{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Creates a tag in the account and returns the complete tag.","properties":{"path":{"type":"object","properties":{"account_id":{"description":"Account ID.","type":"string"}},"required":["account_id"],"additionalProperties":false},"body":{"type":"object","properties":{"activeDuration":{"anyOf":[{"type":"string"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"string"}},"required":["value"],"type":"object"}]},"actorCategory":{"anyOf":[{"type":"string"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"string"}},"required":["value"],"type":"object"}]},"aliasGroupNames":{"type":"array","items":{"type":"string"}},"aliasGroupNamesInternal":{"type":"array","items":{"type":"string"}},"aliases":{"description":"Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).","type":"array","items":{"properties":{"confidence":{"type":["integer","null"],"maximum":10,"minimum":1,"examples":[8]},"tlp":{"type":["string","null"],"enum":["red","amber","amber-strict","green","clear","purple","amber+strict"],"examples":["amber"]},"value":{"type":"string","examples":["Fancy Bear"]}},"required":["value"],"type":"object"}},"attributionOrganization":{"anyOf":[{"type":"string"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"string"}},"required":["value"],"type":"object"}]},"categoryUuid":{"description":"Tag type (category) UUID. Optional — when present, `properties` is validated against this category's schema. When absent, the tag is typeless and properties are accepted free-form.","type":"string","examples":["12345678-1234-1234-1234-1234567890ab"]},"confidence":{"description":"Overall tag confidence (1-10). Optional.","type":"integer","maximum":10,"minimum":1,"examples":[8]},"dateOfDiscovery":{"description":"Date of discovery (ISO YYYY-MM-DD). Optional.","type":"string","pattern":"^\\d{4}-\\d{2}-\\d{2}$","examples":["2024-01-15T00:00:00Z"]},"description":{"type":"string","examples":["A suspected state-sponsored group."]},"externalReferenceLinks":{"type":"array","items":{"type":"string"}},"externalReferences":{"description":"Structured external references ({ url, description }). Public: returned to all accounts.","type":"array","items":{"properties":{"description":{"type":["string","null"],"examples":["Vendor threat report"]},"url":{"type":"string","examples":["https://example.com/report"]}},"required":["url"],"type":"object"}},"internalAliases":{"description":"Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.","type":"array","items":{"properties":{"confidence":{"type":["integer","null"],"maximum":10,"minimum":1,"examples":[8]},"tlp":{"type":["string","null"],"enum":["red","amber","amber-strict","green","clear","purple","amber+strict"],"examples":["amber"]},"value":{"type":"string","examples":["Fancy Bear"]}},"required":["value"],"type":"object"}},"internalDescription":{"type":"string"},"lastSeen":{"type":"string"},"motive":{"anyOf":[{"type":"string"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"string"}},"required":["value"],"type":"object"}]},"opsecLevel":{"anyOf":[{"type":"string"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"string"}},"required":["value"],"type":"object"}]},"originCountryISO":{"anyOf":[{"type":"string"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"string"}},"required":["value"],"type":"object"}]},"priority":{"anyOf":[{"type":"number"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"number"}},"required":["value"],"type":"object"}]},"properties":{"description":"Structured metadata blob. Optional. When `categoryUuid` is given, validated against this category's schema on write. When typeless, accepted free-form. Use `{}` for a tag with no custom data.","type":"object","additionalProperties":true},"sophisticationLevel":{"anyOf":[{"type":"string"},{"properties":{"confidence":{"type":"integer","maximum":10,"minimum":1},"tlp":{"type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"]},"value":{"type":"string"}},"required":["value"],"type":"object"}]},"tlp":{"description":"Tag-level TLP handling marking. Optional. Allowed values: red, amber, amber-strict, green, clear, purple, amber+strict.","type":"string","enum":["red","amber","amber-strict","green","clear","purple","amber+strict"],"examples":["amber"]},"value":{"type":"string","examples":["APT28"]}},"required":["value"]}},"required":["path"],"additionalProperties":false},"name":"Create a tag","id":"cloudflare.post_tagcreate","example":{"path":{"account_id":"example"}},"maxRequests":1,"summary":false}}