } ``` ## Remove the archive marking from a finding instance `client.zeroTrust.casb.posture.findings.instances.unarchive(stringfindingID, InstanceUnarchiveParamsparams, RequestOptionsoptions?): InstanceUnarchiveResponse` **post** `/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances/unarchive` Remove the archive marking from one or more finding instances. ### Parameters - `findingID: string` - `params: InstanceUnarchiveParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `check_instances: Array` Body param: A list of finding instance IDs to pass along. ### Returns - `InstanceUnarchiveResponse` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: string` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: Category` Category information for an asset. - `service: string | null` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: string` The type of asset. - `vendor: string` The vendor the asset is part of. - `id?: string` Unique identifier for the asset category. - `external_id: string` External identifier from the source system. - `fields: Array` The fields associated with the asset. - `name: string` The name of the field. - `value: string` The value of the field. - `link?: string | null` Optional link associated with the field. - `name: string` Human-readable name of the asset. - `id?: string` Unique identifier for the asset. - `link?: string | null` Direct link to the asset. - `dlp_contexts: Array` DLP context information if this is a content finding. - `created: string` When the DLP context was created. - `entry_ids: Array` DLP Entry IDs. - `profile_id: string` DLP Profile ID. - `updated: string` When the DLP context was last updated. - `id?: string` Unique identifier for the DLP context. - `deleted?: string | null` When the DLP context was deleted. - `match_context_max_extent?: number | null` DLP Right Boundary of match context. - `match_context_min_extent?: number | null` DLP Left Boundary of match context. - `match_context_payload?: Record | null` DLP Match context payload that matched the profile in question. - `remediations: Array` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: string` Unique identifier for the remediation job. - `created_at: string` When the remediation job was created. - `stale: boolean` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: "pending" | "processing" | "completed" | 2 more` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: Array` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: LatestJob` The most recent webhook job for this webhook configuration. - `id: string` Unique identifier for the webhook job. - `created_at: string` When the webhook job was created. - `stale: boolean` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: "pending" | "processing" | "completed"` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: string` Unique identifier for the webhook configuration. - `webhook_label: string` Account-specified display label for the webhook configuration. - `id?: string` Unique identifier for the finding instance. - `is_archived?: boolean` Whether this finding instance has been archived. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const response = await client.zeroTrust.casb.posture.findings.instances.unarchive( 'U3RhaW5sZXNzIHJvY2tz', { account_id: '46148281d8a93d002ef242d8b0d5f9f6', check_instances: ['497f6eca-6276-4993-bfeb-53cbbbba6f08'], }, ); console.log(response.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "affliction_date": "2025-03-18T17:25:38.700541Z", "asset": { "category": { "service": null, "type": "file", "vendor": "Slack", "id": "1a78cbf3-b98f-4289-b1f2-22db64130f4f" }, "external_id": "external-file-id-123", "fields": [ { "name": "Credential name", "value": "Test asset 2", "link": "https://example.com" } ], "name": "Public.svg", "id": "8a043daf-def4-403e-9d28-da2e93d9b824", "link": "https://slack-files.com/TYJH37DCK-E0238GG6B8-92fd5y5674" }, "dlp_contexts": [ { "created": "2025-03-18T17:25:38.695977Z", "entry_ids": [ "21befc68-a297-4090-ac10-17a051b901cd", "d6dd1e16-f78c-401a-b564-45c4e44aa467" ], "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e", "updated": "2025-03-18T17:25:38.695977Z", "id": "7653ff3a-d25e-4c10-8034-3460937c045b", "deleted": "2025-03-18T17:25:38.695977Z", "match_context_max_extent": 512, "match_context_min_extent": 1, "match_context_payload": {} } ], "remediations": [ { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" } ], "webhooks": [ { "latest_job": { "id": "123e4567-e89b-12d3-a456-426614174000", "created_at": "2025-03-18T18:30:15.123456Z", "stale": false, "status": "pending" }, "webhook_id": "550e8400-e29b-41d4-a716-446655440000", "webhook_label": "Send to Gmail" } ], "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "is_archived": false } } ``` ## Domain Types ### Instance List Response - `InstanceListResponse` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: string` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: Category` Category information for an asset. - `service: string | null` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: string` The type of asset. - `vendor: string` The vendor the asset is part of. - `id?: string` Unique identifier for the asset category. - `external_id: string` External identifier from the source system. - `fields: Array` The fields associated with the asset. - `name: string` The name of the field. - `value: string` The value of the field. - `link?: string | null` Optional link associated with the field. - `name: string` Human-readable name of the asset. - `id?: string` Unique identifier for the asset. - `link?: string | null` Direct link to the asset. - `dlp_contexts: Array` DLP context information if this is a content finding. - `created: string` When the DLP context was created. - `entry_ids: Array` DLP Entry IDs. - `profile_id: string` DLP Profile ID. - `updated: string` When the DLP context was last updated. - `id?: string` Unique identifier for the DLP context. - `deleted?: string | null` When the DLP context was deleted. - `match_context_max_extent?: number | null` DLP Right Boundary of match context. - `match_context_min_extent?: number | null` DLP Left Boundary of match context. - `match_context_payload?: Record | null` DLP Match context payload that matched the profile in question. - `remediations: Array` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: string` Unique identifier for the remediation job. - `created_at: string` When the remediation job was created. - `stale: boolean` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: "pending" | "processing" | "completed" | 2 more` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: Array` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: LatestJob` The most recent webhook job for this webhook configuration. - `id: string` Unique identifier for the webhook job. - `created_at: string` When the webhook job was created. - `stale: boolean` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: "pending" | "processing" | "completed"` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: string` Unique identifier for the webhook configuration. - `webhook_label: string` Account-specified display label for the webhook configuration. - `id?: string` Unique identifier for the finding instance. - `is_archived?: boolean` Whether this finding instance has been archived. ### Instance Get Response - `InstanceGetResponse` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: string` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: Category` Category information for an asset. - `service: string | null` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: string` The type of asset. - `vendor: string` The vendor the asset is part of. - `id?: string` Unique identifier for the asset category. - `external_id: string` External identifier from the source system. - `fields: Array` The fields associated with the asset. - `name: string` The name of the field. - `value: string` The value of the field. - `link?: string | null` Optional link associated with the field. - `name: string` Human-readable name of the asset. - `id?: string` Unique identifier for the asset. - `link?: string | null` Direct link to the asset. - `dlp_contexts: Array` DLP context information if this is a content finding. - `created: string` When the DLP context was created. - `entry_ids: Array` DLP Entry IDs. - `profile_id: string` DLP Profile ID. - `updated: string` When the DLP context was last updated. - `id?: string` Unique identifier for the DLP context. - `deleted?: string | null` When the DLP context was deleted. - `match_context_max_extent?: number | null` DLP Right Boundary of match context. - `match_context_min_extent?: number | null` DLP Left Boundary of match context. - `match_context_payload?: Record | null` DLP Match context payload that matched the profile in question. - `remediations: Array` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: string` Unique identifier for the remediation job. - `created_at: string` When the remediation job was created. - `stale: boolean` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: "pending" | "processing" | "completed" | 2 more` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: Array` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: LatestJob` The most recent webhook job for this webhook configuration. - `id: string` Unique identifier for the webhook job. - `created_at: string` When the webhook job was created. - `stale: boolean` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: "pending" | "processing" | "completed"` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: string` Unique identifier for the webhook configuration. - `webhook_label: string` Account-specified display label for the webhook configuration. - `id?: string` Unique identifier for the finding instance. - `is_archived?: boolean` Whether this finding instance has been archived. ### Instance Export Response - `InstanceExportResponse` Information about an export job. - `id: string` Unique identifier for the export job. - `status: "Pending" | "Success" | "Failure" | 2 more` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: "finding" | "findingInstance" | "content" | "remediationJob"` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: string` ID of the export-requesting user. - `download_url?: string | null` The URL by which the successfully created export can be downloaded by the end users. - `errors?: string | null` Contains information on errors which may have occurred during export creation. - `file_name?: string | null` The base name of the file that is/was generated by the export job. - `file_path?: string | null` The full path of the file that is stored within external storage (currently R2). ### Instance Archive Response - `InstanceArchiveResponse` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: string` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: Category` Category information for an asset. - `service: string | null` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: string` The type of asset. - `vendor: string` The vendor the asset is part of. - `id?: string` Unique identifier for the asset category. - `external_id: string` External identifier from the source system. - `fields: Array` The fields associated with the asset. - `name: string` The name of the field. - `value: string` The value of the field. - `link?: string | null` Optional link associated with the field. - `name: string` Human-readable name of the asset. - `id?: string` Unique identifier for the asset. - `link?: string | null` Direct link to the asset. - `dlp_contexts: Array` DLP context information if this is a content finding. - `created: string` When the DLP context was created. - `entry_ids: Array` DLP Entry IDs. - `profile_id: string` DLP Profile ID. - `updated: string` When the DLP context was last updated. - `id?: string` Unique identifier for the DLP context. - `deleted?: string | null` When the DLP context was deleted. - `match_context_max_extent?: number | null` DLP Right Boundary of match context. - `match_context_min_extent?: number | null` DLP Left Boundary of match context. - `match_context_payload?: Record | null` DLP Match context payload that matched the profile in question. - `remediations: Array` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: string` Unique identifier for the remediation job. - `created_at: string` When the remediation job was created. - `stale: boolean` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: "pending" | "processing" | "completed" | 2 more` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: Array` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: LatestJob` The most recent webhook job for this webhook configuration. - `id: string` Unique identifier for the webhook job. - `created_at: string` When the webhook job was created. - `stale: boolean` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: "pending" | "processing" | "completed"` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: string` Unique identifier for the webhook configuration. - `webhook_label: string` Account-specified display label for the webhook configuration. - `id?: string` Unique identifier for the finding instance. - `is_archived?: boolean` Whether this finding instance has been archived. ### Instance Unarchive Response - `InstanceUnarchiveResponse` A specific instance of a security finding. In the API interface, we refer to the 'finding' table in our DB as finding instances, optimized for the p99 use case. - `affliction_date: string` When this specific instance was identified. - `asset: Asset` Asset information including metadata and categorization. - `category: Category` Category information for an asset. - `service: string | null` The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service. - `type: string` The type of asset. - `vendor: string` The vendor the asset is part of. - `id?: string` Unique identifier for the asset category. - `external_id: string` External identifier from the source system. - `fields: Array` The fields associated with the asset. - `name: string` The name of the field. - `value: string` The value of the field. - `link?: string | null` Optional link associated with the field. - `name: string` Human-readable name of the asset. - `id?: string` Unique identifier for the asset. - `link?: string | null` Direct link to the asset. - `dlp_contexts: Array` DLP context information if this is a content finding. - `created: string` When the DLP context was created. - `entry_ids: Array` DLP Entry IDs. - `profile_id: string` DLP Profile ID. - `updated: string` When the DLP context was last updated. - `id?: string` Unique identifier for the DLP context. - `deleted?: string | null` When the DLP context was deleted. - `match_context_max_extent?: number | null` DLP Right Boundary of match context. - `match_context_min_extent?: number | null` DLP Left Boundary of match context. - `match_context_payload?: Record | null` DLP Match context payload that matched the profile in question. - `remediations: Array` A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The 'stale' field indicates whether the remediation job was created before the finding instance's affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array. - `id: string` Unique identifier for the remediation job. - `created_at: string` When the remediation job was created. - `stale: boolean` Whether this remediation job is stale (created before the finding instance's affliction_date). - `status: "pending" | "processing" | "completed" | 2 more` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `webhooks: Array` The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The 'stale' field indicates whether the job was invoked before the finding instance's current affliction_date. If no webhook jobs have been created, this field will be an empty array. - `latest_job: LatestJob` The most recent webhook job for this webhook configuration. - `id: string` Unique identifier for the webhook job. - `created_at: string` When the webhook job was created. - `stale: boolean` Whether this webhook job is stale (created before the finding instance's current affliction_date). - `status: "pending" | "processing" | "completed"` Current status of the webhook job. - `"pending"` - `"processing"` - `"completed"` - `webhook_id: string` Unique identifier for the webhook configuration. - `webhook_label: string` Account-specified display label for the webhook configuration. - `id?: string` Unique identifier for the finding instance. - `is_archived?: boolean` Whether this finding instance has been archived. # Exports ## List all export jobs `client.zeroTrust.casb.posture.exports.list(ExportListParamsparams, RequestOptionsoptions?): V4PagePaginationArray` **get** `/accounts/{account_id}/data-security/posture/exports` List all export jobs for a given requestor's organization ### Parameters - `params: ExportListParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `page?: number` Query param: A page number within the paginated result set. - `per_page?: number` Query param: Number of results to return per page. - `status?: "Pending" | "Success" | "Failure" | 2 more` Query param: Filter on export job's status - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` ### Returns - `ExportListResponse` Information about an export job. - `id: string` Unique identifier for the export job. - `status: "Pending" | "Success" | "Failure" | 2 more` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: "finding" | "findingInstance" | "content" | "remediationJob"` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: string` ID of the export-requesting user. - `download_url?: string | null` The URL by which the successfully created export can be downloaded by the end users. - `errors?: string | null` Contains information on errors which may have occurred during export creation. - `file_name?: string | null` The base name of the file that is/was generated by the export job. - `file_path?: string | null` The full path of the file that is stored within external storage (currently R2). ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); // Automatically fetches more pages as needed. for await (const exportListResponse of client.zeroTrust.casb.posture.exports.list({ account_id: '46148281d8a93d002ef242d8b0d5f9f6', })) { console.log(exportListResponse.id); } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } ] } ``` ## Get a single export job `client.zeroTrust.casb.posture.exports.get(stringid, ExportGetParamsparams, RequestOptionsoptions?): ExportGetResponse` **get** `/accounts/{account_id}/data-security/posture/exports/{id}` Retrieves a single export job by its unique identifier ### Parameters - `id: string` - `params: ExportGetParams` - `account_id: string` Cloudflare account ID for the user making the request. ### Returns - `ExportGetResponse` Information about an export job. - `id: string` Unique identifier for the export job. - `status: "Pending" | "Success" | "Failure" | 2 more` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: "finding" | "findingInstance" | "content" | "remediationJob"` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: string` ID of the export-requesting user. - `download_url?: string | null` The URL by which the successfully created export can be downloaded by the end users. - `errors?: string | null` Contains information on errors which may have occurred during export creation. - `file_name?: string | null` The base name of the file that is/was generated by the export job. - `file_path?: string | null` The full path of the file that is stored within external storage (currently R2). ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const _export = await client.zeroTrust.casb.posture.exports.get('id', { account_id: '46148281d8a93d002ef242d8b0d5f9f6', }); console.log(_export.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } } ``` ## Domain Types ### Export List Response - `ExportListResponse` Information about an export job. - `id: string` Unique identifier for the export job. - `status: "Pending" | "Success" | "Failure" | 2 more` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: "finding" | "findingInstance" | "content" | "remediationJob"` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: string` ID of the export-requesting user. - `download_url?: string | null` The URL by which the successfully created export can be downloaded by the end users. - `errors?: string | null` Contains information on errors which may have occurred during export creation. - `file_name?: string | null` The base name of the file that is/was generated by the export job. - `file_path?: string | null` The full path of the file that is stored within external storage (currently R2). ### Export Get Response - `ExportGetResponse` Information about an export job. - `id: string` Unique identifier for the export job. - `status: "Pending" | "Success" | "Failure" | 2 more` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: "finding" | "findingInstance" | "content" | "remediationJob"` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: string` ID of the export-requesting user. - `download_url?: string | null` The URL by which the successfully created export can be downloaded by the end users. - `errors?: string | null` Contains information on errors which may have occurred during export creation. - `file_name?: string | null` The base name of the file that is/was generated by the export job. - `file_path?: string | null` The full path of the file that is stored within external storage (currently R2). # Finding Types ## List all finding types `client.zeroTrust.casb.posture.findingTypes.list(FindingTypeListParamsparams, RequestOptionsoptions?): V4PagePaginationArray` **get** `/accounts/{account_id}/data-security/posture/finding_types` List all available finding types with pagination support. ### Parameters - `params: FindingTypeListParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `page?: number` Query param: A page number within the paginated result set. - `per_page?: number` Query param: Number of results to return per page. ### Returns - `FindingTypeListResponse` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); // Automatically fetches more pages as needed. for await (const findingTypeListResponse of client.zeroTrust.casb.posture.findingTypes.list({ account_id: '46148281d8a93d002ef242d8b0d5f9f6', })) { console.log(findingTypeListResponse.id); } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace" } ] } ``` ## Get finding by ID `client.zeroTrust.casb.posture.findingTypes.get(stringfindingTypeID, FindingTypeGetParamsparams, RequestOptionsoptions?): FindingTypeGetResponse` **get** `/accounts/{account_id}/data-security/posture/finding_types/{finding_type_id}` Retrieve a specific finding type by its unique identifier. ### Parameters - `findingTypeID: string` - `params: FindingTypeGetParams` - `account_id: string` Cloudflare account ID for the user making the request. ### Returns - `FindingTypeGetResponse` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const findingType = await client.zeroTrust.casb.posture.findingTypes.get( '182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e', { account_id: '46148281d8a93d002ef242d8b0d5f9f6' }, ); console.log(findingType.