Use Cloudflare in Sim to manage zones, DNS, cache, WAF rules, rate limits, and Zero Trust Access. Manage Worker routes and tunnels, configure R2 CORS and lifecycle rules, and read certificates, analytics, and Worker settings.

Create a Cloudflare API token with the read or write permissions for the resources you use. Zone operations need a zone ID; Access, R2, Workers scripts, and tunnels need an account ID.

For structured inputs, enter JSON or connect an upstream block output. DNS record data supports record-specific fields such as SRV priority, weight, port, and target. Cache purge files also accept JSON entries with a URL and cache-key headers. DNS tags and Access application tags and identity-provider IDs also accept JSON string arrays; use [] to clear these lists during an update.

Read a resource before replacing it and resend the fields you want to keep. Access applications and policies, rules, tunnel configuration, R2 policies, and Worker routes have replacement semantics. Rulesets operations that expose dry_run can validate a request without saving it; successful validation may return empty resource fields. List operations return one page; use page numbers or the returned cursor to continue.

Use the block

Manage Cloudflare DNS, zones, SSL, cache, and analytics. Configure WAF rulesets and rate limiting; administer Access applications, policies, groups, and service tokens; manage Worker routes and tunnels; and configure R2 buckets, CORS, and lifecycle rules.

Actions

Cloudflare Create Access Application

Creates a Cloudflare Access (Zero Trust) application that puts an identity check in front of a hostname. Until at least one policy is attached the application denies everyone, so pair this with "Create Access Policy". Requires an API token with Account Access: Apps and Policies Edit.

Inputs and outputs

Input

Parameter	Type	Required	Description
destinations	json	No	JSON array. List of destinations secured by Access. This supersedes self_hosted_domains to allow for more flexibility in defining different types of domains. If destinations are provided, then self_hosted_domains will be ignored. Fields: overrides, type, uri, cidr, hostname, l4_protocol, port_range, vnet_id, mcp_server_id, worker_id.
oauth_configuration	json	No	JSON object. Required for end_user applications. Beta: Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta. Fields: dynamic_client_registration, enabled, grant.
self_hosted_domains	json	No	JSON array. List of public domains that Access will secure. This field is deprecated in favor of destinations and will be supported until November 21, 2025. If destinations are provided, then self_hosted_domains will be ignored.
user_populations	json	No	JSON array. Required for end_user applications. The single user population associated with this application.
allow_authenticate_via_warp	boolean	No	When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.
allow_iframe	boolean	No	Enables loading application content in an iFrame.
cors_headers	json	No	JSON object. cors headers Fields: allow_all_headers, allow_all_methods, allow_all_origins, allow_credentials, allowed_headers, allowed_methods, allowed_origins, max_age.
custom_non_identity_deny_url	string	No	The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.
custom_pages	json	No	JSON array. The custom pages that will be displayed when applicable for this application
eager_redirect_cookie_setting	boolean	No	Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
enable_binding_cookie	boolean	No	Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
http_only_cookie_attribute	boolean	No	Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
mfa_config	json	No	JSON object. Configures multi-factor authentication (MFA) settings. Fields: allowed_authenticators, mfa_disabled, session_duration.
options_preflight_bypass	boolean	No	Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
path_cookie_attribute	boolean	No	Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default
read_service_tokens_from_header	string	No	Allows matching Access Service Tokens passed HTTP in a single header with this name. This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers. The header value will be interpreted as a json object similar to: { "cf-access-client-id": "<CLIENT_ID>", "cf-access-client-secret": "<CLIENT_SECRET>" }
same_site_cookie_attribute	string	No	Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
scim_config	json	No	JSON object. Configuration for provisioning to this application via SCIM. This is currently in closed beta. Fields: authentication, deactivate_on_delete, enabled, idp_uid, mappings, remote_uri.
service_auth_401_redirect	boolean	No	Returns a 401 status code when the request is blocked by a Service Auth policy.
skip_interstitial	boolean	No	Enables automatic authentication through cloudflared.
use_clientless_isolation_app_launcher_url	boolean	No	Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.
app_launcher_logo_url	string	No	The image URL of the logo shown in the App Launcher header.
bg_color	string	No	The background color of the App Launcher page.
footer_links	json	No	JSON array. The links in the App Launcher footer. Fields: name, url.
header_bg_color	string	No	The background color of the App Launcher header.
landing_page_design	json	No	JSON object. The design of the App Launcher landing page shown to users when they log in. Fields: button_color, button_text_color, image_url, message, title.
skip_app_launcher_login_page	boolean	No	Determines when to skip the App Launcher landing page.
accountId	string	Yes	The Cloudflare account ID. Access applications are account-scoped
type	string	Yes	Application type: self_hosted, end_user, saas, ssh, vnc, app_launcher, warp, biso, bookmark, infrastructure, rdp, mcp, mcp_portal, or proxy_endpoint. dash_sso has no request variant and cannot be created through the API
domain	string	No	The primary hostname and path secured by Access, e.g. internal.example.com or example.com/admin. Required for the self_hosted, ssh, vnc, and rdp types; optional for bookmark and mcp_portal; read-only for app_launcher, warp, biso, and proxy_endpoint; and absent from the saas, infrastructure, and mcp variants
name	string	No	Friendly name shown in the dashboard and App Launcher
sessionDuration	string	No	How long an Access session stays valid, e.g. 24h or 30m
allowedIdps	string	No	Comma-separated identity provider IDs users may authenticate with. Leave empty to allow all configured providers
appLauncherVisible	boolean	No	Whether the application is shown in the App Launcher
autoRedirectToIdentity	boolean	No	Whether users skip the identity provider picker
customDenyMessage	string	No	Message shown to users who are denied access
customDenyUrl	string	No	URL denied users are redirected to
logoUrl	string	No	Logo image URL shown in the dashboard and App Launcher
tags	string	No	Comma-separated tag names categorizing the application
policies	string	No	JSON array of policies to attach. Entries may be reusable policy IDs or inline policy objects, e.g. ["<POLICY_ID>"]
saasApp	string	No	JSON SaaS configuration, required for the saas type and rejected on every other type. SAML, e.g. { "auth_type": "saml", "consumer_service_url": "https://example.com/acs", "sp_entity_id": "https://example.com" }; OIDC, e.g. { "auth_type": "oidc", "client_id": "...", "redirect_uris": [ "https://example.com/callback" ] }
targetCriteria	string	No	JSON array of infrastructure target criteria, required for the infrastructure and rdp types and rejected on every other type, e.g. [{"port":22,"protocol":"SSH","target_attributes":{"hostname":["production"]}}]
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
aud	string	Audience tag.
created_at	string	created at
id	string	UUID.
updated_at	string	updated at
allowed_idps	array	The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
destinations	array	List of destinations secured by Access. This supersedes self_hosted_domains to allow for more flexibility in defining different types of domains. If destinations are provided, then self_hosted_domains will be ignored.
↳ overrides	array	Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations.
↳ behavior	string	The behavior to apply to matching requests. Values: public.
↳ path_pattern	string	The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard.
↳ type	string	type Values: public, private, via_mcp_server_portal, worker, preview_worker, all_workers, all_preview_workers.
↳ uri	string	The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
↳ cidr	string	The CIDR range of the destination. Single IPs will be computed as /32.
↳ hostname	string	The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
↳ l4_protocol	string	The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match. Values: tcp, udp.
↳ port_range	string	The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.
↳ vnet_id	string	The VNET ID to match the destination. When omitted, all VNETs will match.
↳ mcp_server_id	string	The MCP server id configured in ai-controls.
↳ worker_id	string	The ID of the Cloudflare Worker whose preview deployments to protect with Access.
domain	string	The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.
name	string	The name of the application.
oauth_configuration	json	Beta: Optional configuration for managing an OAuth authorization flow controlled by Access.
↳ dynamic_client_registration	json	Settings for OAuth dynamic client registration.
↳ allow_any_on_localhost	boolean	Allows any client with redirect URIs on localhost.
↳ allow_any_on_loopback	boolean	Allows any client with redirect URIs on 127.0.0.1.
↳ allowed_uris	array	The URIs that are allowed as redirect URIs for dynamically registered clients. HTTP and HTTPS paths may end in /* to match all sub-paths. Custom-scheme URIs must be explicitly configured and match exactly.
↳ enabled	boolean	Whether dynamic client registration is enabled.
↳ enabled	boolean	Whether the OAuth configuration is enabled for this application. When set to false, Access will not handle OAuth for this application. Defaults to true if omitted. Values: True.
↳ grant	json	Settings for OAuth grant behavior.
↳ access_token_lifetime	string	The lifetime of the access token. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h.
↳ session_duration	string	The duration of the OAuth session. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h.
self_hosted_domains	array	List of public domains that Access will secure. This field is deprecated in favor of destinations and will be supported until November 21, 2025. If destinations are provided, then self_hosted_domains will be ignored.
type	string	The application type. Values: end_user, self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, dash_sso, infrastructure, rdp, mcp, mcp_portal, proxy_endpoint.
user_populations	array	The single user population associated with this application.
allow_authenticate_via_warp	boolean	When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.
allow_iframe	boolean	Enables loading application content in an iFrame.
app_launcher_visible	boolean	Displays the application in the App Launcher.
auto_redirect_to_identity	boolean	When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
cors_headers	json	cors headers
↳ allow_all_headers	boolean	Allows all HTTP request headers.
↳ allow_all_methods	boolean	Allows all HTTP request methods.
↳ allow_all_origins	boolean	Allows all origins.
↳ allow_credentials	boolean	When set to true, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.
↳ allowed_headers	array	Allowed HTTP request headers.
↳ allowed_methods	array	Allowed HTTP request methods.
↳ allowed_origins	array	Allowed origins.
↳ max_age	number	The maximum number of seconds the results of a preflight request can be cached.
custom_deny_message	string	The custom error message shown to a user when they are denied access to the application.
custom_deny_url	string	The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.
custom_non_identity_deny_url	string	The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.
custom_pages	array	The custom pages that will be displayed when applicable for this application
eager_redirect_cookie_setting	boolean	Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
enable_binding_cookie	boolean	Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
http_only_cookie_attribute	boolean	Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
logo_url	string	The image URL for the logo shown in the App Launcher dashboard.
mfa_config	json	Configures multi-factor authentication (MFA) settings.
↳ allowed_authenticators	array	Lists the MFA methods that users can authenticate with.
↳ mfa_disabled	boolean	Indicates whether to disable MFA for this resource. This option is available at the application and policy level.
↳ session_duration	string	Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
options_preflight_bypass	boolean	Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
path_cookie_attribute	boolean	Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default
read_service_tokens_from_header	string	Allows matching Access Service Tokens passed HTTP in a single header with this name.
same_site_cookie_attribute	string	Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
scim_config	json	Configuration for provisioning to this application via SCIM. This is currently in closed beta.
↳ authentication	json	Multiple authentication schemes
↳ password	string	Password used to authenticate with the remote SCIM service.
↳ scheme	string	The authentication scheme to use when making SCIM requests to this application. Values: httpbasic, oauthbearertoken, oauth2, access_service_token.
↳ user	string	User name used to authenticate with the remote SCIM service.
↳ token	string	Token used to authenticate with the remote SCIM service.
↳ authorization_url	string	URL used to generate the auth code used during token generation.
↳ client_id	string	Client ID of the Access service token used to authenticate with the remote service.
↳ client_secret	string	Client secret of the Access service token used to authenticate with the remote service.
↳ scopes	array	The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.
↳ token_url	string	URL used to generate the token used to authenticate with the remote SCIM service.
↳ deactivate_on_delete	boolean	If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.
↳ enabled	boolean	Whether SCIM provisioning is turned on for this application.
↳ idp_uid	string	The UID of the IdP to use as the source for SCIM resources to provision to this application.
↳ mappings	array	A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
↳ enabled	boolean	Whether or not this mapping is enabled.
↳ filter	string	A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.
↳ operations	json	Whether or not this mapping applies to creates, updates, or deletes.
↳ create	boolean	Whether or not this mapping applies to create (POST) operations.
↳ delete	boolean	Whether or not this mapping applies to DELETE operations.
↳ update	boolean	Whether or not this mapping applies to update (PATCH/PUT) operations.
↳ schema	string	Which SCIM resource type this mapping applies to.
↳ strictness	string	The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. Values: strict, passthrough.
↳ transform_jsonata	string	A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.
↳ remote_uri	string	The base URI for the application's SCIM-compatible API.
service_auth_401_redirect	boolean	Returns a 401 status code when the request is blocked by a Service Auth policy.
session_duration	string	The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
skip_interstitial	boolean	Enables automatic authentication through cloudflared.
tags	array	The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.
use_clientless_isolation_app_launcher_url	boolean	Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.
policies	array	policies
↳ approval_groups	array	Administrators who can approve a temporary authentication request.
↳ approvals_needed	number	The number of approvals needed to obtain access.
↳ email_addresses	array	A list of emails that can approve the access request.
↳ email_list_uuid	string	The UUID of an re-usable email list.
↳ approval_required	boolean	Requires the user to request access from an administrator at the start of each session.
↳ connection_rules	json	The rules that define how users may connect to targets secured by your application.
↳ rdp	json	The RDP-specific rules that define clipboard behavior for RDP connections.
↳ allowed_clipboard_local_to_remote_formats	array	Clipboard formats allowed when copying from local machine to remote RDP session.
↳ allowed_clipboard_remote_to_local_formats	array	Clipboard formats allowed when copying from remote RDP session to local machine.
↳ isolation_required	boolean	Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
↳ mfa_config	json	Configures multi-factor authentication (MFA) settings.
↳ allowed_authenticators	array	Lists the MFA methods that users can authenticate with.
↳ mfa_disabled	boolean	Indicates whether to disable MFA for this resource. This option is available at the application and policy level.
↳ session_duration	string	Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
↳ purpose_justification_prompt	string	A custom message that will appear on the purpose justification screen.
↳ purpose_justification_required	boolean	Require users to enter a justification when they log in to the application.
↳ session_duration	string	The amount of time that tokens issued for the application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
↳ created_at	string	created at
↳ decision	string	The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Values: allow, deny, non_identity, bypass.
↳ exclude	array	Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ id	string	The UUID of the policy
↳ include	array	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ name	string	The name of the Access policy.
↳ require	array	Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ updated_at	string	updated at
↳ account_id	string	Identifier.
↳ precedence	number	The order of execution for this policy. Must be unique for each policy within an app.
saas_app	json	saas app
↳ auth_type	string	Identifier of the authentication protocol used for the saas app. Required for OIDC. Values: saml, oidc.
↳ consumer_service_url	string	The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.
↳ created_at	string	created at
↳ custom_attributes	array	custom attributes
↳ friendly_name	string	The SAML FriendlyName of the attribute.
↳ name	string	The name of the attribute.
↳ name_format	string	A globally unique name for an identity or service provider. Values: urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified, urn:oasis:names:tc:SAML:2.0:attrname-format:basic, urn:oasis:names:tc:SAML:2.0:attrname-format:uri.
↳ required	boolean	If the attribute is required when building a SAML assertion.
↳ source	json	source
↳ name	string	The name of the IdP attribute.
↳ name_by_idp	array	A mapping from IdP ID to attribute name.
↳ idp_id	string	The UID of the IdP.
↳ source_name	string	The name of the IdP provided attribute.
↳ default_relay_state	string	The URL that the user will be redirected to after a successful login for IDP initiated logins.
↳ idp_entity_id	string	The unique identifier for your SaaS application.
↳ name_id_format	string	The format of the name identifier sent to the SaaS application. Values: id, email.
↳ name_id_transform_jsonata	string	A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting.
↳ public_key	string	The Access public certificate that will be used to verify your identity.
↳ saml_attribute_transform_jsonata	string	A [JSONata] (https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response.
↳ sp_entity_id	string	A globally unique name for an identity or service provider.
↳ sso_endpoint	string	The endpoint where your SaaS application will send login requests.
↳ updated_at	string	updated at
↳ access_token_lifetime	string	The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.
↳ allow_pkce_without_client_secret	boolean	If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.
↳ app_launcher_url	string	The URL where this applications tile redirects users
↳ client_id	string	The application client id
↳ client_secret	string	The application client secret, only returned on POST request.
↳ custom_claims	array	custom claims
↳ name	string	The name of the claim.
↳ required	boolean	If the claim is required when building an OIDC token.
↳ scope	string	The scope of the claim. Values: groups, profile, email, openid.
↳ source	json	source
↳ name	string	The name of the IdP claim.
↳ name_by_idp	json	A mapping from IdP ID to claim name.
↳ grant_types	array	The OIDC flows supported by this application
↳ group_filter_regex	string	A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
↳ hybrid_and_implicit_options	json	hybrid and implicit options
↳ return_access_token_from_authorization_endpoint	boolean	If an Access Token should be returned from the OIDC Authorization endpoint
↳ return_id_token_from_authorization_endpoint	boolean	If an ID Token should be returned from the OIDC Authorization endpoint
↳ redirect_uris	array	The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens
↳ refresh_token_options	json	refresh token options
↳ lifetime	string	How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.
↳ scopes	array	Define the user information shared with access, "offline_access" scope will be automatically enabled if refresh tokens are enabled
app_launcher_logo_url	string	The image URL of the logo shown in the App Launcher header.
bg_color	string	The background color of the App Launcher page.
footer_links	array	The links in the App Launcher footer.
↳ name	string	The hypertext in the footer link.
↳ url	string	the hyperlink in the footer link.
header_bg_color	string	The background color of the App Launcher header.
landing_page_design	json	The design of the App Launcher landing page shown to users when they log in.
↳ button_color	string	The background color of the log in button on the landing page.
↳ button_text_color	string	The color of the text in the log in button on the landing page.
↳ image_url	string	The URL of the image shown on the landing page.
↳ message	string	The message shown on the landing page.
↳ title	string	The title shown on the landing page.
skip_app_launcher_login_page	boolean	Determines when to skip the App Launcher landing page.
target_criteria	array	target criteria
↳ exclude	json	Selectors within an include, require, or exclude rule. At least one of target_attributes or tags must be non-empty.
↳ tags	json	Map of target tag keys to values. Values within a key are OR'd.
↳ target_attributes	json	Hostname selector map for include, require, or exclude rules. This is distinct from the deprecated top-level target_attributes field and only supports the hostname key.
↳ hostname	array	hostname
↳ include	json	Selectors within an include, require, or exclude rule. At least one of target_attributes or tags must be non-empty.
↳ tags	json	Map of target tag keys to values. Values within a key are OR'd.
↳ target_attributes	json	Hostname selector map for include, require, or exclude rules. This is distinct from the deprecated top-level target_attributes field and only supports the hostname key.
↳ hostname	array	hostname
↳ port	number	The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.
↳ require	json	Selectors within an include, require, or exclude rule. At least one of target_attributes or tags must be non-empty.
↳ tags	json	Map of target tag keys to values. Values within a key are OR'd.
↳ target_attributes	json	Hostname selector map for include, require, or exclude rules. This is distinct from the deprecated top-level target_attributes field and only supports the hostname key.
↳ hostname	array	hostname
↳ target_attributes	json	Contains a map of target attribute keys to target attribute values.
↳ protocol	string	The communication protocol your application secures. Values: RDP.

Cloudflare Create Access Group

Creates a new Access group.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
apiKey	string	Yes	Cloudflare API token
exclude	json	No	JSON array. Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules. Fields: group, any_valid_service_token, auth_context, auth_method, azureAD, certificate, common_name, geo, device_posture, email_domain, email_list, email, everyone, external_evaluation, github-organization, gsuite, login_method, ip_list, ip, okta, saml, oidc, service_token, linked_app_token, user_risk_score, cloudflare_account_member.
include	json	Yes	JSON array. Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. Fields: group, any_valid_service_token, auth_context, auth_method, azureAD, certificate, common_name, geo, device_posture, email_domain, email_list, email, everyone, external_evaluation, github-organization, gsuite, login_method, ip_list, ip, okta, saml, oidc, service_token, linked_app_token, user_risk_score, cloudflare_account_member.
is_default	boolean	No	Whether this is the default group
name	string	Yes	The name of the Access group.
require	json	No	JSON array. Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules. Fields: group, any_valid_service_token, auth_context, auth_method, azureAD, certificate, common_name, geo, device_posture, email_domain, email_list, email, everyone, external_evaluation, github-organization, gsuite, login_method, ip_list, ip, okta, saml, oidc, service_token, linked_app_token, user_risk_score, cloudflare_account_member.

Output

Parameter	Type	Description
created_at	string	created at
exclude	array	Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
id	string	UUID.
include	array	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
is_default	array	Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
name	string	The name of the Access group.
require	array	Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
updated_at	string	updated at

Cloudflare Create Access Policy

Creates a Cloudflare Access (Zero Trust) policy on an application, deciding who may reach it. A policy takes effect on live traffic as soon as it is created — an allow policy with a broad include rule grants access immediately. Requires an API token with Account Access: Apps and Policies Edit.

Inputs and outputs

Input

Parameter	Type	Required	Description
approval_groups	json	No	JSON array. Administrators who can approve a temporary authentication request. Fields: approvals_needed, email_addresses, email_list_uuid.
connection_rules	json	No	JSON object. The rules that define how users may connect to the targets secured by your application. Fields: rdp, ssh.
mfa_config	json	No	JSON object. Configures multi-factor authentication (MFA) settings for infrastructure applications. Fields: allowed_authenticators, mfa_disabled, session_duration.
accountId	string	Yes	The Cloudflare account ID. Access applications are account-scoped
appId	string	Yes	The Access application ID to attach the policy to
name	string	Yes	Name of the policy
decision	string	Yes	What the policy does when it matches: allow, deny, non_identity (service tokens and other non-identity rules), or bypass (skip Access entirely)
include	string	Yes	JSON array of Access rules evaluated with OR logic — matching any one selects the policy. Example: [{"email":{"email":"user@example.com"}}] or [{"email_domain":{"domain":"example.com"}}]
exclude	string	No	JSON array of Access rules evaluated with NOT logic — matching any one rejects the request
require	string	No	JSON array of Access rules evaluated with AND logic — all of them must match
precedence	number	No	Evaluation order of the policy within the application
sessionDuration	string	No	How long a session granted by this policy stays valid, e.g. 24h. Leave it unset on a policy attached to an infrastructure-typed application — Cloudflare rejects those with error 12130
approvalRequired	boolean	No	Whether an approver must grant each access request
isolationRequired	boolean	No	Whether the session must run in a remote isolated browser
purposeJustificationRequired	boolean	No	Whether users must state a reason for access
purposeJustificationPrompt	string	No	Prompt shown when a justification is required
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
approval_groups	array	Administrators who can approve a temporary authentication request.
↳ approvals_needed	number	The number of approvals needed to obtain access.
↳ email_addresses	array	A list of emails that can approve the access request.
↳ email_list_uuid	string	The UUID of an re-usable email list.
approval_required	boolean	Requires the user to request access from an administrator at the start of each session.
connection_rules	json	The rules that define how users may connect to the targets secured by your application.
↳ rdp	json	The RDP-specific rules that define clipboard behavior for RDP connections.
↳ allowed_clipboard_local_to_remote_formats	array	Clipboard formats allowed when copying from local machine to remote RDP session.
↳ allowed_clipboard_remote_to_local_formats	array	Clipboard formats allowed when copying from remote RDP session to local machine.
↳ ssh	json	The SSH-specific rules that define how users may connect to the targets secured by your application.
↳ allow_email_alias	boolean	Enables using Identity Provider email alias as SSH username.
↳ usernames	array	Contains the Unix usernames that may be used when connecting over SSH.
isolation_required	boolean	Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
mfa_config	json	Configures multi-factor authentication (MFA) settings for infrastructure applications.
↳ allowed_authenticators	array	Lists the MFA methods that users can authenticate with. For infrastructure applications, supported values are piv_key and ssh_fido2_key.
↳ mfa_disabled	boolean	Indicates whether to disable MFA for this resource. This option is available at the application and policy level.
↳ session_duration	string	Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples: 5m or 24h.
purpose_justification_prompt	string	A custom message that will appear on the purpose justification screen.
purpose_justification_required	boolean	Require users to enter a justification when they log in to the application.
session_duration	string	The amount of time that tokens issued for the application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
created_at	string	created at
decision	string	The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Values: allow, deny, non_identity, bypass.
exclude	array	Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
id	string	The UUID of the policy
include	array	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
name	string	The name of the Access policy.
require	array	Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
updated_at	string	updated at
account_id	string	Identifier.
precedence	number	The order of execution for this policy. Must be unique for each policy within an app.

Cloudflare Create Access Service Token

Creates a Cloudflare Access (Zero Trust) service token so a machine can authenticate to Access-protected applications. This is the only response that ever contains the client secret — Cloudflare will not return it again, so capture it in the same run. Requires an API token with Account Access: Service Tokens Edit.

Inputs and outputs

Input

Parameter	Type	Required	Description
client_secret_version	number	No	A version number identifying the current client_secret associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by previous_client_secret_expires_at. If the service token was reported as leaked, previous_client_secret_expires_at is not required, may not be in the future, and the previous secret is discarded immediately.
enabled	boolean	No	Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous client_secret stop being accepted, but the token itself is preserved and can be re-enabled. A service token reported as leaked is disabled automatically and cannot be re-enabled until its secret is rotated; attempting to do so returns a 409. Defaults to enabled when omitted on create.
previous_client_secret_expires_at	string	No	The expiration of the previous client_secret. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise. Rotating a service token that was reported as leaked discards the previous secret entirely, so no grace period can be set.
accountId	string	Yes	The Cloudflare account ID. Service tokens are account-scoped
name	string	Yes	Name of the service token
duration	string	No	How long the token stays valid before it expires, e.g. 8760h. Defaults to Cloudflare's standard lifetime
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
client_id	string	The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
client_secret	string	The Client Secret for the service token. Access will check for this value in the CF-Access-Client-Secret request header.
created_at	string	created at
duration	string	The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m, or the special value forever for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).
enabled	boolean	Whether the service token is enabled.
id	string	The ID of the service token.
name	string	The name of the service token.
updated_at	string	updated at
expires_at	string	Service token expires at when returned by Cloudflare; retained for existing workflows
last_seen_at	string	Service token last seen at when returned by Cloudflare; retained for existing workflows

Cloudflare Create DNS Record

Creates a new DNS record for a zone.

