{"command":{"effect":"read","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Lists indicators of compromise extracted from the account's Threat Signals articles.","properties":{"path":{"type":"object","properties":{"account_id":{"type":"string"}},"required":["account_id"],"additionalProperties":false},"query":{"type":"object","properties":{"feed_id":{"description":"Feed UUID filter. Omit to include indicators from every account feed.","type":"string","format":"uuid"},"article_id":{"description":"Article UUID filter. Omit to include indicators from every article.","type":"string","format":"uuid"},"search":{"description":"NFC-normalized and trimmed, case-insensitive literal substring search of indicator values. Requires 3–500 Unicode code points; the upper code-point bound is described here because OpenAPI string length cannot precisely express it without imposing UTF-16 semantics.","type":"string"},"per_page":{"description":"Number of indicators per cursor page, from 1 to 100. Defaults to 20.","type":"integer","default":20,"maximum":100,"minimum":1},"sort":{"description":"Sort by id. Use id for ascending or -id for descending order; defaults to id.","type":"string","default":"id","pattern":"^-?(id)$"},"include_total":{"description":"When true on the first page, count matching indicators and return an exact total. Defaults to false; cursor pages do not recalculate totals.","type":"boolean","default":false},"cursor":{"description":"Opaque cursor from the previous response's `pagination.cursor`. When provided, page size, ordering, and filters come from the cursor. Sending `per_page`, `sort`, `include_total`, `feed_id`, `article_id`, or `search` alongside it returns a 400 `CursorFilterConflictError`.","type":"string","minLength":1}},"required":[],"additionalProperties":false}},"required":["path"],"additionalProperties":false},"name":"List Threat Signals article indicators","id":"cloudflare.rssarticleindicatorlist","example":{"path":{"account_id":"example"}},"maxRequests":1,"summary":false}}