{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Create a new custom finding type with policy definition.","properties":{"path":{"type":"object","properties":{"account_id":{"type":"string","examples":["46148281d8a93d002ef242d8b0d5f9f6"],"description":"Cloudflare account ID for the user making the request."}},"required":["account_id"],"additionalProperties":false},"body":{"$ref":"#/definitions/posture-api_create-finding-type-request"}},"required":["path","body"],"additionalProperties":false,"definitions":{"posture-api_create-finding-type-request":{"type":"object","properties":{"applies_to_all_integrations":{"description":"When true, this finding type applies to every current and future integration of the vendor.","type":"boolean","examples":[true]},"asset_class":{"description":"Asset class this finding type applies to (PascalCase, e.g. GoogleWorkspaceFile)","type":"string","examples":["GoogleWorkspaceFile"]},"asset_vendor":{"type":"string","allOf":[{"$ref":"#/definitions/posture-api_FindingTypeVendorsEnum"},{"description":"Canonical vendor enum for the platform whose assets this finding type evaluates.","type":"string"}]},"description":{"description":"Human-readable description of the finding type. Cannot be empty. Maximum 4096 characters.","type":"string","maxLength":4096,"examples":["Detects files shared with too many users"]},"expression":{"description":"Rego expression body for the policy. `package cloudflare.casb.custom` and `import rego.v1` are added automatically. Do not include package or import declarations. This field cannot be changed after creation. Maximum 4096 characters.","type":"string","maxLength":4096,"examples":["default result := \"pass\"\n\nresult := \"fail\" if input.asset.publicLinkDisabled == false\n"]},"integration_ids":{"description":"Required and non-empty when applies_to_all_integrations is false; omit when it is true.","type":"array","items":{"format":"uuid","type":"string"},"uniqueItems":true,"examples":[["550e8400-e29b-41d4-a716-446655440000"]]},"name":{"description":"Human-readable name for the finding type. Maximum 256 characters.","type":"string","maxLength":256,"examples":["Excessive File Sharing"]},"severity":{"type":"string","allOf":[{"$ref":"#/definitions/posture-api_SeverityEnum"},{"description":"Default severity used when no integration-specific severity override exists.","type":"string"}]}},"required":["name","description","asset_vendor","asset_class","severity","expression","applies_to_all_integrations"]},"posture-api_FindingTypeVendorsEnum":{"description":"Vendors whose assets a finding type can evaluate.","type":"string","enum":["ANTHROPIC","AWS","BITBUCKET","BOX","CONFLUENCE","DROPBOX","GITHUB","GOOGLE_CLOUD_PLATFORM","GOOGLE_WORKSPACE","JIRA","MICROSOFT","OPENAI","SALESFORCE","SERVICENOW","SLACK","ZOOM"],"examples":["GOOGLE_WORKSPACE"]},"posture-api_SeverityEnum":{"description":"The severity level of a finding.","type":"string","enum":["Critical","High","Medium","Low"],"examples":["High"]}}},"name":"Create a custom finding type","id":"cloudflare.createfindingtype","example":{"path":{"account_id":"46148281d8a93d002ef242d8b0d5f9f6"},"body":{"name":"Excessive File Sharing","description":"Detects files shared with too many users","asset_vendor":"GOOGLE_WORKSPACE","asset_class":"GoogleWorkspaceFile","severity":"High","expression":"default result := \"pass\"\n\nresult := \"fail\" if input.asset.publicLinkDisabled == false\n","applies_to_all_integrations":true}},"maxRequests":1,"summary":false}}