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94", "category": { "observation": "Issue", "product": "SaaS", "type": "Posture" }, "name": "Slack File Publicly Accessible", "severity": "High", "vendor": "Google Workspace" } } ``` ## Domain Types ### Finding Type List Response - `FindingTypeListResponse` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. ### Finding Type Get Response - `FindingTypeGetResponse` Basic finding type information. - `id: string` The unique identifier of the finding. - `category: Category` Category information for a finding. - `observation: "Issue" | "Insight" | "Activity"` The type of the observation. - `"Issue"` - `"Insight"` - `"Activity"` - `product: "SaaS" | "Cloud"` The product category. - `"SaaS"` - `"Cloud"` - `type: "Content" | "Posture"` The type of the finding category. - `"Content"` - `"Posture"` - `name: string` The name of the finding. - `severity: "Critical" | "High" | "Medium" | "Low"` The severity level of a finding. - `"Critical"` - `"High"` - `"Medium"` - `"Low"` - `vendor: string` The SaaS/Cloud vendor of the platform with which the finding is associated. # Remediation Types ## List remediation types for a finding type `client.zeroTrust.casb.posture.findingTypes.remediationTypes.list(stringfindingTypeID, RemediationTypeListParamsparams, RequestOptionsoptions?): V4PagePaginationArray` **get** `/accounts/{account_id}/data-security/posture/finding_types/{finding_type_id}/remediation_types` List all remediation types for a given finding type. This endpoint supports both cursor and offset pagination. Note that `cursor` and `page` are mutually exclusive. ### Parameters - `findingTypeID: string` - `params: RemediationTypeListParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `cursor?: string` Query param: A cursor for pagination. - `integration_id?: string` Query param: Filter by an integration ID - `page?: number` Query param: A page number within the paginated result set. - `per_page?: number` Query param: Number of results to return per page. ### Returns - `RemediationTypeListResponse` Information about a remediation type. - `id: string` The identifier for the remediation type. - `description: string` A description of the action(s) taken by the remediation type. - `display_name: string` The name of the remediation type as displayed in the cloudflare dashboard. - `finding_type_id: string` The identifier of the finding_type which this remediation type should remediate. - `remediation_type: string` The name of the remediation type. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); // Automatically fetches more pages as needed. for await (const remediationTypeListResponse of client.zeroTrust.casb.posture.findingTypes.remediationTypes.list( '182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e', { account_id: '46148281d8a93d002ef242d8b0d5f9f6' }, )) { console.log(remediationTypeListResponse.id); } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "id": "7d736ac5-ed3b-46d5-9375-7025175ba1d9", "description": "Remove publicly accessible URL granting edit access", "display_name": "Remove Publicly Accessible URL - Edit Access", "finding_type_id": "6a790513-bbb5-4933-8971-76a744ec5448", "remediation_type": "Microsoft: Remove Publicly Accessible URL - Edit Access" } ] } ``` ## Domain Types ### Remediation Type List Response - `RemediationTypeListResponse` Information about a remediation type. - `id: string` The identifier for the remediation type. - `description: string` A description of the action(s) taken by the remediation type. - `display_name: string` The name of the remediation type as displayed in the cloudflare dashboard. - `finding_type_id: string` The identifier of the finding_type which this remediation type should remediate. - `remediation_type: string` The name of the remediation type. # Content ## List DLP content findings `client.zeroTrust.casb.posture.content.list(ContentListParamsparams, RequestOptionsoptions?): V4PagePaginationArray` **get** `/accounts/{account_id}/data-security/posture/content` List DLP content findings ### Parameters - `params: ContentListParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `direction?: "asc" | "desc"` Query param: Direction to order results. - `"asc"` - `"desc"` - `dlp_profile_id?: string` Query param: Filter by an DLP profile ID - `integration_id?: string` Query param: Filter by an integration ID - `max_affliction_date?: string` Query param: Filter to view findings that occurred on or before the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `min_affliction_date?: string` Query param: Filter to view findings that occurred on or after the affliction date. Can be a date-time in ISO 8601 format or an epoch timestamp. - `order?: "asset_name" | "dlp_profile_count" | "integration_name" | "latest_affliction_date"` Query param: Which field to use when ordering content assets. - `"asset_name"` - `"dlp_profile_count"` - `"integration_name"` - `"latest_affliction_date"` - `page?: number` Query param: A page number within the paginated result set. - `per_page?: number` Query param: Number of results to return per page. - `search?: string` Query param: A search term. - `vendor?: "ANTHROPIC" | "AWS" | "BITBUCKET" | 13 more` Query param: Filter by vendor - `"ANTHROPIC"` - `"AWS"` - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_CLOUD_PLATFORM"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT"` - `"MICROSOFT_INTERNAL"` - `"OPENAI"` - `"SALESFORCE"` - `"SERVICENOW"` - `"SLACK"` ### Returns - `ContentListResponse` Content asset with DLP information. - `asset_id: string` Unique identifier for the asset. - `asset_name: string` Name of the asset. - `dlp_contexts: Array` DLP context information for this asset. - `created: string` When the DLP context was created. - `entry_ids: Array` DLP Entry IDs. - `profile_id: string` DLP Profile ID. - `updated: string` When the DLP context was last updated. - `id?: string` Unique identifier for the DLP context. - `deleted?: string | null` When the DLP context was deleted. - `match_context_max_extent?: number | null` DLP Right Boundary of match context. - `match_context_min_extent?: number | null` DLP Left Boundary of match context. - `match_context_payload?: Record | null` DLP Match context payload that matched the profile in question. - `dlp_profile_count: number` Number of DLP profiles that flagged this asset. - `dlp_profile_ids: Array` IDs of DLP profiles that flagged this asset. - `integration: Integration` Summary information about an integration. - `created: string` When entity was created. - `last_hydrated: string` When were the integration credentials last updated. - `name: string` Name of the integration. - `permissions: Array` The vendor-specific permissions associated with the integration. - `policy: Policy` Policy configuration for an integration. - `id?: string` Policy identifier. - `client_id?: string | null` OAuth client ID for the policy. - `compliance_level?: string` Compliance level for the policy. - `dlp_enabled?: boolean` Whether DLP is enabled for this policy. - `link?: string | null` Link to policy documentation. - `name?: string` Policy name. - `permissions?: Array` List of permissions included in the policy. - `status: string` Current status of the integration. - `updated: string` Last entity was updated. - `upgradable: boolean` Whether the integrations permissions can be updated. - `vendor: Vendor` Information about a vendor/service provider. - `id: string` The id of the vendor. - `description: string | null` Detailed information about what kinds of issues are detected for this vendor. - `display_name: string` The display name of the vendor. - `logo: string` Logo URL for the vendor. - `name: string` The name of the vendor. - `static_logo: string` Static logo URL for the vendor. - `zt_enrollments: Array` The vendor's compatible Zero Trust products. - `policies?: Array>` The policies related to the vendor. - `zt_enrollments: Array` Zero Trust products associated with this integration. - `id?: string` The internal identifier of the Zero Trust Product. - `description?: string` Brief description of the Zero Trust Product. - `display_name?: string` The verbose name of the Zero Trust Product. - `enabled?: boolean` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id?: string` Integration ID. - `credential_health_status?: "Initializing" | "Healthy" | "Unhealthy"` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry?: string | null` The date and time when the integration credentials will expire. - `is_paused?: boolean` Whether the given integration is paused by the user. - `upgrade_dismissed?: boolean` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: string` Most recent date this asset was flagged. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); // Automatically fetches more pages as needed. for await (const contentListResponse of client.zeroTrust.casb.posture.content.list({ account_id: '46148281d8a93d002ef242d8b0d5f9f6', })) { console.log(contentListResponse.asset_id); } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result_info": { "count": 1, "cursor": "eyJpZCI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImFmZmxpY3Rpb25fZGF0ZSI6IjE5NzAtMDEtMDFUMDA6MDA6MDAuMDAwMDAwWiJ9", "next": "https://example.com", "page": 1, "per_page": 20, "previous": "https://example.com", "total_count": 2000 }, "success": true, "result": [ { "asset_id": "e6910838-4b91-45e9-b2b4-91bb23cb9762", "asset_name": "Test Asset Name", "dlp_contexts": [ { "created": "2025-03-18T17:25:38.695977Z", "entry_ids": [ "21befc68-a297-4090-ac10-17a051b901cd", "d6dd1e16-f78c-401a-b564-45c4e44aa467" ], "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e", "updated": "2025-03-18T17:25:38.695977Z", "id": "7653ff3a-d25e-4c10-8034-3460937c045b", "deleted": "2025-03-18T17:25:38.695977Z", "match_context_max_extent": 512, "match_context_min_extent": 1, "match_context_payload": {} } ], "dlp_profile_count": 2, "dlp_profile_ids": [ "c12f2059-8df4-43f8-9eb9-d27112d92b63", "822c051b-0bb4-4747-8929-471a1d506eef" ], "integration": { "created": "2021-08-10T20:16:11.851451Z", "last_hydrated": "2025-03-18T17:25:38.697894Z", "name": "Example integration", "permissions": [ "GroupMember.Read.All", "Group.Read.All" ], "policy": { "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c", "client_id": "client_id", "compliance_level": "standard", "dlp_enabled": true, "link": "https://example.com", "name": "Google Workspace Standard Policy", "permissions": [ "https://www.googleapis.com/auth/admin.directory.domain.readonly", "https://www.googleapis.com/auth/admin.directory.user.readonly" ] }, "status": "Healthy", "updated": "2021-08-10T20:16:11.851451Z", "upgradable": false, "vendor": { "id": "R09PR0xFX1dPUktTUEFDRQ==", "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.", "display_name": "Google Workspace", "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png", "name": "GOOGLE_WORKSPACE", "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png", "zt_enrollments": [ "casb" ], "policies": [ { "foo": "bar" } ] }, "zt_enrollments": [ { "id": "casb", "description": "example", "display_name": "Cloud Access Security Broker", "enabled": true } ], "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f", "credential_health_status": "Healthy", "credentials_expiry": "2025-03-18T17:25:38.697902Z", "is_paused": false, "upgrade_dismissed": false }, "latest_affliction_date": "2024-10-18T19:53:57.626659Z" } ] } ``` ## Create a content export `client.zeroTrust.casb.posture.content.export(ContentExportParamsparams, RequestOptionsoptions?): ContentExportResponse` **post** `/accounts/{account_id}/data-security/posture/content/export` Creates a CSV export for content and accepts optional filters in the payload. ### Parameters - `params: ContentExportParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `dlp_profile_information: Array` Body param: DLP profile metadata for the export. - `id: string` Unique identifier for the DLP profile. - `entries: Array` Entries contained within this DLP profile. - `id: string` Unique identifier for the DLP profile entry. - `name: string` Name of the DLP profile entry. - `profile_id: string` ID of the parent DLP profile. - `name: string` Name of the DLP profile. - `dlp_profile_id?: Array` Body param: Filter by DLP profile IDs. - `integration_id?: Array` Body param: Filter by integration IDs. - `max_affliction_date?: string` Body param: Filter to view content flagged on or before this date. - `min_affliction_date?: string` Body param: Filter to view content flagged on or after this date. - `orders?: Array` Body param: Ordering specifications for the export. - `direction: "asc" | "desc"` Sort direction. - `"asc"` - `"desc"` - `name: "asset_name" | "dlp_profile_count" | "integration_name" | "latest_affliction_date"` Content-specific field names for ordering. - `"asset_name"` - `"dlp_profile_count"` - `"integration_name"` - `"latest_affliction_date"` - `search?: string` Body param: Search term to filter content. - `vendors?: Array<"ANTHROPIC" | "AWS" | "BITBUCKET" | 13 more>` Body param: Filter by vendor types. - `"ANTHROPIC"` - `"AWS"` - `"BITBUCKET"` - `"BOX"` - `"CONFLUENCE"` - `"DROPBOX"` - `"GITHUB"` - `"GOOGLE_CLOUD_PLATFORM"` - `"GOOGLE_WORKSPACE"` - `"JIRA"` - `"MICROSOFT"` - `"MICROSOFT_INTERNAL"` - `"OPENAI"` - `"SALESFORCE"` - `"SERVICENOW"` - `"SLACK"` ### Returns - `ContentExportResponse` Information about an export job. - `id: string` Unique identifier for the export job. - `status: "Pending" | "Success" | "Failure" | 2 more` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: "finding" | "findingInstance" | "content" | "remediationJob"` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: string` ID of the export-requesting user. - `download_url?: string | null` The URL by which the successfully created export can be downloaded by the end users. - `errors?: string | null` Contains information on errors which may have occurred during export creation. - `file_name?: string | null` The base name of the file that is/was generated by the export job. - `file_path?: string | null` The full path of the file that is stored within external storage (currently R2). ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const response = await client.zeroTrust.casb.posture.content.export({ account_id: '46148281d8a93d002ef242d8b0d5f9f6', dlp_profile_information: [ { id: 'e91a2360-da51-4fdf-9711-bcdecd462614', entries: [ { id: '55ba2c6c-8ef4-4b2e-9148-e75e8b6ccac1', name: 'Credit Card Numbers', profile_id: 'e91a2360-da51-4fdf-9711-bcdecd462614', }, ], name: 'Financial Information', }, ], }); console.log(response.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } } ``` ## Domain Types ### Content List Response - `ContentListResponse` Content asset with DLP information. - `asset_id: string` Unique identifier for the asset. - `asset_name: string` Name of the asset. - `dlp_contexts: Array` DLP context information for this asset. - `created: string` When the DLP context was created. - `entry_ids: Array` DLP Entry IDs. - `profile_id: string` DLP Profile ID. - `updated: string` When the DLP context was last updated. - `id?: string` Unique identifier for the DLP context. - `deleted?: string | null` When the DLP context was deleted. - `match_context_max_extent?: number | null` DLP Right Boundary of match context. - `match_context_min_extent?: number | null` DLP Left Boundary of match context. - `match_context_payload?: Record | null` DLP Match context payload that matched the profile in question. - `dlp_profile_count: number` Number of DLP profiles that flagged this asset. - `dlp_profile_ids: Array` IDs of DLP profiles that flagged this asset. - `integration: Integration` Summary information about an integration. - `created: string` When entity was created. - `last_hydrated: string` When were the integration credentials last updated. - `name: string` Name of the integration. - `permissions: Array` The vendor-specific permissions associated with the integration. - `policy: Policy` Policy configuration for an integration. - `id?: string` Policy identifier. - `client_id?: string | null` OAuth client ID for the policy. - `compliance_level?: string` Compliance level for the policy. - `dlp_enabled?: boolean` Whether DLP is enabled for this policy. - `link?: string | null` Link to policy documentation. - `name?: string` Policy name. - `permissions?: Array` List of permissions included in the policy. - `status: string` Current status of the integration. - `updated: string` Last entity was updated. - `upgradable: boolean` Whether the integrations permissions can be updated. - `vendor: Vendor` Information about a vendor/service provider. - `id: string` The id of the vendor. - `description: string | null` Detailed information about what kinds of issues are detected for this vendor. - `display_name: string` The display name of the vendor. - `logo: string` Logo URL for the vendor. - `name: string` The name of the vendor. - `static_logo: string` Static logo URL for the vendor. - `zt_enrollments: Array` The vendor's compatible Zero Trust products. - `policies?: Array>` The policies related to the vendor. - `zt_enrollments: Array` Zero Trust products associated with this integration. - `id?: string` The internal identifier of the Zero Trust Product. - `description?: string` Brief description of the Zero Trust Product. - `display_name?: string` The verbose name of the Zero Trust Product. - `enabled?: boolean` Flag to enable/disable access to the listed integration from the corresponding Cloudflare product. - `id?: string` Integration ID. - `credential_health_status?: "Initializing" | "Healthy" | "Unhealthy"` Health status of integration credentials. - `"Initializing"` - `"Healthy"` - `"Unhealthy"` - `credentials_expiry?: string | null` The date and time when the integration credentials will expire. - `is_paused?: boolean` Whether the given integration is paused by the user. - `upgrade_dismissed?: boolean` UI State as to whether a potential permissions upgrade has been dismissed. - `latest_affliction_date: string` Most recent date this asset was flagged. ### Content Export Response - `ContentExportResponse` Information about an export job. - `id: string` Unique identifier for the export job. - `status: "Pending" | "Success" | "Failure" | 2 more` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: "finding" | "findingInstance" | "content" | "remediationJob"` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: string` ID of the export-requesting user. - `download_url?: string | null` The URL by which the successfully created export can be downloaded by the end users. - `errors?: string | null` Contains information on errors which may have occurred during export creation. - `file_name?: string | null` The base name of the file that is/was generated by the export job. - `file_path?: string | null` The full path of the file that is stored within external storage (currently R2). # Remediations # Jobs ## List remediation jobs `client.zeroTrust.casb.posture.remediations.jobs.list(JobListParamsparams, RequestOptionsoptions?): V4PagePaginationArray` **get** `/accounts/{account_id}/data-security/posture/remediations/jobs` List all remediation jobs tied to a specific Cloudflare Account. Note that `cursor` and `page` are mutually exclusive. ### Parameters - `params: JobListParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `cursor?: string` Query param: A cursor for pagination. - `direction?: "asc" | "desc"` Query param: Direction to order results. - `"asc"` - `"desc"` - `integration_id?: string` Query param: Filter by an integration ID - `max_updated_at?: string` Query param: Filter to view remediations updated on or before the max updated datetime. Can be a date-time in ISO 8601 format or an epoch timestamp. - `min_updated_at?: string` Query param: Filter to view remediations updated on or after the min updated datetime. Can be a date-time in ISO 8601 format or an epoch timestamp. - `order?: "created_at" | "affliction_date" | "integration_name" | 4 more` Query param: An optional param to sort the results by the given field. - `"created_at"` - `"affliction_date"` - `"integration_name"` - `"status"` - `"last_updated_at"` - `"asset_name"` - `"finding_type_name"` - `page?: number` Query param: A page number within the paginated result set. - `per_page?: number` Query param: Number of results to return per page. - `search?: string` Query param: A search term. - `status?: "pending" | "processing" | "completed" | 2 more` Query param: Filter to view remediations with the given status. