cloudflare 7.2.0 → 7.3.0

package/src/resources/client-certificates/client-certificates.ts

@@ -67,7 +67,7 @@ export class BaseClientCertificates extends APIResource {
    * ```ts
    * const clientCertificate =
    *   await client.clientCertificates.delete(
-   *     '023e105f4ecef8ad9ca31a8372d0c353',
+   *     '0d89c70d-ad9f-4843-b99f-6cc0252067e9',
    *     { zone_id: '023e105f4ecef8ad9ca31a8372d0c353' },
    *   );
    * ```
@@ -94,7 +94,7 @@ export class BaseClientCertificates extends APIResource {
    * ```ts
    * const clientCertificate =
    *   await client.clientCertificates.edit(
-   *     '023e105f4ecef8ad9ca31a8372d0c353',
+   *     '0d89c70d-ad9f-4843-b99f-6cc0252067e9',
    *     { zone_id: '023e105f4ecef8ad9ca31a8372d0c353' },
    *   );
    * ```
@@ -120,7 +120,7 @@ export class BaseClientCertificates extends APIResource {
    * ```ts
    * const clientCertificate =
    *   await client.clientCertificates.get(
-   *     '023e105f4ecef8ad9ca31a8372d0c353',
+   *     '0d89c70d-ad9f-4843-b99f-6cc0252067e9',
    *     { zone_id: '023e105f4ecef8ad9ca31a8372d0c353' },
    *   );
    * ```
@@ -145,7 +145,7 @@ export type ClientCertificatesV4PagePaginationArray = V4PagePaginationArray<Clie
 
 export interface ClientCertificate {
   /**
-   * Identifier.
+   * Client Certificate Tag
    */
   id?: string;
 

package/src/resources/cloud-connector/rules.ts

@@ -122,7 +122,7 @@ export interface RuleUpdateParams {
   /**
    * Body param
    */
-  rules?: Array<RuleUpdateParams.Rule>;
+  rules: Array<RuleUpdateParams.Rule>;
 }
 
 export namespace RuleUpdateParams {

package/src/resources/cloudforce-one/api.md

@@ -1,34 +1,5 @@
 # CloudforceOne
 
-## Scans
-
-### Results
-
-Types:
-
-- <code><a href="./src/resources/cloudforce-one/scans/results.ts">ScanResult</a></code>
-- <code><a href="./src/resources/cloudforce-one/scans/results.ts">ResultGetResponse</a></code>
-
-Methods:
-
-- <code title="get /accounts/{account_id}/cloudforce-one/scans/results/{config_id}">client.cloudforceOne.scans.results.<a href="./src/resources/cloudforce-one/scans/results.ts">get</a>(configID, { ...params }) -> ResultGetResponse</code>
-
-### Config
-
-Types:
-
-- <code><a href="./src/resources/cloudforce-one/scans/config.ts">ConfigCreateResponse</a></code>
-- <code><a href="./src/resources/cloudforce-one/scans/config.ts">ConfigListResponse</a></code>
-- <code><a href="./src/resources/cloudforce-one/scans/config.ts">ConfigDeleteResponse</a></code>
-- <code><a href="./src/resources/cloudforce-one/scans/config.ts">ConfigEditResponse</a></code>
-
-Methods:
-
-- <code title="post /accounts/{account_id}/cloudforce-one/scans/config">client.cloudforceOne.scans.config.<a href="./src/resources/cloudforce-one/scans/config.ts">create</a>({ ...params }) -> ConfigCreateResponse</code>
-- <code title="get /accounts/{account_id}/cloudforce-one/scans/config">client.cloudforceOne.scans.config.<a href="./src/resources/cloudforce-one/scans/config.ts">list</a>({ ...params }) -> ConfigListResponsesSinglePage</code>
-- <code title="delete /accounts/{account_id}/cloudforce-one/scans/config/{config_id}">client.cloudforceOne.scans.config.<a href="./src/resources/cloudforce-one/scans/config.ts">delete</a>(configID, { ...params }) -> ConfigDeleteResponse</code>
-- <code title="patch /accounts/{account_id}/cloudforce-one/scans/config/{config_id}">client.cloudforceOne.scans.config.<a href="./src/resources/cloudforce-one/scans/config.ts">edit</a>(configID, { ...params }) -> ConfigEditResponse</code>
-
 ## BinaryStorage
 