Inputs and outputs

Input

Parameter	Type	Required	Description
settings	json	No	JSON object. Settings for the DNS record. Fields: ipv4_only, ipv6_only, flatten_cname.
private_routing	boolean	No	Enables private network routing to the origin.
data	json	No	JSON object. Structured record data. The available fields depend on the DNS record type. Fields: flags, tag, value, algorithm, certificate, key_tag, type, protocol, public_key, digest, digest_type, priority, target, altitude, lat_degrees, lat_direction, lat_minutes, lat_seconds, long_degrees, long_direction, long_minutes, long_seconds, precision_horz, precision_vert, size, order, preference, regex, replacement, service, matching_type, selector, usage, port, weight, fingerprint.
include_shadow_metadata	boolean	No	Whether to include shadow metadata in the meta field of each record in the response. See [Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records).
zoneId	string	Yes	The zone ID to create the DNS record in
type	string	Yes	DNS record type (e.g., "A", "AAAA", "CNAME", "MX", "TXT", "NS", "SRV")
name	string	Yes	DNS record name (e.g., "example.com" or "subdomain.example.com")
content	string	No	DNS record content (e.g., IP address for A records, target for CNAME)
ttl	number	No	Time to live in seconds (1 = automatic, default: 1)
proxied	boolean	No	Whether to enable Cloudflare proxy (default: false)
priority	number	No	Record priority. Cloudflare accepts this top-level field for MX and URI records only; use the data object for structured records such as SRV (priority, weight, port, target)
comment	string	No	Comment for the DNS record
tags	string	No	Comma-separated tags for the DNS record
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
comment	string	Comments or notes about the DNS record. This field has no effect on DNS responses.
name	string	Complete DNS record name, including the zone name, in Punycode.
proxied	boolean	Whether the record is receiving the performance and security benefits of Cloudflare.
settings	json	Settings for the DNS record.
↳ ipv4_only	boolean	When enabled, only A records will be generated, and AAAA records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
↳ ipv6_only	boolean	When enabled, only AAAA records will be generated, and A records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
↳ flatten_cname	boolean	If enabled, causes the CNAME record to be resolved externally and the resulting address records (e.g., A and AAAA) to be returned instead of the CNAME record itself. This setting is unavailable for proxied records, since they are always flattened.
tags	array	Custom tags for the DNS record. This field has no effect on DNS responses.
ttl	number	Time To Live (TTL) of the DNS record in seconds. Setting to 1 means 'automatic'. Value must be between 60 and 86400, with the minimum reduced to 30 for Enterprise zones. Values: 1.
content	string	Formatted URI content. See 'data' to set URI properties.
private_routing	boolean	Enables private network routing to the origin.
type	string	Record type. Values: A, AAAA, CNAME, MX, NS, OPENPGPKEY, PTR, TXT, CAA, CERT, DNSKEY, DS, HTTPS, LOC, NAPTR, SMIMEA, SRV, SSHFP, SVCB, TLSA, URI.
priority	number	Required for MX and URI records; ignored for other record types (but may still be returned by the API). Records with lower priorities are preferred. This field is to be deprecated in favor of the priority field within the data map.
data	json	Structured record data. The available fields depend on the DNS record type.
↳ flags	json	Flags.
↳ tag	string	Name of the property controlled by this record (e.g.: issue, issuewild, iodef).
↳ value	string	Value.
↳ algorithm	number	Algorithm.
↳ certificate	string	Certificate.
↳ key_tag	number	Key Tag.
↳ type	number	Type.
↳ protocol	number	Protocol.
↳ public_key	string	Public Key.
↳ digest	string	Digest.
↳ digest_type	number	Digest Type.
↳ priority	number	Priority.
↳ target	string	The record content.
↳ altitude	number	Altitude of location in meters.
↳ lat_degrees	number	Degrees of latitude.
↳ lat_direction	string	Latitude direction. Values: N, S.
↳ lat_minutes	number	Minutes of latitude.
↳ lat_seconds	number	Seconds of latitude.
↳ long_degrees	number	Degrees of longitude.
↳ long_direction	string	Longitude direction. Values: E, W.
↳ long_minutes	number	Minutes of longitude.
↳ long_seconds	number	Seconds of longitude.
↳ precision_horz	number	Horizontal precision of location.
↳ precision_vert	number	Vertical precision of location.
↳ size	number	Size of location in meters.
↳ order	number	Order.
↳ preference	number	Preference.
↳ regex	string	Regex.
↳ replacement	string	Replacement.
↳ service	string	Service.
↳ matching_type	number	Matching Type.
↳ selector	number	Selector.
↳ usage	number	Usage.
↳ port	number	The port of the service.
↳ weight	number	The record weight.
↳ fingerprint	string	Fingerprint.
comment_modified_on	string	When the record comment was last modified. Omitted if there is no comment.
created_on	string	When the record was created.
id	string	Identifier.
meta	json	Extra Cloudflare-specific metadata about the record.
↳ dead_glue	boolean	Whether this glue record is not served because a shallower NS delegation takes precedence over the deeper delegation that needs it.
↳ is_glue	boolean	Whether this A or AAAA record is glue for a subdomain NS delegation. See [Glue records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records#glue-records).
↳ shadowed_by	array	IDs of the NS records that shadow this record. See [Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records).
↳ shadowed_records_count	number	Number of records shadowed by this NS delegation. See [Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records).
modified_on	string	When the record was last modified.
proxiable	boolean	Whether the record can be proxied by Cloudflare or not.
tags_modified_on	string	When the record tags were last modified. Omitted if there are no tags.
zone_id	string	Legacy DNS response zone ID when returned by Cloudflare
zone_name	string	Legacy DNS response zone name when returned by Cloudflare
locked	boolean	Legacy DNS response lock flag when returned by Cloudflare

Cloudflare Create R2 Bucket

Creates an R2 object storage bucket in an account. The location hint and jurisdiction are fixed at creation and cannot be changed later. Requires an API token with Account Workers R2 Storage Edit.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	The Cloudflare account ID. R2 buckets are account-scoped
bucketName	string	Yes	Name for the new bucket
locationHint	string	No	Region hint for where the bucket should live: apac, eeur, enam, weur, wnam, or oc. Cannot be changed after creation
storageClass	string	No	Default storage class for objects: Standard or InfrequentAccess
jurisdiction	string	No	Data-residency jurisdiction to create the bucket in: default, eu, or fedramp. Cannot be changed after creation
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
creation_date	string	Creation timestamp.
jurisdiction	string	Jurisdiction where objects in this bucket are guaranteed to be stored. Values: default, eu, us, fedramp, fedramp-high.
location	string	Location of the bucket. Values: apac, eeur, enam, weur, wnam, oc.
name	string	Name of the bucket.
storage_class	string	Storage class for newly uploaded objects, unless specified otherwise. Values: Standard, InfrequentAccess.

Cloudflare Create Rate Limiting Rule

Creates a rate limiting rule in the http_ratelimit phase entry point ruleset of a zone, using the current Rulesets-based rate limiting API (the legacy rate_limits endpoint is no longer available). Run "List Rate Limiting Rules" first to get the ruleset ID. Requires an API token with Zone WAF Edit.

Inputs and outputs

Input

Parameter	Type	Required	Description
actionParameters	json	No	JSON object. The parameters configuring the rule's action. Fields: response, algorithms, id, matched_data, overrides, cookie_fields, raw_response_fields, request_fields, response_fields, transformed_request_fields, from_list, from_value, headers, uri, host_header, origin, sni, increment, content_type, status_code, content, asset_name, immutable, max-age, must-revalidate, must-understand, no-cache, no-store, no-transform, private, proxy-revalidate, public, s-maxage, stale-if-error, stale-while-revalidate, additional_cacheable_ports, browser_ttl, cache, cache_key, cache_reserve, edge_ttl, origin_cache_control, origin_error_page_passthru, origin_range_requests, read_timeout, respect_strong_etags, serve_stale, shared_dictionary, strip_etags, strip_last_modified, strip_set_cookie, vary, operation, values, expression, automatic_https_rewrites, autominify, bic, content_converter, disable_apps, disable_pay_per_crawl, disable_rum, disable_zaraz, email_obfuscation, fonts, hotlink_protection, mirage, opportunistic_encryption, polish, redirects_for_ai_training, request_body_buffering, response_body_buffering, rocket_loader, security_level, server_side_excludes, ssl, sxg, webmcp_enabled, webmcp_packs, phase, phases, products, rules, ruleset, rulesets, link_maze.
exposed_credential_check	json	No	JSON object. Configuration for exposed credential checking. Fields: password_expression, username_expression.
id	string	No	The unique ID of the rule.
logging	json	No	JSON object. An object configuring the rule's logging behavior. Fields: enabled.
ref	string	No	The reference of the rule (the rule's ID by default).
position	json	No	JSON object. An object configuring where the rule will be placed. Fields: before, after, index.
score_per_period	number	No	The score threshold per period for which the action will be executed the first time.
score_response_header_name	string	No	A response header name provided by the origin, which contains the score to increment rate limit counter with.
dry_run	boolean	No	dry run
zoneId	string	Yes	The zone ID to add the rate limiting rule to
rulesetId	string	Yes	The http_ratelimit entry point ruleset ID, as returned by "List Rate Limiting Rules"
expression	string	Yes	Cloudflare filter expression selecting the requests the rule applies to, e.g. (http.request.uri.path matches "^/api/")
characteristics	string	Yes	Comma-separated counting characteristics. cf.colo.id is mandatory. ip.src and cf.unique_visitor_id are mutually exclusive — include at most one. Example: cf.colo.id,ip.src
period	number	Yes	Counting window in seconds. Cloudflare accepts only 10, 60, 120, 300, 600, or 3600
requestsPerPeriod	number	Yes	Number of requests allowed within the counting period before the action fires
action	string	No	Action applied once the limit is exceeded, e.g. block, managed_challenge, js_challenge, challenge, or log. Defaults to block
mitigationTimeout	number	No	Seconds the action stays applied after the limit is exceeded. Cloudflare accepts only 0, 10, 60, 120, 300, 600, 3600, or 86400
counting_expression	string	No	Optional expression defining which requests are counted, when it differs from the matching expression
requestsToOrigin	boolean	No	When true, only requests that reach the origin are counted
description	string	No	Human-readable description of the rule
enabled	boolean	No	Whether the rule is enabled
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
description	string	An informative description of the ruleset.
id	string	The unique ID of the ruleset.
last_updated	string	The timestamp of when the ruleset was last modified.
name	string	The human-readable name of the ruleset.
version	string	The version of the ruleset.
kind	string	The kind of the ruleset. Values: managed, custom, root, zone.
phase	string	The phase of the ruleset.
rules	array	The list of rules in the ruleset.
↳ action	string	The action to perform when the rule matches.
↳ action_parameters	json	The parameters configuring the rule's action.
↳ response	json	The response to show when the block is applied.
↳ content	string	The content to return.
↳ content_type	string	The type of the content to return.
↳ status_code	number	The status code to return.
↳ algorithms	array	Custom order for compression algorithms.
↳ name	string	Name of the compression algorithm to enable. Values: none, auto, default, gzip, brotli, zstd.
↳ id	string	The ID of the ruleset to execute.
↳ matched_data	json	The configuration to use for matched data logging.
↳ public_key	string	The public key to encrypt matched data logs with.
↳ overrides	json	A set of overrides to apply to the target ruleset.
↳ action	string	An action to override all rules with. This option has lower precedence than rule and category overrides.
↳ categories	array	A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
↳ action	string	The action to override rules in the category with.
↳ category	string	The name of the category to override.
↳ enabled	boolean	Whether to enable execution of rules in the category.
↳ sensitivity_level	string	The sensitivity level to use for rules in the category. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ enabled	boolean	Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
↳ rules	array	A list of rule-level overrides. This option has the highest precedence.
↳ action	string	The action to override the rule with.
↳ enabled	boolean	Whether to enable execution of the rule.
↳ id	string	The ID of the rule to override.
↳ score_threshold	number	The score threshold to use for the rule.
↳ sensitivity_level	string	The sensitivity level to use for the rule. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ sensitivity_level	string	A sensitivity level to set for all rules. This option has lower precedence than rule and category overrides and is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ cookie_fields	array	The cookie fields to log.
↳ name	string	The name of the cookie.
↳ raw_response_fields	array	The raw response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ request_fields	array	The raw request fields to log.
↳ name	string	The name of the header.
↳ response_fields	array	The transformed response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ transformed_request_fields	array	The transformed request fields to log.
↳ name	string	The name of the header.
↳ from_list	json	A redirect based on a bulk list lookup.
↳ key	string	An expression that evaluates to the list lookup key.
↳ name	string	The name of the list to match against.
↳ from_value	json	A redirect based on the request properties.
↳ preserve_query_string	boolean	Whether to keep the query string of the original request.
↳ status_code	number	The status code to use for the redirect. Values: 301, 302, 303, 307, 308.
↳ target_url	json	A URL to redirect the request to.
↳ expression	string	An expression that evaluates to a URL to redirect the request to.
↳ value	string	A URL to redirect the request to.
↳ headers	json	A map of headers to rewrite.
↳ uri	json	A URI query rewrite.
↳ path	json	A URI path rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI path to.
↳ value	string	A value to rewrite the URI path to.
↳ query	json	A URI query rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI query to.
↳ value	string	A value to rewrite the URI query to.
↳ origin	boolean	Whether to propagate the rewritten URI to origin.
↳ host_header	string	A value to rewrite the HTTP host header to.
↳ origin	json	An origin to route to.
↳ host	string	A resolved host to route to.
↳ port	number	A destination port to route to.
↳ sni	json	A Server Name Indication (SNI) override.
↳ value	string	A value to override the SNI to.
↳ increment	number	A delta to change the score by, which can be either positive or negative.
↳ content_type	string	The content type header to set with the error response. Values: application/json, text/html, text/plain, text/xml.
↳ status_code	number	The status code to use for the error.
↳ content	string	The response content.
↳ asset_name	string	The name of a custom asset to serve as the error response.
↳ immutable	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ max-age	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ must-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ must-understand	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-cache	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ no-store	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-transform	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ private	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ proxy-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ public	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ s-maxage	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-if-error	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-while-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ additional_cacheable_ports	array	A list of additional ports that caching should be enabled on.
↳ browser_ttl	json	How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
↳ default	number	The browser TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The browser TTL mode. Values: respect_origin, bypass_by_default, override_origin, bypass.
↳ cache	boolean	Whether the request's response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
↳ cache_key	json	Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
↳ cache_by_device_type	boolean	Whether to separate cached content based on the visitor's device type.
↳ cache_deception_armor	boolean	Whether to protect from web cache deception attacks, while allowing static assets to be cached.
↳ custom_key	json	Which components of the request are included or excluded from the cache key.
↳ cookie	json	Which cookies to include in the cache key.
↳ check_presence	array	A list of cookies to check for the presence of. The presence of these cookies is included in the cache key.
↳ include	array	A list of cookies to include in the cache key.
↳ header	json	Which headers to include in the cache key.
↳ check_presence	array	A list of headers to check for the presence of. The presence of these headers is included in the cache key.
↳ contains	json	A mapping of header names to a list of values. If a header is present in the request and contains any of the values provided, its value is included in the cache key.
↳ exclude_origin	boolean	Whether to exclude the origin header in the cache key.
↳ include	array	A list of headers to include in the cache key.
↳ host	json	How to use the host in the cache key.
↳ resolved	boolean	Whether to use the resolved host in the cache key.
↳ query_string	json	Which query string parameters to include in or exclude from the cache key.
↳ exclude	json	Which query string parameters to exclude from the cache key.
↳ all	boolean	Whether to exclude all query string parameters from the cache key. Values: True.
↳ list	array	A list of query string parameters to exclude from the cache key.
↳ include	json	Which query string parameters to include in the cache key.
↳ all	boolean	Whether to include all query string parameters in the cache key. Values: True.
↳ list	array	A list of query string parameters to include in the cache key.
↳ user	json	How to use characteristics of the request user agent in the cache key.
↳ device_type	boolean	Whether to use the user agent's device type in the cache key.
↳ geo	boolean	Whether to use the user agents's country in the cache key.
↳ lang	boolean	Whether to use the user agent's language in the cache key.
↳ ignore_query_strings_order	boolean	Whether to treat requests with the same query parameters the same, regardless of the order those query parameters are in.
↳ cache_reserve	json	Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
↳ eligible	boolean	Whether Cache Reserve is enabled. If this is true and a request meets eligibility criteria, Cloudflare will write the resource to Cache Reserve.
↳ minimum_file_size	number	The minimum file size eligible for storage in Cache Reserve.
↳ edge_ttl	json	How long the Cloudflare edge network should cache the response.
↳ default	number	The edge TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The edge TTL mode. Values: respect_origin, bypass_by_default, override_origin.
↳ status_code_ttl	array	A list of TTLs to apply to specific status codes or status code ranges.
↳ status_code	number	A single status code to apply the TTL to.
↳ status_code_range	json	A range of status codes to apply the TTL to.
↳ from	number	The lower bound of the range.
↳ to	number	The upper bound of the range.
↳ value	number	The time to cache the response for (in seconds). A value of 0 is equivalent to setting the cache control header with the value "no-cache". A value of -1 is equivalent to setting the cache control header with the value of "no-store".
↳ origin_cache_control	boolean	Whether Cloudflare will aim to strictly adhere to RFC 7234.
↳ origin_error_page_passthru	boolean	Whether to generate Cloudflare error pages for issues from the origin server.
↳ origin_range_requests	json	Controls whether Cloudflare fetches a large asset from the origin as a series of range requests instead of one whole-body request.
↳ mode	string	Whether to use range requests. default is the behaviour the zone gets without this rule. Values: on, off, default.
↳ read_timeout	number	A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
↳ respect_strong_etags	boolean	Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
↳ serve_stale	json	When to serve stale content from cache.
↳ disable_stale_while_updating	boolean	Whether Cloudflare should disable serving stale content while getting the latest content from the origin.
↳ shared_dictionary	json	Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
↳ match_pattern	string	URL pattern for the Use-As-Dictionary match field. This pattern specifies which URLs can use this response as a dictionary.
↳ strip_etags	boolean	Whether to strip ETag headers from the origin response before caching.
↳ strip_last_modified	boolean	Whether to strip Last-Modified headers from the origin response before caching.
↳ strip_set_cookie	boolean	Whether to strip Set-Cookie headers from the origin response before caching.
↳ vary	json	Controls how cached responses vary based on request headers. default is required by the API and applies to any Vary response header that does not have a per-header override.
↳ default	json	Controls how response Vary headers without a per-header override contribute to the cache key.
↳ action	string	How the header value is treated when building the cache key. Values: bypass, passthrough, normalize.
↳ headers	json	A mapping of lowercase request header names to their vary configuration.
↳ operation	string	The operation to perform on the cache tags. Values: add, remove, set.
↳ values	array	A list of cache tag values.
↳ expression	string	An expression that evaluates to an array of cache tag values.
↳ automatic_https_rewrites	boolean	Whether to enable Automatic HTTPS Rewrites.
↳ autominify	json	Which file extensions to minify automatically.
↳ css	boolean	Whether to minify CSS files.
↳ html	boolean	Whether to minify HTML files.
↳ js	boolean	Whether to minify JavaScript files.
↳ bic	boolean	Whether to enable Browser Integrity Check (BIC).
↳ content_converter	boolean	Whether to enable content conversion (e.g., HTML to Markdown).
↳ disable_apps	boolean	Whether to disable Cloudflare Apps. Values: True.
↳ disable_pay_per_crawl	boolean	Whether to disable Pay Per Crawl. Values: True.
↳ disable_rum	boolean	Whether to disable Real User Monitoring (RUM). Values: True.
↳ disable_zaraz	boolean	Whether to disable Zaraz. Values: True.
↳ email_obfuscation	boolean	Whether to enable Email Obfuscation.
↳ fonts	boolean	Whether to enable Cloudflare Fonts.
↳ hotlink_protection	boolean	Whether to enable Hotlink Protection.
↳ mirage	boolean	Whether to enable Mirage.
↳ opportunistic_encryption	boolean	Whether to enable Opportunistic Encryption.
↳ polish	string	The Polish level to configure. Values: off, lossless, lossy, webp.
↳ redirects_for_ai_training	boolean	Whether to redirect verified AI training crawlers to canonical URLs found in the HTML response.
↳ request_body_buffering	string	The request body buffering mode. Values: none, standard, full.
↳ response_body_buffering	string	The response body buffering mode. Values: none, standard.
↳ rocket_loader	boolean	Whether to enable Rocket Loader.
↳ security_level	string	The Security Level to configure. Values: off, essentially_off, low, medium, high, under_attack.
↳ server_side_excludes	boolean	Whether to enable Server-Side Excludes.
↳ ssl	string	The SSL level to configure. Values: off, flexible, full, strict, origin_pull.
↳ sxg	boolean	Whether to enable Signed Exchanges (SXG).
↳ webmcp_enabled	boolean	Whether to serve the WebMCP bridge script, which exposes the page's tools to browser AI agents.
↳ webmcp_packs	array	Bundled WebMCP tool packs to activate for matching requests. An empty array disables all packs. Omitting this parameter leaves the pack selection unchanged. Does not enable the WebMCP bridge itself.
↳ phase	string	A phase to skip the execution of. This option is only compatible with the products option. Values: current.
↳ phases	array	A list of phases to skip the execution of. This option is incompatible with the rulesets option.
↳ products	array	A list of legacy security products to skip the execution of.
↳ rules	json	A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
↳ ruleset	string	A ruleset to skip the execution of. This option is incompatible with the rulesets option. Values: current.
↳ rulesets	array	A list of ruleset IDs to skip the execution of. This option is incompatible with the ruleset and phases options.
↳ link_maze	json	Enables the link maze transformation on the response.
↳ categories	array	The categories of the rule.
↳ description	string	An informative description of the rule.
↳ enabled	boolean	Whether the rule should be executed.
↳ exposed_credential_check	json	Configuration for exposed credential checking.
↳ password_expression	string	An expression that selects the password used in the credentials check.
↳ username_expression	string	An expression that selects the user ID used in the credentials check.
↳ expression	string	The expression defining which traffic will match the rule.
↳ id	string	The unique ID of the rule.
↳ last_updated	string	The timestamp of when the rule was last modified.
↳ logging	json	An object configuring the rule's logging behavior.
↳ enabled	boolean	Whether to generate a log when the rule matches.
↳ ratelimit	json	An object configuring the rule's rate limit behavior.
↳ characteristics	array	Characteristics of the request on which the rate limit counter will be incremented.
↳ counting_expression	string	An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
↳ mitigation_timeout	number	Period of time in seconds after which the action will be disabled following its first execution.
↳ period	number	Period in seconds over which the counter is being incremented.
↳ requests_per_period	number	The threshold of requests per period after which the action will be executed for the first time.
↳ requests_to_origin	boolean	Whether counting is only performed when an origin is reached.
↳ score_per_period	number	The score threshold per period for which the action will be executed the first time.
↳ score_response_header_name	string	A response header name provided by the origin, which contains the score to increment rate limit counter with.
↳ ref	string	The reference of the rule (the rule's ID by default).
↳ version	string	The version of the rule.

Cloudflare Create Ruleset

Creates a zone ruleset for a phase, optionally seeded with its first rules. Use this when a phase has no entry point ruleset yet — reading the entry point returns 404 on a zone that has never had a rule in that phase, and rules can only be appended to a ruleset that already exists. Create the entry point with kind "zone" and the target phase (for example http_ratelimit for rate limiting rules or http_request_firewall_custom for WAF custom rules), then use the returned ruleset ID for later rule operations. Requires an API token with Zone WAF Edit (or another matching ruleset Edit permission).

