---
title: "Fetch a flow"
method: GET
path: "/flows/{id}"
tags: ["Flow"]
---

# Fetch a flow

`GET /flows/{id}`

## Request

- Base URL: `https://api.recordedfuture.com/fusion/v3`
- URL: `https://api.recordedfuture.com/fusion/v3/flows/{id}`
- Auth: one of:
  - API key in header `X-RFToken`
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`

Fetch the configuration of a flow.

## Path parameters

- `id` string, required

## Response `200`

Flow configuration

- FlowConfigurationOutput
  - `id` string: Id of the flow
  - `name` string
  - `owner` string: ID (uhash) of user that owns the flow
  - `description` string
  - `blocks` FlowBlock[], required
    - union
      - object: Custom block used for running Python code. Requires special privileges to use.
        - `id` string: Id of the custom block, used to chain this block to another. Must match regex [a-z0-9_]+
        - `description` string, required
        - `script` string, required: Stringified Python code
        - `params` object[]
          - `name` string
          - `required` boolean
          - `default_value` string: The default value of the parameter, can be anything
        - `inputs` object[]
          - `name` string
          - `required` boolean
          - `singleton` boolean: Flag to indicate if this is the only input
      - object: A Constant Block represents a fixed set of records that are specified in the block configuration. This block is useful when there is a very limited set of records to be used when filtering larger sets of records, for example, a whitelist.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'constant', required: The type of block
        - `description` string
        - `records` object[], required: A list of JSON objects representing records to be passed through the flow.
      - object: An Entity List Block pulls entities from a Recorded Future entity list with a given ID. This ID may be looked up in the Connect API or through the debug view in the Recorded Future web app. A possible use case would be to construct a custom risk list from indicators selected from within the web app.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'entitylist', required: The type of block
        - `description` string
        - `list` string, required: An entity list ID with or without 'report:' prefix.
        - `entity_type` 'ip' | 'vulnerability' | 'hash' | 'domain' | 'url' | 'company'
        - `fields` 'basic' | 'full': Entity serialization to use. Valid values are 'basic' (default) or 'full'. If basic serialization is used, the records will only contain entity ID, name and type. If full serialization is used, the entire entity object as presented in the Raw API will be stored in the record, as well as any list entry metadata - additional properties that an entity may have in a list, but which do not belong to the entity itself. Such additional properties might be harvested from an external list or assigned to list entries using the List API. If found, they will be included in the flow record under the context attribute.
      - object: This block formats any string containing a date to a date string. The formatting is based on a pattern string that is mostly compatible with the JDK date patterns and performed by the DateTimeFormatter java class. The source input to this block is expected to be in a json format.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'dateformatter', required: The type of block
        - `description` string
        - `mappings` object[], required: An object describing a list of DateFormatMappings.
          - `path` string, required: The path to the data you want to affect. This describes a JSON path where a dot (.) is used as a delimiter.
          - `destination_path` string: Describes the output path. Destination path is not json path aware thus the prefix "$." is stripped. Has the same value as path unless specified.
          - `pattern` string, required: The pattern syntax is mostly compatible with java.text.SimpleDateFormat, see https://www.joda.org/joda-time///apidocs/org/joda/time/format/DateTimeFormat.html Time zone names cannot be parsed and a few more symbols are supported. See separate Fusion documentation for more details.
        - `keep` boolean: Ensures that any data that comes into this block will follow through to the next block unless it is explicitly overwritten.
      - object: This block formats any string containing a number to a decimal number string. The formatting is based on a pattern string performed by the DecimalFormat java class. One can supply a locale to be used when doing formatting. It uses RoundingMode.HALF_EVEN when rounding values. The source input to this block is expected to be in a json format.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'decimalnumberformatter', required: The type of block
        - `description` string
        - `mappings` object[], required: An object describing a list of DecimalNumberMappings
          - `path` string, required: The path to the data you want to affect. This describes a JSON path where a dot (.) is used as a delimiter.
          - `destination_path` string: Describes the output path. Destination path is not json path aware thus the prefix "$." is stripped. Has the same value as path unless specified.
