{"openapi":"3.1.0","info":{"title":"Cloudflare Threat Intel (BYOK) API","version":"0.1.0","description":"Cloudflare Threat Intel (BYOK) lets an AI assistant read your own Cloudflare Threat Intel data through the Cloudflare Threat Intel API with a key you supply (Cloudflare API token with Intel read permission). Read-only: 9 tools (get_domain_details, get_domain_history, get_ip_overview, get_asn_subnets, get_passive_dns_by_ip, get_whois_record, get_url_intelligence, list_indicator_feeds,...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-cloudflare-threat-intel.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-cloudflare-threat-intel/docs"},"termsOfService":"https://connectorbay.com/byok-cloudflare-threat-intel/terms"},"servers":[{"url":"https://byok-cloudflare-threat-intel.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-cloudflare-threat-intel/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/get_domain_details":{"post":{"operationId":"get_domain_details","summary":"Get Cloudflare's view of a domain: content categories, risk types, risk score, popularity rank and what it resolves to. ","description":"Get Cloudflare's view of a domain: content categories, risk types, risk score, popularity rank and what it resolves to. Use for \"What risk categories does Cloudflare assign to example.com\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"domain":{"anyOf":[{"maxLength":253,"type":"string"},{"type":"null"}],"default":null,"description":"Domain name to look up, for example 'example.com'.","title":"Domain"},"skip_dns":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":null,"description":"True to skip DNS resolution lookups for a faster answer.","title":"Skip Dns"},"skip_ranking":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":null,"description":"True to skip the popularity ranking lookup.","title":"Skip Ranking"}},"required":["account_id"],"title":"get_domain_detailsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_domain_history":{"post":{"operationId":"get_domain_history","summary":"Get the history of content categorizations of a domain with start and end dates. Use for \"How was example.com categorize","description":"Get the history of content categorizations of a domain with start and end dates. Use for \"How was example.com categorized over time\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"domain":{"description":"Domain name to look up, for example 'example.com'.","maxLength":253,"title":"Domain","type":"string"}},"required":["account_id","domain"],"title":"get_domain_historyArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_ip_overview":{"post":{"operationId":"get_ip_overview","summary":"Get Cloudflare's overview of an IPv4 or IPv6 address: the network that owns it and risk types. Use for \"Who owns IP 93.1","description":"Get Cloudflare's overview of an IPv4 or IPv6 address: the network that owns it and risk types. Use for \"Who owns IP 93.184.216.34 and is it risky\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"ipv4":{"anyOf":[{"maxLength":15,"type":"string"},{"type":"null"}],"default":null,"description":"IPv4 address to look up, for example '93.184.216.34'.","title":"Ipv4"},"ipv6":{"anyOf":[{"maxLength":45,"type":"string"},{"type":"null"}],"default":null,"description":"IPv6 address to look up. Use this or ipv4.","title":"Ipv6"}},"required":["account_id"],"title":"get_ip_overviewArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_asn_subnets":{"post":{"operationId":"get_asn_subnets","summary":"List the subnets announced by an autonomous system number, with the total IP count. Use for \"Which subnets does AS13335 ","description":"List the subnets announced by an autonomous system number, with the total IP count. Use for \"Which subnets does AS13335 announce\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"asn":{"description":"Autonomous system number, digits only, for example 13335.","maximum":4294967295,"minimum":1,"title":"Asn","type":"integer"}},"required":["account_id","asn"],"title":"get_asn_subnetsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_passive_dns_by_ip":{"post":{"operationId":"get_passive_dns_by_ip","summary":"Get hostnames that Cloudflare saw resolving to an IPv4 address, with first and last seen times. Use for \"Which hostnames","description":"Get hostnames that Cloudflare saw resolving to an IPv4 address, with first and last seen times. Use for \"Which hostnames pointed to 93.184.216.34\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"ipv4":{"description":"IPv4 address to look up.","maxLength":15,"title":"Ipv4","type":"string"},"page":{"anyOf":[{"maximum":10000,"minimum":1,"type":"integer"},{"type":"null"}],"default":1,"description":"Page number, starting at 1.","title":"Page"},"per_page":{"anyOf":[{"maximum":100,"minimum":1,"type":"integer"},{"type":"null"}],"default":20,"description":"How many records per page (1 to 100).","title":"Per Page"}},"required":["account_id","ipv4"],"title":"get_passive_dns_by_ipArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_whois_record":{"post":{"operationId":"get_whois_record","summary":"Get a domain's public WHOIS registration facts: registrar, creation, update and expiry dates, nameservers, status and DN","description":"Get a domain's public WHOIS registration facts: registrar, creation, update and expiry dates, nameservers, status and DNSSEC. Contact details are left out. Use for \"When does example.com expire and who is the registrar\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"domain":{"description":"Domain name to look up, for example 'example.com'.","maxLength":253,"title":"Domain","type":"string"}},"required":["account_id","domain"],"title":"get_whois_recordArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_url_intelligence":{"post":{"operationId":"get_url_intelligence","summary":"Get Cloudflare's categories and risk types for a full URL. Use for \"Is the URL https://example.com/login considered risk","description":"Get Cloudflare's categories and risk types for a full URL. Use for \"Is the URL https://example.com/login considered risky\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"},"url":{"description":"Full URL to look up, for example 'https://example.com/login'.","maxLength":2000,"title":"Url","type":"string"}},"required":["account_id","url"],"title":"get_url_intelligenceArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_indicator_feeds":{"post":{"operationId":"list_indicator_feeds","summary":"List the custom indicator feeds your account owns, with public and downloadable flags. Use for \"Which threat indicator f","description":"List the custom indicator feeds your account owns, with public and downloadable flags. Use for \"Which threat indicator feeds do I own in Cloudflare\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"list_indicator_feedsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_ip_lists":{"post":{"operationId":"list_ip_lists","summary":"List the managed IP lists available for Cloudflare Intel (id, name, description). Use for \"Which managed IP lists can I ","description":"List the managed IP lists available for Cloudflare Intel (id, name, description). Use for \"Which managed IP lists can I use\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"account_id":{"description":"Cloudflare account id (32-character hex string shown in the dashboard URL, or from the Cloudflare connector's list_accounts).","maxLength":40,"title":"Account Id","type":"string"}},"required":["account_id"],"title":"list_ip_listsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}