Inputs and outputs

Input

Parameter	Type	Required	Description
dry_run	boolean	No	dry run
zoneId	string	Yes	The zone ID to create the ruleset in
name	string	Yes	Human-readable name for the ruleset
phase	string	Yes	The ruleset phase, e.g. http_ratelimit, http_request_firewall_custom, http_request_firewall_managed, http_request_transform, http_request_dynamic_redirect
kind	string	No	Ruleset kind: zone or custom. Use zone to create a phase entry point ruleset and custom for a ruleset an execute rule deploys. Defaults to zone. "root" is the account-level phase entry point and "managed" is Cloudflare-owned, so neither can be created on this zone-scoped endpoint
description	string	No	Description of the ruleset
rules	json	No	JSON array of rules to seed the ruleset with, in evaluation order. Each rule takes action, expression, and optionally description, enabled, action_parameters, and ratelimit
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
description	string	An informative description of the ruleset.
id	string	The unique ID of the ruleset.
last_updated	string	The timestamp of when the ruleset was last modified.
name	string	The human-readable name of the ruleset.
version	string	The version of the ruleset.
kind	string	The kind of the ruleset. Values: managed, custom, root, zone.
phase	string	The phase of the ruleset.
rules	array	The list of rules in the ruleset.
↳ action	string	The action to perform when the rule matches.
↳ action_parameters	json	The parameters configuring the rule's action.
↳ response	json	The response to show when the block is applied.
↳ content	string	The content to return.
↳ content_type	string	The type of the content to return.
↳ status_code	number	The status code to return.
↳ algorithms	array	Custom order for compression algorithms.
↳ name	string	Name of the compression algorithm to enable. Values: none, auto, default, gzip, brotli, zstd.
↳ id	string	The ID of the ruleset to execute.
↳ matched_data	json	The configuration to use for matched data logging.
↳ public_key	string	The public key to encrypt matched data logs with.
↳ overrides	json	A set of overrides to apply to the target ruleset.
↳ action	string	An action to override all rules with. This option has lower precedence than rule and category overrides.
↳ categories	array	A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
↳ action	string	The action to override rules in the category with.
↳ category	string	The name of the category to override.
↳ enabled	boolean	Whether to enable execution of rules in the category.
↳ sensitivity_level	string	The sensitivity level to use for rules in the category. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ enabled	boolean	Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
↳ rules	array	A list of rule-level overrides. This option has the highest precedence.
↳ action	string	The action to override the rule with.
↳ enabled	boolean	Whether to enable execution of the rule.
↳ id	string	The ID of the rule to override.
↳ score_threshold	number	The score threshold to use for the rule.
↳ sensitivity_level	string	The sensitivity level to use for the rule. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ sensitivity_level	string	A sensitivity level to set for all rules. This option has lower precedence than rule and category overrides and is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ cookie_fields	array	The cookie fields to log.
↳ name	string	The name of the cookie.
↳ raw_response_fields	array	The raw response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ request_fields	array	The raw request fields to log.
↳ name	string	The name of the header.
↳ response_fields	array	The transformed response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ transformed_request_fields	array	The transformed request fields to log.
↳ name	string	The name of the header.
↳ from_list	json	A redirect based on a bulk list lookup.
↳ key	string	An expression that evaluates to the list lookup key.
↳ name	string	The name of the list to match against.
↳ from_value	json	A redirect based on the request properties.
↳ preserve_query_string	boolean	Whether to keep the query string of the original request.
↳ status_code	number	The status code to use for the redirect. Values: 301, 302, 303, 307, 308.
↳ target_url	json	A URL to redirect the request to.
↳ expression	string	An expression that evaluates to a URL to redirect the request to.
↳ value	string	A URL to redirect the request to.
↳ headers	json	A map of headers to rewrite.
↳ uri	json	A URI query rewrite.
↳ path	json	A URI path rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI path to.
↳ value	string	A value to rewrite the URI path to.
↳ query	json	A URI query rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI query to.
↳ value	string	A value to rewrite the URI query to.
↳ origin	boolean	Whether to propagate the rewritten URI to origin.
↳ host_header	string	A value to rewrite the HTTP host header to.
↳ origin	json	An origin to route to.
↳ host	string	A resolved host to route to.
↳ port	number	A destination port to route to.
↳ sni	json	A Server Name Indication (SNI) override.
↳ value	string	A value to override the SNI to.
↳ increment	number	A delta to change the score by, which can be either positive or negative.
↳ content_type	string	The content type header to set with the error response. Values: application/json, text/html, text/plain, text/xml.
↳ status_code	number	The status code to use for the error.
↳ content	string	The response content.
↳ asset_name	string	The name of a custom asset to serve as the error response.
↳ immutable	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ max-age	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ must-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ must-understand	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-cache	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ no-store	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-transform	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ private	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ proxy-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ public	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ s-maxage	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-if-error	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-while-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ additional_cacheable_ports	array	A list of additional ports that caching should be enabled on.
↳ browser_ttl	json	How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
↳ default	number	The browser TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The browser TTL mode. Values: respect_origin, bypass_by_default, override_origin, bypass.
↳ cache	boolean	Whether the request's response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
↳ cache_key	json	Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
↳ cache_by_device_type	boolean	Whether to separate cached content based on the visitor's device type.
↳ cache_deception_armor	boolean	Whether to protect from web cache deception attacks, while allowing static assets to be cached.
↳ custom_key	json	Which components of the request are included or excluded from the cache key.
↳ cookie	json	Which cookies to include in the cache key.
↳ check_presence	array	A list of cookies to check for the presence of. The presence of these cookies is included in the cache key.
↳ include	array	A list of cookies to include in the cache key.
↳ header	json	Which headers to include in the cache key.
↳ check_presence	array	A list of headers to check for the presence of. The presence of these headers is included in the cache key.
↳ contains	json	A mapping of header names to a list of values. If a header is present in the request and contains any of the values provided, its value is included in the cache key.
↳ exclude_origin	boolean	Whether to exclude the origin header in the cache key.
↳ include	array	A list of headers to include in the cache key.
↳ host	json	How to use the host in the cache key.
↳ resolved	boolean	Whether to use the resolved host in the cache key.
↳ query_string	json	Which query string parameters to include in or exclude from the cache key.
↳ exclude	json	Which query string parameters to exclude from the cache key.
↳ all	boolean	Whether to exclude all query string parameters from the cache key. Values: True.
↳ list	array	A list of query string parameters to exclude from the cache key.
↳ include	json	Which query string parameters to include in the cache key.
↳ all	boolean	Whether to include all query string parameters in the cache key. Values: True.
↳ list	array	A list of query string parameters to include in the cache key.
↳ user	json	How to use characteristics of the request user agent in the cache key.
↳ device_type	boolean	Whether to use the user agent's device type in the cache key.
↳ geo	boolean	Whether to use the user agents's country in the cache key.
↳ lang	boolean	Whether to use the user agent's language in the cache key.
↳ ignore_query_strings_order	boolean	Whether to treat requests with the same query parameters the same, regardless of the order those query parameters are in.
↳ cache_reserve	json	Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
↳ eligible	boolean	Whether Cache Reserve is enabled. If this is true and a request meets eligibility criteria, Cloudflare will write the resource to Cache Reserve.
↳ minimum_file_size	number	The minimum file size eligible for storage in Cache Reserve.
↳ edge_ttl	json	How long the Cloudflare edge network should cache the response.
↳ default	number	The edge TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The edge TTL mode. Values: respect_origin, bypass_by_default, override_origin.
↳ status_code_ttl	array	A list of TTLs to apply to specific status codes or status code ranges.
↳ status_code	number	A single status code to apply the TTL to.
↳ status_code_range	json	A range of status codes to apply the TTL to.
↳ from	number	The lower bound of the range.
↳ to	number	The upper bound of the range.
↳ value	number	The time to cache the response for (in seconds). A value of 0 is equivalent to setting the cache control header with the value "no-cache". A value of -1 is equivalent to setting the cache control header with the value of "no-store".
↳ origin_cache_control	boolean	Whether Cloudflare will aim to strictly adhere to RFC 7234.
↳ origin_error_page_passthru	boolean	Whether to generate Cloudflare error pages for issues from the origin server.
↳ origin_range_requests	json	Controls whether Cloudflare fetches a large asset from the origin as a series of range requests instead of one whole-body request.
↳ mode	string	Whether to use range requests. default is the behaviour the zone gets without this rule. Values: on, off, default.
↳ read_timeout	number	A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
↳ respect_strong_etags	boolean	Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
↳ serve_stale	json	When to serve stale content from cache.
↳ disable_stale_while_updating	boolean	Whether Cloudflare should disable serving stale content while getting the latest content from the origin.
↳ shared_dictionary	json	Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
↳ match_pattern	string	URL pattern for the Use-As-Dictionary match field. This pattern specifies which URLs can use this response as a dictionary.
↳ strip_etags	boolean	Whether to strip ETag headers from the origin response before caching.
↳ strip_last_modified	boolean	Whether to strip Last-Modified headers from the origin response before caching.
↳ strip_set_cookie	boolean	Whether to strip Set-Cookie headers from the origin response before caching.
↳ vary	json	Controls how cached responses vary based on request headers. default is required by the API and applies to any Vary response header that does not have a per-header override.
↳ default	json	Controls how response Vary headers without a per-header override contribute to the cache key.
↳ action	string	How the header value is treated when building the cache key. Values: bypass, passthrough, normalize.
↳ headers	json	A mapping of lowercase request header names to their vary configuration.
↳ operation	string	The operation to perform on the cache tags. Values: add, remove, set.
↳ values	array	A list of cache tag values.
↳ expression	string	An expression that evaluates to an array of cache tag values.
↳ automatic_https_rewrites	boolean	Whether to enable Automatic HTTPS Rewrites.
↳ autominify	json	Which file extensions to minify automatically.
↳ css	boolean	Whether to minify CSS files.
↳ html	boolean	Whether to minify HTML files.
↳ js	boolean	Whether to minify JavaScript files.
↳ bic	boolean	Whether to enable Browser Integrity Check (BIC).
↳ content_converter	boolean	Whether to enable content conversion (e.g., HTML to Markdown).
↳ disable_apps	boolean	Whether to disable Cloudflare Apps. Values: True.
↳ disable_pay_per_crawl	boolean	Whether to disable Pay Per Crawl. Values: True.
↳ disable_rum	boolean	Whether to disable Real User Monitoring (RUM). Values: True.
↳ disable_zaraz	boolean	Whether to disable Zaraz. Values: True.
↳ email_obfuscation	boolean	Whether to enable Email Obfuscation.
↳ fonts	boolean	Whether to enable Cloudflare Fonts.
↳ hotlink_protection	boolean	Whether to enable Hotlink Protection.
↳ mirage	boolean	Whether to enable Mirage.
↳ opportunistic_encryption	boolean	Whether to enable Opportunistic Encryption.
↳ polish	string	The Polish level to configure. Values: off, lossless, lossy, webp.
↳ redirects_for_ai_training	boolean	Whether to redirect verified AI training crawlers to canonical URLs found in the HTML response.
↳ request_body_buffering	string	The request body buffering mode. Values: none, standard, full.
↳ response_body_buffering	string	The response body buffering mode. Values: none, standard.
↳ rocket_loader	boolean	Whether to enable Rocket Loader.
↳ security_level	string	The Security Level to configure. Values: off, essentially_off, low, medium, high, under_attack.
↳ server_side_excludes	boolean	Whether to enable Server-Side Excludes.
↳ ssl	string	The SSL level to configure. Values: off, flexible, full, strict, origin_pull.
↳ sxg	boolean	Whether to enable Signed Exchanges (SXG).
↳ webmcp_enabled	boolean	Whether to serve the WebMCP bridge script, which exposes the page's tools to browser AI agents.
↳ webmcp_packs	array	Bundled WebMCP tool packs to activate for matching requests. An empty array disables all packs. Omitting this parameter leaves the pack selection unchanged. Does not enable the WebMCP bridge itself.
↳ phase	string	A phase to skip the execution of. This option is only compatible with the products option. Values: current.
↳ phases	array	A list of phases to skip the execution of. This option is incompatible with the rulesets option.
↳ products	array	A list of legacy security products to skip the execution of.
↳ rules	json	A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
↳ ruleset	string	A ruleset to skip the execution of. This option is incompatible with the rulesets option. Values: current.
↳ rulesets	array	A list of ruleset IDs to skip the execution of. This option is incompatible with the ruleset and phases options.
↳ link_maze	json	Enables the link maze transformation on the response.
↳ categories	array	The categories of the rule.
↳ description	string	An informative description of the rule.
↳ enabled	boolean	Whether the rule should be executed.
↳ exposed_credential_check	json	Configuration for exposed credential checking.
↳ password_expression	string	An expression that selects the password used in the credentials check.
↳ username_expression	string	An expression that selects the user ID used in the credentials check.
↳ expression	string	The expression defining which traffic will match the rule.
↳ id	string	The unique ID of the rule.
↳ last_updated	string	The timestamp of when the rule was last modified.
↳ logging	json	An object configuring the rule's logging behavior.
↳ enabled	boolean	Whether to generate a log when the rule matches.
↳ ratelimit	json	An object configuring the rule's rate limit behavior.
↳ characteristics	array	Characteristics of the request on which the rate limit counter will be incremented.
↳ counting_expression	string	An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
↳ mitigation_timeout	number	Period of time in seconds after which the action will be disabled following its first execution.
↳ period	number	Period in seconds over which the counter is being incremented.
↳ requests_per_period	number	The threshold of requests per period after which the action will be executed for the first time.
↳ requests_to_origin	boolean	Whether counting is only performed when an origin is reached.
↳ score_per_period	number	The score threshold per period for which the action will be executed the first time.
↳ score_response_header_name	string	A response header name provided by the origin, which contains the score to increment rate limit counter with.
↳ ref	string	The reference of the rule (the rule's ID by default).
↳ version	string	The version of the rule.

Cloudflare Create Ruleset Rule

Adds a rule to a zone ruleset. Use "Get Phase Entry Point Ruleset" first to find the ruleset ID for the phase you want (for example http_request_firewall_custom for a WAF custom rule, or http_request_firewall_managed with action "execute" to deploy a managed ruleset). The rule is appended to the end of the ruleset unless a position is given. Requires an API token with Zone WAF Edit (or another matching ruleset Write permission).

Inputs and outputs

Input

Parameter	Type	Required	Description
exposed_credential_check	json	No	JSON object. Configuration for exposed credential checking. Fields: password_expression, username_expression.
id	string	No	The unique ID of the rule.
logging	json	No	JSON object. An object configuring the rule's logging behavior. Fields: enabled.
ratelimit	json	No	JSON object. An object configuring the rule's rate limit behavior. Fields: characteristics, counting_expression, mitigation_timeout, period, requests_per_period, requests_to_origin, score_per_period, score_response_header_name.
dry_run	boolean	No	dry run
zoneId	string	Yes	The zone ID that owns the ruleset
rulesetId	string	Yes	The ruleset ID to add the rule to
action	string	Yes	The action the rule performs. Valid values depend on the phase — e.g. block, challenge, js_challenge, managed_challenge, log, skip, or execute (to deploy a managed ruleset)
expression	string	Yes	Cloudflare filter expression selecting matching requests, e.g. (ip.src.country in {"GB" "FR"}). Use "true" to match every request
description	string	No	Human-readable description of the rule
enabled	boolean	No	Whether the rule is enabled
ref	string	No	Reference tag that stays stable across rule updates
actionParameters	string	No	JSON object of action-specific parameters. For an "execute" rule this carries the managed ruleset id and any overrides, e.g. {"id":"<MANAGED_RULESET_ID>","overrides":{"action":"log"}}
position	string	No	JSON object placing the rule within the ruleset. Exactly one of {"before":"<RULE_ID>"}, {"after":"<RULE_ID>"}, or {"index":<1-based position>}
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
description	string	An informative description of the ruleset.
id	string	The unique ID of the ruleset.
last_updated	string	The timestamp of when the ruleset was last modified.
name	string	The human-readable name of the ruleset.
version	string	The version of the ruleset.
kind	string	The kind of the ruleset. Values: managed, custom, root, zone.
phase	string	The phase of the ruleset.
rules	array	The list of rules in the ruleset.
↳ action	string	The action to perform when the rule matches.
↳ action_parameters	json	The parameters configuring the rule's action.
↳ response	json	The response to show when the block is applied.
↳ content	string	The content to return.
↳ content_type	string	The type of the content to return.
↳ status_code	number	The status code to return.
↳ algorithms	array	Custom order for compression algorithms.
↳ name	string	Name of the compression algorithm to enable. Values: none, auto, default, gzip, brotli, zstd.
↳ id	string	The ID of the ruleset to execute.
↳ matched_data	json	The configuration to use for matched data logging.
↳ public_key	string	The public key to encrypt matched data logs with.
↳ overrides	json	A set of overrides to apply to the target ruleset.
↳ action	string	An action to override all rules with. This option has lower precedence than rule and category overrides.
↳ categories	array	A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
↳ action	string	The action to override rules in the category with.
↳ category	string	The name of the category to override.
↳ enabled	boolean	Whether to enable execution of rules in the category.
↳ sensitivity_level	string	The sensitivity level to use for rules in the category. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ enabled	boolean	Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
↳ rules	array	A list of rule-level overrides. This option has the highest precedence.
↳ action	string	The action to override the rule with.
↳ enabled	boolean	Whether to enable execution of the rule.
↳ id	string	The ID of the rule to override.
↳ score_threshold	number	The score threshold to use for the rule.
↳ sensitivity_level	string	The sensitivity level to use for the rule. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ sensitivity_level	string	A sensitivity level to set for all rules. This option has lower precedence than rule and category overrides and is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ cookie_fields	array	The cookie fields to log.
↳ name	string	The name of the cookie.
↳ raw_response_fields	array	The raw response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ request_fields	array	The raw request fields to log.
↳ name	string	The name of the header.
↳ response_fields	array	The transformed response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ transformed_request_fields	array	The transformed request fields to log.
↳ name	string	The name of the header.
↳ from_list	json	A redirect based on a bulk list lookup.
↳ key	string	An expression that evaluates to the list lookup key.
↳ name	string	The name of the list to match against.
↳ from_value	json	A redirect based on the request properties.
↳ preserve_query_string	boolean	Whether to keep the query string of the original request.
↳ status_code	number	The status code to use for the redirect. Values: 301, 302, 303, 307, 308.
↳ target_url	json	A URL to redirect the request to.
↳ expression	string	An expression that evaluates to a URL to redirect the request to.
↳ value	string	A URL to redirect the request to.
↳ headers	json	A map of headers to rewrite.
↳ uri	json	A URI query rewrite.
↳ path	json	A URI path rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI path to.
↳ value	string	A value to rewrite the URI path to.
↳ query	json	A URI query rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI query to.
↳ value	string	A value to rewrite the URI query to.
↳ origin	boolean	Whether to propagate the rewritten URI to origin.
↳ host_header	string	A value to rewrite the HTTP host header to.
↳ origin	json	An origin to route to.
↳ host	string	A resolved host to route to.
↳ port	number	A destination port to route to.
↳ sni	json	A Server Name Indication (SNI) override.
↳ value	string	A value to override the SNI to.
↳ increment	number	A delta to change the score by, which can be either positive or negative.
↳ content_type	string	The content type header to set with the error response. Values: application/json, text/html, text/plain, text/xml.
↳ status_code	number	The status code to use for the error.
↳ content	string	The response content.
↳ asset_name	string	The name of a custom asset to serve as the error response.
↳ immutable	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ max-age	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ must-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ must-understand	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-cache	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ no-store	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-transform	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ private	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ proxy-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ public	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ s-maxage	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-if-error	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-while-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ additional_cacheable_ports	array	A list of additional ports that caching should be enabled on.
↳ browser_ttl	json	How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
↳ default	number	The browser TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The browser TTL mode. Values: respect_origin, bypass_by_default, override_origin, bypass.
↳ cache	boolean	Whether the request's response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
↳ cache_key	json	Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
↳ cache_by_device_type	boolean	Whether to separate cached content based on the visitor's device type.
↳ cache_deception_armor	boolean	Whether to protect from web cache deception attacks, while allowing static assets to be cached.
↳ custom_key	json	Which components of the request are included or excluded from the cache key.
↳ cookie	json	Which cookies to include in the cache key.
↳ check_presence	array	A list of cookies to check for the presence of. The presence of these cookies is included in the cache key.
↳ include	array	A list of cookies to include in the cache key.
↳ header	json	Which headers to include in the cache key.
↳ check_presence	array	A list of headers to check for the presence of. The presence of these headers is included in the cache key.
↳ contains	json	A mapping of header names to a list of values. If a header is present in the request and contains any of the values provided, its value is included in the cache key.
↳ exclude_origin	boolean	Whether to exclude the origin header in the cache key.
↳ include	array	A list of headers to include in the cache key.
↳ host	json	How to use the host in the cache key.
↳ resolved	boolean	Whether to use the resolved host in the cache key.
↳ query_string	json	Which query string parameters to include in or exclude from the cache key.
↳ exclude	json	Which query string parameters to exclude from the cache key.
↳ all	boolean	Whether to exclude all query string parameters from the cache key. Values: True.
↳ list	array	A list of query string parameters to exclude from the cache key.
↳ include	json	Which query string parameters to include in the cache key.
↳ all	boolean	Whether to include all query string parameters in the cache key. Values: True.
↳ list	array	A list of query string parameters to include in the cache key.
↳ user	json	How to use characteristics of the request user agent in the cache key.
↳ device_type	boolean	Whether to use the user agent's device type in the cache key.
↳ geo	boolean	Whether to use the user agents's country in the cache key.
↳ lang	boolean	Whether to use the user agent's language in the cache key.
↳ ignore_query_strings_order	boolean	Whether to treat requests with the same query parameters the same, regardless of the order those query parameters are in.
↳ cache_reserve	json	Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
↳ eligible	boolean	Whether Cache Reserve is enabled. If this is true and a request meets eligibility criteria, Cloudflare will write the resource to Cache Reserve.
↳ minimum_file_size	number	The minimum file size eligible for storage in Cache Reserve.
↳ edge_ttl	json	How long the Cloudflare edge network should cache the response.
↳ default	number	The edge TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The edge TTL mode. Values: respect_origin, bypass_by_default, override_origin.
↳ status_code_ttl	array	A list of TTLs to apply to specific status codes or status code ranges.
↳ status_code	number	A single status code to apply the TTL to.
↳ status_code_range	json	A range of status codes to apply the TTL to.
↳ from	number	The lower bound of the range.
↳ to	number	The upper bound of the range.
↳ value	number	The time to cache the response for (in seconds). A value of 0 is equivalent to setting the cache control header with the value "no-cache". A value of -1 is equivalent to setting the cache control header with the value of "no-store".
↳ origin_cache_control	boolean	Whether Cloudflare will aim to strictly adhere to RFC 7234.
↳ origin_error_page_passthru	boolean	Whether to generate Cloudflare error pages for issues from the origin server.
↳ origin_range_requests	json	Controls whether Cloudflare fetches a large asset from the origin as a series of range requests instead of one whole-body request.
↳ mode	string	Whether to use range requests. default is the behaviour the zone gets without this rule. Values: on, off, default.
↳ read_timeout	number	A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
↳ respect_strong_etags	boolean	Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
↳ serve_stale	json	When to serve stale content from cache.
↳ disable_stale_while_updating	boolean	Whether Cloudflare should disable serving stale content while getting the latest content from the origin.
↳ shared_dictionary	json	Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
↳ match_pattern	string	URL pattern for the Use-As-Dictionary match field. This pattern specifies which URLs can use this response as a dictionary.
↳ strip_etags	boolean	Whether to strip ETag headers from the origin response before caching.
↳ strip_last_modified	boolean	Whether to strip Last-Modified headers from the origin response before caching.
↳ strip_set_cookie	boolean	Whether to strip Set-Cookie headers from the origin response before caching.
↳ vary	json	Controls how cached responses vary based on request headers. default is required by the API and applies to any Vary response header that does not have a per-header override.
↳ default	json	Controls how response Vary headers without a per-header override contribute to the cache key.
↳ action	string	How the header value is treated when building the cache key. Values: bypass, passthrough, normalize.
↳ headers	json	A mapping of lowercase request header names to their vary configuration.
↳ operation	string	The operation to perform on the cache tags. Values: add, remove, set.
↳ values	array	A list of cache tag values.
↳ expression	string	An expression that evaluates to an array of cache tag values.
↳ automatic_https_rewrites	boolean	Whether to enable Automatic HTTPS Rewrites.
↳ autominify	json	Which file extensions to minify automatically.
↳ css	boolean	Whether to minify CSS files.
↳ html	boolean	Whether to minify HTML files.
↳ js	boolean	Whether to minify JavaScript files.
↳ bic	boolean	Whether to enable Browser Integrity Check (BIC).
↳ content_converter	boolean	Whether to enable content conversion (e.g., HTML to Markdown).
↳ disable_apps	boolean	Whether to disable Cloudflare Apps. Values: True.
↳ disable_pay_per_crawl	boolean	Whether to disable Pay Per Crawl. Values: True.
↳ disable_rum	boolean	Whether to disable Real User Monitoring (RUM). Values: True.
↳ disable_zaraz	boolean	Whether to disable Zaraz. Values: True.
↳ email_obfuscation	boolean	Whether to enable Email Obfuscation.
↳ fonts	boolean	Whether to enable Cloudflare Fonts.
↳ hotlink_protection	boolean	Whether to enable Hotlink Protection.
↳ mirage	boolean	Whether to enable Mirage.
↳ opportunistic_encryption	boolean	Whether to enable Opportunistic Encryption.
↳ polish	string	The Polish level to configure. Values: off, lossless, lossy, webp.
↳ redirects_for_ai_training	boolean	Whether to redirect verified AI training crawlers to canonical URLs found in the HTML response.
↳ request_body_buffering	string	The request body buffering mode. Values: none, standard, full.
↳ response_body_buffering	string	The response body buffering mode. Values: none, standard.
↳ rocket_loader	boolean	Whether to enable Rocket Loader.
↳ security_level	string	The Security Level to configure. Values: off, essentially_off, low, medium, high, under_attack.
↳ server_side_excludes	boolean	Whether to enable Server-Side Excludes.
↳ ssl	string	The SSL level to configure. Values: off, flexible, full, strict, origin_pull.
↳ sxg	boolean	Whether to enable Signed Exchanges (SXG).
↳ webmcp_enabled	boolean	Whether to serve the WebMCP bridge script, which exposes the page's tools to browser AI agents.
↳ webmcp_packs	array	Bundled WebMCP tool packs to activate for matching requests. An empty array disables all packs. Omitting this parameter leaves the pack selection unchanged. Does not enable the WebMCP bridge itself.
↳ phase	string	A phase to skip the execution of. This option is only compatible with the products option. Values: current.
↳ phases	array	A list of phases to skip the execution of. This option is incompatible with the rulesets option.
↳ products	array	A list of legacy security products to skip the execution of.
↳ rules	json	A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
↳ ruleset	string	A ruleset to skip the execution of. This option is incompatible with the rulesets option. Values: current.
↳ rulesets	array	A list of ruleset IDs to skip the execution of. This option is incompatible with the ruleset and phases options.
↳ link_maze	json	Enables the link maze transformation on the response.
↳ categories	array	The categories of the rule.
↳ description	string	An informative description of the rule.
↳ enabled	boolean	Whether the rule should be executed.
↳ exposed_credential_check	json	Configuration for exposed credential checking.
↳ password_expression	string	An expression that selects the password used in the credentials check.
↳ username_expression	string	An expression that selects the user ID used in the credentials check.
↳ expression	string	The expression defining which traffic will match the rule.
↳ id	string	The unique ID of the rule.
↳ last_updated	string	The timestamp of when the rule was last modified.
↳ logging	json	An object configuring the rule's logging behavior.
↳ enabled	boolean	Whether to generate a log when the rule matches.
↳ ratelimit	json	An object configuring the rule's rate limit behavior.
↳ characteristics	array	Characteristics of the request on which the rate limit counter will be incremented.
↳ counting_expression	string	An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
↳ mitigation_timeout	number	Period of time in seconds after which the action will be disabled following its first execution.
↳ period	number	Period in seconds over which the counter is being incremented.
↳ requests_per_period	number	The threshold of requests per period after which the action will be executed for the first time.
↳ requests_to_origin	boolean	Whether counting is only performed when an origin is reached.
↳ score_per_period	number	The score threshold per period for which the action will be executed the first time.
↳ score_response_header_name	string	A response header name provided by the origin, which contains the score to increment rate limit counter with.
↳ ref	string	The reference of the rule (the rule's ID by default).
↳ version	string	The version of the rule.

Cloudflare Create Tunnel

Creates a remotely or locally managed Cloudflare Tunnel in an account. After creation, retrieve its token and run cloudflared to establish the connector connection.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
apiKey	string	Yes	Cloudflare API token
config_src	string	No	Indicates if this is a locally or remotely configured tunnel. If local, manage the tunnel using a YAML file on the origin machine. If cloudflare, manage the tunnel on the Zero Trust dashboard. Allowed values: local, cloudflare.
name	string	Yes	A user-friendly name for a tunnel.
tunnel_secret	string	No	Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.

Output

Parameter	Type	Description
account_tag	string	Cloudflare account ID
config_src	string	Indicates if this is a locally or remotely configured tunnel. If local, manage the tunnel using a YAML file on the origin machine. If cloudflare, manage the tunnel on the Zero Trust dashboard. Values: local, cloudflare.
connections	array	The Cloudflare Tunnel connections between your origin and Cloudflare's edge.
↳ client_id	string	UUID of the Cloudflare Tunnel connector.
↳ client_version	string	The cloudflared version used to establish this connection.
↳ colo_name	string	The Cloudflare data center used for this connection.
↳ id	string	UUID of the Cloudflare Tunnel connection.
↳ is_pending_reconnect	boolean	Cloudflare continues to track connections for several minutes after they disconnect. This is an optimization to improve latency and reliability of reconnecting. If true, the connection has disconnected but is still being tracked. If false, the connection is actively serving traffic.
↳ opened_at	string	Timestamp of when the connection was established.
↳ origin_ip	string	The public IP address of the host running cloudflared.
↳ uuid	string	UUID of the Cloudflare Tunnel connection.
conns_active_at	string	Timestamp of when the tunnel established at least one connection to Cloudflare's edge. If null, the tunnel is inactive.
conns_inactive_at	string	Timestamp of when the tunnel became inactive (no connections to Cloudflare's edge). If null, the tunnel is active.
created_at	string	Timestamp of when the resource was created.
deleted_at	string	Timestamp of when the resource was deleted. If null, the resource has not been deleted.
id	string	UUID of the tunnel.
metadata	json	Metadata associated with the tunnel.
name	string	A user-friendly name for a tunnel.
remote_config	boolean	If true, the tunnel can be configured remotely from the Zero Trust dashboard. If false, the tunnel must be configured locally on the origin machine.
status	string	The status of the tunnel.
tun_type	string	The type of tunnel. Values: cfd_tunnel, warp_connector, warp, magic, ip_sec, gre, cni.

Cloudflare Create Worker Route

Creates a route that maps a URL pattern to a Worker.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	Zone id
apiKey	string	Yes	Cloudflare API token
pattern	string	Yes	Pattern to match incoming requests against. [Learn more](https://developers.cloudflare.com/workers/configuration/routing/routes/#matching-behavior).
script	string	No	Name of the script to run if the route matches.

Output

Parameter	Type	Description
id	string	Identifier.
pattern	string	Pattern to match incoming requests against. [Learn more](https://developers.cloudflare.com/workers/configuration/routing/routes/#matching-behavior).
script	string	Name of the script to run if the route matches.

Cloudflare Create Zone

Adds a new zone (domain) to the Cloudflare account.