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `triggered_by_actor?: Array<"user" | "account_token">` Query param: Filter remediations by what kind of actor triggered them. Supports multiple comma-separated values. - `"user"` - `"account_token"` ### Returns - `JobListResponse` Information about a remediation job. - `id: string` Unique identifier for the remediation job. - `asset: Asset` Asset information for a remediation job. - `id: string` Unique identifier for the asset. - `category: Category` Category information for a remediation job asset. - `service: string` Specific service within the vendor. - `type: string` Asset type. - `vendor: "AWS" | "Anthropic" | "Bitbucket" | 16 more` Display names for vendor types. - `"AWS"` - `"Anthropic"` - `"Bitbucket"` - `"Box"` - `"Confluence"` - `"Dropbox"` - `"GitHub"` - `"Google Cloud Platform"` - `"Google Workspace"` - `"Jira"` - `"Microsoft"` - `"Microsoft Internal"` - `"Okta"` - `"OpenAI"` - `"Slack"` - `"Salesforce"` - `"ServiceNow"` - `"Workday"` - `"Zoom"` - `external_id: string` External identifier from the source system. - `fields: Array` Additional fields associated with the asset. - `name: string` Field name. - `value: string | number | boolean` Field value (can be string, number, or boolean). - `string` - `number` - `boolean` - `link?: string | null` Optional link associated with the field. - `name: string` Human-readable name of the asset. - `link?: string | null` Direct link to the asset. - `created_at: string` When the remediation job was created. - `finding_id: string` Encoded finding ID. - `finding_instance_id: string` ID of the finding instance being remediated. - `finding_type_id: string` ID of the finding type. - `finding_type_name: string` Name of the finding type. - `integration_name: string` Name of the integration. - `last_updated: string` When the remediation job was last updated. - `remediation_type: string` Type of remediation being performed. - `status: "pending" | "processing" | "completed" | 2 more` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `triggered_by_user: string` Email of the user who triggered the remediation. For account-token actors this is the literal "Account API Token"; for policy actors this is empty. - `triggered_by_actor?: "user" | "account_token" | null` Type of actor that triggered the remediation job. Null on legacy rows created before this column was populated. - `"user"` - `"account_token"` - `triggered_by_id?: string | null` ID of the actor that triggered the job. Meaning depends on triggered_by_actor. Null on legacy rows. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); // Automatically fetches more pages as needed. for await (const jobListResponse of client.zeroTrust.casb.posture.remediations.jobs.list({ account_id: '46148281d8a93d002ef242d8b0d5f9f6', })) { console.log(jobListResponse.id); } ``` #### Response ```json { "errors": [ {} ], "messages": [ {} ], "result": [ { "id": "c416bc38-75db-425f-ae25-c37b5df5c37f", "asset": { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "category": { "service": "OneDrive", "type": "SaaS", "vendor": "Google Workspace" }, "external_id": "c416bc38-75db-425f-ae25-c37b5df5c37f", "fields": [ { "name": "File Name", "value": "sensitive-document.xlsx", "link": "https://dashboard.microsoft.com/files/details" } ], "name": "Microsoft File Publicly Accessible", "link": "https://dashboard.microsoft.com/files/details" }, "created_at": "2025-07-07T18:39:13.123456Z", "finding_id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "finding_instance_id": "3f7b8c9d-6e5a-4f3b-9c2d-1e0a8b7c6d5e", "finding_type_id": "775c5f38-efcf-4b2b-93db-8428979eb6a2", "finding_type_name": "Microsoft: File publicly accessible with edit access", "integration_name": "Microsoft", "last_updated": "2025-07-07T18:39:13.123456Z", "remediation_type": "Remove publicly accessible edit url", "status": "pending", "triggered_by_user": "user@example.com", "triggered_by_actor": "user", "triggered_by_id": "0123456789abcdef0123456789abcdef" } ], "result_info": { "count": 2, "cursor": "next_cursor_value", "page": 1, "per_page": 10, "total_count": 2 }, "success": true } ``` ## Creates remediation jobs `client.zeroTrust.casb.posture.remediations.jobs.create(JobCreateParamsparams, RequestOptionsoptions?): JobCreateResponse` **post** `/accounts/{account_id}/data-security/posture/remediations/jobs` Create one or more remediation jobs tied to a specific Cloudflare Account. ### Parameters - `params: JobCreateParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `finding_instance_ids: Array` Body param: UUIDs identifying Finding Instances. - `remediation_type_id: string` Body param: A UUID identifying this Remediation Type. ### Returns - `JobCreateResponse` - `created: Array` Successfully created remediation jobs. - `id: string` Unique identifier for the remediation job. - `asset: Asset` Asset information for a remediation job. - `id: string` Unique identifier for the asset. - `category: Category` Category information for a remediation job asset. - `service: string` Specific service within the vendor. - `type: string` Asset type. - `vendor: "AWS" | "Anthropic" | "Bitbucket" | 16 more` Display names for vendor types. - `"AWS"` - `"Anthropic"` - `"Bitbucket"` - `"Box"` - `"Confluence"` - `"Dropbox"` - `"GitHub"` - `"Google Cloud Platform"` - `"Google Workspace"` - `"Jira"` - `"Microsoft"` - `"Microsoft Internal"` - `"Okta"` - `"OpenAI"` - `"Slack"` - `"Salesforce"` - `"ServiceNow"` - `"Workday"` - `"Zoom"` - `external_id: string` External identifier from the source system. - `fields: Array` Additional fields associated with the asset. - `name: string` Field name. - `value: string | number | boolean` Field value (can be string, number, or boolean). - `string` - `number` - `boolean` - `link?: string | null` Optional link associated with the field. - `name: string` Human-readable name of the asset. - `link?: string | null` Direct link to the asset. - `created_at: string` When the remediation job was created. - `finding_id: string` Encoded finding ID. - `finding_instance_id: string` ID of the finding instance being remediated. - `finding_type_id: string` ID of the finding type. - `finding_type_name: string` Name of the finding type. - `integration_name: string` Name of the integration. - `last_updated: string` When the remediation job was last updated. - `remediation_type: string` Type of remediation being performed. - `status: "pending" | "processing" | "completed" | 2 more` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `triggered_by_user: string` Email of the user who triggered the remediation. For account-token actors this is the literal "Account API Token"; for policy actors this is empty. - `triggered_by_actor?: "user" | "account_token" | null` Type of actor that triggered the remediation job. Null on legacy rows created before this column was populated. - `"user"` - `"account_token"` - `triggered_by_id?: string | null` ID of the actor that triggered the job. Meaning depends on triggered_by_actor. Null on legacy rows. - `failed: Array` Failed remediation job creation attempts. - `error: string` Error message describing the failure. - `finding_instance_id: string` ID of the finding instance that failed to create a remediation job. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const job = await client.zeroTrust.casb.posture.remediations.jobs.create({ account_id: '46148281d8a93d002ef242d8b0d5f9f6', finding_instance_ids: ['182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e'], remediation_type_id: '5a7d9e2f-1b3c-4d5e-8f6a-7b8c9d0e1f2a', }); console.log(job.created); ``` #### Response ```json { "errors": [ {} ], "messages": [ {} ], "result": { "created": [ { "id": "c416bc38-75db-425f-ae25-c37b5df5c37f", "asset": { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "category": { "service": "OneDrive", "type": "SaaS", "vendor": "Google Workspace" }, "external_id": "c416bc38-75db-425f-ae25-c37b5df5c37f", "fields": [ { "name": "File Name", "value": "sensitive-document.xlsx", "link": "https://dashboard.microsoft.com/files/details" } ], "name": "Microsoft File Publicly Accessible", "link": "https://dashboard.microsoft.com/files/details" }, "created_at": "2025-07-07T18:39:13.123456Z", "finding_id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=", "finding_instance_id": "3f7b8c9d-6e5a-4f3b-9c2d-1e0a8b7c6d5e", "finding_type_id": "775c5f38-efcf-4b2b-93db-8428979eb6a2", "finding_type_name": "Microsoft: File publicly accessible with edit access", "integration_name": "Microsoft", "last_updated": "2025-07-07T18:39:13.123456Z", "remediation_type": "Remove publicly accessible edit url", "status": "pending", "triggered_by_user": "user@example.com", "triggered_by_actor": "user", "triggered_by_id": "0123456789abcdef0123456789abcdef" } ], "failed": [ { "error": "Failed to create remediation job", "finding_instance_id": "2e6b4c8a-9d1f-4e3b-8c7a-5f9e2d1a6b4c" } ] }, "success": true } ``` ## Create a remediation jobs export `client.zeroTrust.casb.posture.remediations.jobs.export(JobExportParamsparams, RequestOptionsoptions?): JobExportResponse` **post** `/accounts/{account_id}/data-security/posture/remediations/jobs/export` Creates a CSV export for remediation jobs and accepts optional filters in the payload. ### Parameters - `params: JobExportParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `integration_id?: Array` Body param: Filter by multiple integration IDs. - `max_updated_at?: string` Body param: Filter to view remediation jobs updated on or before this datetime. Can be a date-time in ISO 8601 format or an epoch timestamp. - `min_updated_at?: string` Body param: Filter to view remediation jobs updated on or after this datetime. Can be a date-time in ISO 8601 format or an epoch timestamp. - `orders?: Array` Body param: Ordering specifications for the export. - `direction: "asc" | "desc"` Sort direction. - `"asc"` - `"desc"` - `name: "asset_name" | "finding_type_name" | "integration_name" | 3 more` Which field to use when ordering the remediation jobs. - `"asset_name"` - `"finding_type_name"` - `"integration_name"` - `"status"` - `"last_updated_at"` - `"affliction_date"` - `search?: string` Body param: A search term. - `status?: Array<"pending" | "processing" | "completed" | 2 more>` Body param: Filter by remediation job status. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` ### Returns - `JobExportResponse` Information about an export job. - `id: string` Unique identifier for the export job. - `status: "Pending" | "Success" | "Failure" | 2 more` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: "finding" | "findingInstance" | "content" | "remediationJob"` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: string` ID of the export-requesting user. - `download_url?: string | null` The URL by which the successfully created export can be downloaded by the end users. - `errors?: string | null` Contains information on errors which may have occurred during export creation. - `file_name?: string | null` The base name of the file that is/was generated by the export job. - `file_path?: string | null` The full path of the file that is stored within external storage (currently R2). ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const response = await client.zeroTrust.casb.posture.remediations.jobs.export({ account_id: '46148281d8a93d002ef242d8b0d5f9f6', }); console.log(response.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "45ce02c2-e797-4a71-98cb-937244352fd4", "status": "Success", "type": "finding", "user_id": "e7712d506b1ee4c5ede0802815f55a75", "download_url": "https://example.com/45ce02c2-e797-4a71-98cb-937244352fd4", "errors": null, "file_name": "findings_export_2024-02-27.csv", "file_path": "/exports/finding-instances/2024/02/27/Finding_Instances_2024-02-27T04:05:26Z.csv" } } ``` ## Domain Types ### Job List Response - `JobListResponse` Information about a remediation job. - `id: string` Unique identifier for the remediation job. - `asset: Asset` Asset information for a remediation job. - `id: string` Unique identifier for the asset. - `category: Category` Category information for a remediation job asset. - `service: string` Specific service within the vendor. - `type: string` Asset type. - `vendor: "AWS" | "Anthropic" | "Bitbucket" | 16 more` Display names for vendor types. - `"AWS"` - `"Anthropic"` - `"Bitbucket"` - `"Box"` - `"Confluence"` - `"Dropbox"` - `"GitHub"` - `"Google Cloud Platform"` - `"Google Workspace"` - `"Jira"` - `"Microsoft"` - `"Microsoft Internal"` - `"Okta"` - `"OpenAI"` - `"Slack"` - `"Salesforce"` - `"ServiceNow"` - `"Workday"` - `"Zoom"` - `external_id: string` External identifier from the source system. - `fields: Array` Additional fields associated with the asset. - `name: string` Field name. - `value: string | number | boolean` Field value (can be string, number, or boolean). - `string` - `number` - `boolean` - `link?: string | null` Optional link associated with the field. - `name: string` Human-readable name of the asset. - `link?: string | null` Direct link to the asset. - `created_at: string` When the remediation job was created. - `finding_id: string` Encoded finding ID. - `finding_instance_id: string` ID of the finding instance being remediated. - `finding_type_id: string` ID of the finding type. - `finding_type_name: string` Name of the finding type. - `integration_name: string` Name of the integration. - `last_updated: string` When the remediation job was last updated. - `remediation_type: string` Type of remediation being performed. - `status: "pending" | "processing" | "completed" | 2 more` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `triggered_by_user: string` Email of the user who triggered the remediation. For account-token actors this is the literal "Account API Token"; for policy actors this is empty. - `triggered_by_actor?: "user" | "account_token" | null` Type of actor that triggered the remediation job. Null on legacy rows created before this column was populated. - `"user"` - `"account_token"` - `triggered_by_id?: string | null` ID of the actor that triggered the job. Meaning depends on triggered_by_actor. Null on legacy rows. ### Job Create Response - `JobCreateResponse` - `created: Array` Successfully created remediation jobs. - `id: string` Unique identifier for the remediation job. - `asset: Asset` Asset information for a remediation job. - `id: string` Unique identifier for the asset. - `category: Category` Category information for a remediation job asset. - `service: string` Specific service within the vendor. - `type: string` Asset type. - `vendor: "AWS" | "Anthropic" | "Bitbucket" | 16 more` Display names for vendor types. - `"AWS"` - `"Anthropic"` - `"Bitbucket"` - `"Box"` - `"Confluence"` - `"Dropbox"` - `"GitHub"` - `"Google Cloud Platform"` - `"Google Workspace"` - `"Jira"` - `"Microsoft"` - `"Microsoft Internal"` - `"Okta"` - `"OpenAI"` - `"Slack"` - `"Salesforce"` - `"ServiceNow"` - `"Workday"` - `"Zoom"` - `external_id: string` External identifier from the source system. - `fields: Array` Additional fields associated with the asset. - `name: string` Field name. - `value: string | number | boolean` Field value (can be string, number, or boolean). - `string` - `number` - `boolean` - `link?: string | null` Optional link associated with the field. - `name: string` Human-readable name of the asset. - `link?: string | null` Direct link to the asset. - `created_at: string` When the remediation job was created. - `finding_id: string` Encoded finding ID. - `finding_instance_id: string` ID of the finding instance being remediated. - `finding_type_id: string` ID of the finding type. - `finding_type_name: string` Name of the finding type. - `integration_name: string` Name of the integration. - `last_updated: string` When the remediation job was last updated. - `remediation_type: string` Type of remediation being performed. - `status: "pending" | "processing" | "completed" | 2 more` Status of a remediation job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `"validating"` - `triggered_by_user: string` Email of the user who triggered the remediation. For account-token actors this is the literal "Account API Token"; for policy actors this is empty. - `triggered_by_actor?: "user" | "account_token" | null` Type of actor that triggered the remediation job. Null on legacy rows created before this column was populated. - `"user"` - `"account_token"` - `triggered_by_id?: string | null` ID of the actor that triggered the job. Meaning depends on triggered_by_actor. Null on legacy rows. - `failed: Array` Failed remediation job creation attempts. - `error: string` Error message describing the failure. - `finding_instance_id: string` ID of the finding instance that failed to create a remediation job. ### Job Export Response - `JobExportResponse` Information about an export job. - `id: string` Unique identifier for the export job. - `status: "Pending" | "Success" | "Failure" | 2 more` Status of an export job. - `"Pending"` - `"Success"` - `"Failure"` - `"Rescheduled"` - `"In-Progress"` - `type: "finding" | "findingInstance" | "content" | "remediationJob"` Type of export job. - `"finding"` - `"findingInstance"` - `"content"` - `"remediationJob"` - `user_id: string` ID of the export-requesting user. - `download_url?: string | null` The URL by which the successfully created export can be downloaded by the end users. - `errors?: string | null` Contains information on errors which may have occurred during export creation. - `file_name?: string | null` The base name of the file that is/was generated by the export job. - `file_path?: string | null` The full path of the file that is stored within external storage (currently R2). # Webhooks ## List webhook configurations `client.zeroTrust.casb.posture.webhooks.list(WebhookListParamsparams, RequestOptionsoptions?): SinglePage` **get** `/accounts/{account_id}/data-security/posture/webhooks` Retrieves all webhook configurations for the authenticated account. Returns an array of webhook configurations that can be used to send finding notifications. ### Parameters - `params: WebhookListParams` - `account_id: string` Cloudflare account ID for the user making the request. ### Returns - `WebhookListResponse` Webhook configuration for sending finding notifications. - `id: string` Unique identifier for the specific webhook configuration. - `authentication_type: "Basic Auth" | "None" | "Bearer Auth" | 2 more` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: string` Timestamp when the webhook configuration was created. - `destination_url: string` Target URL for the webhook configuration. Where resulting data will be sent. - `label: string` Account-specified display label for the webhook configuration. - `status: "enabled" | "disabled"` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: string` Timestamp when the webhook configuration was last updated. - `version: number` Version number of the configuration. - `headers?: Array
` List of header keys configured for this webhook. Values are not included for security reasons. - `key?: string` Header key name (lowercase). - `value?: string` Header value. This field is never returned in API responses for security reasons. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); // Automatically fetches more pages as needed. for await (const webhookListResponse of client.zeroTrust.casb.posture.webhooks.list({ account_id: '46148281d8a93d002ef242d8b0d5f9f6', })) { console.log(webhookListResponse.id); } ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": [ { "id": "550e8400-e29b-41d4-a716-446655440000", "authentication_type": "Bearer Auth", "created_at": "2024-01-15T10:30:00Z", "destination_url": "https://example.com/webhook", "label": "Send to Gmail", "status": "enabled", "updated_at": "2024-01-20T14:45:00Z", "version": 1, "headers": [ { "key": "authorization" } ] } ] } ``` ## Create a new webhook configuration `client.zeroTrust.casb.posture.webhooks.create(WebhookCreateParamsparams, RequestOptionsoptions?): WebhookCreateResponse` **post** `/accounts/{account_id}/data-security/posture/webhooks` Creates a new webhook configuration for sending finding notifications to external endpoints. ### Parameters - `params: WebhookCreateParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `authentication_type: "Basic Auth" | "None" | "Bearer Auth" | 2 more` Body param: Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `destination_url: string` Body param: Target URL for the webhook configuration. Where resulting data will be sent. - `label: string` Body param: Account-specified display label for the webhook configuration. - `headers?: Array
` Body param: List of custom headers to include in webhook requests. - `key: string` Header key name. - `value?: string | null` Header value. Required on Create and Evaluate. On Update, omit or set to null to keep existing value. - `signing_secret?: string` Body param: Secret key used for HMAC signing when authentication_type is "HMAC-Signing". ### Returns - `WebhookCreateResponse` Webhook configuration for sending finding notifications. - `id: string` Unique identifier for the specific webhook configuration. - `authentication_type: "Basic Auth" | "None" | "Bearer Auth" | 2 more` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: string` Timestamp when the webhook configuration was created. - `destination_url: string` Target URL for the webhook configuration. Where resulting data will be sent. - `label: string` Account-specified display label for the webhook configuration. - `status: "enabled" | "disabled"` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: string` Timestamp when the webhook configuration was last updated. - `version: number` Version number of the configuration. - `headers?: Array