 Types:
@@ -110,6 +81,35 @@ Methods:
 - <code title="delete /accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}">client.cloudforceOne.requests.assets.<a href="./src/resources/cloudforce-one/requests/assets.ts">delete</a>(assetID, { ...params }) -> AssetDeleteResponse</code>
 - <code title="get /accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}">client.cloudforceOne.requests.assets.<a href="./src/resources/cloudforce-one/requests/assets.ts">get</a>(assetID, { ...params }) -> AssetGetResponsesSinglePage</code>
 
+## Scans
+
+### Results
+
+Types:
+
+- <code><a href="./src/resources/cloudforce-one/scans/results.ts">ScanResult</a></code>
+- <code><a href="./src/resources/cloudforce-one/scans/results.ts">ResultGetResponse</a></code>
+
+Methods:
+
+- <code title="get /accounts/{account_id}/cloudforce-one/scans/results/{config_id}">client.cloudforceOne.scans.results.<a href="./src/resources/cloudforce-one/scans/results.ts">get</a>(configID, { ...params }) -> ResultGetResponse</code>
+
+### Config
+
+Types:
+
+- <code><a href="./src/resources/cloudforce-one/scans/config.ts">ConfigCreateResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/scans/config.ts">ConfigListResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/scans/config.ts">ConfigDeleteResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/scans/config.ts">ConfigEditResponse</a></code>
+
+Methods:
+
+- <code title="post /accounts/{account_id}/cloudforce-one/scans/config">client.cloudforceOne.scans.config.<a href="./src/resources/cloudforce-one/scans/config.ts">create</a>({ ...params }) -> ConfigCreateResponse</code>
+- <code title="get /accounts/{account_id}/cloudforce-one/scans/config">client.cloudforceOne.scans.config.<a href="./src/resources/cloudforce-one/scans/config.ts">list</a>({ ...params }) -> ConfigListResponsesSinglePage</code>
+- <code title="delete /accounts/{account_id}/cloudforce-one/scans/config/{config_id}">client.cloudforceOne.scans.config.<a href="./src/resources/cloudforce-one/scans/config.ts">delete</a>(configID, { ...params }) -> ConfigDeleteResponse</code>
+- <code title="patch /accounts/{account_id}/cloudforce-one/scans/config/{config_id}">client.cloudforceOne.scans.config.<a href="./src/resources/cloudforce-one/scans/config.ts">edit</a>(configID, { ...params }) -> ConfigEditResponse</code>
+
 ## ThreatEvents
 
 Types:
@@ -438,3 +438,155 @@ Methods:
 - <code title="get /accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog">client.cloudforceOne.threatEvents.targetIndustries.catalog.<a href="./src/resources/cloudforce-one/threat-events/target-industries/catalog.ts">list</a>({ ...params }) -> CatalogListResponse</code>
 