          - `pattern` string, required: You can use the following characters in the formatting pattern: "0" - A digit - always displayed, even if number has less digits (then 0 is displayed) "#" - A digit, leading zeroes are omitted. "." - Marks decimal separator "," - Marks grouping separator (e.g. thousand separator) "E" - Marks separation of mantissa and exponent for exponential formats. ";" - Separates formats "-" Marks the negative number prefix "%" - Multiplies by 100 and shows number as percentage "?" - Multiplies by 1000 and shows number as per mille "¤" - Currency sign - replaced by the currency sign for the Locale. Also makes formatting use the monetary decimal separator instead of normal decimal separator. ¤¤ makes formatting use international monetary symbols. "X" - Marks a character to be used in number prefix or suffix "'" - Marks a quote around special characters in prefix or suffix of formatted number. See https://docs.oracle.com/javase/10/docs/api/java/text/DecimalFormat.html for more information.
        - `locale` object
          - `lang` string: An ISO 639 alpha-2 or alpha-3 language code, or a language subtag up to 8 characters in length. See the Locale Java class description about valid language values.
          - `country` string: An ISO 3166 alpha-2 country code or a UN M.49 numeric-3 area code. See the Locale Java class description about valid country values.
        - `keep` boolean: Ensures that any data that comes into this block will follow through to the next block unless it is explicitly overwritten.
      - object: Reads records from a file in the File API. The file must be in one of the supported format. The file name can be configured to include the date when the file was created either as a prefix or suffix of the file name.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'fileapisource', required: The type of block
        - `description` string
        - `path` string, required: The path in the File API where the file is stored.
        - `gzip` boolean: Flag to control if Gzip compression should be used
        - `format` union, required: An object containing format parameters.
          - CVSFormatter: The CSV formatter handles line-separated records where the data for each record is delimited by some character.
            - `type` 'csv', required: The type of formatter to use
            - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
            - `contains_headers` boolean: Boolean value for if the input file contains headers or if the output file should use headers.
            - `headers` string[]
            - `header_mapping` object: Used only in inputs. A JSON object containing a mapping of input CSV headers (string) to keys (string) to be used in the resulting records.
            - `header_filter` string[]: Used only in inputs. An array of headers to include in the resulting records.
            - `separator` string: What separator character to use. Defaults to ",".
            - `line_break` string: What line break character sequence to use. Defaults to "\n" (ASCII new-line character).
            - `always_quote` boolean: True if output string values should always be quoted. Required for some CSV processors. Note that only strings are quoted using this parameter. Other data, like integers and floating-point numbers may not be quoted.
            - `escape_quotes` boolean: True if quotes should be escaped using the character provided in escape_char
            - `escape_char` boolean: Character to escape quotes with. The default is to escape quotes with quote characters ("double-quote escaping"). Other common characters are backslashes
            - `strict_quoting` boolean: True if in-depth analysis should be done when the writer decides when to quote. Has a performance impact.
            - `disable_quotes` boolean: Disables any quoting of columns if set to True.
          - JSONFormatter: The JSON formatter handles JSON input and output. Currently, it is not able to stream JSON input records. This means that the worker processing the flow will read the full JSON document into memory before emitting records, making this input unsuitable for very large inputs. JSON input must be an array (list) of objects (dicts). It is possible to set the path parameter to point out where to find the input array.
            - `type` 'json', required: The type of formatter to use
            - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
            - `pretty` boolean: Boolean value for if the JSON output should be prettified, i.e. written in a more readable manner.
            - `path` string: A JSONPath to where the array of objects can be found. See the specification at https://goessner.net/articles/JsonPath/ for information on how to construct a JSONPath transform that suits your needs.
          - XMLFormatter: The XML formatter handles arbitrary XML input and output
            - `type` 'xml', required: The type of formatter to use
            - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
            - `base` string, required: A slash-separated path to where the XML collection that should be converted to flow records is located.
            - `mappings` object, required: JSON object that maps flow record keys to XPath selectors. These are relative to the base path.
          - TempleFormatter: When dealing with formats that are hard to generalize, it's possible to create a template that decides how the output should be formatted. This is our default way of rendering XML output, and may be used for creating XML based formats such as STIX, among others. The templating engine used is Jinja.