` List of header keys configured for this webhook. Values are not included for security reasons. - `key?: string` Header key name (lowercase). - `value?: string` Header value. This field is never returned in API responses for security reasons. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const webhook = await client.zeroTrust.casb.posture.webhooks.create({ account_id: '46148281d8a93d002ef242d8b0d5f9f6', authentication_type: 'Bearer Auth', destination_url: 'https://example.com/webhook', label: 'Send to Slack', }); console.log(webhook.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "550e8400-e29b-41d4-a716-446655440000", "authentication_type": "Bearer Auth", "created_at": "2024-01-15T10:30:00Z", "destination_url": "https://example.com/webhook", "label": "Send to Gmail", "status": "enabled", "updated_at": "2024-01-20T14:45:00Z", "version": 1, "headers": [ { "key": "authorization" } ] } } ``` ## Get webhook configuration by ID `client.zeroTrust.casb.posture.webhooks.get(stringwebhookID, WebhookGetParamsparams, RequestOptionsoptions?): WebhookGetResponse` **get** `/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}` Retrieves a specific webhook configuration by its unique identifier. ### Parameters - `webhookID: string` - `params: WebhookGetParams` - `account_id: string` Cloudflare account ID for the user making the request. ### Returns - `WebhookGetResponse` Webhook configuration for sending finding notifications. - `id: string` Unique identifier for the specific webhook configuration. - `authentication_type: "Basic Auth" | "None" | "Bearer Auth" | 2 more` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: string` Timestamp when the webhook configuration was created. - `destination_url: string` Target URL for the webhook configuration. Where resulting data will be sent. - `label: string` Account-specified display label for the webhook configuration. - `status: "enabled" | "disabled"` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: string` Timestamp when the webhook configuration was last updated. - `version: number` Version number of the configuration. - `headers?: Array
` List of header keys configured for this webhook. Values are not included for security reasons. - `key?: string` Header key name (lowercase). - `value?: string` Header value. This field is never returned in API responses for security reasons. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const webhook = await client.zeroTrust.casb.posture.webhooks.get( '182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e', { account_id: '46148281d8a93d002ef242d8b0d5f9f6' }, ); console.log(webhook.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "550e8400-e29b-41d4-a716-446655440000", "authentication_type": "Bearer Auth", "created_at": "2024-01-15T10:30:00Z", "destination_url": "https://example.com/webhook", "label": "Send to Gmail", "status": "enabled", "updated_at": "2024-01-20T14:45:00Z", "version": 1, "headers": [ { "key": "authorization" } ] } } ``` ## Update an existing webhook configuration `client.zeroTrust.casb.posture.webhooks.update(stringwebhookID, WebhookUpdateParamsparams, RequestOptionsoptions?): WebhookUpdateResponse` **put** `/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}` Updates an existing webhook configuration with new settings. ### Parameters - `webhookID: string` - `params: WebhookUpdateParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `authentication_type: "Basic Auth" | "None" | "Bearer Auth" | 2 more` Body param: Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `destination_url: string` Body param: Target URL for the webhook configuration. Where resulting data will be sent. - `label: string` Body param: Account-specified display label for the webhook configuration. - `status: "enabled" | "disabled"` Body param: Status of the webhook configuration. - `"enabled"` - `"disabled"` - `headers?: Array
` Body param: List of custom headers to include in webhook requests. - `key: string` Header key name. - `value?: string | null` Header value. Required on Create and Evaluate. On Update, omit or set to null to keep existing value. - `signing_secret?: string` Body param: Secret key used for HMAC signing when authentication_type is "HMAC-Signing". ### Returns - `WebhookUpdateResponse` Webhook configuration for sending finding notifications. - `id: string` Unique identifier for the specific webhook configuration. - `authentication_type: "Basic Auth" | "None" | "Bearer Auth" | 2 more` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: string` Timestamp when the webhook configuration was created. - `destination_url: string` Target URL for the webhook configuration. Where resulting data will be sent. - `label: string` Account-specified display label for the webhook configuration. - `status: "enabled" | "disabled"` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: string` Timestamp when the webhook configuration was last updated. - `version: number` Version number of the configuration. - `headers?: Array
` List of header keys configured for this webhook. Values are not included for security reasons. - `key?: string` Header key name (lowercase). - `value?: string` Header value. This field is never returned in API responses for security reasons. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const webhook = await client.zeroTrust.casb.posture.webhooks.update( '182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e', { account_id: '46148281d8a93d002ef242d8b0d5f9f6', authentication_type: 'Bearer Auth', destination_url: 'https://example.com/webhook', label: 'Send to Slack', status: 'enabled', }, ); console.log(webhook.id); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "id": "550e8400-e29b-41d4-a716-446655440000", "authentication_type": "Bearer Auth", "created_at": "2024-01-15T10:30:00Z", "destination_url": "https://example.com/webhook", "label": "Send to Gmail", "status": "enabled", "updated_at": "2024-01-20T14:45:00Z", "version": 1, "headers": [ { "key": "authorization" } ] } } ``` ## Delete a webhook configuration `client.zeroTrust.casb.posture.webhooks.delete(stringwebhookID, WebhookDeleteParamsparams, RequestOptionsoptions?): WebhookDeleteResponse` **delete** `/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}` Soft deletes a webhook configuration by its unique identifier. The webhook will be marked as deleted and will no longer be available for use. ### Parameters - `webhookID: string` - `params: WebhookDeleteParams` - `account_id: string` Cloudflare account ID for the user making the request. ### Returns - `WebhookDeleteResponse` Common response structure for all API endpoints. - `errors: Array` - `code: number` Error or message code. - `message: string` Human-readable message. - `documentation_url?: string` Link to relevant documentation. - `source?: Source` - `pointer?: string` JSON pointer to the source of the error. - `messages: Array` - `code: number` Error or message code. - `message: string` Human-readable message. - `documentation_url?: string` Link to relevant documentation. - `source?: Source` - `pointer?: string` JSON pointer to the source of the error. - `success: boolean` Whether the API call was successful. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const webhook = await client.zeroTrust.casb.posture.webhooks.delete( '182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e', { account_id: '46148281d8a93d002ef242d8b0d5f9f6' }, ); console.log(webhook.errors); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true } ``` ## Test a webhook configuration before creating it `client.zeroTrust.casb.posture.webhooks.evaluate(WebhookEvaluateParamsparams, RequestOptionsoptions?): WebhookEvaluateResponse` **post** `/accounts/{account_id}/data-security/posture/webhooks/evaluate` Sends a test webhook event to the specified destination URL to verify the webhook endpoint is reachable and properly configured. This allows customers to validate their webhook configuration before creating the actual webhook resource. The test payload includes: - event_type: "webhook.test" - timestamp: Current UTC timestamp - message: Test message indicating this is from Cloudflare CASB - data: Object with test: true ### Parameters - `params: WebhookEvaluateParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `authentication_type: "Basic Auth" | "None" | "Bearer Auth" | 2 more` Body param: Type of authentication to use for the test webhook request. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `destination_url: string` Body param: Target URL to send the test webhook event to. - `headers?: Array
` Body param: List of custom headers to include in the test webhook request. - `key: string` Header key name. - `value?: string | null` Header value. Required on Create and Evaluate. On Update, omit or set to null to keep existing value. - `signing_secret?: string` Body param: Secret key used for HMAC signing when authentication_type is "HMAC-Signing". ### Returns - `WebhookEvaluateResponse` Response body for webhook evaluation test results. - `message: string` Human-readable message describing the test result. - `status_code: number` HTTP status code returned by the webhook endpoint. 0 if connection failed. - `success: boolean` Whether the webhook test was successful (received 2xx response). ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const response = await client.zeroTrust.casb.posture.webhooks.evaluate({ account_id: '46148281d8a93d002ef242d8b0d5f9f6', authentication_type: 'Bearer Auth', destination_url: 'https://example.com/webhook', }); console.log(response.message); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "message": "Webhook test successful", "status_code": 200, "success": true } } ``` ## Test an existing webhook configuration `client.zeroTrust.casb.posture.webhooks.evaluateExisting(stringwebhookID, WebhookEvaluateExistingParamsparams, RequestOptionsoptions?): WebhookEvaluateExistingResponse` **post** `/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}/evaluate` Sends a test webhook event using an existing webhook configuration. This allows customers to verify their webhook endpoint is still reachable and properly configured after creating the webhook resource. The test payload includes: - event_type: "webhook.test" - timestamp: Current UTC timestamp - message: Test message indicating this is from Cloudflare CASB - data: Object with test: true ### Parameters - `webhookID: string` - `params: WebhookEvaluateExistingParams` - `account_id: string` Cloudflare account ID for the user making the request. ### Returns - `WebhookEvaluateExistingResponse` Response body for webhook evaluation test results. - `message: string` Human-readable message describing the test result. - `status_code: number` HTTP status code returned by the webhook endpoint. 0 if connection failed. - `success: boolean` Whether the webhook test was successful (received 2xx response). ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const response = await client.zeroTrust.casb.posture.webhooks.evaluateExisting( '182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e', { account_id: '46148281d8a93d002ef242d8b0d5f9f6' }, ); console.log(response.message); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "success": true, "result": { "message": "Webhook test successful", "status_code": 200, "success": true } } ``` ## Domain Types ### Webhook List Response - `WebhookListResponse` Webhook configuration for sending finding notifications. - `id: string` Unique identifier for the specific webhook configuration. - `authentication_type: "Basic Auth" | "None" | "Bearer Auth" | 2 more` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: string` Timestamp when the webhook configuration was created. - `destination_url: string` Target URL for the webhook configuration. Where resulting data will be sent. - `label: string` Account-specified display label for the webhook configuration. - `status: "enabled" | "disabled"` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: string` Timestamp when the webhook configuration was last updated. - `version: number` Version number of the configuration. - `headers?: Array
