Skip to content
Cloudflare API
Start here
API Reference
Zero Trust
Casb
Posture
Findings

Reset severity for a finding back to the default

client.ZeroTrust.Casb.Posture.Findings.ResetSeverity(ctx, findingID, body) (*CasbPostureFindingResetSeverityResponse, error)
POST/accounts/{account_id}/data-security/posture/findings/{finding_id}/reset_finding_severity

If a Finding’s severity has been changed, reset it back to default value. Does nothing if no override exists.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
Accepted Permissions (at least one required)
Zero Trust Write
ParametersExpand Collapse
findingID string
formatbyte
body CasbPostureFindingResetSeverityParams
AccountID param.Field[string]

Cloudflare account ID for the user making the request.

ReturnsExpand Collapse
type CasbPostureFindingResetSeverityResponse struct{…}

Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics.

ID string

Base64 encoded identifier of the security finding.

formatbyte
ActiveCount int64

Number of active problematic instances identified in the security finding.

ArchivedCount int64

Number of archived instances identified in the security finding.

Finding CasbPostureFindingResetSeverityResponseFinding

Basic finding type information.

ID string

The unique identifier of the finding.

formatuuid
Category CasbPostureFindingResetSeverityResponseFindingCategory

Category information for a finding.

Observation CasbPostureFindingResetSeverityResponseFindingCategoryObservation

The type of the observation.

One of the following:
const CasbPostureFindingResetSeverityResponseFindingCategoryObservationIssue CasbPostureFindingResetSeverityResponseFindingCategoryObservation = "Issue"
const CasbPostureFindingResetSeverityResponseFindingCategoryObservationInsight CasbPostureFindingResetSeverityResponseFindingCategoryObservation = "Insight"
const CasbPostureFindingResetSeverityResponseFindingCategoryObservationActivity CasbPostureFindingResetSeverityResponseFindingCategoryObservation = "Activity"
Product CasbPostureFindingResetSeverityResponseFindingCategoryProduct

The product category.

One of the following:
const CasbPostureFindingResetSeverityResponseFindingCategoryProductSaaS CasbPostureFindingResetSeverityResponseFindingCategoryProduct = "SaaS"
const CasbPostureFindingResetSeverityResponseFindingCategoryProductCloud CasbPostureFindingResetSeverityResponseFindingCategoryProduct = "Cloud"
Type CasbPostureFindingResetSeverityResponseFindingCategoryType

The type of the finding category.

One of the following:
const CasbPostureFindingResetSeverityResponseFindingCategoryTypeContent CasbPostureFindingResetSeverityResponseFindingCategoryType = "Content"
const CasbPostureFindingResetSeverityResponseFindingCategoryTypePosture CasbPostureFindingResetSeverityResponseFindingCategoryType = "Posture"
Name string

The name of the finding.

Severity CasbPostureFindingResetSeverityResponseFindingSeverity

The severity level of a finding.

One of the following:
const CasbPostureFindingResetSeverityResponseFindingSeverityCritical CasbPostureFindingResetSeverityResponseFindingSeverity = "Critical"
const CasbPostureFindingResetSeverityResponseFindingSeverityHigh CasbPostureFindingResetSeverityResponseFindingSeverity = "High"
const CasbPostureFindingResetSeverityResponseFindingSeverityMedium CasbPostureFindingResetSeverityResponseFindingSeverity = "Medium"
const CasbPostureFindingResetSeverityResponseFindingSeverityLow CasbPostureFindingResetSeverityResponseFindingSeverity = "Low"
Vendor string

The SaaS/Cloud vendor of the platform with which the finding is associated.

Description stringOptional

Detailed description of the finding.

Remediation CasbPostureFindingResetSeverityResponseFindingRemediationOptional

Remediation guide information for a finding.

ID string

Remediation Id.

formatuuid
Frameworks []string

Relevant Compliance Frameworks.

Guide string

Remediation guide text.

Impact string

Description of the potential impact.

Locale string

I18N Locale.

Threat string

Description of the threat.

Ignored bool

Determines if finding is currently ignored.

InstanceCount int64

Number of total (Active or archived) problematic instances identified in the security finding.

Integration CasbPostureFindingResetSeverityResponseIntegration

Summary information about an integration.

Created Time

When entity was created.

formatdate-time
LastHydrated Time

When were the integration credentials last updated.

formatdate-time
Name string

Name of the integration.

maxLength256
Permissions []string

The vendor-specific permissions associated with the integration.

Policy CasbPostureFindingResetSeverityResponseIntegrationPolicy

Policy configuration for an integration.

ID stringOptional

Policy identifier.

formatuuid
ClientID stringOptional

OAuth client ID for the policy.

ComplianceLevel stringOptional

Compliance level for the policy.