Inputs and outputs

Input

Parameter	Type	Required	Description
name	string	Yes	The domain name to add (e.g., "example.com")
accountId	string	Yes	The Cloudflare account ID
type	string	No	Zone type: "full" (Cloudflare manages DNS), "partial" (CNAME setup), "secondary" (secondary DNS), or "internal" (internal DNS zone)
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
account	json	The account the zone belongs to.
↳ id	string	Identifier
↳ name	string	The name of the account.
activated_on	string	The last time proof of ownership was detected and the zone was made active.
cname_suffix	string	Allows the customer to use a custom apex. Tenants Only Configuration.
created_on	string	When the zone was created.
development_mode	number	The interval (in seconds) from when development mode expires (positive integer) or last expired (negative integer) for the domain. If development mode has never been enabled, this value is 0.
id	string	Identifier
meta	json	Metadata about the zone.
↳ cdn_only	boolean	The zone is only configured for CDN.
↳ custom_certificate_quota	number	Number of Custom Certificates the zone can have.
↳ dns_only	boolean	The zone is only configured for DNS.
↳ foundation_dns	boolean	The zone is setup with Foundation DNS.
↳ page_rule_quota	number	Number of Page Rules a zone can have.
↳ phishing_detected	boolean	The zone has been flagged for phishing.
↳ step	number	step
modified_on	string	When the zone was last modified.
name	string	The domain name. Per [RFC 1035](https://datatracker.ietf.org/doc/html/rfc1035#section-2.3.4) the overall zone name can be up to 253 characters, with each segment ("label") not exceeding 63 characters.
name_servers	array	The name servers Cloudflare assigns to a zone.
original_dnshost	string	DNS host at the time of switching to Cloudflare.
original_name_servers	array	Original name servers before moving to Cloudflare.
original_registrar	string	Registrar for the domain at the time of switching to Cloudflare.
owner	json	The owner of the zone.
↳ id	string	Identifier
↳ name	string	Name of the owner.
↳ type	string	The type of owner.
paused	boolean	Indicates whether the zone is only using Cloudflare DNS services. A true value means the zone will not receive security or performance benefits.
permissions	array	Legacy permissions based on legacy user membership information.
plan	json	A Zones subscription information.
↳ can_subscribe	boolean	States if the subscription can be activated.
↳ currency	string	The denomination of the customer.
↳ externally_managed	boolean	If this Zone is managed by another company.
↳ frequency	string	How often the customer is billed.
↳ id	string	Identifier
↳ is_subscribed	boolean	States if the subscription active.
↳ legacy_discount	boolean	If the legacy discount applies to this Zone.
↳ legacy_id	string	The legacy name of the plan.
↳ name	string	Name of the owner.
↳ price	number	How much the customer is paying.
status	string	The zone status on Cloudflare. Values: initializing, pending, active, moved.
tenant	json	The root organizational unit that this zone belongs to (such as a tenant or organization).
↳ id	string	Identifier
↳ name	string	The name of the Tenant account.
tenant_unit	json	The immediate parent organizational unit that this zone belongs to (such as under a tenant or sub-organization).
↳ id	string	Identifier
type	string	A full zone implies that DNS is hosted with Cloudflare. A partial zone is typically a partner-hosted zone or a CNAME setup. Values: full, partial, secondary, internal.
vanity_name_servers	array	An array of domains used for custom name servers. This is only available for Business and Enterprise plans.
verification_key	string	Verification key for partial zone setup.

Cloudflare Delete Access Application

Permanently deletes a Cloudflare Access (Zero Trust) application and every policy attached to it. The hostname it protected is immediately left without an Access identity check, so anyone who can reach it can reach the origin. This cannot be undone. Requires an API token with Account Access: Apps and Policies Edit.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	The Cloudflare account ID. Access applications are account-scoped
appId	string	Yes	The Access application ID to delete permanently
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
id	string	Identifier of the deleted Access application

Cloudflare Delete Access Group

Deletes an Access group.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
groupId	string	Yes	Group id
apiKey	string	Yes	Cloudflare API token

Output

Parameter	Type	Description
id	string	UUID.

Cloudflare Delete Access Policy

Permanently deletes a Cloudflare Access (Zero Trust) policy from an application. This changes who can reach the application the moment it runs: removing an allow policy locks out everyone it covered, and removing a deny or require policy drops that restriction. This cannot be undone. Requires an API token with Account Access: Apps and Policies Edit.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	The Cloudflare account ID. Access applications are account-scoped
appId	string	Yes	The Access application ID that owns the policy
policyId	string	Yes	The Access policy ID to delete permanently
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
id	string	Identifier of the deleted Access policy

Cloudflare Delete DNS Record

Deletes a DNS record from a zone.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	The zone ID containing the DNS record
recordId	string	Yes	The DNS record ID to delete
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
id	string	Deleted record ID

Cloudflare Delete R2 Bucket

Permanently deletes an R2 object storage bucket. Cloudflare only deletes an empty bucket, and the deletion cannot be undone. Requires an API token with Account Workers R2 Storage Edit.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	The Cloudflare account ID. R2 buckets are account-scoped
bucketName	string	Yes	The name of the bucket to delete permanently
jurisdiction	string	No	Data-residency jurisdiction the bucket lives in: default, eu, or fedramp
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
name	string	Name of the deleted bucket. Cloudflare returns an empty result body for this endpoint, so the name is echoed from the request

Cloudflare Delete R2 Bucket Cors

Delete the CORS policy for a bucket.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
bucketName	string	Yes	Bucket name
apiKey	string	Yes	Cloudflare API token
jurisdiction	string	No	Jurisdiction where objects in this bucket are guaranteed to be stored.

Output

Parameter	Type	Description
success	boolean	Whether Cloudflare accepted the operation

Cloudflare Delete Ruleset

Deletes all versions of an existing zone ruleset.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	Zone id
rulesetId	string	Yes	Ruleset id
apiKey	string	Yes	Cloudflare API token
dry_run	boolean	No	Validates the request without persisting changes when set to true. Responses that normally return 200 return result: null; endpoints that normally return 204 continue to return 204.

Output

Parameter	Type	Description
success	boolean	Whether Cloudflare accepted the operation

Cloudflare Delete Ruleset Rule

Permanently deletes a rule from a zone ruleset. This takes effect immediately on live traffic and cannot be undone — deleting a WAF custom rule, a managed-ruleset deployment, or a rate limiting rule removes that protection from the zone. Also use this to delete rate limiting rules, which live in the http_ratelimit phase ruleset. Requires an API token with Zone WAF Edit (or another matching ruleset Write permission).

Inputs and outputs

Input

Parameter	Type	Required	Description
dry_run	boolean	No	dry run
zoneId	string	Yes	The zone ID that owns the ruleset
rulesetId	string	Yes	The ruleset ID containing the rule
ruleId	string	Yes	The rule ID to delete permanently
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
description	string	An informative description of the ruleset.
id	string	The unique ID of the ruleset.
last_updated	string	The timestamp of when the ruleset was last modified.
name	string	The human-readable name of the ruleset.
version	string	The version of the ruleset.
kind	string	The kind of the ruleset. Values: managed, custom, root, zone.
phase	string	The phase of the ruleset.
rules	array	The list of rules in the ruleset.
↳ action	string	The action to perform when the rule matches.
↳ action_parameters	json	The parameters configuring the rule's action.
↳ response	json	The response to show when the block is applied.
↳ content	string	The content to return.
↳ content_type	string	The type of the content to return.
↳ status_code	number	The status code to return.
↳ algorithms	array	Custom order for compression algorithms.
↳ name	string	Name of the compression algorithm to enable. Values: none, auto, default, gzip, brotli, zstd.
↳ id	string	The ID of the ruleset to execute.
↳ matched_data	json	The configuration to use for matched data logging.
↳ public_key	string	The public key to encrypt matched data logs with.
↳ overrides	json	A set of overrides to apply to the target ruleset.
↳ action	string	An action to override all rules with. This option has lower precedence than rule and category overrides.
↳ categories	array	A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
↳ action	string	The action to override rules in the category with.
↳ category	string	The name of the category to override.
↳ enabled	boolean	Whether to enable execution of rules in the category.
↳ sensitivity_level	string	The sensitivity level to use for rules in the category. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ enabled	boolean	Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
↳ rules	array	A list of rule-level overrides. This option has the highest precedence.
↳ action	string	The action to override the rule with.
↳ enabled	boolean	Whether to enable execution of the rule.
↳ id	string	The ID of the rule to override.
↳ score_threshold	number	The score threshold to use for the rule.
↳ sensitivity_level	string	The sensitivity level to use for the rule. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ sensitivity_level	string	A sensitivity level to set for all rules. This option has lower precedence than rule and category overrides and is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ cookie_fields	array	The cookie fields to log.
↳ name	string	The name of the cookie.
↳ raw_response_fields	array	The raw response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ request_fields	array	The raw request fields to log.
↳ name	string	The name of the header.
↳ response_fields	array	The transformed response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ transformed_request_fields	array	The transformed request fields to log.
↳ name	string	The name of the header.
↳ from_list	json	A redirect based on a bulk list lookup.
↳ key	string	An expression that evaluates to the list lookup key.
↳ name	string	The name of the list to match against.
↳ from_value	json	A redirect based on the request properties.
↳ preserve_query_string	boolean	Whether to keep the query string of the original request.
↳ status_code	number	The status code to use for the redirect. Values: 301, 302, 303, 307, 308.
↳ target_url	json	A URL to redirect the request to.
↳ expression	string	An expression that evaluates to a URL to redirect the request to.
↳ value	string	A URL to redirect the request to.
↳ headers	json	A map of headers to rewrite.
↳ uri	json	A URI query rewrite.
↳ path	json	A URI path rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI path to.
↳ value	string	A value to rewrite the URI path to.
↳ query	json	A URI query rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI query to.
↳ value	string	A value to rewrite the URI query to.
↳ origin	boolean	Whether to propagate the rewritten URI to origin.
↳ host_header	string	A value to rewrite the HTTP host header to.
↳ origin	json	An origin to route to.
↳ host	string	A resolved host to route to.
↳ port	number	A destination port to route to.
↳ sni	json	A Server Name Indication (SNI) override.
↳ value	string	A value to override the SNI to.
↳ increment	number	A delta to change the score by, which can be either positive or negative.
↳ content_type	string	The content type header to set with the error response. Values: application/json, text/html, text/plain, text/xml.
↳ status_code	number	The status code to use for the error.
↳ content	string	The response content.
↳ asset_name	string	The name of a custom asset to serve as the error response.
↳ immutable	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ max-age	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ must-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ must-understand	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-cache	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ no-store	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-transform	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ private	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ proxy-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ public	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ s-maxage	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-if-error	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-while-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ additional_cacheable_ports	array	A list of additional ports that caching should be enabled on.
↳ browser_ttl	json	How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
↳ default	number	The browser TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The browser TTL mode. Values: respect_origin, bypass_by_default, override_origin, bypass.
↳ cache	boolean	Whether the request's response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
↳ cache_key	json	Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
↳ cache_by_device_type	boolean	Whether to separate cached content based on the visitor's device type.
↳ cache_deception_armor	boolean	Whether to protect from web cache deception attacks, while allowing static assets to be cached.
↳ custom_key	json	Which components of the request are included or excluded from the cache key.
↳ cookie	json	Which cookies to include in the cache key.
↳ check_presence	array	A list of cookies to check for the presence of. The presence of these cookies is included in the cache key.
↳ include	array	A list of cookies to include in the cache key.
↳ header	json	Which headers to include in the cache key.
↳ check_presence	array	A list of headers to check for the presence of. The presence of these headers is included in the cache key.
↳ contains	json	A mapping of header names to a list of values. If a header is present in the request and contains any of the values provided, its value is included in the cache key.
↳ exclude_origin	boolean	Whether to exclude the origin header in the cache key.
↳ include	array	A list of headers to include in the cache key.
↳ host	json	How to use the host in the cache key.
↳ resolved	boolean	Whether to use the resolved host in the cache key.
↳ query_string	json	Which query string parameters to include in or exclude from the cache key.
↳ exclude	json	Which query string parameters to exclude from the cache key.
↳ all	boolean	Whether to exclude all query string parameters from the cache key. Values: True.
↳ list	array	A list of query string parameters to exclude from the cache key.
↳ include	json	Which query string parameters to include in the cache key.
↳ all	boolean	Whether to include all query string parameters in the cache key. Values: True.
↳ list	array	A list of query string parameters to include in the cache key.
↳ user	json	How to use characteristics of the request user agent in the cache key.
↳ device_type	boolean	Whether to use the user agent's device type in the cache key.
↳ geo	boolean	Whether to use the user agents's country in the cache key.
↳ lang	boolean	Whether to use the user agent's language in the cache key.
↳ ignore_query_strings_order	boolean	Whether to treat requests with the same query parameters the same, regardless of the order those query parameters are in.
↳ cache_reserve	json	Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
↳ eligible	boolean	Whether Cache Reserve is enabled. If this is true and a request meets eligibility criteria, Cloudflare will write the resource to Cache Reserve.
↳ minimum_file_size	number	The minimum file size eligible for storage in Cache Reserve.
↳ edge_ttl	json	How long the Cloudflare edge network should cache the response.
↳ default	number	The edge TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The edge TTL mode. Values: respect_origin, bypass_by_default, override_origin.
↳ status_code_ttl	array	A list of TTLs to apply to specific status codes or status code ranges.
↳ status_code	number	A single status code to apply the TTL to.
↳ status_code_range	json	A range of status codes to apply the TTL to.
↳ from	number	The lower bound of the range.
↳ to	number	The upper bound of the range.
↳ value	number	The time to cache the response for (in seconds). A value of 0 is equivalent to setting the cache control header with the value "no-cache". A value of -1 is equivalent to setting the cache control header with the value of "no-store".
↳ origin_cache_control	boolean	Whether Cloudflare will aim to strictly adhere to RFC 7234.
↳ origin_error_page_passthru	boolean	Whether to generate Cloudflare error pages for issues from the origin server.
↳ origin_range_requests	json	Controls whether Cloudflare fetches a large asset from the origin as a series of range requests instead of one whole-body request.
↳ mode	string	Whether to use range requests. default is the behaviour the zone gets without this rule. Values: on, off, default.
↳ read_timeout	number	A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
↳ respect_strong_etags	boolean	Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
↳ serve_stale	json	When to serve stale content from cache.
↳ disable_stale_while_updating	boolean	Whether Cloudflare should disable serving stale content while getting the latest content from the origin.
↳ shared_dictionary	json	Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
↳ match_pattern	string	URL pattern for the Use-As-Dictionary match field. This pattern specifies which URLs can use this response as a dictionary.
↳ strip_etags	boolean	Whether to strip ETag headers from the origin response before caching.
↳ strip_last_modified	boolean	Whether to strip Last-Modified headers from the origin response before caching.
↳ strip_set_cookie	boolean	Whether to strip Set-Cookie headers from the origin response before caching.
↳ vary	json	Controls how cached responses vary based on request headers. default is required by the API and applies to any Vary response header that does not have a per-header override.
↳ default	json	Controls how response Vary headers without a per-header override contribute to the cache key.
↳ action	string	How the header value is treated when building the cache key. Values: bypass, passthrough, normalize.
↳ headers	json	A mapping of lowercase request header names to their vary configuration.
↳ operation	string	The operation to perform on the cache tags. Values: add, remove, set.
↳ values	array	A list of cache tag values.
↳ expression	string	An expression that evaluates to an array of cache tag values.
↳ automatic_https_rewrites	boolean	Whether to enable Automatic HTTPS Rewrites.
↳ autominify	json	Which file extensions to minify automatically.
↳ css	boolean	Whether to minify CSS files.
↳ html	boolean	Whether to minify HTML files.
↳ js	boolean	Whether to minify JavaScript files.
↳ bic	boolean	Whether to enable Browser Integrity Check (BIC).
↳ content_converter	boolean	Whether to enable content conversion (e.g., HTML to Markdown).
↳ disable_apps	boolean	Whether to disable Cloudflare Apps. Values: True.
↳ disable_pay_per_crawl	boolean	Whether to disable Pay Per Crawl. Values: True.
↳ disable_rum	boolean	Whether to disable Real User Monitoring (RUM). Values: True.
↳ disable_zaraz	boolean	Whether to disable Zaraz. Values: True.
↳ email_obfuscation	boolean	Whether to enable Email Obfuscation.
↳ fonts	boolean	Whether to enable Cloudflare Fonts.
↳ hotlink_protection	boolean	Whether to enable Hotlink Protection.
↳ mirage	boolean	Whether to enable Mirage.
↳ opportunistic_encryption	boolean	Whether to enable Opportunistic Encryption.
↳ polish	string	The Polish level to configure. Values: off, lossless, lossy, webp.
↳ redirects_for_ai_training	boolean	Whether to redirect verified AI training crawlers to canonical URLs found in the HTML response.
↳ request_body_buffering	string	The request body buffering mode. Values: none, standard, full.
↳ response_body_buffering	string	The response body buffering mode. Values: none, standard.
↳ rocket_loader	boolean	Whether to enable Rocket Loader.
↳ security_level	string	The Security Level to configure. Values: off, essentially_off, low, medium, high, under_attack.
↳ server_side_excludes	boolean	Whether to enable Server-Side Excludes.
↳ ssl	string	The SSL level to configure. Values: off, flexible, full, strict, origin_pull.
↳ sxg	boolean	Whether to enable Signed Exchanges (SXG).
↳ webmcp_enabled	boolean	Whether to serve the WebMCP bridge script, which exposes the page's tools to browser AI agents.
↳ webmcp_packs	array	Bundled WebMCP tool packs to activate for matching requests. An empty array disables all packs. Omitting this parameter leaves the pack selection unchanged. Does not enable the WebMCP bridge itself.
↳ phase	string	A phase to skip the execution of. This option is only compatible with the products option. Values: current.
↳ phases	array	A list of phases to skip the execution of. This option is incompatible with the rulesets option.
↳ products	array	A list of legacy security products to skip the execution of.
↳ rules	json	A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
↳ ruleset	string	A ruleset to skip the execution of. This option is incompatible with the rulesets option. Values: current.
↳ rulesets	array	A list of ruleset IDs to skip the execution of. This option is incompatible with the ruleset and phases options.
↳ link_maze	json	Enables the link maze transformation on the response.
↳ categories	array	The categories of the rule.
↳ description	string	An informative description of the rule.
↳ enabled	boolean	Whether the rule should be executed.
↳ exposed_credential_check	json	Configuration for exposed credential checking.
↳ password_expression	string	An expression that selects the password used in the credentials check.
↳ username_expression	string	An expression that selects the user ID used in the credentials check.
↳ expression	string	The expression defining which traffic will match the rule.
↳ id	string	The unique ID of the rule.
↳ last_updated	string	The timestamp of when the rule was last modified.
↳ logging	json	An object configuring the rule's logging behavior.
↳ enabled	boolean	Whether to generate a log when the rule matches.
↳ ratelimit	json	An object configuring the rule's rate limit behavior.
↳ characteristics	array	Characteristics of the request on which the rate limit counter will be incremented.
↳ counting_expression	string	An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
↳ mitigation_timeout	number	Period of time in seconds after which the action will be disabled following its first execution.
↳ period	number	Period in seconds over which the counter is being incremented.
↳ requests_per_period	number	The threshold of requests per period after which the action will be executed for the first time.
↳ requests_to_origin	boolean	Whether counting is only performed when an origin is reached.
↳ score_per_period	number	The score threshold per period for which the action will be executed the first time.
↳ score_response_header_name	string	A response header name provided by the origin, which contains the score to increment rate limit counter with.
↳ ref	string	The reference of the rule (the rule's ID by default).
↳ version	string	The version of the rule.

Cloudflare Delete Tunnel

Permanently deletes a Cloudflare Tunnel from an account. The tunnel must have no active connections.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
tunnelId	string	Yes	Tunnel id
apiKey	string	Yes	Cloudflare API token

Output

Parameter	Type	Description
account_tag	string	Cloudflare account ID
config_src	string	Indicates if this is a locally or remotely configured tunnel. If local, manage the tunnel using a YAML file on the origin machine. If cloudflare, manage the tunnel on the Zero Trust dashboard. Values: local, cloudflare.
connections	array	The Cloudflare Tunnel connections between your origin and Cloudflare's edge.
↳ client_id	string	UUID of the Cloudflare Tunnel connector.
↳ client_version	string	The cloudflared version used to establish this connection.
↳ colo_name	string	The Cloudflare data center used for this connection.
↳ id	string	UUID of the Cloudflare Tunnel connection.
↳ is_pending_reconnect	boolean	Cloudflare continues to track connections for several minutes after they disconnect. This is an optimization to improve latency and reliability of reconnecting. If true, the connection has disconnected but is still being tracked. If false, the connection is actively serving traffic.
↳ opened_at	string	Timestamp of when the connection was established.
↳ origin_ip	string	The public IP address of the host running cloudflared.
↳ uuid	string	UUID of the Cloudflare Tunnel connection.
conns_active_at	string	Timestamp of when the tunnel established at least one connection to Cloudflare's edge. If null, the tunnel is inactive.
conns_inactive_at	string	Timestamp of when the tunnel became inactive (no connections to Cloudflare's edge). If null, the tunnel is active.
created_at	string	Timestamp of when the resource was created.
deleted_at	string	Timestamp of when the resource was deleted. If null, the resource has not been deleted.
id	string	UUID of the tunnel.
metadata	json	Metadata associated with the tunnel.
name	string	A user-friendly name for a tunnel.
remote_config	boolean	If true, the tunnel can be configured remotely from the Zero Trust dashboard. If false, the tunnel must be configured locally on the origin machine.
status	string	The status of the tunnel.
tun_type	string	The type of tunnel. Values: cfd_tunnel, warp_connector, warp, magic, ip_sec, gre, cni.

Cloudflare Delete Worker Route

Deletes a Worker route.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	Zone id
routeId	string	Yes	Route id
apiKey	string	Yes	Cloudflare API token

Output

Parameter	Type	Description
id	string	Identifier.

Cloudflare Delete Worker Script

Delete your worker. This call has no response body on a successful delete.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
scriptName	string	Yes	Script name
apiKey	string	Yes	Cloudflare API token
force	boolean	No	If true, delete the Worker even when other Workers still reference it. Service bindings in those Workers may be left broken. Durable Object namespaces implemented by the deleted Worker are deleted even if other Workers reference them.

Output

Parameter	Type	Description
success	boolean	Whether Cloudflare accepted the operation

Cloudflare Delete Zone

Deletes a zone (domain) from the Cloudflare account.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	The zone ID to delete
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
id	string	Deleted zone ID

Cloudflare DNS Analytics

Gets DNS analytics report for a zone including query counts and trends.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	The zone ID to get DNS analytics for
since	string	No	Start date for analytics (ISO 8601, e.g., "2024-01-01T00:00:00Z") or relative (e.g., "-6h")
until	string	No	End date for analytics (ISO 8601, e.g., "2024-01-31T23:59:59Z") or relative (e.g., "now")
metrics	string	No	Comma-separated metrics to retrieve (e.g., "queryCount,uncachedCount,staleCount,responseTimeAvg,responseTimeMedian,responseTime90th,responseTime99th"). Optional in the API
dimensions	string	No	Comma-separated dimensions to group by (e.g., "queryName,queryType,responseCode,responseCached,coloName,origin,dayOfWeek,tcp,ipVersion,querySizeBucket,responseSizeBucket")
filters	string	No	Filters to apply to the data (e.g., "queryType==A")
sort	string	No	Sort order for the result set. Fields must be included in metrics or dimensions (e.g., "+queryCount" or "-responseTimeAvg")
limit	number	No	Maximum number of results to return
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
totals	object	Aggregate DNS analytics totals for the entire queried period. Only the metrics that were requested are present.
↳ queryCount	number	Total number of DNS queries. Absent when queryCount was not requested
↳ uncachedCount	number	Number of uncached DNS queries. Absent when uncachedCount was not requested
↳ staleCount	number	Number of stale DNS queries. Absent when staleCount was not requested
↳ responseTimeAvg	number	Average response time in milliseconds
↳ responseTimeMedian	number	Median response time in milliseconds
↳ responseTime90th	number	90th percentile response time in milliseconds
↳ responseTime99th	number	99th percentile response time in milliseconds
min	json	Per-metric minimums. Cloudflare documents this field as currently always an empty object, so treat a populated value as unexpected rather than relied upon.
max	json	Per-metric maximums. Cloudflare documents this field as currently always an empty object, so treat a populated value as unexpected rather than relied upon.
data	array	Raw analytics data rows returned by the Cloudflare DNS analytics report
↳ dimensions	array	Dimension values for this data row, parallel to the requested dimensions list
↳ metrics	array	Metric values for this data row, parallel to the requested metrics list
data_lag	number	Processing lag in seconds before analytics data becomes available
rows	number	Total number of rows in the result set
query	object	Echo of the query parameters sent to the API
↳ since	string	Start date of the analytics query
↳ until	string	End date of the analytics query
↳ metrics	array	Metrics requested in the query
↳ dimensions	array	Dimensions requested in the query
↳ filters	string	Filters applied to the query
↳ sort	array	Sort order applied to the query
↳ limit	number	Maximum number of results requested