 ### Insights
+
+## ThreatSignals
+
+### Search
+
+Types:
+
+- <code><a href="./src/resources/cloudforce-one/threat-signals/search.ts">SearchSearchResponse</a></code>
+
+Methods:
+
+- <code title="get /accounts/{account_id}/cloudforce-one/v2/threat-signals/search">client.cloudforceOne.threatSignals.search.<a href="./src/resources/cloudforce-one/threat-signals/search.ts">search</a>({ ...params }) -> SearchSearchResponse</code>
+
+### Categories
+
+Types:
+
+- <code><a href="./src/resources/cloudforce-one/threat-signals/categories.ts">CategoryListResponse</a></code>
+
+Methods:
+
+- <code title="get /accounts/{account_id}/cloudforce-one/v2/threat-signals/categories">client.cloudforceOne.threatSignals.categories.<a href="./src/resources/cloudforce-one/threat-signals/categories.ts">list</a>({ ...params }) -> CategoryListResponse</code>
+
+### Feeds
+
+Types:
+
+- <code><a href="./src/resources/cloudforce-one/threat-signals/feeds/feeds.ts">FeedCreateResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/threat-signals/feeds/feeds.ts">FeedListResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/threat-signals/feeds/feeds.ts">FeedDeleteResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/threat-signals/feeds/feeds.ts">FeedEditResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/threat-signals/feeds/feeds.ts">FeedPollResponse</a></code>
+
+Methods:
+
+- <code title="post /accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds">client.cloudforceOne.threatSignals.feeds.<a href="./src/resources/cloudforce-one/threat-signals/feeds/feeds.ts">create</a>({ ...params }) -> FeedCreateResponse</code>
+- <code title="get /accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds">client.cloudforceOne.threatSignals.feeds.<a href="./src/resources/cloudforce-one/threat-signals/feeds/feeds.ts">list</a>({ ...params }) -> FeedListResponsesV4PagePagination</code>
+- <code title="delete /accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}">client.cloudforceOne.threatSignals.feeds.<a href="./src/resources/cloudforce-one/threat-signals/feeds/feeds.ts">delete</a>(feedID, { ...params }) -> FeedDeleteResponse</code>
+- <code title="patch /accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}">client.cloudforceOne.threatSignals.feeds.<a href="./src/resources/cloudforce-one/threat-signals/feeds/feeds.ts">edit</a>(feedID, { ...params }) -> FeedEditResponse</code>
+- <code title="post /accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/poll">client.cloudforceOne.threatSignals.feeds.<a href="./src/resources/cloudforce-one/threat-signals/feeds/feeds.ts">poll</a>({ ...params }) -> FeedPollResponse</code>
+
+#### Raw
+
+Types:
+
+- <code><a href="./src/resources/cloudforce-one/threat-signals/feeds/raw.ts">RawGetResponse</a></code>
+
+Methods:
+
+- <code title="get /accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/raw">client.cloudforceOne.threatSignals.feeds.raw.<a href="./src/resources/cloudforce-one/threat-signals/feeds/raw.ts">get</a>(feedID, { ...params }) -> string</code>
+
+#### Skills
+
+Types:
+
+- <code><a href="./src/resources/cloudforce-one/threat-signals/feeds/skills.ts">SkillUpdateResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/threat-signals/feeds/skills.ts">SkillGetResponse</a></code>
+
+Methods:
+
+- <code title="put /accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/skills">client.cloudforceOne.threatSignals.feeds.skills.<a href="./src/resources/cloudforce-one/threat-signals/feeds/skills.ts">update</a>(feedID, { ...params }) -> SkillUpdateResponse</code>
+- <code title="get /accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/skills">client.cloudforceOne.threatSignals.feeds.skills.<a href="./src/resources/cloudforce-one/threat-signals/feeds/skills.ts">get</a>(feedID, { ...params }) -> SkillGetResponse</code>
+
+### Articles
+
+Types:
+
+- <code><a href="./src/resources/cloudforce-one/threat-signals/articles/articles.ts">ArticleListResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/threat-signals/articles/articles.ts">ArticleBulkEditResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/threat-signals/articles/articles.ts">ArticleEditResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/threat-signals/articles/articles.ts">ArticleGetResponse</a></code>
+
+Methods:
+
+- <code title="get /accounts/{account_id}/cloudforce-one/v2/threat-signals/articles">client.cloudforceOne.threatSignals.articles.<a href="./src/resources/cloudforce-one/threat-signals/articles/articles.ts">list</a>({ ...params }) -> ArticleListResponse</code>
+- <code title="patch /accounts/{account_id}/cloudforce-one/v2/threat-signals/articles">client.cloudforceOne.threatSignals.articles.<a href="./src/resources/cloudforce-one/threat-signals/articles/articles.ts">bulkEdit</a>({ ...params }) -> ArticleBulkEditResponse</code>
+- <code title="patch /accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}">client.cloudforceOne.threatSignals.articles.<a href="./src/resources/cloudforce-one/threat-signals/articles/articles.ts">edit</a>(articleID, { ...params }) -> ArticleEditResponse</code>
+- <code title="get /accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}">client.cloudforceOne.threatSignals.articles.<a href="./src/resources/cloudforce-one/threat-signals/articles/articles.ts">get</a>(articleID, { ...params }) -> ArticleGetResponse</code>