            - `type` 'template', required: The type of formatter to use
            - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
            - `header` string: Header template string.
            - `header_file` string: Header template file in the File API.
            - `record` string: Record template string. One of record or record_file must be set.
            - `record_file` string: Record template file in the File API. One of record or record_file must be set.
            - `footer` string: Footer template string.
            - `footer_file` string: Footer template file in the File API.
          - RawFormatter: A simple formatter that will for each record take the value of a column and print it. It will not add newlines, if that is needed it must be part of the column value.
            - `type` 'raw', required: The type of formatter to use
            - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
            - `column` string, required: The column to read the value from.
      - object: Reads records from a file served over HTTP. The file must be in one of the supported formats.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'httpsource', required: The type of block
        - `description` string
        - `url` string, required
        - `headers` object: A JSON object holding headers required for the request.
        - `certificate` object: JSON object for client certificate TLS authentication. This will set up a TLS context with the given key file and certificate chain file.
          - `key` string, required: File API path to a PKCS#8 private key in PEM format.
          - `chain` string, required: File API path to a X.509 certificate chain in PEM format.
          - `trust` string: File API path to a X.509 certificate in PEM format that should be added to the store of trusted certificates.
        - `auth` object: Properties for Basic Authentication.
          - `username` string, required
          - `password` string, required
        - `method` 'GET' | 'POST' | 'PUT': HTTP method to use.
        - `data` string: HTTP request body, typically used in POST requests and is usually a stringified JSON object
        - `gzip` boolean: Flag that indicates if the file has been compressed with GZip compression.
        - `format` union, required: An object containing format parameters.
          - CVSFormatter: The CSV formatter handles line-separated records where the data for each record is delimited by some character.
            - `type` 'csv', required: The type of formatter to use
            - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
            - `contains_headers` boolean: Boolean value for if the input file contains headers or if the output file should use headers.
            - `headers` string[]
            - `header_mapping` object: Used only in inputs. A JSON object containing a mapping of input CSV headers (string) to keys (string) to be used in the resulting records.
            - `header_filter` string[]: Used only in inputs. An array of headers to include in the resulting records.
            - `separator` string: What separator character to use. Defaults to ",".
            - `line_break` string: What line break character sequence to use. Defaults to "\n" (ASCII new-line character).
            - `always_quote` boolean: True if output string values should always be quoted. Required for some CSV processors. Note that only strings are quoted using this parameter. Other data, like integers and floating-point numbers may not be quoted.
            - `escape_quotes` boolean: True if quotes should be escaped using the character provided in escape_char
            - `escape_char` boolean: Character to escape quotes with. The default is to escape quotes with quote characters ("double-quote escaping"). Other common characters are backslashes
            - `strict_quoting` boolean: True if in-depth analysis should be done when the writer decides when to quote. Has a performance impact.
            - `disable_quotes` boolean: Disables any quoting of columns if set to True.
          - JSONFormatter: The JSON formatter handles JSON input and output. Currently, it is not able to stream JSON input records. This means that the worker processing the flow will read the full JSON document into memory before emitting records, making this input unsuitable for very large inputs. JSON input must be an array (list) of objects (dicts). It is possible to set the path parameter to point out where to find the input array.
            - `type` 'json', required: The type of formatter to use
            - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
            - `pretty` boolean: Boolean value for if the JSON output should be prettified, i.e. written in a more readable manner.
            - `path` string: A JSONPath to where the array of objects can be found. See the specification at https://goessner.net/articles/JsonPath/ for information on how to construct a JSONPath transform that suits your needs.
          - XMLFormatter: The XML formatter handles arbitrary XML input and output
            - `type` 'xml', required: The type of formatter to use
            - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
            - `base` string, required: A slash-separated path to where the XML collection that should be converted to flow records is located.
            - `mappings` object, required: JSON object that maps flow record keys to XPath selectors. These are relative to the base path.
          - TempleFormatter: When dealing with formats that are hard to generalize, it's possible to create a template that decides how the output should be formatted. This is our default way of rendering XML output, and may be used for creating XML based formats such as STIX, among others. The templating engine used is Jinja.