Cloudflare Get Access Application

Reads a single Cloudflare Access (Zero Trust) application, including its attached policies. Requires an API token with Account Access: Apps and Policies Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	The Cloudflare account ID. Access applications are account-scoped
appId	string	Yes	The Access application ID (or audience tag) to read
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
aud	string	Audience tag.
created_at	string	created at
id	string	UUID.
updated_at	string	updated at
allowed_idps	array	The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
destinations	array	List of destinations secured by Access. This supersedes self_hosted_domains to allow for more flexibility in defining different types of domains. If destinations are provided, then self_hosted_domains will be ignored.
↳ overrides	array	Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations.
↳ behavior	string	The behavior to apply to matching requests. Values: public.
↳ path_pattern	string	The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard.
↳ type	string	type Values: public, private, via_mcp_server_portal, worker, preview_worker, all_workers, all_preview_workers.
↳ uri	string	The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
↳ cidr	string	The CIDR range of the destination. Single IPs will be computed as /32.
↳ hostname	string	The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
↳ l4_protocol	string	The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match. Values: tcp, udp.
↳ port_range	string	The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.
↳ vnet_id	string	The VNET ID to match the destination. When omitted, all VNETs will match.
↳ mcp_server_id	string	The MCP server id configured in ai-controls.
↳ worker_id	string	The ID of the Cloudflare Worker whose preview deployments to protect with Access.
domain	string	The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.
name	string	The name of the application.
oauth_configuration	json	Beta: Optional configuration for managing an OAuth authorization flow controlled by Access.
↳ dynamic_client_registration	json	Settings for OAuth dynamic client registration.
↳ allow_any_on_localhost	boolean	Allows any client with redirect URIs on localhost.
↳ allow_any_on_loopback	boolean	Allows any client with redirect URIs on 127.0.0.1.
↳ allowed_uris	array	The URIs that are allowed as redirect URIs for dynamically registered clients. HTTP and HTTPS paths may end in /* to match all sub-paths. Custom-scheme URIs must be explicitly configured and match exactly.
↳ enabled	boolean	Whether dynamic client registration is enabled.
↳ enabled	boolean	Whether the OAuth configuration is enabled for this application. When set to false, Access will not handle OAuth for this application. Defaults to true if omitted. Values: True.
↳ grant	json	Settings for OAuth grant behavior.
↳ access_token_lifetime	string	The lifetime of the access token. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h.
↳ session_duration	string	The duration of the OAuth session. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h.
self_hosted_domains	array	List of public domains that Access will secure. This field is deprecated in favor of destinations and will be supported until November 21, 2025. If destinations are provided, then self_hosted_domains will be ignored.
type	string	The application type. Values: end_user, self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, dash_sso, infrastructure, rdp, mcp, mcp_portal, proxy_endpoint.
user_populations	array	The single user population associated with this application.
allow_authenticate_via_warp	boolean	When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.
allow_iframe	boolean	Enables loading application content in an iFrame.
app_launcher_visible	boolean	Displays the application in the App Launcher.
auto_redirect_to_identity	boolean	When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
cors_headers	json	cors headers
↳ allow_all_headers	boolean	Allows all HTTP request headers.
↳ allow_all_methods	boolean	Allows all HTTP request methods.
↳ allow_all_origins	boolean	Allows all origins.
↳ allow_credentials	boolean	When set to true, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.
↳ allowed_headers	array	Allowed HTTP request headers.
↳ allowed_methods	array	Allowed HTTP request methods.
↳ allowed_origins	array	Allowed origins.
↳ max_age	number	The maximum number of seconds the results of a preflight request can be cached.
custom_deny_message	string	The custom error message shown to a user when they are denied access to the application.
custom_deny_url	string	The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.
custom_non_identity_deny_url	string	The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.
custom_pages	array	The custom pages that will be displayed when applicable for this application
eager_redirect_cookie_setting	boolean	Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
enable_binding_cookie	boolean	Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
http_only_cookie_attribute	boolean	Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
logo_url	string	The image URL for the logo shown in the App Launcher dashboard.
mfa_config	json	Configures multi-factor authentication (MFA) settings.
↳ allowed_authenticators	array	Lists the MFA methods that users can authenticate with.
↳ mfa_disabled	boolean	Indicates whether to disable MFA for this resource. This option is available at the application and policy level.
↳ session_duration	string	Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
options_preflight_bypass	boolean	Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
path_cookie_attribute	boolean	Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default
read_service_tokens_from_header	string	Allows matching Access Service Tokens passed HTTP in a single header with this name.
same_site_cookie_attribute	string	Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
scim_config	json	Configuration for provisioning to this application via SCIM. This is currently in closed beta.
↳ authentication	json	Multiple authentication schemes
↳ password	string	Password used to authenticate with the remote SCIM service.
↳ scheme	string	The authentication scheme to use when making SCIM requests to this application. Values: httpbasic, oauthbearertoken, oauth2, access_service_token.
↳ user	string	User name used to authenticate with the remote SCIM service.
↳ token	string	Token used to authenticate with the remote SCIM service.
↳ authorization_url	string	URL used to generate the auth code used during token generation.
↳ client_id	string	Client ID of the Access service token used to authenticate with the remote service.
↳ client_secret	string	Client secret of the Access service token used to authenticate with the remote service.
↳ scopes	array	The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.
↳ token_url	string	URL used to generate the token used to authenticate with the remote SCIM service.
↳ deactivate_on_delete	boolean	If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.
↳ enabled	boolean	Whether SCIM provisioning is turned on for this application.
↳ idp_uid	string	The UID of the IdP to use as the source for SCIM resources to provision to this application.
↳ mappings	array	A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
↳ enabled	boolean	Whether or not this mapping is enabled.
↳ filter	string	A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.
↳ operations	json	Whether or not this mapping applies to creates, updates, or deletes.
↳ create	boolean	Whether or not this mapping applies to create (POST) operations.
↳ delete	boolean	Whether or not this mapping applies to DELETE operations.
↳ update	boolean	Whether or not this mapping applies to update (PATCH/PUT) operations.
↳ schema	string	Which SCIM resource type this mapping applies to.
↳ strictness	string	The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. Values: strict, passthrough.
↳ transform_jsonata	string	A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.
↳ remote_uri	string	The base URI for the application's SCIM-compatible API.
service_auth_401_redirect	boolean	Returns a 401 status code when the request is blocked by a Service Auth policy.
session_duration	string	The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
skip_interstitial	boolean	Enables automatic authentication through cloudflared.
tags	array	The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.
use_clientless_isolation_app_launcher_url	boolean	Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.
policies	array	policies
↳ approval_groups	array	Administrators who can approve a temporary authentication request.
↳ approvals_needed	number	The number of approvals needed to obtain access.
↳ email_addresses	array	A list of emails that can approve the access request.
↳ email_list_uuid	string	The UUID of an re-usable email list.
↳ approval_required	boolean	Requires the user to request access from an administrator at the start of each session.
↳ connection_rules	json	The rules that define how users may connect to targets secured by your application.
↳ rdp	json	The RDP-specific rules that define clipboard behavior for RDP connections.
↳ allowed_clipboard_local_to_remote_formats	array	Clipboard formats allowed when copying from local machine to remote RDP session.
↳ allowed_clipboard_remote_to_local_formats	array	Clipboard formats allowed when copying from remote RDP session to local machine.
↳ isolation_required	boolean	Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
↳ mfa_config	json	Configures multi-factor authentication (MFA) settings.
↳ allowed_authenticators	array	Lists the MFA methods that users can authenticate with.
↳ mfa_disabled	boolean	Indicates whether to disable MFA for this resource. This option is available at the application and policy level.
↳ session_duration	string	Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
↳ purpose_justification_prompt	string	A custom message that will appear on the purpose justification screen.
↳ purpose_justification_required	boolean	Require users to enter a justification when they log in to the application.
↳ session_duration	string	The amount of time that tokens issued for the application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
↳ created_at	string	created at
↳ decision	string	The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Values: allow, deny, non_identity, bypass.
↳ exclude	array	Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ id	string	The UUID of the policy
↳ include	array	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ name	string	The name of the Access policy.
↳ require	array	Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ updated_at	string	updated at
↳ account_id	string	Identifier.
↳ precedence	number	The order of execution for this policy. Must be unique for each policy within an app.
saas_app	json	saas app
↳ auth_type	string	Identifier of the authentication protocol used for the saas app. Required for OIDC. Values: saml, oidc.
↳ consumer_service_url	string	The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.
↳ created_at	string	created at
↳ custom_attributes	array	custom attributes
↳ friendly_name	string	The SAML FriendlyName of the attribute.
↳ name	string	The name of the attribute.
↳ name_format	string	A globally unique name for an identity or service provider. Values: urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified, urn:oasis:names:tc:SAML:2.0:attrname-format:basic, urn:oasis:names:tc:SAML:2.0:attrname-format:uri.
↳ required	boolean	If the attribute is required when building a SAML assertion.
↳ source	json	source
↳ name	string	The name of the IdP attribute.
↳ name_by_idp	array	A mapping from IdP ID to attribute name.
↳ idp_id	string	The UID of the IdP.
↳ source_name	string	The name of the IdP provided attribute.
↳ default_relay_state	string	The URL that the user will be redirected to after a successful login for IDP initiated logins.
↳ idp_entity_id	string	The unique identifier for your SaaS application.
↳ name_id_format	string	The format of the name identifier sent to the SaaS application. Values: id, email.
↳ name_id_transform_jsonata	string	A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting.
↳ public_key	string	The Access public certificate that will be used to verify your identity.
↳ saml_attribute_transform_jsonata	string	A [JSONata] (https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response.
↳ sp_entity_id	string	A globally unique name for an identity or service provider.
↳ sso_endpoint	string	The endpoint where your SaaS application will send login requests.
↳ updated_at	string	updated at
↳ access_token_lifetime	string	The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.
↳ allow_pkce_without_client_secret	boolean	If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.
↳ app_launcher_url	string	The URL where this applications tile redirects users
↳ client_id	string	The application client id
↳ client_secret	string	The application client secret, only returned on POST request.
↳ custom_claims	array	custom claims
↳ name	string	The name of the claim.
↳ required	boolean	If the claim is required when building an OIDC token.
↳ scope	string	The scope of the claim. Values: groups, profile, email, openid.
↳ source	json	source
↳ name	string	The name of the IdP claim.
↳ name_by_idp	json	A mapping from IdP ID to claim name.
↳ grant_types	array	The OIDC flows supported by this application
↳ group_filter_regex	string	A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
↳ hybrid_and_implicit_options	json	hybrid and implicit options
↳ return_access_token_from_authorization_endpoint	boolean	If an Access Token should be returned from the OIDC Authorization endpoint
↳ return_id_token_from_authorization_endpoint	boolean	If an ID Token should be returned from the OIDC Authorization endpoint
↳ redirect_uris	array	The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens
↳ refresh_token_options	json	refresh token options
↳ lifetime	string	How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.
↳ scopes	array	Define the user information shared with access, "offline_access" scope will be automatically enabled if refresh tokens are enabled
app_launcher_logo_url	string	The image URL of the logo shown in the App Launcher header.
bg_color	string	The background color of the App Launcher page.
footer_links	array	The links in the App Launcher footer.
↳ name	string	The hypertext in the footer link.
↳ url	string	the hyperlink in the footer link.
header_bg_color	string	The background color of the App Launcher header.
landing_page_design	json	The design of the App Launcher landing page shown to users when they log in.
↳ button_color	string	The background color of the log in button on the landing page.
↳ button_text_color	string	The color of the text in the log in button on the landing page.
↳ image_url	string	The URL of the image shown on the landing page.
↳ message	string	The message shown on the landing page.
↳ title	string	The title shown on the landing page.
skip_app_launcher_login_page	boolean	Determines when to skip the App Launcher landing page.
target_criteria	array	target criteria
↳ exclude	json	Selectors within an include, require, or exclude rule. At least one of target_attributes or tags must be non-empty.
↳ tags	json	Map of target tag keys to values. Values within a key are OR'd.
↳ target_attributes	json	Hostname selector map for include, require, or exclude rules. This is distinct from the deprecated top-level target_attributes field and only supports the hostname key.
↳ hostname	array	hostname
↳ include	json	Selectors within an include, require, or exclude rule. At least one of target_attributes or tags must be non-empty.
↳ tags	json	Map of target tag keys to values. Values within a key are OR'd.
↳ target_attributes	json	Hostname selector map for include, require, or exclude rules. This is distinct from the deprecated top-level target_attributes field and only supports the hostname key.
↳ hostname	array	hostname
↳ port	number	The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.
↳ require	json	Selectors within an include, require, or exclude rule. At least one of target_attributes or tags must be non-empty.
↳ tags	json	Map of target tag keys to values. Values within a key are OR'd.
↳ target_attributes	json	Hostname selector map for include, require, or exclude rules. This is distinct from the deprecated top-level target_attributes field and only supports the hostname key.
↳ hostname	array	hostname
↳ target_attributes	json	Contains a map of target attribute keys to target attribute values.
↳ protocol	string	The communication protocol your application secures. Values: RDP.

Cloudflare Get Access Group

Fetches a single Access group.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
groupId	string	Yes	Group id
apiKey	string	Yes	Cloudflare API token

Output

Parameter	Type	Description
created_at	string	created at
exclude	array	Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
id	string	UUID.
include	array	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
is_default	array	Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
name	string	The name of the Access group.
require	array	Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
updated_at	string	updated at

Cloudflare Get Access Policy

Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
appId	string	Yes	App id
policyId	string	Yes	Policy id
apiKey	string	Yes	Cloudflare API token

Output

Parameter	Type	Description
approval_groups	array	Administrators who can approve a temporary authentication request.
↳ approvals_needed	number	The number of approvals needed to obtain access.
↳ email_addresses	array	A list of emails that can approve the access request.
↳ email_list_uuid	string	The UUID of an re-usable email list.
approval_required	boolean	Requires the user to request access from an administrator at the start of each session.
connection_rules	json	The rules that define how users may connect to the targets secured by your application.
↳ rdp	json	The RDP-specific rules that define clipboard behavior for RDP connections.
↳ allowed_clipboard_local_to_remote_formats	array	Clipboard formats allowed when copying from local machine to remote RDP session.
↳ allowed_clipboard_remote_to_local_formats	array	Clipboard formats allowed when copying from remote RDP session to local machine.
↳ ssh	json	The SSH-specific rules that define how users may connect to the targets secured by your application.
↳ allow_email_alias	boolean	Enables using Identity Provider email alias as SSH username.
↳ usernames	array	Contains the Unix usernames that may be used when connecting over SSH.
isolation_required	boolean	Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
mfa_config	json	Configures multi-factor authentication (MFA) settings for infrastructure applications.
↳ allowed_authenticators	array	Lists the MFA methods that users can authenticate with. For infrastructure applications, supported values are piv_key and ssh_fido2_key.
↳ mfa_disabled	boolean	Indicates whether to disable MFA for this resource. This option is available at the application and policy level.
↳ session_duration	string	Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples: 5m or 24h.
purpose_justification_prompt	string	A custom message that will appear on the purpose justification screen.
purpose_justification_required	boolean	Require users to enter a justification when they log in to the application.
session_duration	string	The amount of time that tokens issued for the application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
created_at	string	created at
decision	string	The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Values: allow, deny, non_identity, bypass.
exclude	array	Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
id	string	The UUID of the policy
include	array	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
name	string	The name of the Access policy.
require	array	Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
updated_at	string	updated at
account_id	string	Identifier.
precedence	number	The order of execution for this policy. Must be unique for each policy within an app.

Cloudflare Get Access Service Token

Fetches a single service token.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
serviceTokenId	string	Yes	Service token id
apiKey	string	Yes	Cloudflare API token

Output

Parameter	Type	Description
client_id	string	The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
created_at	string	created at
duration	string	The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m, or the special value forever for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).
enabled	boolean	Whether the service token is enabled.
expires_at	string	expires at
id	string	UUID.
last_seen_at	string	last seen at
leak_report_url	string	Where the leaked client_secret was found, if provided by the reporter. Omitted if the token has not been reported as leaked.
leak_reported_at	string	When a secret scanning partner reported this service token's client_secret as leaked. A leaked service token is disabled and must be rotated before it can be re-enabled. Cleared once the secret is rotated. Omitted if the token has not been reported as leaked.
leak_reporter	string	The secret scanning partner that reported the leak. Omitted if the token has not been reported as leaked.
name	string	The name of the service token.
updated_at	string	updated at

Cloudflare Get Dns Record

Retrieves details for a specific DNS record in the zone.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	Zone id
recordId	string	Yes	Dns record id
apiKey	string	Yes	Cloudflare API token
include_shadow_metadata	boolean	No	Whether to include shadow metadata in the meta field of each record in the response. See [Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records).

Output

Parameter	Type	Description
comment	string	Comments or notes about the DNS record. This field has no effect on DNS responses.
name	string	Complete DNS record name, including the zone name, in Punycode.
proxied	boolean	Whether the record is receiving the performance and security benefits of Cloudflare.
settings	json	Settings for the DNS record.
↳ ipv4_only	boolean	When enabled, only A records will be generated, and AAAA records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
↳ ipv6_only	boolean	When enabled, only AAAA records will be generated, and A records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
↳ flatten_cname	boolean	If enabled, causes the CNAME record to be resolved externally and the resulting address records (e.g., A and AAAA) to be returned instead of the CNAME record itself. This setting is unavailable for proxied records, since they are always flattened.
tags	array	Custom tags for the DNS record. This field has no effect on DNS responses.
ttl	number	Time To Live (TTL) of the DNS record in seconds. Setting to 1 means 'automatic'. Value must be between 60 and 86400, with the minimum reduced to 30 for Enterprise zones. Values: 1.
content	string	Formatted URI content. See 'data' to set URI properties.
private_routing	boolean	Enables private network routing to the origin.
type	string	Record type. Values: A, AAAA, CNAME, MX, NS, OPENPGPKEY, PTR, TXT, CAA, CERT, DNSKEY, DS, HTTPS, LOC, NAPTR, SMIMEA, SRV, SSHFP, SVCB, TLSA, URI.
priority	number	Required for MX and URI records; ignored for other record types (but may still be returned by the API). Records with lower priorities are preferred. This field is to be deprecated in favor of the priority field within the data map.
data	json	Structured record data. The available fields depend on the DNS record type.
↳ flags	json	Flags.
↳ tag	string	Name of the property controlled by this record (e.g.: issue, issuewild, iodef).
↳ value	string	Value.
↳ algorithm	number	Algorithm.
↳ certificate	string	Certificate.
↳ key_tag	number	Key Tag.
↳ type	number	Type.
↳ protocol	number	Protocol.
↳ public_key	string	Public Key.
↳ digest	string	Digest.
↳ digest_type	number	Digest Type.
↳ priority	number	Priority.
↳ target	string	The record content.
↳ altitude	number	Altitude of location in meters.
↳ lat_degrees	number	Degrees of latitude.
↳ lat_direction	string	Latitude direction. Values: N, S.
↳ lat_minutes	number	Minutes of latitude.
↳ lat_seconds	number	Seconds of latitude.
↳ long_degrees	number	Degrees of longitude.
↳ long_direction	string	Longitude direction. Values: E, W.
↳ long_minutes	number	Minutes of longitude.
↳ long_seconds	number	Seconds of longitude.
↳ precision_horz	number	Horizontal precision of location.
↳ precision_vert	number	Vertical precision of location.
↳ size	number	Size of location in meters.
↳ order	number	Order.
↳ preference	number	Preference.
↳ regex	string	Regex.
↳ replacement	string	Replacement.
↳ service	string	Service.
↳ matching_type	number	Matching Type.
↳ selector	number	Selector.
↳ usage	number	Usage.
↳ port	number	The port of the service.
↳ weight	number	The record weight.
↳ fingerprint	string	Fingerprint.
comment_modified_on	string	When the record comment was last modified. Omitted if there is no comment.
created_on	string	When the record was created.
id	string	Identifier.
meta	json	Extra Cloudflare-specific metadata about the record.
↳ dead_glue	boolean	Whether this glue record is not served because a shallower NS delegation takes precedence over the deeper delegation that needs it.
↳ is_glue	boolean	Whether this A or AAAA record is glue for a subdomain NS delegation. See [Glue records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records#glue-records).
↳ shadowed_by	array	IDs of the NS records that shadow this record. See [Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records).
↳ shadowed_records_count	number	Number of records shadowed by this NS delegation. See [Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records).
modified_on	string	When the record was last modified.
proxiable	boolean	Whether the record can be proxied by Cloudflare or not.
tags_modified_on	string	When the record tags were last modified. Omitted if there are no tags.
zone_id	string	Legacy DNS response zone ID when returned by Cloudflare
zone_name	string	Legacy DNS response zone name when returned by Cloudflare
locked	boolean	Legacy DNS response lock flag when returned by Cloudflare

Cloudflare Get R2 Bucket

Reads the metadata of a single R2 object storage bucket. Requires an API token with Account Workers R2 Storage Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	The Cloudflare account ID. R2 buckets are account-scoped
bucketName	string	Yes	The name of the bucket to read
jurisdiction	string	No	Data-residency jurisdiction the bucket lives in: default, eu, or fedramp
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
creation_date	string	Creation timestamp.
jurisdiction	string	Jurisdiction where objects in this bucket are guaranteed to be stored. Values: default, eu, us, fedramp, fedramp-high.
location	string	Location of the bucket. Values: apac, eeur, enam, weur, wnam, oc.
name	string	Name of the bucket.
storage_class	string	Storage class for newly uploaded objects, unless specified otherwise. Values: Standard, InfrequentAccess.

Cloudflare Get R2 Bucket Cors

Get the CORS policy for a bucket.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
bucketName	string	Yes	Bucket name
apiKey	string	Yes	Cloudflare API token
jurisdiction	string	No	Jurisdiction where objects in this bucket are guaranteed to be stored.

Output

Parameter	Type	Description
rules	array	rules
↳ allowed	json	Object specifying allowed origins, methods and headers for this CORS rule.
↳ headers	array	Specifies the value for the Access-Control-Allow-Headers header R2 sets when requesting objects in this bucket from a browser. Cross-origin requests that include custom headers (e.g. x-user-id) should specify these headers as AllowedHeaders.
↳ methods	array	Specifies the value for the Access-Control-Allow-Methods header R2 sets when requesting objects in a bucket from a browser.
↳ origins	array	Specifies the value for the Access-Control-Allow-Origin header R2 sets when requesting objects in a bucket from a browser.
↳ exposeHeaders	array	Specifies the headers that can be exposed back, and accessed by, the JavaScript making the cross-origin request. If you need to access headers beyond the safelisted response headers, such as Content-Encoding or cf-cache-status, you must specify it here.
↳ id	string	Identifier for this rule.
↳ maxAgeSeconds	number	Specifies the amount of time (in seconds) browsers are allowed to cache CORS preflight responses. Browsers may limit this to 2 hours or less, even if the maximum value (86400) is specified.

Cloudflare Get R2 Bucket Lifecycle

Get object lifecycle rules for a bucket.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
bucketName	string	Yes	Bucket name
apiKey	string	Yes	Cloudflare API token
jurisdiction	string	No	Jurisdiction where objects in this bucket are guaranteed to be stored.

Output

Parameter	Type	Description
rules	array	rules
↳ abortMultipartUploadsTransition	json	Transition to abort ongoing multipart uploads.
↳ condition	json	Condition for lifecycle transitions to apply after an object reaches an age in seconds.
↳ maxAge	number	maxAge
↳ type	string	type Values: Age.
↳ conditions	json	Conditions that apply to all transitions of this rule.
↳ prefix	string	Transitions will only apply to objects/uploads in the bucket that start with the given prefix, an empty prefix can be provided to scope rule to all objects/uploads.
↳ deleteObjectsTransition	json	Transition to delete objects.
↳ condition	json	Condition for lifecycle transitions to apply on a specific date.
↳ maxAge	number	maxAge
↳ type	string	type Values: Age, Date.
↳ date	string	date
↳ enabled	boolean	Whether or not this rule is in effect.
↳ id	string	Unique identifier for this rule.
↳ storageClassTransitions	array	Transitions to change the storage class of objects.
↳ condition	json	Condition for lifecycle transitions to apply on a specific date.
↳ maxAge	number	maxAge
↳ type	string	type Values: Age, Date.
↳ date	string	date
↳ storageClass	string	storageClass Values: InfrequentAccess.

Cloudflare Get Ruleset

Reads a single zone ruleset including every rule it contains, in evaluation order. Requires an API token with Zone WAF Read (or another matching ruleset Read permission).

