Skip to content
Cloudflare API
Start here
API Reference
Zero Trust
Casb
Posture
Findings
Instances

Remove the archive marking from a finding instance

client.ZeroTrust.Casb.Posture.Findings.Instances.Unarchive(ctx, findingID, params) (*CasbPostureFindingInstanceUnarchiveResponse, error)
POST/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances/unarchive

Remove the archive marking from one or more finding instances.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
Accepted Permissions (at least one required)
Zero Trust Write
ParametersExpand Collapse
findingID string
formatbyte
params CasbPostureFindingInstanceUnarchiveParams
AccountID param.Field[string]

Path param: Cloudflare account ID for the user making the request.

CheckInstances param.Field[[]string]

Body param: A list of finding instance IDs to pass along.

ReturnsExpand Collapse
type CasbPostureFindingInstanceUnarchiveResponse struct{…}

A specific instance of a security finding. In the API interface, we refer to the ‘finding’ table in our DB as finding instances, optimized for the p99 use case.

AfflictionDate Time

When this specific instance was identified.

formatdate-time
Asset CasbPostureFindingInstanceUnarchiveResponseAsset

Asset information including metadata and categorization.

Category CasbPostureFindingInstanceUnarchiveResponseAssetCategory

Category information for an asset.

Service string

The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service.

Type string

The type of asset.

Vendor string

The vendor the asset is part of.

ID stringOptional

Unique identifier for the asset category.

formatuuid
ExternalID string

External identifier from the source system.

maxLength512
Fields []CasbPostureFindingInstanceUnarchiveResponseAssetField

The fields associated with the asset.

Name string

The name of the field.

Value string

The value of the field.

Name string

Human-readable name of the asset.

ID stringOptional

Unique identifier for the asset.

formatuuid
DLPContexts []CasbPostureFindingInstanceUnarchiveResponseDLPContext

DLP context information if this is a content finding.

Created Time

When the DLP context was created.

formatdate-time
EntryIDs []string

DLP Entry IDs.

ProfileID string

DLP Profile ID.

formatuuid
Updated Time

When the DLP context was last updated.

formatdate-time
ID stringOptional

Unique identifier for the DLP context.

formatuuid
Deleted TimeOptional

When the DLP context was deleted.

formatdate-time
MatchContextMaxExtent int64Optional

DLP Right Boundary of match context.

maximum2147483647
minimum0
MatchContextMinExtent int64Optional

DLP Left Boundary of match context.

maximum2147483647
minimum0
MatchContextPayload map[string, unknown]Optional

DLP Match context payload that matched the profile in question.

Remediations []CasbPostureFindingInstanceUnarchiveResponseRemediation

A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The ‘stale’ field indicates whether the remediation job was created before the finding instance’s affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array.

ID string

Unique identifier for the remediation job.

formatuuid
CreatedAt Time

When the remediation job was created.

formatdate-time
Stale bool

Whether this remediation job is stale (created before the finding instance’s affliction_date).

Status CasbPostureFindingInstanceUnarchiveResponseRemediationsStatus

Status of a remediation job.

One of the following:
const CasbPostureFindingInstanceUnarchiveResponseRemediationsStatusPending CasbPostureFindingInstanceUnarchiveResponseRemediationsStatus = "pending"
const CasbPostureFindingInstanceUnarchiveResponseRemediationsStatusProcessing CasbPostureFindingInstanceUnarchiveResponseRemediationsStatus = "processing"
const CasbPostureFindingInstanceUnarchiveResponseRemediationsStatusCompleted CasbPostureFindingInstanceUnarchiveResponseRemediationsStatus = "completed"
const CasbPostureFindingInstanceUnarchiveResponseRemediationsStatusFailed CasbPostureFindingInstanceUnarchiveResponseRemediationsStatus = "failed"
const CasbPostureFindingInstanceUnarchiveResponseRemediationsStatusValidating CasbPostureFindingInstanceUnarchiveResponseRemediationsStatus = "validating"
Webhooks []CasbPostureFindingInstanceUnarchiveResponseWebhook

The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The ‘stale’ field indicates whether the job was invoked before the finding instance’s current affliction_date. If no webhook jobs have been created, this field will be an empty array.

LatestJob CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJob

The most recent webhook job for this webhook configuration.

ID string

Unique identifier for the webhook job.

formatuuid
CreatedAt Time

When the webhook job was created.

formatdate-time
Stale bool

Whether this webhook job is stale (created before the finding instance’s current affliction_date).

Status CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJobStatus

Current status of the webhook job.

One of the following:
const CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJobStatusPending CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJobStatus = "pending"
const CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJobStatusProcessing CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJobStatus = "processing"
const CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJobStatusCompleted CasbPostureFindingInstanceUnarchiveResponseWebhooksLatestJobStatus = "completed"
WebhookID string

Unique identifier for the webhook configuration.

formatuuid
WebhookLabel string

Account-specified display label for the webhook configuration.

ID stringOptional

Unique identifier for the finding instance.

formatuuid
IsArchived boolOptional

Whether this finding instance has been archived.