            - `type` 'template', required: The type of formatter to use
            - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
            - `header` string: Header template string.
            - `header_file` string: Header template file in the File API.
            - `record` string: Record template string. One of record or record_file must be set.
            - `record_file` string: Record template file in the File API. One of record or record_file must be set.
            - `footer` string: Footer template string.
            - `footer_file` string: Footer template file in the File API.
          - RawFormatter: A simple formatter that will for each record take the value of a column and print it. It will not add newlines, if that is needed it must be part of the column value.
            - `type` 'raw', required: The type of formatter to use
            - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
            - `column` string, required: The column to read the value from.
      - object: Fetches enriched entities filtered by a set of parameters. The data generated from an indicator block follows the same structure as the respective Connect API response.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'indicators', required: The type of block
        - `description` string
        - `entity_type` 'ip' | 'vulnerability' | 'hash' | 'domain' | 'url' | 'company', required
        - `fields` string[]
        - `limit` integer: Maximum number of entities to create records for.
        - `filters` object: A JSON object containing filtering parameters. The filtering is powered by the same filtering logic that the Connect API uses. This means that any of the filtering options for the different indicator types that are available in the Connect API are also available in the Indicators block and uses the same syntax. For example, when filtering IPs on risk score, the following key-value pair is present in the request query string: riskScore=(70, ). To use the same filter in the block, simply add the key-value pair as a JSON key-value pair instead: "riskScore": "(70, )" For convenience, there's one extra filter that is not exposed in the Connect API: the riskRules filter. This takes a comma-separated list of risk rule names and filters out any indicator that contains one of the risk rules.
        - `attributes` object: A JSON object used as an advanced alternative to filters. Filters on Raw API attributes. Should only be used when constructing complex logic that is not possible to express in regular filters.
        - `order_by` string: Field to order results by
        - `order_direction` 'desc' | 'asc'
      - object: Enrich blocks adds Recorded Future risk information to arbitrary records of indicators such as IPs, hashes, etc. It comes with filtering capabilities, making it possible to discard indicators with low risk scores or indicators that haven't triggered some risk rule. If no filters are provided, all input indicators are included in the resulting record set. If filters are provided, only indicators which pass the filter conditions are included.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'enrich', required: The type of block
        - `description` string
        - `entity_type` 'ip' | 'vulnerability' | 'hash' | 'domain' | 'url' | 'company', required
        - `fields` string[]
        - `limit` integer: Maximum number of entities to create records for.
        - `filters` object: A JSON object containing filtering parameters. The filtering is powered by the same filtering logic that the Connect API uses. This means that any of the filtering options for the different indicator types that are available in the Connect API are also available in the Indicators block and uses the same syntax. For example, when filtering IPs on risk score, the following key-value pair is present in the request query string: riskScore=(70, ). To use the same filter in the block, simply add the key-value pair as a JSON key-value pair instead: "riskScore": "(70, )" For convenience, there's one extra filter that is not exposed in the Connect API: the riskRules filter. This takes a comma-separated list of risk rule names and filters out any indicator that contains one of the risk rules.
        - `attributes` object: A JSON object used as an advanced alternative to filters. Filters on Raw API attributes. Should only be used when constructing complex logic that is not possible to express in regular filters.
        - `key` string, required: The field key in the Flow record to apply operation on
        - `key_type` 'name' | 'id': If the key is an entity name, or id, which represents a Recorded Future entity ID.
        - `sources` object[]
          - `source` string: Block id to get data from
          - `name` 'in'
      - object: Enables fetching data using term queries for references, entities, enriched entities, etc. in Fusion. This should only be used in advanced use cases. See TQL documentation for more information.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'query', required: The type of block
        - `description` string
        - `limit` integer: Maximum number of references or entities to fetch.
        - `query` object, required: JSON object representing a terms query
      - object: Fetches a list of Analyst Notes created by the user or the Insikt Group based on a set of search filters.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'notes', required: The type of block
        - `description` string
        - `term` object: Advanced search query using TQL. See TQL documentation for more information.
        - `limit` integer
        - `tagged_text` boolean: If the note text fragment should include entity tags
        - `filters` object: A JSON object containing filtering parameters.