+
+#### Content
+
+Types:
+
+- <code><a href="./src/resources/cloudforce-one/threat-signals/articles/content.ts">ContentGetResponse</a></code>
+
+Methods:
+
+- <code title="get /accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/content">client.cloudforceOne.threatSignals.articles.content.<a href="./src/resources/cloudforce-one/threat-signals/articles/content.ts">get</a>(articleID, { ...params }) -> string</code>
+
+#### Tags
+
+Types:
+
+- <code><a href="./src/resources/cloudforce-one/threat-signals/articles/tags.ts">TagCreateResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/threat-signals/articles/tags.ts">TagDeleteResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/threat-signals/articles/tags.ts">TagGenerateResponse</a></code>
+
+Methods:
+
+- <code title="post /accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tags">client.cloudforceOne.threatSignals.articles.tags.<a href="./src/resources/cloudforce-one/threat-signals/articles/tags.ts">create</a>(articleID, { ...params }) -> TagCreateResponse</code>
+- <code title="delete /accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tags/{tag_id}">client.cloudforceOne.threatSignals.articles.tags.<a href="./src/resources/cloudforce-one/threat-signals/articles/tags.ts">delete</a>(tagID, { ...params }) -> TagDeleteResponse</code>
+- <code title="post /accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tag">client.cloudforceOne.threatSignals.articles.tags.<a href="./src/resources/cloudforce-one/threat-signals/articles/tags.ts">generate</a>(articleID, { ...params }) -> TagGenerateResponse</code>
+
+#### SkillOutputs
+
+Types:
+
+- <code><a href="./src/resources/cloudforce-one/threat-signals/articles/skill-outputs.ts">SkillOutputGetResponse</a></code>
+
+Methods:
+
+- <code title="get /accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/skills/{skill_id}/output">client.cloudforceOne.threatSignals.articles.skillOutputs.<a href="./src/resources/cloudforce-one/threat-signals/articles/skill-outputs.ts">get</a>(skillID, { ...params }) -> SkillOutputGetResponse</code>
+
+### Indicators
+
+Types:
+
+- <code><a href="./src/resources/cloudforce-one/threat-signals/indicators.ts">IndicatorListResponse</a></code>
+
+Methods:
+
+- <code title="get /accounts/{account_id}/cloudforce-one/v2/threat-signals/indicators">client.cloudforceOne.threatSignals.indicators.<a href="./src/resources/cloudforce-one/threat-signals/indicators.ts">list</a>({ ...params }) -> IndicatorListResponse</code>
+
+### Skills
+
+Types:
+
+- <code><a href="./src/resources/cloudforce-one/threat-signals/skills/skills.ts">SkillCreateResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/threat-signals/skills/skills.ts">SkillListResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/threat-signals/skills/skills.ts">SkillDeleteResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/threat-signals/skills/skills.ts">SkillEditResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/threat-signals/skills/skills.ts">SkillGetResponse</a></code>
+
+Methods:
+
+- <code title="post /accounts/{account_id}/cloudforce-one/v2/threat-signals/skills">client.cloudforceOne.threatSignals.skills.<a href="./src/resources/cloudforce-one/threat-signals/skills/skills.ts">create</a>({ ...params }) -> SkillCreateResponse</code>
+- <code title="get /accounts/{account_id}/cloudforce-one/v2/threat-signals/skills">client.cloudforceOne.threatSignals.skills.<a href="./src/resources/cloudforce-one/threat-signals/skills/skills.ts">list</a>({ ...params }) -> SkillListResponsesV4PagePagination</code>
+- <code title="delete /accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}">client.cloudforceOne.threatSignals.skills.<a href="./src/resources/cloudforce-one/threat-signals/skills/skills.ts">delete</a>(skillID, { ...params }) -> SkillDeleteResponse</code>
+- <code title="patch /accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}">client.cloudforceOne.threatSignals.skills.<a href="./src/resources/cloudforce-one/threat-signals/skills/skills.ts">edit</a>(skillID, { ...params }) -> SkillEditResponse</code>
+- <code title="get /accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}">client.cloudforceOne.threatSignals.skills.<a href="./src/resources/cloudforce-one/threat-signals/skills/skills.ts">get</a>(skillID, { ...params }) -> SkillGetResponse</code>
+
+#### TagCategories
+
+Types:
+
+- <code><a href="./src/resources/cloudforce-one/threat-signals/skills/tag-categories.ts">TagCategoryUpdateResponse</a></code>
+- <code><a href="./src/resources/cloudforce-one/threat-signals/skills/tag-categories.ts">TagCategoryGetResponse</a></code>
+
+Methods:
+
+- <code title="put /accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}/tag-categories">client.cloudforceOne.threatSignals.skills.tagCategories.<a href="./src/resources/cloudforce-one/threat-signals/skills/tag-categories.ts">update</a>(skillID, { ...params }) -> TagCategoryUpdateResponse</code>
+- <code title="get /accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}/tag-categories">client.cloudforceOne.threatSignals.skills.tagCategories.<a href="./src/resources/cloudforce-one/threat-signals/skills/tag-categories.ts">get</a>(skillID, { ...params }) -> TagCategoryGetResponse</code>