DLPEnabled boolOptional

Whether DLP is enabled for this policy.

Name stringOptional

Policy name.

Permissions []stringOptional

List of permissions included in the policy.

Status string

Current status of the integration.

Updated Time

Last entity was updated.

formatdate-time
Upgradable bool

Whether the integrations permissions can be updated.

Vendor CasbPostureFindingResetSeverityResponseIntegrationVendor

Information about a vendor/service provider.

ID string

The id of the vendor.

Description string

Detailed information about what kinds of issues are detected for this vendor.

DisplayName string

The display name of the vendor.

Name string

The name of the vendor.

ZtEnrollments []string

The vendor’s compatible Zero Trust products.

Policies []map[string, unknown]Optional

The policies related to the vendor.

ZtEnrollments []CasbPostureFindingResetSeverityResponseIntegrationZtEnrollment

Zero Trust products associated with this integration.

ID stringOptional

The internal identifier of the Zero Trust Product.

Description stringOptional

Brief description of the Zero Trust Product.

DisplayName stringOptional

The verbose name of the Zero Trust Product.

Enabled boolOptional

Flag to enable/disable access to the listed integration from the corresponding Cloudflare product.

ID stringOptional

Integration ID.

formatuuid
CredentialHealthStatus CasbPostureFindingResetSeverityResponseIntegrationCredentialHealthStatusOptional

Health status of integration credentials.

One of the following:
const CasbPostureFindingResetSeverityResponseIntegrationCredentialHealthStatusInitializing CasbPostureFindingResetSeverityResponseIntegrationCredentialHealthStatus = "Initializing"
const CasbPostureFindingResetSeverityResponseIntegrationCredentialHealthStatusHealthy CasbPostureFindingResetSeverityResponseIntegrationCredentialHealthStatus = "Healthy"
const CasbPostureFindingResetSeverityResponseIntegrationCredentialHealthStatusUnhealthy CasbPostureFindingResetSeverityResponseIntegrationCredentialHealthStatus = "Unhealthy"
CredentialsExpiry TimeOptional

The date and time when the integration credentials will expire.

formatdate-time
IsPaused boolOptional

Whether the given integration is paused by the user.

UpgradeDismissed boolOptional

UI State as to whether a potential permissions upgrade has been dismissed.

LatestAfflictionDate Time

Timestamp of the latest affliction date of an active finding.

formatdate-time
SeverityOverride CasbPostureFindingResetSeverityResponseSeverityOverrideOptional

Override information for finding severity.

CreatedBy string

User ID who created the override.

Severity CasbPostureFindingResetSeverityResponseSeverityOverrideSeverity

The severity level of a finding.

One of the following:
const CasbPostureFindingResetSeverityResponseSeverityOverrideSeverityCritical CasbPostureFindingResetSeverityResponseSeverityOverrideSeverity = "Critical"
const CasbPostureFindingResetSeverityResponseSeverityOverrideSeverityHigh CasbPostureFindingResetSeverityResponseSeverityOverrideSeverity = "High"
const CasbPostureFindingResetSeverityResponseSeverityOverrideSeverityMedium CasbPostureFindingResetSeverityResponseSeverityOverrideSeverity = "Medium"
const CasbPostureFindingResetSeverityResponseSeverityOverrideSeverityLow CasbPostureFindingResetSeverityResponseSeverityOverrideSeverity = "Low"

Reset severity for a finding back to the default

package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/option"
  "github.com/cloudflare/cloudflare-go/zero_trust"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.ZeroTrust.Casb.Posture.Findings.ResetSeverity(
    context.TODO(),
    "U3RhaW5sZXNzIHJvY2tz",
    zero_trust.CasbPostureFindingResetSeverityParams{
      AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.ID)
}