          - `author` string: Note author as RF ID
          - `title` string: Filters notes based on some word or phrase in the document title.
          - `entity` string: Filters notes related to some entity (as RF ID).
          - `topic` string: What topic (as RF ID) the note should have.
          - `published` string: When the note was published. Uses the Recorded Future "Time Query" language for specifying absolute or relative ranges. Examples: * lastweek * -10d * 2018-03-13T00:00:00 -- 2018-03-15T00:00:00
          - `note_category` 'userNote' | 'recordedFutureNote'
      - object: Pulls data from TAXII 1.x servers using TAXII Poll requests.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'taxii', required: The type of block
        - `description` string
        - `url` string, required
        - `headers` object: A JSON object holding headers required for the request.
        - `certificate` object: JSON object for client certificate TLS authentication. This will set up a TLS context with the given key file and certificate chain file.
          - `key` string, required: File API path to a PKCS#8 private key in PEM format.
          - `chain` string, required: File API path to a X.509 certificate chain in PEM format.
          - `trust` string: File API path to a X.509 certificate in PEM format that should be added to the store of trusted certificates.
        - `auth` object: Properties for Basic Authentication.
          - `username` string, required
          - `password` string, required
        - `version` string: TAXII protocol version to use. Defaults to 1.1. Adjust if needed by the server.
        - `collection` string, required: The collection to download.
        - `subscription` string: TAXII subscription ID to pull data for.
        - `date_range` string: Date range for the requested records. Uses the Recorded Future "Time Query" language for specifying absolute or relative ranges. Examples: * lastweek * -10d * 2018-03-13T00:00:00 -- 2018-03-15T00:00:00
        - `format` XMLFormatter: The XML formatter handles arbitrary XML input and output
          - `type` 'xml', required: The type of formatter to use
          - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
          - `base` string, required: A slash-separated path to where the XML collection that should be converted to flow records is located.
          - `mappings` object, required: JSON object that maps flow record keys to XPath selectors. These are relative to the base path.
      - object: Pulls data from TAXII 2.1 servers.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'taxii', required: The type of block
        - `description` string
        - `url` string, required
        - `headers` object: A JSON object holding headers required for the request.
        - `certificate` object: JSON object for client certificate TLS authentication. This will set up a TLS context with the given key file and certificate chain file.
          - `key` string, required: File API path to a PKCS#8 private key in PEM format.
          - `chain` string, required: File API path to a X.509 certificate chain in PEM format.
          - `trust` string: File API path to a X.509 certificate in PEM format that should be added to the store of trusted certificates.
        - `auth` object: Properties for Basic Authentication.
          - `username` string, required
          - `password` string, required
        - `collection` string, required: The collection to download. Should be an UUID or alias.
        - `match` string: A JSON object for filters as defined in the TAXII specification.
        - `added_after` string: Date range for the requested records. Uses the Recorded Future "Time Query" language for specifying absolute or relative ranges. Examples: * lastweek * -10d * 2018-03-13T00:00:00 -- 2018-03-15T00:00:00
        - `limit` integer: Limit the result to a maximum number of objects.
        - `format` JSONFormatter: The JSON formatter handles JSON input and output. Currently, it is not able to stream JSON input records. This means that the worker processing the flow will read the full JSON document into memory before emitting records, making this input unsuitable for very large inputs. JSON input must be an array (list) of objects (dicts). It is possible to set the path parameter to point out where to find the input array.
          - `type` 'json', required: The type of formatter to use
          - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
          - `pretty` boolean: Boolean value for if the JSON output should be prettified, i.e. written in a more readable manner.
          - `path` string: A JSONPath to where the array of objects can be found. See the specification at https://goessner.net/articles/JsonPath/ for information on how to construct a JSONPath transform that suits your needs.
      - object: This block reads records from the Payment Card Fraud API. For full documentation about which properties are available see the Payment Card Fraud API documentation.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'paymentcardfraudsource', required: The type of block
        - `description` string
        - `harvested_between` object: An object describing a date range. The lower bound (gt/gtl) must be before the upper bound (lt/lte). The date format is a valid ISO 8601 format. The parameters harvestedBetween and harvestedPriorHoursFromNow are mutually exclusive.