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	The zone ID that owns the ruleset
rulesetId	string	Yes	The ruleset ID to read
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
description	string	An informative description of the ruleset.
id	string	The unique ID of the ruleset.
last_updated	string	The timestamp of when the ruleset was last modified.
name	string	The human-readable name of the ruleset.
version	string	The version of the ruleset.
kind	string	The kind of the ruleset. Values: managed, custom, root, zone.
phase	string	The phase of the ruleset.
rules	array	The list of rules in the ruleset.
↳ action	string	The action to perform when the rule matches.
↳ action_parameters	json	The parameters configuring the rule's action.
↳ response	json	The response to show when the block is applied.
↳ content	string	The content to return.
↳ content_type	string	The type of the content to return.
↳ status_code	number	The status code to return.
↳ algorithms	array	Custom order for compression algorithms.
↳ name	string	Name of the compression algorithm to enable. Values: none, auto, default, gzip, brotli, zstd.
↳ id	string	The ID of the ruleset to execute.
↳ matched_data	json	The configuration to use for matched data logging.
↳ public_key	string	The public key to encrypt matched data logs with.
↳ overrides	json	A set of overrides to apply to the target ruleset.
↳ action	string	An action to override all rules with. This option has lower precedence than rule and category overrides.
↳ categories	array	A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
↳ action	string	The action to override rules in the category with.
↳ category	string	The name of the category to override.
↳ enabled	boolean	Whether to enable execution of rules in the category.
↳ sensitivity_level	string	The sensitivity level to use for rules in the category. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ enabled	boolean	Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
↳ rules	array	A list of rule-level overrides. This option has the highest precedence.
↳ action	string	The action to override the rule with.
↳ enabled	boolean	Whether to enable execution of the rule.
↳ id	string	The ID of the rule to override.
↳ score_threshold	number	The score threshold to use for the rule.
↳ sensitivity_level	string	The sensitivity level to use for the rule. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ sensitivity_level	string	A sensitivity level to set for all rules. This option has lower precedence than rule and category overrides and is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ cookie_fields	array	The cookie fields to log.
↳ name	string	The name of the cookie.
↳ raw_response_fields	array	The raw response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ request_fields	array	The raw request fields to log.
↳ name	string	The name of the header.
↳ response_fields	array	The transformed response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ transformed_request_fields	array	The transformed request fields to log.
↳ name	string	The name of the header.
↳ from_list	json	A redirect based on a bulk list lookup.
↳ key	string	An expression that evaluates to the list lookup key.
↳ name	string	The name of the list to match against.
↳ from_value	json	A redirect based on the request properties.
↳ preserve_query_string	boolean	Whether to keep the query string of the original request.
↳ status_code	number	The status code to use for the redirect. Values: 301, 302, 303, 307, 308.
↳ target_url	json	A URL to redirect the request to.
↳ expression	string	An expression that evaluates to a URL to redirect the request to.
↳ value	string	A URL to redirect the request to.
↳ headers	json	A map of headers to rewrite.
↳ uri	json	A URI query rewrite.
↳ path	json	A URI path rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI path to.
↳ value	string	A value to rewrite the URI path to.
↳ query	json	A URI query rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI query to.
↳ value	string	A value to rewrite the URI query to.
↳ origin	boolean	Whether to propagate the rewritten URI to origin.
↳ host_header	string	A value to rewrite the HTTP host header to.
↳ origin	json	An origin to route to.
↳ host	string	A resolved host to route to.
↳ port	number	A destination port to route to.
↳ sni	json	A Server Name Indication (SNI) override.
↳ value	string	A value to override the SNI to.
↳ increment	number	A delta to change the score by, which can be either positive or negative.
↳ content_type	string	The content type header to set with the error response. Values: application/json, text/html, text/plain, text/xml.
↳ status_code	number	The status code to use for the error.
↳ content	string	The response content.
↳ asset_name	string	The name of a custom asset to serve as the error response.
↳ immutable	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ max-age	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ must-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ must-understand	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-cache	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ no-store	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-transform	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ private	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ proxy-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ public	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ s-maxage	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-if-error	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-while-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ additional_cacheable_ports	array	A list of additional ports that caching should be enabled on.
↳ browser_ttl	json	How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
↳ default	number	The browser TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The browser TTL mode. Values: respect_origin, bypass_by_default, override_origin, bypass.
↳ cache	boolean	Whether the request's response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
↳ cache_key	json	Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
↳ cache_by_device_type	boolean	Whether to separate cached content based on the visitor's device type.
↳ cache_deception_armor	boolean	Whether to protect from web cache deception attacks, while allowing static assets to be cached.
↳ custom_key	json	Which components of the request are included or excluded from the cache key.
↳ cookie	json	Which cookies to include in the cache key.
↳ check_presence	array	A list of cookies to check for the presence of. The presence of these cookies is included in the cache key.
↳ include	array	A list of cookies to include in the cache key.
↳ header	json	Which headers to include in the cache key.
↳ check_presence	array	A list of headers to check for the presence of. The presence of these headers is included in the cache key.
↳ contains	json	A mapping of header names to a list of values. If a header is present in the request and contains any of the values provided, its value is included in the cache key.
↳ exclude_origin	boolean	Whether to exclude the origin header in the cache key.
↳ include	array	A list of headers to include in the cache key.
↳ host	json	How to use the host in the cache key.
↳ resolved	boolean	Whether to use the resolved host in the cache key.
↳ query_string	json	Which query string parameters to include in or exclude from the cache key.
↳ exclude	json	Which query string parameters to exclude from the cache key.
↳ all	boolean	Whether to exclude all query string parameters from the cache key. Values: True.
↳ list	array	A list of query string parameters to exclude from the cache key.
↳ include	json	Which query string parameters to include in the cache key.
↳ all	boolean	Whether to include all query string parameters in the cache key. Values: True.
↳ list	array	A list of query string parameters to include in the cache key.
↳ user	json	How to use characteristics of the request user agent in the cache key.
↳ device_type	boolean	Whether to use the user agent's device type in the cache key.
↳ geo	boolean	Whether to use the user agents's country in the cache key.
↳ lang	boolean	Whether to use the user agent's language in the cache key.
↳ ignore_query_strings_order	boolean	Whether to treat requests with the same query parameters the same, regardless of the order those query parameters are in.
↳ cache_reserve	json	Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
↳ eligible	boolean	Whether Cache Reserve is enabled. If this is true and a request meets eligibility criteria, Cloudflare will write the resource to Cache Reserve.
↳ minimum_file_size	number	The minimum file size eligible for storage in Cache Reserve.
↳ edge_ttl	json	How long the Cloudflare edge network should cache the response.
↳ default	number	The edge TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The edge TTL mode. Values: respect_origin, bypass_by_default, override_origin.
↳ status_code_ttl	array	A list of TTLs to apply to specific status codes or status code ranges.
↳ status_code	number	A single status code to apply the TTL to.
↳ status_code_range	json	A range of status codes to apply the TTL to.
↳ from	number	The lower bound of the range.
↳ to	number	The upper bound of the range.
↳ value	number	The time to cache the response for (in seconds). A value of 0 is equivalent to setting the cache control header with the value "no-cache". A value of -1 is equivalent to setting the cache control header with the value of "no-store".
↳ origin_cache_control	boolean	Whether Cloudflare will aim to strictly adhere to RFC 7234.
↳ origin_error_page_passthru	boolean	Whether to generate Cloudflare error pages for issues from the origin server.
↳ origin_range_requests	json	Controls whether Cloudflare fetches a large asset from the origin as a series of range requests instead of one whole-body request.
↳ mode	string	Whether to use range requests. default is the behaviour the zone gets without this rule. Values: on, off, default.
↳ read_timeout	number	A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
↳ respect_strong_etags	boolean	Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
↳ serve_stale	json	When to serve stale content from cache.
↳ disable_stale_while_updating	boolean	Whether Cloudflare should disable serving stale content while getting the latest content from the origin.
↳ shared_dictionary	json	Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
↳ match_pattern	string	URL pattern for the Use-As-Dictionary match field. This pattern specifies which URLs can use this response as a dictionary.
↳ strip_etags	boolean	Whether to strip ETag headers from the origin response before caching.
↳ strip_last_modified	boolean	Whether to strip Last-Modified headers from the origin response before caching.
↳ strip_set_cookie	boolean	Whether to strip Set-Cookie headers from the origin response before caching.
↳ vary	json	Controls how cached responses vary based on request headers. default is required by the API and applies to any Vary response header that does not have a per-header override.
↳ default	json	Controls how response Vary headers without a per-header override contribute to the cache key.
↳ action	string	How the header value is treated when building the cache key. Values: bypass, passthrough, normalize.
↳ headers	json	A mapping of lowercase request header names to their vary configuration.
↳ operation	string	The operation to perform on the cache tags. Values: add, remove, set.
↳ values	array	A list of cache tag values.
↳ expression	string	An expression that evaluates to an array of cache tag values.
↳ automatic_https_rewrites	boolean	Whether to enable Automatic HTTPS Rewrites.
↳ autominify	json	Which file extensions to minify automatically.
↳ css	boolean	Whether to minify CSS files.
↳ html	boolean	Whether to minify HTML files.
↳ js	boolean	Whether to minify JavaScript files.
↳ bic	boolean	Whether to enable Browser Integrity Check (BIC).
↳ content_converter	boolean	Whether to enable content conversion (e.g., HTML to Markdown).
↳ disable_apps	boolean	Whether to disable Cloudflare Apps. Values: True.
↳ disable_pay_per_crawl	boolean	Whether to disable Pay Per Crawl. Values: True.
↳ disable_rum	boolean	Whether to disable Real User Monitoring (RUM). Values: True.
↳ disable_zaraz	boolean	Whether to disable Zaraz. Values: True.
↳ email_obfuscation	boolean	Whether to enable Email Obfuscation.
↳ fonts	boolean	Whether to enable Cloudflare Fonts.
↳ hotlink_protection	boolean	Whether to enable Hotlink Protection.
↳ mirage	boolean	Whether to enable Mirage.
↳ opportunistic_encryption	boolean	Whether to enable Opportunistic Encryption.
↳ polish	string	The Polish level to configure. Values: off, lossless, lossy, webp.
↳ redirects_for_ai_training	boolean	Whether to redirect verified AI training crawlers to canonical URLs found in the HTML response.
↳ request_body_buffering	string	The request body buffering mode. Values: none, standard, full.
↳ response_body_buffering	string	The response body buffering mode. Values: none, standard.
↳ rocket_loader	boolean	Whether to enable Rocket Loader.
↳ security_level	string	The Security Level to configure. Values: off, essentially_off, low, medium, high, under_attack.
↳ server_side_excludes	boolean	Whether to enable Server-Side Excludes.
↳ ssl	string	The SSL level to configure. Values: off, flexible, full, strict, origin_pull.
↳ sxg	boolean	Whether to enable Signed Exchanges (SXG).
↳ webmcp_enabled	boolean	Whether to serve the WebMCP bridge script, which exposes the page's tools to browser AI agents.
↳ webmcp_packs	array	Bundled WebMCP tool packs to activate for matching requests. An empty array disables all packs. Omitting this parameter leaves the pack selection unchanged. Does not enable the WebMCP bridge itself.
↳ phase	string	A phase to skip the execution of. This option is only compatible with the products option. Values: current.
↳ phases	array	A list of phases to skip the execution of. This option is incompatible with the rulesets option.
↳ products	array	A list of legacy security products to skip the execution of.
↳ rules	json	A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
↳ ruleset	string	A ruleset to skip the execution of. This option is incompatible with the rulesets option. Values: current.
↳ rulesets	array	A list of ruleset IDs to skip the execution of. This option is incompatible with the ruleset and phases options.
↳ link_maze	json	Enables the link maze transformation on the response.
↳ categories	array	The categories of the rule.
↳ description	string	An informative description of the rule.
↳ enabled	boolean	Whether the rule should be executed.
↳ exposed_credential_check	json	Configuration for exposed credential checking.
↳ password_expression	string	An expression that selects the password used in the credentials check.
↳ username_expression	string	An expression that selects the user ID used in the credentials check.
↳ expression	string	The expression defining which traffic will match the rule.
↳ id	string	The unique ID of the rule.
↳ last_updated	string	The timestamp of when the rule was last modified.
↳ logging	json	An object configuring the rule's logging behavior.
↳ enabled	boolean	Whether to generate a log when the rule matches.
↳ ratelimit	json	An object configuring the rule's rate limit behavior.
↳ characteristics	array	Characteristics of the request on which the rate limit counter will be incremented.
↳ counting_expression	string	An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
↳ mitigation_timeout	number	Period of time in seconds after which the action will be disabled following its first execution.
↳ period	number	Period in seconds over which the counter is being incremented.
↳ requests_per_period	number	The threshold of requests per period after which the action will be executed for the first time.
↳ requests_to_origin	boolean	Whether counting is only performed when an origin is reached.
↳ score_per_period	number	The score threshold per period for which the action will be executed the first time.
↳ score_response_header_name	string	A response header name provided by the origin, which contains the score to increment rate limit counter with.
↳ ref	string	The reference of the rule (the rule's ID by default).
↳ version	string	The version of the rule.

Cloudflare Get Phase Entry Point Ruleset

Reads the entry point ruleset for a phase on a zone, including all of its rules. This is how you find the ruleset ID you need before adding, updating, or deleting a rule — for example http_request_firewall_custom for WAF custom rules, http_request_firewall_managed for managed-ruleset deployments and overrides, or http_ratelimit for rate limiting rules. Requires an API token with Zone WAF Read (or another matching ruleset Read permission).

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	The zone ID to read the phase entry point for
phase	string	Yes	The ruleset phase, e.g. http_request_firewall_custom, http_request_firewall_managed, http_ratelimit, http_request_transform, http_request_dynamic_redirect
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
description	string	An informative description of the ruleset.
id	string	The unique ID of the ruleset.
last_updated	string	The timestamp of when the ruleset was last modified.
name	string	The human-readable name of the ruleset.
version	string	The version of the ruleset.
kind	string	The kind of the ruleset. Values: managed, custom, root, zone.
phase	string	The phase of the ruleset.
rules	array	The list of rules in the ruleset.
↳ action	string	The action to perform when the rule matches.
↳ action_parameters	json	The parameters configuring the rule's action.
↳ response	json	The response to show when the block is applied.
↳ content	string	The content to return.
↳ content_type	string	The type of the content to return.
↳ status_code	number	The status code to return.
↳ algorithms	array	Custom order for compression algorithms.
↳ name	string	Name of the compression algorithm to enable. Values: none, auto, default, gzip, brotli, zstd.
↳ id	string	The ID of the ruleset to execute.
↳ matched_data	json	The configuration to use for matched data logging.
↳ public_key	string	The public key to encrypt matched data logs with.
↳ overrides	json	A set of overrides to apply to the target ruleset.
↳ action	string	An action to override all rules with. This option has lower precedence than rule and category overrides.
↳ categories	array	A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
↳ action	string	The action to override rules in the category with.
↳ category	string	The name of the category to override.
↳ enabled	boolean	Whether to enable execution of rules in the category.
↳ sensitivity_level	string	The sensitivity level to use for rules in the category. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ enabled	boolean	Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
↳ rules	array	A list of rule-level overrides. This option has the highest precedence.
↳ action	string	The action to override the rule with.
↳ enabled	boolean	Whether to enable execution of the rule.
↳ id	string	The ID of the rule to override.
↳ score_threshold	number	The score threshold to use for the rule.
↳ sensitivity_level	string	The sensitivity level to use for the rule. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ sensitivity_level	string	A sensitivity level to set for all rules. This option has lower precedence than rule and category overrides and is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ cookie_fields	array	The cookie fields to log.
↳ name	string	The name of the cookie.
↳ raw_response_fields	array	The raw response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ request_fields	array	The raw request fields to log.
↳ name	string	The name of the header.
↳ response_fields	array	The transformed response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ transformed_request_fields	array	The transformed request fields to log.
↳ name	string	The name of the header.
↳ from_list	json	A redirect based on a bulk list lookup.
↳ key	string	An expression that evaluates to the list lookup key.
↳ name	string	The name of the list to match against.
↳ from_value	json	A redirect based on the request properties.
↳ preserve_query_string	boolean	Whether to keep the query string of the original request.
↳ status_code	number	The status code to use for the redirect. Values: 301, 302, 303, 307, 308.
↳ target_url	json	A URL to redirect the request to.
↳ expression	string	An expression that evaluates to a URL to redirect the request to.
↳ value	string	A URL to redirect the request to.
↳ headers	json	A map of headers to rewrite.
↳ uri	json	A URI query rewrite.
↳ path	json	A URI path rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI path to.
↳ value	string	A value to rewrite the URI path to.
↳ query	json	A URI query rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI query to.
↳ value	string	A value to rewrite the URI query to.
↳ origin	boolean	Whether to propagate the rewritten URI to origin.
↳ host_header	string	A value to rewrite the HTTP host header to.
↳ origin	json	An origin to route to.
↳ host	string	A resolved host to route to.
↳ port	number	A destination port to route to.
↳ sni	json	A Server Name Indication (SNI) override.
↳ value	string	A value to override the SNI to.
↳ increment	number	A delta to change the score by, which can be either positive or negative.
↳ content_type	string	The content type header to set with the error response. Values: application/json, text/html, text/plain, text/xml.
↳ status_code	number	The status code to use for the error.
↳ content	string	The response content.
↳ asset_name	string	The name of a custom asset to serve as the error response.
↳ immutable	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ max-age	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ must-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ must-understand	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-cache	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ no-store	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-transform	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ private	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ proxy-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ public	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ s-maxage	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-if-error	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-while-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ additional_cacheable_ports	array	A list of additional ports that caching should be enabled on.
↳ browser_ttl	json	How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
↳ default	number	The browser TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The browser TTL mode. Values: respect_origin, bypass_by_default, override_origin, bypass.
↳ cache	boolean	Whether the request's response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
↳ cache_key	json	Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
↳ cache_by_device_type	boolean	Whether to separate cached content based on the visitor's device type.
↳ cache_deception_armor	boolean	Whether to protect from web cache deception attacks, while allowing static assets to be cached.
↳ custom_key	json	Which components of the request are included or excluded from the cache key.
↳ cookie	json	Which cookies to include in the cache key.
↳ check_presence	array	A list of cookies to check for the presence of. The presence of these cookies is included in the cache key.
↳ include	array	A list of cookies to include in the cache key.
↳ header	json	Which headers to include in the cache key.
↳ check_presence	array	A list of headers to check for the presence of. The presence of these headers is included in the cache key.
↳ contains	json	A mapping of header names to a list of values. If a header is present in the request and contains any of the values provided, its value is included in the cache key.
↳ exclude_origin	boolean	Whether to exclude the origin header in the cache key.
↳ include	array	A list of headers to include in the cache key.
↳ host	json	How to use the host in the cache key.
↳ resolved	boolean	Whether to use the resolved host in the cache key.
↳ query_string	json	Which query string parameters to include in or exclude from the cache key.
↳ exclude	json	Which query string parameters to exclude from the cache key.
↳ all	boolean	Whether to exclude all query string parameters from the cache key. Values: True.
↳ list	array	A list of query string parameters to exclude from the cache key.
↳ include	json	Which query string parameters to include in the cache key.
↳ all	boolean	Whether to include all query string parameters in the cache key. Values: True.
↳ list	array	A list of query string parameters to include in the cache key.
↳ user	json	How to use characteristics of the request user agent in the cache key.
↳ device_type	boolean	Whether to use the user agent's device type in the cache key.
↳ geo	boolean	Whether to use the user agents's country in the cache key.
↳ lang	boolean	Whether to use the user agent's language in the cache key.
↳ ignore_query_strings_order	boolean	Whether to treat requests with the same query parameters the same, regardless of the order those query parameters are in.
↳ cache_reserve	json	Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
↳ eligible	boolean	Whether Cache Reserve is enabled. If this is true and a request meets eligibility criteria, Cloudflare will write the resource to Cache Reserve.
↳ minimum_file_size	number	The minimum file size eligible for storage in Cache Reserve.
↳ edge_ttl	json	How long the Cloudflare edge network should cache the response.
↳ default	number	The edge TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The edge TTL mode. Values: respect_origin, bypass_by_default, override_origin.
↳ status_code_ttl	array	A list of TTLs to apply to specific status codes or status code ranges.
↳ status_code	number	A single status code to apply the TTL to.
↳ status_code_range	json	A range of status codes to apply the TTL to.
↳ from	number	The lower bound of the range.
↳ to	number	The upper bound of the range.
↳ value	number	The time to cache the response for (in seconds). A value of 0 is equivalent to setting the cache control header with the value "no-cache". A value of -1 is equivalent to setting the cache control header with the value of "no-store".
↳ origin_cache_control	boolean	Whether Cloudflare will aim to strictly adhere to RFC 7234.
↳ origin_error_page_passthru	boolean	Whether to generate Cloudflare error pages for issues from the origin server.
↳ origin_range_requests	json	Controls whether Cloudflare fetches a large asset from the origin as a series of range requests instead of one whole-body request.
↳ mode	string	Whether to use range requests. default is the behaviour the zone gets without this rule. Values: on, off, default.
↳ read_timeout	number	A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
↳ respect_strong_etags	boolean	Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
↳ serve_stale	json	When to serve stale content from cache.
↳ disable_stale_while_updating	boolean	Whether Cloudflare should disable serving stale content while getting the latest content from the origin.
↳ shared_dictionary	json	Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
↳ match_pattern	string	URL pattern for the Use-As-Dictionary match field. This pattern specifies which URLs can use this response as a dictionary.
↳ strip_etags	boolean	Whether to strip ETag headers from the origin response before caching.
↳ strip_last_modified	boolean	Whether to strip Last-Modified headers from the origin response before caching.
↳ strip_set_cookie	boolean	Whether to strip Set-Cookie headers from the origin response before caching.
↳ vary	json	Controls how cached responses vary based on request headers. default is required by the API and applies to any Vary response header that does not have a per-header override.
↳ default	json	Controls how response Vary headers without a per-header override contribute to the cache key.
↳ action	string	How the header value is treated when building the cache key. Values: bypass, passthrough, normalize.
↳ headers	json	A mapping of lowercase request header names to their vary configuration.
↳ operation	string	The operation to perform on the cache tags. Values: add, remove, set.
↳ values	array	A list of cache tag values.
↳ expression	string	An expression that evaluates to an array of cache tag values.
↳ automatic_https_rewrites	boolean	Whether to enable Automatic HTTPS Rewrites.
↳ autominify	json	Which file extensions to minify automatically.
↳ css	boolean	Whether to minify CSS files.
↳ html	boolean	Whether to minify HTML files.
↳ js	boolean	Whether to minify JavaScript files.
↳ bic	boolean	Whether to enable Browser Integrity Check (BIC).
↳ content_converter	boolean	Whether to enable content conversion (e.g., HTML to Markdown).
↳ disable_apps	boolean	Whether to disable Cloudflare Apps. Values: True.
↳ disable_pay_per_crawl	boolean	Whether to disable Pay Per Crawl. Values: True.
↳ disable_rum	boolean	Whether to disable Real User Monitoring (RUM). Values: True.
↳ disable_zaraz	boolean	Whether to disable Zaraz. Values: True.
↳ email_obfuscation	boolean	Whether to enable Email Obfuscation.
↳ fonts	boolean	Whether to enable Cloudflare Fonts.
↳ hotlink_protection	boolean	Whether to enable Hotlink Protection.
↳ mirage	boolean	Whether to enable Mirage.
↳ opportunistic_encryption	boolean	Whether to enable Opportunistic Encryption.
↳ polish	string	The Polish level to configure. Values: off, lossless, lossy, webp.
↳ redirects_for_ai_training	boolean	Whether to redirect verified AI training crawlers to canonical URLs found in the HTML response.
↳ request_body_buffering	string	The request body buffering mode. Values: none, standard, full.
↳ response_body_buffering	string	The response body buffering mode. Values: none, standard.
↳ rocket_loader	boolean	Whether to enable Rocket Loader.
↳ security_level	string	The Security Level to configure. Values: off, essentially_off, low, medium, high, under_attack.
↳ server_side_excludes	boolean	Whether to enable Server-Side Excludes.
↳ ssl	string	The SSL level to configure. Values: off, flexible, full, strict, origin_pull.
↳ sxg	boolean	Whether to enable Signed Exchanges (SXG).
↳ webmcp_enabled	boolean	Whether to serve the WebMCP bridge script, which exposes the page's tools to browser AI agents.
↳ webmcp_packs	array	Bundled WebMCP tool packs to activate for matching requests. An empty array disables all packs. Omitting this parameter leaves the pack selection unchanged. Does not enable the WebMCP bridge itself.
↳ phase	string	A phase to skip the execution of. This option is only compatible with the products option. Values: current.
↳ phases	array	A list of phases to skip the execution of. This option is incompatible with the rulesets option.
↳ products	array	A list of legacy security products to skip the execution of.
↳ rules	json	A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
↳ ruleset	string	A ruleset to skip the execution of. This option is incompatible with the rulesets option. Values: current.
↳ rulesets	array	A list of ruleset IDs to skip the execution of. This option is incompatible with the ruleset and phases options.
↳ link_maze	json	Enables the link maze transformation on the response.
↳ categories	array	The categories of the rule.
↳ description	string	An informative description of the rule.
↳ enabled	boolean	Whether the rule should be executed.
↳ exposed_credential_check	json	Configuration for exposed credential checking.
↳ password_expression	string	An expression that selects the password used in the credentials check.
↳ username_expression	string	An expression that selects the user ID used in the credentials check.
↳ expression	string	The expression defining which traffic will match the rule.
↳ id	string	The unique ID of the rule.
↳ last_updated	string	The timestamp of when the rule was last modified.
↳ logging	json	An object configuring the rule's logging behavior.
↳ enabled	boolean	Whether to generate a log when the rule matches.
↳ ratelimit	json	An object configuring the rule's rate limit behavior.
↳ characteristics	array	Characteristics of the request on which the rate limit counter will be incremented.
↳ counting_expression	string	An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
↳ mitigation_timeout	number	Period of time in seconds after which the action will be disabled following its first execution.
↳ period	number	Period in seconds over which the counter is being incremented.
↳ requests_per_period	number	The threshold of requests per period after which the action will be executed for the first time.
↳ requests_to_origin	boolean	Whether counting is only performed when an origin is reached.
↳ score_per_period	number	The score threshold per period for which the action will be executed the first time.
↳ score_response_header_name	string	A response header name provided by the origin, which contains the score to increment rate limit counter with.
↳ ref	string	The reference of the rule (the rule's ID by default).
↳ version	string	The version of the rule.

Cloudflare Get Tunnel

Reads a single Cloudflare Tunnel (cloudflared), including its health status and active connector connections. Requires an API token with Account Cloudflare Tunnel Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	The Cloudflare account ID. Tunnels are account-scoped
tunnelId	string	Yes	The tunnel ID to read
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
account_tag	string	Cloudflare account ID
config_src	string	Indicates if this is a locally or remotely configured tunnel. If local, manage the tunnel using a YAML file on the origin machine. If cloudflare, manage the tunnel on the Zero Trust dashboard. Values: local, cloudflare.
connections	array	The Cloudflare Tunnel connections between your origin and Cloudflare's edge.
↳ client_id	string	UUID of the Cloudflare Tunnel connector.
↳ client_version	string	The cloudflared version used to establish this connection.
↳ colo_name	string	The Cloudflare data center used for this connection.
↳ id	string	UUID of the Cloudflare Tunnel connection.
↳ is_pending_reconnect	boolean	Cloudflare continues to track connections for several minutes after they disconnect. This is an optimization to improve latency and reliability of reconnecting. If true, the connection has disconnected but is still being tracked. If false, the connection is actively serving traffic.
↳ opened_at	string	Timestamp of when the connection was established.
↳ origin_ip	string	The public IP address of the host running cloudflared.
↳ uuid	string	UUID of the Cloudflare Tunnel connection.
conns_active_at	string	Timestamp of when the tunnel established at least one connection to Cloudflare's edge. If null, the tunnel is inactive.
conns_inactive_at	string	Timestamp of when the tunnel became inactive (no connections to Cloudflare's edge). If null, the tunnel is active.
created_at	string	Timestamp of when the resource was created.
deleted_at	string	Timestamp of when the resource was deleted. If null, the resource has not been deleted.
id	string	UUID of the tunnel.
metadata	json	Metadata associated with the tunnel.
name	string	A user-friendly name for a tunnel.
remote_config	boolean	If true, the tunnel can be configured remotely from the Zero Trust dashboard. If false, the tunnel must be configured locally on the origin machine.
status	string	The status of the tunnel.
tun_type	string	The type of tunnel. Values: cfd_tunnel, warp_connector, warp, magic, ip_sec, gre, cni.

Cloudflare Get Tunnel Configuration

Reads the configuration of a remotely-managed Cloudflare Tunnel — its ingress rules, origin request settings, and WARP routing. Only tunnels whose configuration source is "cloudflare" have a remote configuration; locally-managed tunnels keep it in their own config file. Requires an API token with Account Cloudflare Tunnel Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	The Cloudflare account ID. Tunnels are account-scoped
tunnelId	string	Yes	The tunnel ID to read the configuration for
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
account_id	string	Identifier.
config	json	The tunnel configuration and ingress rules.
↳ ingress	array	List of public hostname definitions. At least one ingress rule needs to be defined for the tunnel.
↳ hostname	string	Public hostname for this service.
↳ originRequest	json	Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.
↳ access	json	For all L7 requests to this hostname, cloudflared will validate each request's Cf-Access-Jwt-Assertion request header.
↳ audTag	array	Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.
↳ required	boolean	Deny traffic that has not fulfilled Access authorization.
↳ teamName	string	teamName
↳ caPool	string	Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
↳ connectTimeout	number	Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.
↳ disableChunkedEncoding	boolean	Disables chunked transfer encoding. Useful if you are running a WSGI server.
↳ http2Origin	boolean	Attempt to connect to origin using HTTP2. Origin must be configured as https.
↳ httpHostHeader	string	Sets the HTTP Host header on requests sent to the local service.
↳ keepAliveConnections	number	Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
↳ keepAliveTimeout	number	Timeout after which an idle keepalive connection can be discarded.
↳ matchSNItoHost	boolean	Auto configure the Hostname on the origin server certificate.
↳ noHappyEyeballs	boolean	Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
↳ noTLSVerify	boolean	Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
↳ originServerName	string	Hostname that cloudflared should expect from your origin server certificate.
↳ proxyType	string	cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
↳ tcpKeepAlive	number	The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
↳ tlsTimeout	number	Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
↳ path	string	Requests with this path route to this public hostname.
↳ service	string	Protocol and address of destination server. Supported protocols: http://, https://, unix://, tcp://, ssh://, rdp://, unix+tls://, smb://. Alternatively can return a HTTP status code http_status:[code] e.g. 'http_status:404'.
↳ originRequest	json	Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.
↳ access	json	For all L7 requests to this hostname, cloudflared will validate each request's Cf-Access-Jwt-Assertion request header.
↳ audTag	array	Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.
↳ required	boolean	Deny traffic that has not fulfilled Access authorization.
↳ teamName	string	teamName
↳ caPool	string	Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
↳ connectTimeout	number	Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.
↳ disableChunkedEncoding	boolean	Disables chunked transfer encoding. Useful if you are running a WSGI server.
↳ http2Origin	boolean	Attempt to connect to origin using HTTP2. Origin must be configured as https.
↳ httpHostHeader	string	Sets the HTTP Host header on requests sent to the local service.
↳ keepAliveConnections	number	Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
↳ keepAliveTimeout	number	Timeout after which an idle keepalive connection can be discarded.
↳ matchSNItoHost	boolean	Auto configure the Hostname on the origin server certificate.
↳ noHappyEyeballs	boolean	Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
↳ noTLSVerify	boolean	Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
↳ originServerName	string	Hostname that cloudflared should expect from your origin server certificate.
↳ proxyType	string	cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
↳ tcpKeepAlive	number	The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
↳ tlsTimeout	number	Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
↳ warp-routing	json	Enable private network access from WARP users to private network routes. This is enabled if the tunnel has an assigned route.
↳ enabled	boolean	enabled
created_at	string	created at
source	string	Indicates if this is a locally or remotely configured tunnel. If local, manage the tunnel using a YAML file on the origin machine. If cloudflare, manage the tunnel's configuration on the Zero Trust dashboard. Values: local, cloudflare.
tunnel_id	string	UUID of the tunnel.
version	number	The version of the Tunnel Configuration.

Cloudflare Get Tunnel Token

Gets the connector token used to run a remotely managed Cloudflare Tunnel with cloudflared.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Cloudflare account ID
tunnelId	string	Yes	Cloudflare Tunnel ID
apiKey	string	Yes	Cloudflare API token

Output

Parameter	Type	Description
token	string	Token for connecting cloudflared to the tunnel

Cloudflare Get Worker Route

Returns information about a Worker route, including URL pattern and Worker.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	Zone id
routeId	string	Yes	Route id
apiKey	string	Yes	Cloudflare API token

Output

Parameter	Type	Description
id	string	Identifier.
pattern	string	Pattern to match incoming requests against. [Learn more](https://developers.cloudflare.com/workers/configuration/routing/routes/#matching-behavior).
script	string	Name of the script to run if the route matches.