package/src/resources/cloudforce-one/cloudforce-one.ts

@@ -50,29 +50,32 @@ import {
   ThreatEventListResponse,
   ThreatEvents,
 } from './threat-events/threat-events';
+import * as ThreatSignalsAPI from './threat-signals/threat-signals';
+import { BaseThreatSignals, ThreatSignals } from './threat-signals/threat-signals';
 
 export class BaseCloudforceOne extends APIResource {
   static override readonly _key: readonly ['cloudforceOne'] = Object.freeze(['cloudforceOne'] as const);
 }
 export class CloudforceOne extends BaseCloudforceOne {
-  scans: ScansAPI.Scans = new ScansAPI.Scans(this._client);
   binaryStorage: BinaryStorageAPI.BinaryStorage = new BinaryStorageAPI.BinaryStorage(this._client);
   requests: RequestsAPI.Requests = new RequestsAPI.Requests(this._client);
+  scans: ScansAPI.Scans = new ScansAPI.Scans(this._client);
   threatEvents: ThreatEventsAPI.ThreatEvents = new ThreatEventsAPI.ThreatEvents(this._client);
+  threatSignals: ThreatSignalsAPI.ThreatSignals = new ThreatSignalsAPI.ThreatSignals(this._client);
 }
 
-CloudforceOne.Scans = Scans;
-CloudforceOne.BaseScans = BaseScans;
 CloudforceOne.BinaryStorage = BinaryStorage;
 CloudforceOne.BaseBinaryStorage = BaseBinaryStorage;
 CloudforceOne.Requests = Requests;
 CloudforceOne.BaseRequests = BaseRequests;
+CloudforceOne.Scans = Scans;
+CloudforceOne.BaseScans = BaseScans;
 CloudforceOne.ThreatEvents = ThreatEvents;
 CloudforceOne.BaseThreatEvents = BaseThreatEvents;
+CloudforceOne.ThreatSignals = ThreatSignals;
+CloudforceOne.BaseThreatSignals = BaseThreatSignals;
 
 export declare namespace CloudforceOne {
-  export { Scans as Scans, BaseScans as BaseScans };
-
   export {
     BinaryStorage as BinaryStorage,
     BaseBinaryStorage as BaseBinaryStorage,
@@ -103,6 +106,8 @@ export declare namespace CloudforceOne {
     type RequestTypesParams as RequestTypesParams,
   };
 
+  export { Scans as Scans, BaseScans as BaseScans };
+
   export {
     ThreatEvents as ThreatEvents,
     BaseThreatEvents as BaseThreatEvents,
@@ -119,4 +124,6 @@ export declare namespace CloudforceOne {
     type ThreatEventEditParams as ThreatEventEditParams,
     type ThreatEventGetParams as ThreatEventGetParams,
   };
+
+  export { ThreatSignals as ThreatSignals, BaseThreatSignals as BaseThreatSignals };
 }

package/src/resources/cloudforce-one/index.ts

@@ -46,3 +46,4 @@ export {
   type ThreatEventEditParams,
   type ThreatEventGetParams,
 } from './threat-events/index';
+export { ThreatSignals, BaseThreatSignals } from './threat-signals/index';

package/src/resources/cloudforce-one/threat-events/indicators/by-dataset/by-dataset.ts