          - `gt` string, date-string: Harvested date greater than
          - `gte` string, date-string: Harvested date greater than or equal to
          - `lt` string, date-string: Harvested date less than
          - `lte` string, date-string: Harvested date less than or equal to
        - `harvested_prior_hours_from_now` integer: This will be mapped to a harvested date range, see harvested_between where the lower bound is harvested_prior_hours_from_now and the upper bound is now (exclusive). The parameters harvested_between and harvested_prior_hours_from_now are mutually exclusive.
        - `data_source` 'PartialDataCardPresent' | 'PartialDataCardNotPresent' | 'FullDataCardPresent' | 'FullDataCardNotPresent' | 'magecart' | 'tester': The filed explain what data you would like to fetch from Fraud module
      - object: The Union Block takes the union of all its inputs and merges any record that occurs in more than one of the inputs.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'union', required: The type of block
        - `description` string
        - `key` string: The field key in the Flow record to apply operation on
        - `strategy` 'first' | 'list': Merge strategy for non-key columns when combining two records that have equal keys.
        - `sources` object[]
          - `source` string: Block id to get data from
          - `name` 'in'
      - object: Passes entities from flow records through an extension. The output record contains the extension response data with an additional entity field containing the entity data used when calling the extension.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'extension', required: The type of block
        - `description` string
        - `extension` string, required: Which extension (from the Extension API) to invoke.
        - `entity_type` 'ip' | 'vulnerability' | 'hash' | 'domain' | 'url' | 'company'
        - `key` string, required: The field key in the Flow record to apply operation on
      - object: Provides functionality for conditionally replacing data in a record, or substitute using a regular expression.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'substitution', required: The type of block
        - `description` string
        - `keep` boolean: If key/values should be kept after transform
        - `version` integer: Decides which version of the substitution algorithm to use
        - `mappings` object[], required
          - `key` string: The field key in the Flow record to apply operation on
          - `path` string: A JSONPath to where the array of objects can be found. See the specification at https://goessner.net/articles/JsonPath/ for information on how to construct a JSONPath transform that suits your needs.
          - `type` 'regex' | 'cond': Substitution type
          - `options` union
            - RegexSubstitutionOptions: Regex substitution type options
              - …
            - ConditionSubstitutionOptions: Condition substitution type options
              - …
        - `sources` object[]
          - `source` string: Block id to get data from
          - `name` 'in'
      - object: Sometimes it's desirable to enrich data that is contained in list structures below some field inside a record. One such example would be when extracting related entities for indicators, which is an n * m relationship. The Flatten Block expands a list structure at some column into a set of Flow records.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'flatten', required: The type of block
        - `description` string
        - `key` string: The field key in the Flow record to apply operation on
        - `output_key` string: The key name to use in the resulting output.
        - `sources` object[]
          - `source` string: Block id to get data from
          - `name` 'in'
      - object: Writes records to a file in the File API. They require a formatter configuration in order to serialize the records into a plain text format.
        - `id` string, required: Block id, used to chain blocks together and create the flow graph
        - `type` 'fileapisink', required: The type of block
        - `description` string
        - `path` string, required: The path in the File API where the file should be stored.
        - `gzip` boolean: Flag that indicates if the file should be compressed with GZip compression.
        - `format` union, required: An object containing format parameters.
          - CVSFormatter: The CSV formatter handles line-separated records where the data for each record is delimited by some character.
            - `type` 'csv', required: The type of formatter to use
            - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
            - `contains_headers` boolean: Boolean value for if the input file contains headers or if the output file should use headers.
            - `headers` string[]
            - `header_mapping` object: Used only in inputs. A JSON object containing a mapping of input CSV headers (string) to keys (string) to be used in the resulting records.
            - `header_filter` string[]: Used only in inputs. An array of headers to include in the resulting records.
            - `separator` string: What separator character to use. Defaults to ",".
            - `line_break` string: What line break character sequence to use. Defaults to "\n" (ASCII new-line character).
            - `always_quote` boolean: True if output string values should always be quoted. Required for some CSV processors. Note that only strings are quoted using this parameter. Other data, like integers and floating-point numbers may not be quoted.