Cloudflare Get Worker Script Settings

Reads the deployment settings of a single Workers script — bindings, compatibility date and flags, limits, observability, placement, and tail consumers. The plain "get script" endpoint in the Cloudflare API returns raw JavaScript source rather than JSON, so this settings endpoint is the structured way to inspect one script. Requires an API token with Account Workers Scripts Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	The Cloudflare account ID. Workers scripts are account-scoped
scriptName	string	Yes	The name of the Workers script to read settings for
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
annotations	json	Annotations for the Worker version. Annotations are not inherited across settings updates; omitting this field means the new version will have no annotations.
↳ workers/message	string	Human-readable message about the version. Truncated to 1000 bytes if longer.
↳ workers/tag	string	User-provided identifier for the version. Maximum 100 bytes.
↳ workers/triggered_by	string	Operation that triggered the creation of the version. This is read-only and set by the server.
bindings	array	List of bindings attached to a Worker. You can find more about bindings on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/#bindings.
↳ name	string	A JavaScript variable name for the binding.
↳ type	string	The kind of resource that the binding provides.
↳ instance_name	string	The user-chosen instance name. Must exist at deploy time. The worker can search, chat, update, and manage items/jobs on this instance.
↳ namespace	string	The name of the dispatch namespace.
↳ dataset	string	The name of the dataset to bind to.
↳ database_id	string	Identifier of the D1 database to bind to.
↳ id	string	Identifier of the Hyperdrive connection to bind to.
↳ part	string	The name of the file containing the WebAssembly module content. Only accepted for service worker syntax Workers.
↳ outbound	json	Outbound worker.
↳ params	array	Pass information from the Dispatch Worker to the Outbound Worker through the parameters.
↳ name	string	Name of the parameter.
↳ worker	json	Outbound worker.
↳ entrypoint	string	Entrypoint to invoke on the outbound worker.
↳ environment	string	Environment of the outbound worker.
↳ service	string	Name of the outbound worker.
↳ class_name	string	Class name of the Workflow. Should only be provided if the Workflow belongs to this script.
↳ dispatch_namespace	string	The dispatch namespace the Durable Object script belongs to.
↳ environment	string	Optional environment if the Worker utilizes one.
↳ namespace_id	string	Identifier of the rate limit namespace to bind to.
↳ script_name	string	Script name that contains the Workflow. If not provided, defaults to this script name.
↳ old_name	string	The old name of the inherited binding. If set, the binding will be renamed from old_name to name in the new version. If not set, the binding will keep the same name between versions.
↳ version_id	string	Identifier for the version to inherit the binding from.
↳ json	json	JSON data to use.
↳ certificate_id	string	Identifier of the certificate to bind to.
↳ text	string	The secret value to use.
↳ pipeline	string	Name of the Pipeline to bind to.
↳ stream	string	ID of a K2 stream owned by the account deploying the Worker.
↳ queue_name	string	Name of the Queue to bind to.
↳ simple	json	The rate limit configuration.
↳ limit	number	The limit (requests per period).
↳ mitigation_timeout	number	Duration in seconds to apply the mitigation action after the rate limit is exceeded. Valid values are 0 (disabled), 10, or multiples of 60 up to 86400. Must be greater than or equal to the period when non-zero.
↳ period	number	The period in seconds.
↳ bucket_name	string	R2 bucket to bind to.
↳ jurisdiction	string	The [jurisdiction](https://developers.cloudflare.com/r2/reference/data-location/#jurisdictional-restrictions) of the R2 bucket. Values: eu, fedramp, fedramp-high, us.
↳ allowed_destination_addresses	array	List of allowed destination addresses.
↳ allowed_sender_addresses	array	List of allowed sender addresses.
↳ destination_address	string	Destination address for the email.
↳ entrypoint	string	Entrypoint to invoke on the target Worker.
↳ service	string	Name of Worker to bind to.
↳ index_name	string	Name of the Vectorize index to bind to.
↳ secret_name	string	Name of the secret in the store.
↳ store_id	string	ID of the store containing the secret.
↳ app_id	string	ID of the Flagship app to bind to for feature flag evaluation.
↳ algorithm	json	Algorithm-specific key parameters. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#algorithm).
↳ format	string	Data format of the key. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#format). Values: raw, pkcs8, spki, jwk.
↳ key_base64	string	Base64-encoded key data. Required if format is "raw", "pkcs8", or "spki".
↳ key_jwk	json	Key data in [JSON Web Key](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#json_web_key) format. Required if format is "jwk".
↳ usages	array	Allowed operations with the key. [Learn more](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey#keyUsages).
↳ workflow_name	string	Name of the Workflow to bind to.
↳ service_id	string	Identifier of the VPC service to bind to.
↳ identity	string	Enables Gateway identity for the binding. Requires network_id to be "cf1:network" and cannot be combined with tunnel_id. Values: runtime-email-alpha.
↳ network_id	string	Identifier of the network to bind to. Only "cf1:network" is currently supported. Mutually exclusive with tunnel_id.
↳ tunnel_id	string	UUID of the Cloudflare Tunnel to bind to. Mutually exclusive with network_id.
cache_options	json	Global CacheW configuration for the Worker. When caching is on, the platform provisions a cloudflare.app zone for the Worker. A type: worker entry in the exports map can override this value for a single entrypoint.
↳ cross_version_cache	boolean	Whether cached responses are shared across Worker version uploads. This is independent of enabled. It can stay true while caching is off, so the preference survives turning caching off and back on.
↳ enabled	boolean	Whether caching is enabled for this Worker.
compatibility_date	string	Date indicating targeted support in the Workers runtime. Backwards incompatible fixes to the runtime following this date will not affect this Worker.
compatibility_flags	array	Flags that enable or disable certain features in the Workers runtime. Used to enable upcoming features or opt in or out of specific changes not included in a compatibility_date.
exports	json	Declarative exports for the Worker, keyed by export name. Worker entrypoint entries (type: worker) carry cache configuration for that entrypoint. Durable Object entries (type: durable-object) are also configured here and drive namespace reconciliation. At most 100 entries; class names are at most 128 characters.
exports_reconciliation	json	Summary of what the declarative exports reconciliation did on this upload.
↳ created	array	Class names for which a new namespace was provisioned.
↳ deleted	array	Class names whose namespace was deleted by a deleted tombstone.
↳ info	array	Non-blocking info entries (stale tombstones, tombstone applied with class still in code). See exports_reconciliation_info.
↳ class	string	The class name the info entry is about.
↳ message	string	Human-readable explanation.
↳ namespace_id	string	The provisioned namespace the entry relates to, when applicable.
↳ referencing_scripts	array	Other Workers in the account that still bind to the affected class. Advisory: while non-empty the tombstone is not yet safe to remove — redeploy these Workers with bindings re-pointed first.
↳ scenario	string	Stable, machine-readable tag identifying which reconciliation scenario produced an error, warning, or info entry.
↳ removable_entries	array	Source class names whose tombstone entry is now stale and safe to delete from exports (no remaining referencing scripts).
↳ renamed	array	Applied renamed tombstones.
↳ from	string	The original (source) class name.
↳ to	string	The new class name (renamed_to).
↳ transfer_pending	array	Phase-1 transfer hints recorded on the target side.
↳ class	string	The target-side class name awaiting transfer.
↳ from	string	The source script the namespace will be transferred from.
↳ transferred	array	Committed transferred tombstones (phase-2).
↳ class	string	The source class name that was transferred.
↳ phase	string	The transfer phase. Currently always committed. Values: committed.
↳ to	string	The destination script that now owns the namespace.
↳ updated	array	Class names whose provisioned namespace was mutated in place.
↳ warnings	array	Non-blocking warnings. See exports_reconciliation_warning.
↳ class	string	The class name the warning is about.
↳ message	string	Human-readable explanation of the warning.
↳ namespace_id	string	The provisioned namespace the warning relates to, when applicable.
↳ scenario	string	Stable, machine-readable tag identifying which reconciliation scenario produced an error, warning, or info entry.
limits	json	Limits to apply for this Worker.
↳ cpu_ms	number	The amount of CPU time this Worker can use in milliseconds.
↳ subrequests	number	The number of subrequests this Worker can make per request.
logpush	boolean	Whether Logpush is turned on for the Worker.
migrations	json	A single set of migrations to apply.
↳ new_tag	string	Tag to set as the latest migration tag.
↳ old_tag	string	Tag used to verify against the latest migration tag for this Worker. If they don't match, the upload is rejected.
↳ deleted_classes	array	A list of classes to delete Durable Object namespaces from.
↳ new_classes	array	A list of classes to create Durable Object namespaces from.
↳ new_sqlite_classes	array	A list of classes to create Durable Object namespaces with SQLite from.
↳ renamed_classes	array	A list of classes with Durable Object namespaces that were renamed.
↳ from	string	from
↳ to	string	to
↳ transferred_classes	array	A list of transfers for Durable Object namespaces from a different Worker and class to a class defined in this Worker.
↳ from	string	from
↳ from_script	string	from script
↳ to	string	to
↳ steps	array	Migrations to apply in order.
↳ deleted_classes	array	A list of classes to delete Durable Object namespaces from.
↳ new_classes	array	A list of classes to create Durable Object namespaces from.
↳ new_sqlite_classes	array	A list of classes to create Durable Object namespaces with SQLite from.
↳ renamed_classes	array	A list of classes with Durable Object namespaces that were renamed.
↳ from	string	from
↳ to	string	to
↳ transferred_classes	array	A list of transfers for Durable Object namespaces from a different Worker and class to a class defined in this Worker.
↳ from	string	from
↳ from_script	string	from script
↳ to	string	to
observability	json	Observability settings for the Worker.
↳ enabled	boolean	Whether observability is enabled for the Worker.
↳ head_sampling_rate	number	The sampling rate for incoming requests. From 0 to 1 (1 = 100%, 0.1 = 10%). Default is 1.
↳ issues	json	Real-time Issues settings for the Worker.
↳ enabled	boolean	Whether real-time Issues are enabled for the Worker.
↳ logs	json	Log settings for the Worker.
↳ destinations	array	A list of destinations where logs will be exported to.
↳ enabled	boolean	Whether logs are enabled for the Worker.
↳ head_sampling_rate	number	The sampling rate for logs. From 0 to 1 (1 = 100%, 0.1 = 10%). Default is 1.
↳ invocation_logs	boolean	Whether [invocation logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/#invocation-logs) are enabled for the Worker.
↳ persist	boolean	Whether log persistence is enabled for the Worker.
↳ redact_query_string	boolean	Whether query strings are removed from request URLs in logs and traces.
↳ traces	json	Trace settings for the Worker.
↳ destinations	array	A list of destinations where traces will be exported to.
↳ enabled	boolean	Whether traces are enabled for the Worker.
↳ head_sampling_rate	number	The sampling rate for traces. From 0 to 1 (1 = 100%, 0.1 = 10%). Default is 1.
↳ persist	boolean	Whether trace persistence is enabled for the Worker.
↳ propagation_policy	string	Controls how inbound trace context (traceparent/tracestate) headers on incoming requests are handled.
placement	json	Configuration for [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement). Specify mode='smart' for Smart Placement, or one of region/hostname/host.
↳ mode	string	Targeted placement mode. Values: smart, targeted.
↳ region	string	Cloud region for targeted placement in format 'provider:region'.
↳ hostname	string	HTTP hostname for targeted placement.
↳ host	string	TCP host and port for targeted placement.
↳ target	array	Array of placement targets (currently limited to single target).
↳ region	string	Cloud region in format 'provider:region'.
↳ hostname	string	HTTP hostname for targeted placement.
↳ host	string	TCP host:port for targeted placement.
tags	array	Tags associated with the Worker.
tail_consumers	array	List of Workers that will consume logs from the attached Worker.
↳ environment	string	Optional environment if the Worker utilizes one.
↳ namespace	string	Optional dispatch namespace the script belongs to.
↳ service	string	Name of Worker that is to be the consumer.
usage_model	string	Usage model for the Worker invocations. Values: standard, bundled, unbound.

Cloudflare Get Zone

Gets details for a specific zone (domain) by its ID.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	The zone ID to retrieve details for
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
account	json	The account the zone belongs to.
↳ id	string	Identifier
↳ name	string	The name of the account.
activated_on	string	The last time proof of ownership was detected and the zone was made active.
cname_suffix	string	Allows the customer to use a custom apex. Tenants Only Configuration.
created_on	string	When the zone was created.
development_mode	number	The interval (in seconds) from when development mode expires (positive integer) or last expired (negative integer) for the domain. If development mode has never been enabled, this value is 0.
id	string	Identifier
meta	json	Metadata about the zone.
↳ cdn_only	boolean	The zone is only configured for CDN.
↳ custom_certificate_quota	number	Number of Custom Certificates the zone can have.
↳ dns_only	boolean	The zone is only configured for DNS.
↳ foundation_dns	boolean	The zone is setup with Foundation DNS.
↳ page_rule_quota	number	Number of Page Rules a zone can have.
↳ phishing_detected	boolean	The zone has been flagged for phishing.
↳ step	number	step
modified_on	string	When the zone was last modified.
name	string	The domain name. Per [RFC 1035](https://datatracker.ietf.org/doc/html/rfc1035#section-2.3.4) the overall zone name can be up to 253 characters, with each segment ("label") not exceeding 63 characters.
name_servers	array	The name servers Cloudflare assigns to a zone.
original_dnshost	string	DNS host at the time of switching to Cloudflare.
original_name_servers	array	Original name servers before moving to Cloudflare.
original_registrar	string	Registrar for the domain at the time of switching to Cloudflare.
owner	json	The owner of the zone.
↳ id	string	Identifier
↳ name	string	Name of the owner.
↳ type	string	The type of owner.
paused	boolean	Indicates whether the zone is only using Cloudflare DNS services. A true value means the zone will not receive security or performance benefits.
permissions	array	Legacy permissions based on legacy user membership information.
plan	json	A Zones subscription information.
↳ can_subscribe	boolean	States if the subscription can be activated.
↳ currency	string	The denomination of the customer.
↳ externally_managed	boolean	If this Zone is managed by another company.
↳ frequency	string	How often the customer is billed.
↳ id	string	Identifier
↳ is_subscribed	boolean	States if the subscription active.
↳ legacy_discount	boolean	If the legacy discount applies to this Zone.
↳ legacy_id	string	The legacy name of the plan.
↳ name	string	Name of the owner.
↳ price	number	How much the customer is paying.
status	string	The zone status on Cloudflare. Values: initializing, pending, active, moved.
tenant	json	The root organizational unit that this zone belongs to (such as a tenant or organization).
↳ id	string	Identifier
↳ name	string	The name of the Tenant account.
tenant_unit	json	The immediate parent organizational unit that this zone belongs to (such as under a tenant or sub-organization).
↳ id	string	Identifier
type	string	A full zone implies that DNS is hosted with Cloudflare. A partial zone is typically a partner-hosted zone or a CNAME setup. Values: full, partial, secondary, internal.
vanity_name_servers	array	An array of domains used for custom name servers. This is only available for Business and Enterprise plans.
verification_key	string	Verification key for partial zone setup.

Cloudflare Get Zone Settings

Reads zone settings such as SSL mode, minimum TLS version, security level, and caching level. Cloudflare retired the endpoint that read every setting in one request, so each setting is read individually — name the ones you need to keep the read small. Defaults to ssl, always_use_https, min_tls_version, tls_1_3, security_level, cache_level, browser_cache_ttl, development_mode, rocket_loader, email_obfuscation, hotlink_protection, ip_geolocation, http2, http3, websockets.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	The zone ID to get settings for
settingIds	string	No	Comma-separated setting IDs to read, e.g. "ssl,min_tls_version,security_level". Leave blank to read the default set (ssl, always_use_https, min_tls_version, tls_1_3, security_level, cache_level, browser_cache_ttl, development_mode, rocket_loader, email_obfuscation, hotlink_protection, ip_geolocation, http2, http3, websockets). At most 40 settings per call.
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
settings	array	The zone settings that were readable
↳ id	string	Setting identifier (e.g., ssl, cache_level, security_level, always_use_https)
↳ value	string	Setting value as a string. Simple values returned as-is (e.g., "full", "on"). SSL Recommender returns its enabled flag. Complex values are JSON-stringified (e.g., {"css":"on","html":"on","js":"on"}).
↳ editable	boolean	Whether the setting can be modified for the current zone plan
↳ modified_on	string	ISO 8601 timestamp when the setting was last modified
↳ time_remaining	number	Development mode countdown, in seconds. Cloudflare documents this only on the zones_development_mode setting, where it is the interval from when development mode expires (positive) or last expired (negative)
unreadable	array	Requested settings Cloudflare refused, typically because the zone plan does not expose them or the setting ID does not exist
↳ id	string	The requested setting identifier
↳ error	string	Why Cloudflare would not return the setting

Cloudflare List Access Applications

Lists the Cloudflare Access (Zero Trust) applications protecting an account. Requires an API token with Account Access: Apps and Policies Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
target_attributes	string	No	Target Criteria attributes in key=value format.
accountId	string	Yes	The Cloudflare account ID. Access applications are account-scoped
name	string	No	Filter by application name
domain	string	No	Filter by the primary hostname the application secures
aud	string	No	Filter by application audience (AUD) tag
search	string	No	Free-text search across applications
exact	boolean	No	Whether the name and domain filters must match exactly
page	number	No	Page number for pagination
per_page	number	No	Number of applications per page
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
applications	array	Applications
↳ aud	string	Audience tag.
↳ created_at	string	created at
↳ id	string	UUID.
↳ updated_at	string	updated at
↳ allowed_idps	array	The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
↳ destinations	array	List of destinations secured by Access. This supersedes self_hosted_domains to allow for more flexibility in defining different types of domains. If destinations are provided, then self_hosted_domains will be ignored.
↳ overrides	array	Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations.
↳ behavior	string	The behavior to apply to matching requests. Values: public.
↳ path_pattern	string	The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard.
↳ type	string	type Values: public, private, via_mcp_server_portal, worker, preview_worker, all_workers, all_preview_workers.
↳ uri	string	The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
↳ cidr	string	The CIDR range of the destination. Single IPs will be computed as /32.
↳ hostname	string	The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
↳ l4_protocol	string	The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match. Values: tcp, udp.
↳ port_range	string	The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.
↳ vnet_id	string	The VNET ID to match the destination. When omitted, all VNETs will match.
↳ mcp_server_id	string	The MCP server id configured in ai-controls.
↳ worker_id	string	The ID of the Cloudflare Worker whose preview deployments to protect with Access.
↳ domain	string	The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.
↳ name	string	The name of the application.
↳ oauth_configuration	json	Beta: Optional configuration for managing an OAuth authorization flow controlled by Access.
↳ dynamic_client_registration	json	Settings for OAuth dynamic client registration.
↳ allow_any_on_localhost	boolean	Allows any client with redirect URIs on localhost.
↳ allow_any_on_loopback	boolean	Allows any client with redirect URIs on 127.0.0.1.
↳ allowed_uris	array	The URIs that are allowed as redirect URIs for dynamically registered clients. HTTP and HTTPS paths may end in /* to match all sub-paths. Custom-scheme URIs must be explicitly configured and match exactly.
↳ enabled	boolean	Whether dynamic client registration is enabled.
↳ enabled	boolean	Whether the OAuth configuration is enabled for this application. When set to false, Access will not handle OAuth for this application. Defaults to true if omitted. Values: True.
↳ grant	json	Settings for OAuth grant behavior.
↳ access_token_lifetime	string	The lifetime of the access token. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h.
↳ session_duration	string	The duration of the OAuth session. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h.
↳ self_hosted_domains	array	List of public domains that Access will secure. This field is deprecated in favor of destinations and will be supported until November 21, 2025. If destinations are provided, then self_hosted_domains will be ignored.
↳ type	string	The application type. Values: end_user, self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, dash_sso, infrastructure, rdp, mcp, mcp_portal, proxy_endpoint.
↳ user_populations	array	The single user population associated with this application.
↳ allow_authenticate_via_warp	boolean	When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.
↳ allow_iframe	boolean	Enables loading application content in an iFrame.
↳ app_launcher_visible	boolean	Displays the application in the App Launcher.
↳ auto_redirect_to_identity	boolean	When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
↳ cors_headers	json	cors headers
↳ allow_all_headers	boolean	Allows all HTTP request headers.
↳ allow_all_methods	boolean	Allows all HTTP request methods.
↳ allow_all_origins	boolean	Allows all origins.
↳ allow_credentials	boolean	When set to true, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.
↳ allowed_headers	array	Allowed HTTP request headers.
↳ allowed_methods	array	Allowed HTTP request methods.
↳ allowed_origins	array	Allowed origins.
↳ max_age	number	The maximum number of seconds the results of a preflight request can be cached.
↳ custom_deny_message	string	The custom error message shown to a user when they are denied access to the application.
↳ custom_deny_url	string	The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.
↳ custom_non_identity_deny_url	string	The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.
↳ custom_pages	array	The custom pages that will be displayed when applicable for this application
↳ eager_redirect_cookie_setting	boolean	Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
↳ enable_binding_cookie	boolean	Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
↳ http_only_cookie_attribute	boolean	Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
↳ logo_url	string	The image URL for the logo shown in the App Launcher dashboard.
↳ mfa_config	json	Configures multi-factor authentication (MFA) settings.
↳ allowed_authenticators	array	Lists the MFA methods that users can authenticate with.
↳ mfa_disabled	boolean	Indicates whether to disable MFA for this resource. This option is available at the application and policy level.
↳ session_duration	string	Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
↳ options_preflight_bypass	boolean	Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
↳ path_cookie_attribute	boolean	Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default
↳ read_service_tokens_from_header	string	Allows matching Access Service Tokens passed HTTP in a single header with this name.
↳ same_site_cookie_attribute	string	Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
↳ scim_config	json	Configuration for provisioning to this application via SCIM. This is currently in closed beta.
↳ authentication	json	Multiple authentication schemes
↳ password	string	Password used to authenticate with the remote SCIM service.
↳ scheme	string	The authentication scheme to use when making SCIM requests to this application. Values: httpbasic, oauthbearertoken, oauth2, access_service_token.
↳ user	string	User name used to authenticate with the remote SCIM service.
↳ token	string	Token used to authenticate with the remote SCIM service.
↳ authorization_url	string	URL used to generate the auth code used during token generation.
↳ client_id	string	Client ID of the Access service token used to authenticate with the remote service.
↳ client_secret	string	Client secret of the Access service token used to authenticate with the remote service.
↳ scopes	array	The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.
↳ token_url	string	URL used to generate the token used to authenticate with the remote SCIM service.
↳ deactivate_on_delete	boolean	If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.
↳ enabled	boolean	Whether SCIM provisioning is turned on for this application.
↳ idp_uid	string	The UID of the IdP to use as the source for SCIM resources to provision to this application.
↳ mappings	array	A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
↳ enabled	boolean	Whether or not this mapping is enabled.
↳ filter	string	A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.
↳ operations	json	Whether or not this mapping applies to creates, updates, or deletes.
↳ create	boolean	Whether or not this mapping applies to create (POST) operations.
↳ delete	boolean	Whether or not this mapping applies to DELETE operations.
↳ update	boolean	Whether or not this mapping applies to update (PATCH/PUT) operations.
↳ schema	string	Which SCIM resource type this mapping applies to.
↳ strictness	string	The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. Values: strict, passthrough.
↳ transform_jsonata	string	A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.
↳ remote_uri	string	The base URI for the application's SCIM-compatible API.
↳ service_auth_401_redirect	boolean	Returns a 401 status code when the request is blocked by a Service Auth policy.
↳ session_duration	string	The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
↳ skip_interstitial	boolean	Enables automatic authentication through cloudflared.
↳ tags	array	The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.
↳ use_clientless_isolation_app_launcher_url	boolean	Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.
↳ policies	array	policies
↳ approval_groups	array	Administrators who can approve a temporary authentication request.
↳ approvals_needed	number	The number of approvals needed to obtain access.
↳ email_addresses	array	A list of emails that can approve the access request.
↳ email_list_uuid	string	The UUID of an re-usable email list.
↳ approval_required	boolean	Requires the user to request access from an administrator at the start of each session.
↳ connection_rules	json	The rules that define how users may connect to targets secured by your application.
↳ rdp	json	The RDP-specific rules that define clipboard behavior for RDP connections.
↳ allowed_clipboard_local_to_remote_formats	array	Clipboard formats allowed when copying from local machine to remote RDP session.
↳ allowed_clipboard_remote_to_local_formats	array	Clipboard formats allowed when copying from remote RDP session to local machine.
↳ isolation_required	boolean	Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
↳ mfa_config	json	Configures multi-factor authentication (MFA) settings.
↳ allowed_authenticators	array	Lists the MFA methods that users can authenticate with.
↳ mfa_disabled	boolean	Indicates whether to disable MFA for this resource. This option is available at the application and policy level.
↳ session_duration	string	Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
↳ purpose_justification_prompt	string	A custom message that will appear on the purpose justification screen.
↳ purpose_justification_required	boolean	Require users to enter a justification when they log in to the application.
↳ session_duration	string	The amount of time that tokens issued for the application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
↳ created_at	string	created at
↳ decision	string	The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Values: allow, deny, non_identity, bypass.
↳ exclude	array	Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ id	string	The UUID of the policy
↳ include	array	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ name	string	The name of the Access policy.
↳ require	array	Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ updated_at	string	updated at
↳ account_id	string	Identifier.
↳ precedence	number	The order of execution for this policy. Must be unique for each policy within an app.
↳ saas_app	json	saas app
↳ auth_type	string	Identifier of the authentication protocol used for the saas app. Required for OIDC. Values: saml, oidc.
↳ consumer_service_url	string	The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.
↳ created_at	string	created at
↳ custom_attributes	array	custom attributes
↳ friendly_name	string	The SAML FriendlyName of the attribute.
↳ name	string	The name of the attribute.
↳ name_format	string	A globally unique name for an identity or service provider. Values: urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified, urn:oasis:names:tc:SAML:2.0:attrname-format:basic, urn:oasis:names:tc:SAML:2.0:attrname-format:uri.
↳ required	boolean	If the attribute is required when building a SAML assertion.
↳ source	json	source
↳ name	string	The name of the IdP attribute.
↳ name_by_idp	array	A mapping from IdP ID to attribute name.
↳ idp_id	string	The UID of the IdP.
↳ source_name	string	The name of the IdP provided attribute.
↳ default_relay_state	string	The URL that the user will be redirected to after a successful login for IDP initiated logins.
↳ idp_entity_id	string	The unique identifier for your SaaS application.
↳ name_id_format	string	The format of the name identifier sent to the SaaS application. Values: id, email.
↳ name_id_transform_jsonata	string	A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting.
↳ public_key	string	The Access public certificate that will be used to verify your identity.
↳ saml_attribute_transform_jsonata	string	A [JSONata] (https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response.
↳ sp_entity_id	string	A globally unique name for an identity or service provider.
↳ sso_endpoint	string	The endpoint where your SaaS application will send login requests.
↳ updated_at	string	updated at
↳ access_token_lifetime	string	The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.
↳ allow_pkce_without_client_secret	boolean	If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.
↳ app_launcher_url	string	The URL where this applications tile redirects users
↳ client_id	string	The application client id
↳ client_secret	string	The application client secret, only returned on POST request.
↳ custom_claims	array	custom claims
↳ name	string	The name of the claim.
↳ required	boolean	If the claim is required when building an OIDC token.
↳ scope	string	The scope of the claim. Values: groups, profile, email, openid.
↳ source	json	source
↳ name	string	The name of the IdP claim.
↳ name_by_idp	json	A mapping from IdP ID to claim name.
↳ grant_types	array	The OIDC flows supported by this application
↳ group_filter_regex	string	A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
↳ hybrid_and_implicit_options	json	hybrid and implicit options
↳ return_access_token_from_authorization_endpoint	boolean	If an Access Token should be returned from the OIDC Authorization endpoint
↳ return_id_token_from_authorization_endpoint	boolean	If an ID Token should be returned from the OIDC Authorization endpoint
↳ redirect_uris	array	The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens
↳ refresh_token_options	json	refresh token options
↳ lifetime	string	How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.
↳ scopes	array	Define the user information shared with access, "offline_access" scope will be automatically enabled if refresh tokens are enabled
↳ app_launcher_logo_url	string	The image URL of the logo shown in the App Launcher header.
↳ bg_color	string	The background color of the App Launcher page.
↳ footer_links	array	The links in the App Launcher footer.
↳ name	string	The hypertext in the footer link.
↳ url	string	the hyperlink in the footer link.
↳ header_bg_color	string	The background color of the App Launcher header.
↳ landing_page_design	json	The design of the App Launcher landing page shown to users when they log in.
↳ button_color	string	The background color of the log in button on the landing page.
↳ button_text_color	string	The color of the text in the log in button on the landing page.
↳ image_url	string	The URL of the image shown on the landing page.
↳ message	string	The message shown on the landing page.
↳ title	string	The title shown on the landing page.
↳ skip_app_launcher_login_page	boolean	Determines when to skip the App Launcher landing page.
↳ target_criteria	array	target criteria
↳ exclude	json	Selectors within an include, require, or exclude rule. At least one of target_attributes or tags must be non-empty.
↳ tags	json	Map of target tag keys to values. Values within a key are OR'd.
↳ target_attributes	json	Hostname selector map for include, require, or exclude rules. This is distinct from the deprecated top-level target_attributes field and only supports the hostname key.
↳ hostname	array	hostname
↳ include	json	Selectors within an include, require, or exclude rule. At least one of target_attributes or tags must be non-empty.
↳ tags	json	Map of target tag keys to values. Values within a key are OR'd.
↳ target_attributes	json	Hostname selector map for include, require, or exclude rules. This is distinct from the deprecated top-level target_attributes field and only supports the hostname key.
↳ hostname	array	hostname
↳ port	number	The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.
↳ require	json	Selectors within an include, require, or exclude rule. At least one of target_attributes or tags must be non-empty.
↳ tags	json	Map of target tag keys to values. Values within a key are OR'd.
↳ target_attributes	json	Hostname selector map for include, require, or exclude rules. This is distinct from the deprecated top-level target_attributes field and only supports the hostname key.
↳ hostname	array	hostname
↳ target_attributes	json	Contains a map of target attribute keys to target attribute values.
↳ protocol	string	The communication protocol your application secures. Values: RDP.
total_count	number	Total matching resources, or the number of resources returned on this page when the API omits a total
result_info	json	Pagination metadata returned by Cloudflare
↳ page	number	Current page
↳ per_page	number	Page size
↳ count	number	Count on the current page
↳ total_count	number	Total matching resources
↳ total_pages	number	Total pages
↳ cursor	string	Pagination cursor
↳ cursors	json	Directional pagination cursors
↳ before	string
↳ after	string