{
  "errors": [
    {
      "code": 1000,
      "message": "Request processed successfully",
      "documentation_url": "https://developers.cloudflare.com/api/operations/list-findings",
      "source": {
        "pointer": "/data/attributes/name"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "Request processed successfully",
      "documentation_url": "https://developers.cloudflare.com/api/operations/list-findings",
      "source": {
        "pointer": "/data/attributes/name"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=",
    "active_count": 5,
    "archived_count": 2,
    "finding": {
      "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94",
      "category": {
        "observation": "Issue",
        "product": "SaaS",
        "type": "Posture"
      },
      "name": "Slack File Publicly Accessible",
      "severity": "High",
      "vendor": "Google Workspace",
      "description": "This finding indicates that a file in your Slack workspace is publicly accessible.",
      "remediation": {
        "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94",
        "frameworks": [
          "SOC2",
          "ISO27001"
        ],
        "guide": "To fix this issue, update the file permissions to remove public access.",
        "impact": "Publicly accessible files may expose sensitive information.",
        "locale": "en-US",
        "threat": "Data exposure and potential compliance violations."
      }
    },
    "ignored": false,
    "instance_count": 7,
    "integration": {
      "created": "2021-08-10T20:16:11.851451Z",
      "last_hydrated": "2025-03-18T17:25:38.697894Z",
      "name": "Example integration",
      "permissions": [
        "GroupMember.Read.All",
        "Group.Read.All"
      ],
      "policy": {
        "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c",
        "client_id": "client_id",
        "compliance_level": "standard",
        "dlp_enabled": true,
        "link": "https://example.com",
        "name": "Google Workspace Standard Policy",
        "permissions": [
          "https://www.googleapis.com/auth/admin.directory.domain.readonly",
          "https://www.googleapis.com/auth/admin.directory.user.readonly"
        ]
      },
      "status": "Healthy",
      "updated": "2021-08-10T20:16:11.851451Z",
      "upgradable": false,
      "vendor": {
        "id": "R09PR0xFX1dPUktTUEFDRQ==",
        "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.",
        "display_name": "Google Workspace",
        "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png",
        "name": "GOOGLE_WORKSPACE",
        "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png",
        "zt_enrollments": [
          "casb"
        ],
        "policies": [
          {
            "foo": "bar"
          }
        ]
      },
      "zt_enrollments": [
        {
          "id": "casb",
          "description": "example",
          "display_name": "Cloud Access Security Broker",
          "enabled": true
        }
      ],
      "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f",
      "credential_health_status": "Healthy",
      "credentials_expiry": "2025-03-18T17:25:38.697902Z",
      "is_paused": false,
      "upgrade_dismissed": false
    },
    "latest_affliction_date": "2025-03-18T17:25:38.700131Z",
    "severity_override": {
      "created_by": "1234",
      "severity": "Critical"
    }
  }
}
Returns Examples
{
  "errors": [
    {
      "code": 1000,
      "message": "Request processed successfully",
      "documentation_url": "https://developers.cloudflare.com/api/operations/list-findings",
      "source": {
        "pointer": "/data/attributes/name"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "Request processed successfully",
      "documentation_url": "https://developers.cloudflare.com/api/operations/list-findings",
      "source": {
        "pointer": "/data/attributes/name"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=",
    "active_count": 5,
    "archived_count": 2,
    "finding": {
      "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94",
      "category": {
        "observation": "Issue",
        "product": "SaaS",
        "type": "Posture"
      },
      "name": "Slack File Publicly Accessible",
      "severity": "High",
      "vendor": "Google Workspace",
      "description": "This finding indicates that a file in your Slack workspace is publicly accessible.",
      "remediation": {
        "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94",
        "frameworks": [
          "SOC2",
          "ISO27001"
        ],
        "guide": "To fix this issue, update the file permissions to remove public access.",
        "impact": "Publicly accessible files may expose sensitive information.",
        "locale": "en-US",
        "threat": "Data exposure and potential compliance violations."
      }
    },
    "ignored": false,
    "instance_count": 7,
    "integration": {
      "created": "2021-08-10T20:16:11.851451Z",
      "last_hydrated": "2025-03-18T17:25:38.697894Z",
      "name": "Example integration",
      "permissions": [
        "GroupMember.Read.All",
        "Group.Read.All"
      ],
      "policy": {
        "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c",
        "client_id": "client_id",
        "compliance_level": "standard",
        "dlp_enabled": true,
        "link": "https://example.com",
        "name": "Google Workspace Standard Policy",
        "permissions": [
          "https://www.googleapis.com/auth/admin.directory.domain.readonly",
          "https://www.googleapis.com/auth/admin.directory.user.readonly"
        ]
      },
      "status": "Healthy",
      "updated": "2021-08-10T20:16:11.851451Z",
      "upgradable": false,
      "vendor": {
        "id": "R09PR0xFX1dPUktTUEFDRQ==",
        "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.",
        "display_name": "Google Workspace",
        "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png",
        "name": "GOOGLE_WORKSPACE",
        "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png",
        "zt_enrollments": [
          "casb"
        ],
        "policies": [
          {
            "foo": "bar"
          }
        ]
      },
      "zt_enrollments": [
        {
          "id": "casb",
          "description": "example",
          "display_name": "Cloud Access Security Broker",
          "enabled": true
        }
      ],
      "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f",
      "credential_health_status": "Healthy",
      "credentials_expiry": "2025-03-18T17:25:38.697902Z",
      "is_paused": false,
      "upgrade_dismissed": false
    },
    "latest_affliction_date": "2025-03-18T17:25:38.700131Z",
    "severity_override": {
      "created_by": "1234",
      "severity": "Critical"
    }
  }
}