Remove the archive marking from a finding instance

package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/option"
  "github.com/cloudflare/cloudflare-go/zero_trust"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.ZeroTrust.Casb.Posture.Findings.Instances.Unarchive(
    context.TODO(),
    "U3RhaW5sZXNzIHJvY2tz",
    zero_trust.CasbPostureFindingInstanceUnarchiveParams{
      AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"),
      CheckInstances: cloudflare.F([]string{"497f6eca-6276-4993-bfeb-53cbbbba6f08"}),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.ID)
}

{
  "errors": [
    {
      "code": 1000,
      "message": "Request processed successfully",
      "documentation_url": "https://developers.cloudflare.com/api/operations/list-findings",
      "source": {
        "pointer": "/data/attributes/name"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "Request processed successfully",
      "documentation_url": "https://developers.cloudflare.com/api/operations/list-findings",
      "source": {
        "pointer": "/data/attributes/name"
      }
    }
  ],
  "success": true,
  "result": {
    "affliction_date": "2025-03-18T17:25:38.700541Z",
    "asset": {
      "category": {
        "service": null,
        "type": "file",
        "vendor": "Slack",
        "id": "1a78cbf3-b98f-4289-b1f2-22db64130f4f"
      },
      "external_id": "external-file-id-123",
      "fields": [
        {
          "name": "Credential name",
          "value": "Test asset 2",
          "link": "https://example.com"
        }
      ],
      "name": "Public.svg",
      "id": "8a043daf-def4-403e-9d28-da2e93d9b824",
      "link": "https://slack-files.com/TYJH37DCK-E0238GG6B8-92fd5y5674"
    },
    "dlp_contexts": [
      {
        "created": "2025-03-18T17:25:38.695977Z",
        "entry_ids": [
          "21befc68-a297-4090-ac10-17a051b901cd",
          "d6dd1e16-f78c-401a-b564-45c4e44aa467"
        ],
        "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e",
        "updated": "2025-03-18T17:25:38.695977Z",
        "id": "7653ff3a-d25e-4c10-8034-3460937c045b",
        "deleted": "2025-03-18T17:25:38.695977Z",
        "match_context_max_extent": 512,
        "match_context_min_extent": 1,
        "match_context_payload": {}
      }
    ],
    "remediations": [
      {
        "id": "123e4567-e89b-12d3-a456-426614174000",
        "created_at": "2025-03-18T18:30:15.123456Z",
        "stale": false,
        "status": "pending"
      }
    ],
    "webhooks": [
      {
        "latest_job": {
          "id": "123e4567-e89b-12d3-a456-426614174000",
          "created_at": "2025-03-18T18:30:15.123456Z",
          "stale": false,
          "status": "pending"
        },
        "webhook_id": "550e8400-e29b-41d4-a716-446655440000",
        "webhook_label": "Send to Gmail"
      }
    ],
    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
    "is_archived": false
  }
}
Returns Examples
{
  "errors": [
    {
      "code": 1000,
      "message": "Request processed successfully",
      "documentation_url": "https://developers.cloudflare.com/api/operations/list-findings",
      "source": {
        "pointer": "/data/attributes/name"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "Request processed successfully",
      "documentation_url": "https://developers.cloudflare.com/api/operations/list-findings",
      "source": {
        "pointer": "/data/attributes/name"
      }
    }
  ],
  "success": true,
  "result": {
    "affliction_date": "2025-03-18T17:25:38.700541Z",
    "asset": {
      "category": {
        "service": null,
        "type": "file",
        "vendor": "Slack",
        "id": "1a78cbf3-b98f-4289-b1f2-22db64130f4f"
      },
      "external_id": "external-file-id-123",
      "fields": [
        {
          "name": "Credential name",
          "value": "Test asset 2",
          "link": "https://example.com"
        }
      ],
      "name": "Public.svg",
      "id": "8a043daf-def4-403e-9d28-da2e93d9b824",
      "link": "https://slack-files.com/TYJH37DCK-E0238GG6B8-92fd5y5674"
    },
    "dlp_contexts": [
      {
        "created": "2025-03-18T17:25:38.695977Z",
        "entry_ids": [
          "21befc68-a297-4090-ac10-17a051b901cd",
          "d6dd1e16-f78c-401a-b564-45c4e44aa467"
        ],
        "profile_id": "ab20a60b-21f2-4b13-ac98-24dcee27ac0e",
        "updated": "2025-03-18T17:25:38.695977Z",
        "id": "7653ff3a-d25e-4c10-8034-3460937c045b",
        "deleted": "2025-03-18T17:25:38.695977Z",
        "match_context_max_extent": 512,
        "match_context_min_extent": 1,
        "match_context_payload": {}
      }
    ],
    "remediations": [
      {
        "id": "123e4567-e89b-12d3-a456-426614174000",
        "created_at": "2025-03-18T18:30:15.123456Z",
        "stale": false,
        "status": "pending"
      }
    ],
    "webhooks": [
      {
        "latest_job": {
          "id": "123e4567-e89b-12d3-a456-426614174000",
          "created_at": "2025-03-18T18:30:15.123456Z",
          "stale": false,
          "status": "pending"
        },
        "webhook_id": "550e8400-e29b-41d4-a716-446655440000",
        "webhook_label": "Send to Gmail"
      }
    ],
    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
    "is_archived": false
  }
}