` List of header keys configured for this webhook. Values are not included for security reasons. - `key?: string` Header key name (lowercase). - `value?: string` Header value. This field is never returned in API responses for security reasons. ### Webhook Create Response - `WebhookCreateResponse` Webhook configuration for sending finding notifications. - `id: string` Unique identifier for the specific webhook configuration. - `authentication_type: "Basic Auth" | "None" | "Bearer Auth" | 2 more` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: string` Timestamp when the webhook configuration was created. - `destination_url: string` Target URL for the webhook configuration. Where resulting data will be sent. - `label: string` Account-specified display label for the webhook configuration. - `status: "enabled" | "disabled"` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: string` Timestamp when the webhook configuration was last updated. - `version: number` Version number of the configuration. - `headers?: Array
` List of header keys configured for this webhook. Values are not included for security reasons. - `key?: string` Header key name (lowercase). - `value?: string` Header value. This field is never returned in API responses for security reasons. ### Webhook Get Response - `WebhookGetResponse` Webhook configuration for sending finding notifications. - `id: string` Unique identifier for the specific webhook configuration. - `authentication_type: "Basic Auth" | "None" | "Bearer Auth" | 2 more` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: string` Timestamp when the webhook configuration was created. - `destination_url: string` Target URL for the webhook configuration. Where resulting data will be sent. - `label: string` Account-specified display label for the webhook configuration. - `status: "enabled" | "disabled"` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: string` Timestamp when the webhook configuration was last updated. - `version: number` Version number of the configuration. - `headers?: Array
` List of header keys configured for this webhook. Values are not included for security reasons. - `key?: string` Header key name (lowercase). - `value?: string` Header value. This field is never returned in API responses for security reasons. ### Webhook Update Response - `WebhookUpdateResponse` Webhook configuration for sending finding notifications. - `id: string` Unique identifier for the specific webhook configuration. - `authentication_type: "Basic Auth" | "None" | "Bearer Auth" | 2 more` Type of authentication used for the webhook. - `"Basic Auth"` - `"None"` - `"Bearer Auth"` - `"Static Headers"` - `"HMAC-Signing"` - `created_at: string` Timestamp when the webhook configuration was created. - `destination_url: string` Target URL for the webhook configuration. Where resulting data will be sent. - `label: string` Account-specified display label for the webhook configuration. - `status: "enabled" | "disabled"` Current status of the webhook configuration. If disabled, data cannot be sent through this configuration. - `"enabled"` - `"disabled"` - `updated_at: string` Timestamp when the webhook configuration was last updated. - `version: number` Version number of the configuration. - `headers?: Array
` List of header keys configured for this webhook. Values are not included for security reasons. - `key?: string` Header key name (lowercase). - `value?: string` Header value. This field is never returned in API responses for security reasons. ### Webhook Delete Response - `WebhookDeleteResponse` Common response structure for all API endpoints. - `errors: Array` - `code: number` Error or message code. - `message: string` Human-readable message. - `documentation_url?: string` Link to relevant documentation. - `source?: Source` - `pointer?: string` JSON pointer to the source of the error. - `messages: Array` - `code: number` Error or message code. - `message: string` Human-readable message. - `documentation_url?: string` Link to relevant documentation. - `source?: Source` - `pointer?: string` JSON pointer to the source of the error. - `success: boolean` Whether the API call was successful. ### Webhook Evaluate Response - `WebhookEvaluateResponse` Response body for webhook evaluation test results. - `message: string` Human-readable message describing the test result. - `status_code: number` HTTP status code returned by the webhook endpoint. 0 if connection failed. - `success: boolean` Whether the webhook test was successful (received 2xx response). ### Webhook Evaluate Existing Response - `WebhookEvaluateExistingResponse` Response body for webhook evaluation test results. - `message: string` Human-readable message describing the test result. - `status_code: number` HTTP status code returned by the webhook endpoint. 0 if connection failed. - `success: boolean` Whether the webhook test was successful (received 2xx response). # Jobs ## Create webhook jobs `client.zeroTrust.casb.posture.webhooks.jobs.create(JobCreateParamsparams, RequestOptionsoptions?): JobCreateResponse` **post** `/accounts/{account_id}/data-security/posture/webhooks/jobs` Creates webhook jobs to send a finding instance to one or more configured webhooks. ### Parameters - `params: JobCreateParams` - `account_id: string` Path param: Cloudflare account ID for the user making the request. - `finding_instance_ids: Array` Body param: Array of finding instance IDs to send to the webhooks - `webhook_ids: Array` Body param: Array of webhook IDs to trigger jobs for ### Returns - `JobCreateResponse` - `created: Array` Successfully created webhook jobs. - `id: string` Unique identifier for the webhook job. - `asset_data: Record` Asset data associated with this webhook job. - `created_at: string` When the webhook job was created. - `integration_id: string` ID of the integration. - `last_updated_at: string` When the webhook job was last updated. - `parameters: Parameters` Parameters for a webhook job. - `finding_instance_id: string` ID of the finding instance. - `status: "pending" | "processing" | "completed" | "failed"` Status of a webhook job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `triggered_by_actor: "user" | "account_token"` Type of actor that triggered the webhook job. - `"user"` - `"account_token"` - `triggered_by_id: string` ID of the actor that triggered the job. - `webhook_id: string` ID of the webhook configuration. - `failure_details?: Record` Additional details about the failure. - `failure_reason?: "Permission Denied" | "Integration Unavailable" | "Service Temporarily Unavailable" | "System Error"` Reason for webhook job failure. - `"Permission Denied"` - `"Integration Unavailable"` - `"Service Temporarily Unavailable"` - `"System Error"` - `failed: Array` Failed webhook job creation attempts. - `error: string` Error message describing the failure. - `finding_instance_id: string` ID of the finding instance that failed to create a webhook job. - `webhook_id: string` ID of the webhook configuration. ### Example ```typescript import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const job = await client.zeroTrust.casb.posture.webhooks.jobs.create({ account_id: '46148281d8a93d002ef242d8b0d5f9f6', finding_instance_ids: [ '770e8400-e29b-41d4-a716-446655440002', '660e8400-e29b-41d4-a716-446655440001', ], webhook_ids: ['550e8400-e29b-41d4-a716-446655440000', '660e8400-e29b-41d4-a716-446655440001'], }); console.log(job.created); ``` #### Response ```json { "errors": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "messages": [ { "code": 1000, "message": "Request processed successfully", "documentation_url": "https://edgetunnel-b2h.pages.dev/api/operations/list-findings", "source": { "pointer": "/data/attributes/name" } } ], "result": { "created": [ { "id": "c416bc38-75db-425f-ae25-c37b5df5c37f", "asset_data": { "foo": "bar" }, "created_at": "2025-07-07T18:39:13.123456Z", "integration_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "last_updated_at": "2025-07-07T18:39:13.123456Z", "parameters": { "finding_instance_id": "3f7b8c9d-6e5a-4f3b-9c2d-1e0a8b7c6d5e" }, "status": "pending", "triggered_by_actor": "user", "triggered_by_id": "user@example.com", "webhook_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "failure_details": { "foo": "bar" }, "failure_reason": "Permission Denied" } ], "failed": [ { "error": "Failed to create webhook job", "finding_instance_id": "2e6b4c8a-9d1f-4e3b-8c7a-5f9e2d1a6b4c", "webhook_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" } ] }, "success": true } ``` ## Domain Types ### Job Create Response - `JobCreateResponse` - `created: Array` Successfully created webhook jobs. - `id: string` Unique identifier for the webhook job. - `asset_data: Record` Asset data associated with this webhook job. - `created_at: string` When the webhook job was created. - `integration_id: string` ID of the integration. - `last_updated_at: string` When the webhook job was last updated. - `parameters: Parameters` Parameters for a webhook job. - `finding_instance_id: string` ID of the finding instance. - `status: "pending" | "processing" | "completed" | "failed"` Status of a webhook job. - `"pending"` - `"processing"` - `"completed"` - `"failed"` - `triggered_by_actor: "user" | "account_token"` Type of actor that triggered the webhook job. - `"user"` - `"account_token"` - `triggered_by_id: string` ID of the actor that triggered the job. - `webhook_id: string` ID of the webhook configuration. - `failure_details?: Record` Additional details about the failure. - `failure_reason?: "Permission Denied" | "Integration Unavailable" | "Service Temporarily Unavailable" | "System Error"` Reason for webhook job failure. - `"Permission Denied"` - `"Integration Unavailable"` - `"Service Temporarily Unavailable"` - `"System Error"` - `failed: Array` Failed webhook job creation attempts. - `error: string` Error message describing the failure. - `finding_instance_id: string` ID of the finding instance that failed to create a webhook job. - `webhook_id: string` ID of the webhook configuration.