@@ -85,8 +85,20 @@ export namespace ByDatasetListResponse {
      */
     datasetId?: string;
 
+    /**
+     * Related events, capped by `relatedEventsLimit` (default 2). Check
+     * `relatedEventsHasMore` to detect a capped list; pass `relatedEventsLimit=-1` to
+     * retrieve all of them.
+     */
     relatedEvents?: Array<Indicator.RelatedEvent>;
 
+    /**
+     * True when this indicator appears in more events than `relatedEvents` contains
+     * because `relatedEventsLimit` capped the list. Pass `relatedEventsLimit=-1` to
+     * retrieve every related event.
+     */
+    relatedEventsHasMore?: boolean;
+
     tags?: Array<Indicator.Tag>;
 
     /**
@@ -164,8 +176,20 @@ export interface ByDatasetGetResponse {
    */
   datasetId?: string;
 
+  /**
+   * Related events, capped by `relatedEventsLimit` (default 2). Check
+   * `relatedEventsHasMore` to detect a capped list; pass `relatedEventsLimit=-1` to
+   * retrieve all of them.
+   */
   relatedEvents?: Array<ByDatasetGetResponse.RelatedEvent>;
 
+  /**
+   * True when this indicator appears in more events than `relatedEvents` contains
+   * because `relatedEventsLimit` capped the list. Pass `relatedEventsLimit=-1` to
+   * retrieve every related event.
+   */
+  relatedEventsHasMore?: boolean;
+
   tags?: Array<ByDatasetGetResponse.Tag>;
 
   /**

package/src/resources/cloudforce-one/threat-events/indicators/indicators.ts

@@ -178,8 +178,20 @@ export namespace IndicatorListResponse {
          */
         datasetId?: string;
 
+        /**
+         * Related events, capped by `relatedEventsLimit` (default 2). Check
+         * `relatedEventsHasMore` to detect a capped list; pass `relatedEventsLimit=-1` to
+         * retrieve all of them.
+         */
         relatedEvents?: Array<Items.RelatedEvent>;
 
+        /**
+         * True when this indicator appears in more events than `relatedEvents` contains
+         * because `relatedEventsLimit` capped the list. Pass `relatedEventsLimit=-1` to
+         * retrieve every related event.
+         */
+        relatedEventsHasMore?: boolean;
+
         tags?: Array<Items.Tag>;
 
         /**
@@ -392,7 +404,10 @@ export interface IndicatorListParams {
 
   /**
    * Query param: Limit the number of related events returned per indicator.
-   * Default: 2. Set to 0 for none, -1 for all events.
+   * Default: 2. Set to 0 for none, -1 for all events. For JSON responses, when the
+   * limit hides events, the indicator carries `relatedEventsHasMore: true` and the
+   * response includes an advisory message — the cap is never applied silently. STIX
+   * and TAXII representations do not include related-event data.
    */
   relatedEventsLimit?: number;
 

package/src/resources/cloudforce-one/threat-events/tags/indicators/by-dataset.ts

@@ -59,8 +59,20 @@ export namespace ByDatasetListResponse {
      */
     datasetId?: string;
 
+    /**
+     * Related events, capped by `relatedEventsLimit` (default 2). Check
+     * `relatedEventsHasMore` to detect a capped list; pass `relatedEventsLimit=-1` to
+     * retrieve all of them.
+     */
     relatedEvents?: Array<Indicator.RelatedEvent>;
 
+    /**
+     * True when this indicator appears in more events than `relatedEvents` contains
+     * because `relatedEventsLimit` capped the list. Pass `relatedEventsLimit=-1` to
+     * retrieve every related event.
+     */
+    relatedEventsHasMore?: boolean;
+
     tags?: Array<Indicator.Tag>;
 
     /**

package/src/resources/cloudforce-one/threat-events/tags/indicators/indicators.ts

@@ -66,8 +66,20 @@ export namespace IndicatorListResponse {
      */
     datasetId?: string;
 
