{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Creates a new Request for Information with the specified project type and details.","properties":{"path":{"type":"object","properties":{"account_id":{"description":"Account ID.","type":"string"},"project_type":{"description":"RFI project type","type":"string","enum":["threat-intelligence","incident-response","ir-emergency-response","table-top","pentest","irp","threat-hunting","cybersecurity-assessment","react-general","legal-response","soc-alerts","demo"],"examples":["threat-intelligence"]}},"required":["account_id","project_type"],"additionalProperties":false},"body":{"type":"object","properties":{"description":{"description":"RFI description (optional). Defaults to an empty string when omitted.","type":"string","examples":["We need analysis of domain patterns observed in recent security events"]},"eventId":{"description":"Optional related event ID","type":["string","null"],"examples":["event-456"]},"metadata":{"description":"Optional metadata fields specific to the RFI type","type":"object","additionalProperties":true},"priority":{"description":"RFI priority. Four-level projects use `low`, `routine`, `high`, `urgent`; existing projects retain legacy `low`->routine compatibility. `medium`, `critical`, and `unknown` remain accepted legacy aliases. Defaults to `routine`.","type":"string","enum":["low","routine","high","urgent","unknown","medium","critical"],"examples":["routine"]},"request_type":{"description":"Optional request type for the request","type":["string","null"]},"subtypeId":{"description":"Optional subtype ID","type":["string","null"],"examples":["subtype-123"]},"title":{"description":"RFI title (optional). When omitted, the server generates a summary from the request type and readable ID.","type":"string","examples":["Investigation into suspicious domain activity"]},"tlp":{"description":"Traffic Light Protocol level. Canonical values are `clear`, `green`, `amber`, `amber-strict`, `red`, `purple`. `white` and `amber+strict` are accepted input aliases; responses always use the canonical spelling.","type":"string","enum":["clear","green","amber","amber-strict","red","purple","white","amber+strict"],"examples":["amber"]}}}},"required":["path"],"additionalProperties":false},"name":"Creates a new RFI","id":"cloudflare.post_requestcreate","example":{"path":{"account_id":"example","project_type":"threat-intelligence"}},"maxRequests":1,"summary":false}}