{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Updates the given fields of a tag and returns the complete tag.","properties":{"path":{"type":"object","properties":{"account_id":{"description":"Account ID.","type":"string"},"tag_uuid":{"description":"Tag UUID.","type":"string"}},"required":["account_id","tag_uuid"],"additionalProperties":false},"body":{"type":"object","properties":{"activeDuration":{"anyOf":[{"type":"string"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"string"}},"required":["value"],"type":"object"}]},"actorCategory":{"anyOf":[{"type":"string"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"string"}},"required":["value"],"type":"object"}]},"aliasGroupNames":{"type":"array","items":{"type":"string"}},"aliasGroupNamesInternal":{"type":"array","items":{"type":"string"}},"aliases":{"description":"Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).","type":"array","items":{"properties":{"confidence":{"type":["integer","null"],"maximum":10,"minimum":1,"examples":[8]},"tlp":{"type":["string","null"],"enum":["red","amber","amber-strict","green","clear","purple","amber+strict"],"examples":["amber"]},"value":{"type":"string","examples":["Fancy Bear"]}},"required":["value"],"type":"object"}},"attributionOrganization":{"anyOf":[{"type":"string"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"string"}},"required":["value"],"type":"object"}]},"categoryUuid":{"description":"Tag type (category) UUID. When changed, existing `properties` are re-validated against the new category's schema (400 on mismatch). Set to null to unlink (typeless; properties stop being validated).","type":"string","examples":["12345678-1234-1234-1234-1234567890ab"]},"confidence":{"description":"Overall tag confidence (1-10). Omit to preserve existing.","type":"integer","maximum":10,"minimum":1,"examples":[8]},"dateOfDiscovery":{"description":"Date of discovery (ISO YYYY-MM-DD). Omit to preserve existing.","type":"string","pattern":"^\\d{4}-\\d{2}-\\d{2}$","examples":["2024-01-15T00:00:00Z"]},"description":{"type":"string"},"externalReferenceLinks":{"type":"array","items":{"type":"string"}},"externalReferences":{"description":"Structured external references ({ url, description }). Public: returned to all accounts.","type":"array","items":{"properties":{"description":{"type":["string","null"],"examples":["Vendor threat report"]},"url":{"type":"string","examples":["https://example.com/report"]}},"required":["url"],"type":"object"}},"internalAliases":{"description":"Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.","type":"array","items":{"properties":{"confidence":{"type":["integer","null"],"maximum":10,"minimum":1,"examples":[8]},"tlp":{"type":["string","null"],"enum":["red","amber","amber-strict","green","clear","purple","amber+strict"],"examples":["amber"]},"value":{"type":"string","examples":["Fancy Bear"]}},"required":["value"],"type":"object"}},"internalDescription":{"type":"string"},"lastSeen":{"type":"string"},"motive":{"anyOf":[{"type":"string"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"string"}},"required":["value"],"type":"object"}]},"opsecLevel":{"anyOf":[{"type":"string"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"string"}},"required":["value"],"type":"object"}]},"originCountryISO":{"anyOf":[{"type":"string"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"string"}},"required":["value"],"type":"object"}]},"priority":{"anyOf":[{"type":"number"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"number"}},"required":["value"],"type":"object"}]},"properties":{"description":"Custom field values blob. When omitted, the existing value is preserved. When provided, performs a shallow per-key merge over the stored value (unmentioned keys are retained). Setting an individual key to null deletes that key. Validation runs against the merged result, so a partial update may omit a schema-required key if the stored value supplies it.","type":"object","additionalProperties":true},"sophisticationLevel":{"anyOf":[{"type":"string"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"string"}},"required":["value"],"type":"object"}]},"tlp":{"description":"Tag-level TLP marking. Omit to preserve existing. Cannot be cleared to null.","type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"],"examples":["amber"]},"value":{"type":"string","examples":["APT28"]}}}},"required":["path"],"additionalProperties":false},"name":"Update a tag","id":"cloudflare.patch_tagupdate","example":{"path":{"account_id":"example","tag_uuid":"example"}},"maxRequests":1,"summary":false}}