+    /**
+     * Related events, capped by `relatedEventsLimit` (default 2). Check
+     * `relatedEventsHasMore` to detect a capped list; pass `relatedEventsLimit=-1` to
+     * retrieve all of them.
+     */
     relatedEvents?: Array<Indicator.RelatedEvent>;
 
+    /**
+     * True when this indicator appears in more events than `relatedEvents` contains
+     * because `relatedEventsLimit` capped the list. Pass `relatedEventsLimit=-1` to
+     * retrieve every related event.
+     */
+    relatedEventsHasMore?: boolean;
+
     tags?: Array<Indicator.Tag>;
 
     /**

package/src/resources/cloudforce-one/threat-events/tags/tags.ts

@@ -33,7 +33,8 @@ export class BaseTags extends APIResource {
   ] as const);
 
   /**
-   * Creates a new tag to be used accross threat events.
+   * Creates an account-owned tag for threat events and returns its complete owner
+   * projection.
    *
    * @example
    * ```ts
@@ -56,8 +57,10 @@ export class BaseTags extends APIResource {
    * Returns all Source-of-Truth tags for an account. Supports legacy free-text
    * `search` on tag value and `categoryUuid` exact match, plus a structured
    * `filters` JSON array for filtering by metadata fields (originCountryISO,
-   * actorCategory, motive, priority, etc.). Country values may be passed as alpha-2,
-   * alpha-3, name, or common alias.
+   * actorCategory, motive, priority, etc.). The authenticated account owns these
+   * account-scoped tags and receives their complete owner projection. Country values
+   * may be passed as alpha-2, alpha-3, name, or common alias. Purple TLP remains
+   * CFONE-only.
    *
    * @example
    * ```ts
@@ -90,7 +93,8 @@ export class BaseTags extends APIResource {
   }
 
   /**
-   * Updates a Source-of-Truth tag by UUID.
+   * Updates an account-owned Source-of-Truth tag by UUID and returns its complete
+   * owner projection.
    *
    * @example
    * ```ts
@@ -168,8 +172,8 @@ export interface TagCreateResponse {
   externalReferences_annotated?: Array<TagCreateResponse.ExternalReferencesAnnotated> | null;
 
   /**
-   * Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never
-   * returned to non-CFONE accounts.
+   * Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to
+   * the owning account and omitted from shared-catalog non-owner responses.
    */
   internalAliases?: Array<TagCreateResponse.InternalAlias>;
 
@@ -377,8 +381,8 @@ export namespace TagListResponse {
     externalReferences_annotated?: Array<Tag.ExternalReferencesAnnotated> | null;
 
     /**
-     * Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never
-     * returned to non-CFONE accounts.
+     * Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to
+     * the owning account and omitted from shared-catalog non-owner responses.
      */
     internalAliases?: Array<Tag.InternalAlias>;
 
@@ -574,8 +578,8 @@ export interface TagEditResponse {
   externalReferences_annotated?: Array<TagEditResponse.ExternalReferencesAnnotated> | null;
 
   /**
-   * Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never
-   * returned to non-CFONE accounts.
+   * Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to
+   * the owning account and omitted from shared-catalog non-owner responses.
    */
   internalAliases?: Array<TagEditResponse.InternalAlias>;
 
@@ -789,8 +793,9 @@ export interface TagCreateParams {
   externalReferences?: Array<TagCreateParams.ExternalReference>;
 
   /**
-   * Body param: Internal structured aliases ({ value, confidence 1-10, tlp }).
-   * CFONE-only: never returned to non-CFONE accounts.
+   * Body param: Owner-private structured aliases ({ value, confidence 1-10, tlp }).
+   * Returned to the owning account and omitted from shared-catalog non-owner
+   * responses.
    */
   internalAliases?: Array<TagCreateParams.InternalAlias>;
 
@@ -1111,8 +1116,9 @@ export interface TagEditParams {
   externalReferences?: Array<TagEditParams.ExternalReference>;
 
   /**
-   * Body param: Internal structured aliases ({ value, confidence 1-10, tlp }).
-   * CFONE-only: never returned to non-CFONE accounts.
+   * Body param: Owner-private structured aliases ({ value, confidence 1-10, tlp }).
+   * Returned to the owning account and omitted from shared-catalog non-owner
+   * responses.
    */
   internalAliases?: Array<TagEditParams.InternalAlias>;