            - `escape_quotes` boolean: True if quotes should be escaped using the character provided in escape_char
            - `escape_char` boolean: Character to escape quotes with. The default is to escape quotes with quote characters ("double-quote escaping"). Other common characters are backslashes
            - `strict_quoting` boolean: True if in-depth analysis should be done when the writer decides when to quote. Has a performance impact.
            - `disable_quotes` boolean: Disables any quoting of columns if set to True.
          - JSONFormatter: The JSON formatter handles JSON input and output. Currently, it is not able to stream JSON input records. This means that the worker processing the flow will read the full JSON document into memory before emitting records, making this input unsuitable for very large inputs. JSON input must be an array (list) of objects (dicts). It is possible to set the path parameter to point out where to find the input array.
            - `type` 'json', required: The type of formatter to use
            - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
            - `pretty` boolean: Boolean value for if the JSON output should be prettified, i.e. written in a more readable manner.
            - `path` string: A JSONPath to where the array of objects can be found. See the specification at https://goessner.net/articles/JsonPath/ for information on how to construct a JSONPath transform that suits your needs.
          - XMLFormatter: The XML formatter handles arbitrary XML input and output
            - `type` 'xml', required: The type of formatter to use
            - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
            - `base` string, required: A slash-separated path to where the XML collection that should be converted to flow records is located.
            - `mappings` object, required: JSON object that maps flow record keys to XPath selectors. These are relative to the base path.
          - TempleFormatter: When dealing with formats that are hard to generalize, it's possible to create a template that decides how the output should be formatted. This is our default way of rendering XML output, and may be used for creating XML based formats such as STIX, among others. The templating engine used is Jinja.
            - `type` 'template', required: The type of formatter to use
            - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
            - `header` string: Header template string.
            - `header_file` string: Header template file in the File API.
            - `record` string: Record template string. One of record or record_file must be set.
            - `record_file` string: Record template file in the File API. One of record or record_file must be set.
            - `footer` string: Footer template string.
            - `footer_file` string: Footer template file in the File API.
          - RawFormatter: A simple formatter that will for each record take the value of a column and print it. It will not add newlines, if that is needed it must be part of the column value.
            - `type` 'raw', required: The type of formatter to use
            - `iso_timestamps` boolean: Flag to control if timestamps should be written as UTC timestamps in ISO 8601 format.
            - `column` string, required: The column to read the value from.
        - `file` object: A JSON object containing file name parameters. If this parameter is not present then the parameter ‘path’ will be used, expecting to contain both the folder path and file name.
          - `name` string, required: The name of the file. It assumes that the path parameter only contains a path/folder name. If the path does not contain a trailing ‘/’, it will then be added when path and name are concatenated.
          - `date_stamp_pattern` string: The pattern syntax is mostly compatible with java.text.SimpleDateFormat, see https://www.joda.org/joda-time///apidocs/org/joda/time/format/DateTimeFormat.html
          - `date_stamp_delimiter` string: A string that will be used as a delimiter between the file and the date.
          - `date_prefix` boolean: Set to true if date should be prefixed in the file name. Set to false to suffix the date in the file name.
  - `last_run` string, date-time
  - `schedule` string
  - `use_case` FlowUseCase
    - `name` string, required: Short name of the use case associated with the flow.
    - `description` string: A longer description of this use case.
    - `intelligence_goal` string: Name of intelligence goal associated with the use case.
    - `tags` string[]: A list of tags associated with the use case.
    - `correlations` object: Information about the suggested correlation sources and actions
      - `sources` string
      - `actions` string
    - `entity_type` 'ip' | 'vulnerability' | 'hash' | 'domain' | 'url' | 'company'
  - `version` integer, required: Flow version, essentially counts the number of updates made to the flow configuration.
  - `contact_info` object
    - `team` string: The name of the Recorded Future team owning the flow
    - `email` string: Email to the owner of the flow
    - `slack_channel` string: Name of Slack channel to contact the Recorded Future team owning the flow
  - `tag` 'internal'

---

[API](https://skmtc.dev/recordedfuture/apis/fusion-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/fusion-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/fusion-api/revisions/15e440739cf0?raw)