Cloudflare List Access Groups

Lists the reusable Cloudflare Access (Zero Trust) groups in an account. Groups bundle identity rules that policies can reference by ID. Requires an API token with Account Access: Organizations, Identity Providers, and Groups Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	The Cloudflare account ID. Access groups are account-scoped
name	string	No	Filter by group name
search	string	No	Free-text search across groups
page	number	No	Page number for pagination
per_page	number	No	Number of groups per page
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
groups	array	Groups
↳ created_at	string	created at
↳ exclude	array	Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ id	string	UUID.
↳ include	array	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ is_default	array	Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ name	string	The name of the Access group.
↳ require	array	Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ updated_at	string	updated at
total_count	number	Total matching resources, or the number of resources returned on this page when the API omits a total
result_info	json	Pagination metadata returned by Cloudflare
↳ page	number	Current page
↳ per_page	number	Page size
↳ count	number	Count on the current page
↳ total_count	number	Total matching resources
↳ total_pages	number	Total pages
↳ cursor	string	Pagination cursor
↳ cursors	json	Directional pagination cursors
↳ before	string
↳ after	string

Cloudflare List Access Identity Providers

Lists the identity providers configured for Cloudflare Access (Zero Trust) in an account, such as Okta, Entra ID, Google Workspace, or a one-time PIN. Use the returned IDs to restrict an application with allowed_idps. Requires an API token with Account Access: Organizations, Identity Providers, and Groups Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
scim_enabled	string	No	Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.
page	number	No	Page number of results.
per_page	number	No	Number of results per page.
accountId	string	Yes	The Cloudflare account ID. Identity providers are account-scoped
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
identity_providers	array	Identity providers
↳ config	json	The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
↳ client_id	string	Your OAuth Client ID
↳ client_secret	string	Your OAuth Client Secret
↳ claims	array	Custom claims
↳ email_claim_name	string	The claim name for email in the id_token response.
↳ conditional_access_enabled	boolean	Should Cloudflare try to load authentication contexts from your account
↳ directory_id	string	Your Azure directory uuid
↳ prompt	string	Configures the prompt behavior for Google authentication. Values: login, select_account, none, consent.
↳ support_groups	boolean	Should Cloudflare try to load groups from your account
↳ centrify_account	string	Your centrify account url
↳ centrify_app_id	string	Your centrify app id
↳ apps_domain	string	Your companies TLD
↳ use_login_hint	boolean	Whether to use a previously authenticated Access email as a Google login hint when exactly one email matches the Workspace domain.
↳ auth_url	string	The authorization_endpoint URL of your IdP
↳ certs_url	string	The jwks_uri endpoint of your IdP to allow the IdP keys to sign the tokens
↳ pkce_enabled	boolean	Enable Proof Key for Code Exchange (PKCE)
↳ scopes	array	OAuth scopes
↳ token_url	string	The token_endpoint URL of your IdP
↳ issuer_url	string	IdP Entity ID or Issuer URL
↳ authorization_server_id	string	Your okta authorization server id
↳ okta_account	string	Your okta account url
↳ onelogin_account	string	Your OneLogin account url
↳ ping_env_id	string	Your PingOne environment identifier
↳ attributes	array	A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
↳ email_attribute_name	string	The attribute name for email in the SAML response.
↳ enable_encryption	boolean	Enable SAML assertion encryption.
↳ force_authn	boolean	Asks the IdP to reauthenticate the user for each SAML authentication request.
↳ header_attributes	array	Add a list of attribute names that will be returned in the response header from the Access callback.
↳ attribute_name	string	attribute name from the IDP
↳ header_name	string	header that will be added on the request to the origin
↳ idp_public_certs	array	X509 certificate to verify the signature in the SAML authentication response
↳ max_sso_url_length	number	The maximum URL length the IdP accepts for the SSO redirect URL. When the constructed SSO URL would exceed this length, the RelayState is stored server-side and a short nonce is passed to the IdP instead. Set this if your IdP enforces a URL length limit.
↳ sign_request	boolean	Sign the SAML authentication request with Access credentials. To verify the signature, use the public key from the Access certs endpoints.
↳ sso_target_url	string	URL to send the SAML authentication requests to
↳ redirect_url	string	redirect url
↳ restrict_to_account_members	boolean	When enabled, only users who are members of your Cloudflare account can authenticate through this identity provider. When disabled, any user with a Cloudflare account can authenticate, subject to your Access policies.
↳ login_page_auto_prompt	boolean	When enabled, the Access login page automatically prompts the user to authenticate with a passkey.
↳ id	string	UUID.
↳ name	string	The name of the identity provider, shown to users on the login page.
↳ read_only	boolean	Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
↳ saml_certificate_set	json	A SAML encryption certificate set containing current and optionally previous certificates for encryption key rotation.
↳ created_at	string	Timestamp when the certificate set was created
↳ current_certificate	json	A single SAML encryption certificate with metadata
↳ is_current	boolean	Indicates whether this is the currently active certificate
↳ not_after	string	Certificate expiration date. Certificates are automatically rotated 30 days before expiration.
↳ public_certificate	string	PEM-encoded X.509 certificate containing the public key. Configure this certificate in your external SAML Identity Provider to enable encryption.
↳ uid	string	Unique identifier for the certificate
↳ previous_certificate	json	The previous certificate, maintained during rotation to ensure continuity. Null if no rotation has occurred. Mirrors the structure of saml_certificate.
↳ uid	string	Unique identifier for the certificate set
↳ updated_at	string	Timestamp when the certificate set was last updated (e.g., during rotation)
↳ saml_certificate_set_id	string	The UID of the SAML encryption certificate set assigned to this Identity Provider. Only present for SAML identity providers with encryption configured. Create a certificate set via POST to /identity_providers/\{id\}/saml_certificate.
↳ scim_config	json	The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
↳ enabled	boolean	A flag to enable or disable SCIM for the identity provider.
↳ identity_update_behavior	string	Indicates how a SCIM event updates a user identity used for policy evaluation.
↳ scim_base_url	string	The base URL of Cloudflare's SCIM V2.0 API endpoint.
↳ seat_deprovision	boolean	A flag to remove a user's seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
↳ secret	string	A read-only token generated when the SCIM integration is enabled for the first time. It is redacted on subsequent requests. If you lose this you will need to refresh it at /access/identity_providers/:idpID/refresh_scim_secret.
↳ user_deprovision	boolean	A flag to enable revoking a user's session in Access and Gateway when they have been deprovisioned in the Identity Provider.
↳ type	string	The type of identity provider.
total_count	number	Total matching resources, or the number of resources returned on this page when the API omits a total
result_info	json	Pagination metadata returned by Cloudflare
↳ page	number	Current page
↳ per_page	number	Page size
↳ count	number	Count on the current page
↳ total_count	number	Total matching resources
↳ total_pages	number	Total pages
↳ cursor	string	Pagination cursor
↳ cursors	json	Directional pagination cursors
↳ before	string
↳ after	string

Cloudflare List Access Policies

Lists the Cloudflare Access (Zero Trust) policies attached to an application, in precedence order. Requires an API token with Account Access: Apps and Policies Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	The Cloudflare account ID. Access applications are account-scoped
appId	string	Yes	The Access application ID whose policies should be listed
page	number	No	Page number for pagination
per_page	number	No	Number of policies per page
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
policies	array	Policies
↳ approval_groups	array	Administrators who can approve a temporary authentication request.
↳ approvals_needed	number	The number of approvals needed to obtain access.
↳ email_addresses	array	A list of emails that can approve the access request.
↳ email_list_uuid	string	The UUID of an re-usable email list.
↳ approval_required	boolean	Requires the user to request access from an administrator at the start of each session.
↳ connection_rules	json	The rules that define how users may connect to the targets secured by your application.
↳ rdp	json	The RDP-specific rules that define clipboard behavior for RDP connections.
↳ allowed_clipboard_local_to_remote_formats	array	Clipboard formats allowed when copying from local machine to remote RDP session.
↳ allowed_clipboard_remote_to_local_formats	array	Clipboard formats allowed when copying from remote RDP session to local machine.
↳ ssh	json	The SSH-specific rules that define how users may connect to the targets secured by your application.
↳ allow_email_alias	boolean	Enables using Identity Provider email alias as SSH username.
↳ usernames	array	Contains the Unix usernames that may be used when connecting over SSH.
↳ isolation_required	boolean	Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
↳ mfa_config	json	Configures multi-factor authentication (MFA) settings for infrastructure applications.
↳ allowed_authenticators	array	Lists the MFA methods that users can authenticate with. For infrastructure applications, supported values are piv_key and ssh_fido2_key.
↳ mfa_disabled	boolean	Indicates whether to disable MFA for this resource. This option is available at the application and policy level.
↳ session_duration	string	Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples: 5m or 24h.
↳ purpose_justification_prompt	string	A custom message that will appear on the purpose justification screen.
↳ purpose_justification_required	boolean	Require users to enter a justification when they log in to the application.
↳ session_duration	string	The amount of time that tokens issued for the application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
↳ created_at	string	created at
↳ decision	string	The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Values: allow, deny, non_identity, bypass.
↳ exclude	array	Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ id	string	The UUID of the policy
↳ include	array	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ name	string	The name of the Access policy.
↳ require	array	Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ updated_at	string	updated at
↳ account_id	string	Identifier.
↳ precedence	number	The order of execution for this policy. Must be unique for each policy within an app.
total_count	number	Total matching resources, or the number of resources returned on this page when the API omits a total
result_info	json	Pagination metadata returned by Cloudflare
↳ page	number	Current page
↳ per_page	number	Page size
↳ count	number	Count on the current page
↳ total_count	number	Total matching resources
↳ total_pages	number	Total pages
↳ cursor	string	Pagination cursor
↳ cursors	json	Directional pagination cursors
↳ before	string
↳ after	string

Cloudflare List Access Service Tokens

Lists the Cloudflare Access (Zero Trust) service tokens in an account, which let machines authenticate to Access-protected applications. Client secrets are never returned by this endpoint — only on creation. Requires an API token with Account Access: Service Tokens Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	The Cloudflare account ID. Service tokens are account-scoped
name	string	No	Filter by service token name
search	string	No	Free-text search across service tokens
page	number	No	Page number for pagination
per_page	number	No	Number of service tokens per page
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
service_tokens	array	Service tokens
↳ client_id	string	The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
↳ created_at	string	created at
↳ duration	string	The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m, or the special value forever for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).
↳ enabled	boolean	Whether the service token is enabled.
↳ expires_at	string	expires at
↳ id	string	UUID.
↳ last_seen_at	string	last seen at
↳ leak_report_url	string	Where the leaked client_secret was found, if provided by the reporter. Omitted if the token has not been reported as leaked.
↳ leak_reported_at	string	When a secret scanning partner reported this service token's client_secret as leaked. A leaked service token is disabled and must be rotated before it can be re-enabled. Cleared once the secret is rotated. Omitted if the token has not been reported as leaked.
↳ leak_reporter	string	The secret scanning partner that reported the leak. Omitted if the token has not been reported as leaked.
↳ name	string	The name of the service token.
↳ updated_at	string	updated at
total_count	number	Total matching resources, or the number of resources returned on this page when the API omits a total
result_info	json	Pagination metadata returned by Cloudflare
↳ page	number	Current page
↳ per_page	number	Page size
↳ count	number	Count on the current page
↳ total_count	number	Total matching resources
↳ total_pages	number	Total pages
↳ cursor	string	Pagination cursor
↳ cursors	json	Directional pagination cursors
↳ before	string
↳ after	string

Cloudflare List Certificates

Lists SSL/TLS certificate packs for a zone.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	The zone ID to list certificates for
status	string	No	Set to "all" to include every certificate pack regardless of status. Cloudflare documents no other value for this filter; omitting it returns only active packs
page	number	No	Page number of paginated results (default: 1)
per_page	number	No	Number of certificate packs per page (default: 20, min: 5, max: 50)
deploy	string	No	Filter by deployment environment: "staging" or "production"
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
certificates	array	Certificates
↳ certificate_authority	string	Certificate Authority selected for the order. For information on any certificate authority specific details or restrictions [see this page for more details](https://developers.cloudflare.com/ssl/reference/certificate-authorities). Values: google, lets_encrypt, ssl_com.
↳ certificates	array	Array of certificates in this pack.
↳ bundle_method	string	Certificate bundle method.
↳ expires_on	string	When the certificate from the authority expires.
↳ geo_restrictions	json	Specify the region where your private key can be held locally.
↳ label	string	label Values: us, eu, highest_security.
↳ hosts	array	Hostnames covered by this certificate.
↳ id	string	Certificate identifier.
↳ issuer	string	The certificate authority that issued the certificate.
↳ modified_on	string	When the certificate was last modified.
↳ priority	number	The order/priority in which the certificate will be used.
↳ signature	string	The type of hash used for the certificate.
↳ status	string	Certificate status.
↳ uploaded_on	string	When the certificate was uploaded to Cloudflare.
↳ zone_id	string	Identifier.
↳ cloudflare_branding	boolean	Whether or not to add Cloudflare Branding for the order. This will add a subdomain of sni.cloudflaressl.com as the Common Name if set to true.
↳ dcv_delegation_records	array	DCV Delegation records for domain validation.
↳ cname	string	The CNAME record hostname for DCV delegation.
↳ cname_target	string	The CNAME record target value for DCV delegation.
↳ emails	array	The set of email addresses that the certificate authority (CA) will use to complete domain validation.
↳ http_body	string	The content that the certificate authority (CA) will expect to find at the http_url during the domain validation.
↳ http_url	string	The url that will be checked during domain validation.
↳ status	string	Status of the validation record.
↳ txt_name	string	The hostname that the certificate authority (CA) will check for a TXT record during domain validation .
↳ txt_value	string	The TXT record that the certificate authority (CA) will check during domain validation.
↳ hosts	array	Comma separated list of valid host names for the certificate packs. Must contain the zone apex, may not contain more than 50 hosts, and may not be empty.
↳ id	string	The unique identifier for a certificate_pack.
↳ primary_certificate	string	Identifier of the primary certificate in a pack.
↳ status	string	Status of certificate pack.
↳ type	string	Type of certificate pack. Values: mh_custom, managed_hostname, sni_custom, universal, advanced, total_tls, keyless, legacy_custom.
↳ validation_errors	array	Domain validation errors that have been received by the certificate authority (CA).
↳ message	string	A domain validation error.
↳ validation_method	string	Validation Method selected for the order. Values: txt, http, email.
↳ validation_records	array	Certificates' validation records.
↳ cname	string	The CNAME record hostname for DCV delegation.
↳ cname_target	string	The CNAME record target value for DCV delegation.
↳ emails	array	The set of email addresses that the certificate authority (CA) will use to complete domain validation.
↳ http_body	string	The content that the certificate authority (CA) will expect to find at the http_url during the domain validation.
↳ http_url	string	The url that will be checked during domain validation.
↳ status	string	Status of the validation record.
↳ txt_name	string	The hostname that the certificate authority (CA) will check for a TXT record during domain validation .
↳ txt_value	string	The TXT record that the certificate authority (CA) will check during domain validation.
↳ validity_days	number	Validity Days selected for the order. Values: 14, 30, 90, 365.
total_count	number	Total matching resources, or the number of resources returned on this page when the API omits a total
result_info	json	Pagination metadata returned by Cloudflare
↳ page	number	Current page
↳ per_page	number	Page size
↳ count	number	Count on the current page
↳ total_count	number	Total matching resources
↳ total_pages	number	Total pages
↳ cursor	string	Pagination cursor
↳ cursors	json	Directional pagination cursors
↳ before	string
↳ after	string

Cloudflare List DNS Records

Lists DNS records for a specific zone.

Inputs and outputs

Input

Parameter	Type	Required	Description
name_contains	string	No	Substring of the DNS record name. Name filters are case-insensitive.
name_startswith	string	No	Prefix of the DNS record name. Name filters are case-insensitive.
name_endswith	string	No	Suffix of the DNS record name. Name filters are case-insensitive.
content_contains	string	No	Substring of the DNS record content. Content filters are case-insensitive.
content_startswith	string	No	Prefix of the DNS record content. Content filters are case-insensitive.
content_endswith	string	No	Suffix of the DNS record content. Content filters are case-insensitive.
comment_present	boolean	No	If this parameter is present, only records with a comment are returned.
comment_absent	boolean	No	If this parameter is present, only records without a comment are returned.
comment_exact	string	No	Exact value of the DNS record comment. Comment filters are case-insensitive.
comment_startswith	string	No	Prefix of the DNS record comment. Comment filters are case-insensitive.
comment_endswith	string	No	Suffix of the DNS record comment. Comment filters are case-insensitive.
tag_present	string	No	Name of a tag which must be present on the DNS record. Tag filters are case-insensitive.
tag_absent	string	No	Name of a tag which must not be present on the DNS record. Tag filters are case-insensitive.
tag_contains	string	No	A tag and value, of the form <tag-name>:<tag-value>. The API will only return DNS records that have a tag named <tag-name> whose value contains <tag-value>. Tag filters are case-insensitive.
tag_startswith	string	No	A tag and value, of the form <tag-name>:<tag-value>. The API will only return DNS records that have a tag named <tag-name> whose value starts with <tag-value>. Tag filters are case-insensitive.
tag_endswith	string	No	A tag and value, of the form <tag-name>:<tag-value>. The API will only return DNS records that have a tag named <tag-name> whose value ends with <tag-value>. Tag filters are case-insensitive.
include_shadow_metadata	boolean	No	Whether to include shadow metadata in the meta field of each record in the response. See [Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records).
shadowed_by_name	string	No	Filters the response to records at or below the specified NS delegation name. NS, DS, and NSEC records at the delegation name are excluded because they are not shadowed by that delegation. Those record types are included only when they exist below the delegation. The value must be a non-apex subdomain of the zone. Requires include_shadow_metadata=true. See [Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records).
shadowing_name	string	No	Returns NS records that shadow the given name, searching at the name itself and each of its ancestor names within the zone, excluding the zone apex. The value must be a subdomain of the zone; the zone apex is not accepted. See [Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records).
zoneId	string	Yes	The zone ID to list DNS records for
type	string	No	Filter by record type (e.g., "A", "AAAA", "CNAME", "MX", "TXT")
name	string	No	Filter by record name (exact match)
content	string	No	Filter by record content (exact match)
page	number	No	Page number for pagination (default: 1)
per_page	number	No	Number of records per page (default: 100, max: 5000000)
direction	string	No	Sort direction (asc or desc)
match	string	No	Match logic for filters: any or all (default: all)
order	string	No	Sort field (type, name, content, ttl, proxied)
proxied	boolean	No	Filter by proxy status
search	string	No	Free-text search across record name, content, and value
tag	string	No	Filter by tag name, or an exact name:value pair (e.g., team:DNS)
tag_match	string	No	Tag filter match logic: any or all. Only affects results when combined with multiple tag filter conditions; has no effect with the single exact-match Tag Filter above.
commentFilter	string	No	Filter records by comment content (substring match)
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
records	array	Records
↳ comment	string	Comments or notes about the DNS record. This field has no effect on DNS responses.
↳ name	string	Complete DNS record name, including the zone name, in Punycode.
↳ proxied	boolean	Whether the record is receiving the performance and security benefits of Cloudflare.
↳ settings	json	Settings for the DNS record.
↳ ipv4_only	boolean	When enabled, only A records will be generated, and AAAA records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
↳ ipv6_only	boolean	When enabled, only AAAA records will be generated, and A records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
↳ flatten_cname	boolean	If enabled, causes the CNAME record to be resolved externally and the resulting address records (e.g., A and AAAA) to be returned instead of the CNAME record itself. This setting is unavailable for proxied records, since they are always flattened.
↳ tags	array	Custom tags for the DNS record. This field has no effect on DNS responses.
↳ ttl	number	Time To Live (TTL) of the DNS record in seconds. Setting to 1 means 'automatic'. Value must be between 60 and 86400, with the minimum reduced to 30 for Enterprise zones. Values: 1.
↳ content	string	Formatted URI content. See 'data' to set URI properties.
↳ private_routing	boolean	Enables private network routing to the origin.
↳ type	string	Record type. Values: A, AAAA, CNAME, MX, NS, OPENPGPKEY, PTR, TXT, CAA, CERT, DNSKEY, DS, HTTPS, LOC, NAPTR, SMIMEA, SRV, SSHFP, SVCB, TLSA, URI.
↳ priority	number	Required for MX and URI records; ignored for other record types (but may still be returned by the API). Records with lower priorities are preferred. This field is to be deprecated in favor of the priority field within the data map.
↳ data	json	Structured record data. The available fields depend on the DNS record type.
↳ flags	json	Flags.
↳ tag	string	Name of the property controlled by this record (e.g.: issue, issuewild, iodef).
↳ value	string	Value.
↳ algorithm	number	Algorithm.
↳ certificate	string	Certificate.
↳ key_tag	number	Key Tag.
↳ type	number	Type.
↳ protocol	number	Protocol.
↳ public_key	string	Public Key.
↳ digest	string	Digest.
↳ digest_type	number	Digest Type.
↳ priority	number	Priority.
↳ target	string	The record content.
↳ altitude	number	Altitude of location in meters.
↳ lat_degrees	number	Degrees of latitude.
↳ lat_direction	string	Latitude direction. Values: N, S.
↳ lat_minutes	number	Minutes of latitude.
↳ lat_seconds	number	Seconds of latitude.
↳ long_degrees	number	Degrees of longitude.
↳ long_direction	string	Longitude direction. Values: E, W.
↳ long_minutes	number	Minutes of longitude.
↳ long_seconds	number	Seconds of longitude.
↳ precision_horz	number	Horizontal precision of location.
↳ precision_vert	number	Vertical precision of location.
↳ size	number	Size of location in meters.
↳ order	number	Order.
↳ preference	number	Preference.
↳ regex	string	Regex.
↳ replacement	string	Replacement.
↳ service	string	Service.
↳ matching_type	number	Matching Type.
↳ selector	number	Selector.
↳ usage	number	Usage.
↳ port	number	The port of the service.
↳ weight	number	The record weight.
↳ fingerprint	string	Fingerprint.
↳ comment_modified_on	string	When the record comment was last modified. Omitted if there is no comment.
↳ created_on	string	When the record was created.
↳ id	string	Identifier.
↳ meta	json	Extra Cloudflare-specific metadata about the record.
↳ dead_glue	boolean	Whether this glue record is not served because a shallower NS delegation takes precedence over the deeper delegation that needs it.
↳ is_glue	boolean	Whether this A or AAAA record is glue for a subdomain NS delegation. See [Glue records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records#glue-records).
↳ shadowed_by	array	IDs of the NS records that shadow this record. See [Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records).
↳ shadowed_records_count	number	Number of records shadowed by this NS delegation. See [Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records).
↳ modified_on	string	When the record was last modified.
↳ proxiable	boolean	Whether the record can be proxied by Cloudflare or not.
↳ tags_modified_on	string	When the record tags were last modified. Omitted if there are no tags.
↳ zone_id	string	Legacy DNS response zone ID when returned by Cloudflare
↳ zone_name	string	Legacy DNS response zone name when returned by Cloudflare
↳ locked	boolean	Legacy DNS response lock flag when returned by Cloudflare
total_count	number	Total matching resources, or the number of resources returned on this page when the API omits a total
result_info	json	Pagination metadata returned by Cloudflare
↳ page	number	Current page
↳ per_page	number	Page size
↳ count	number	Count on the current page
↳ total_count	number	Total matching resources
↳ total_pages	number	Total pages
↳ cursor	string	Pagination cursor
↳ cursors	json	Directional pagination cursors
↳ before	string
↳ after	string

Cloudflare List Managed Ruleset Overrides

Lists the WAF managed rulesets deployed on a zone together with the overrides applied to each one. Cloudflare has no dedicated overrides endpoint — overrides live on the "execute" rules of the http_request_firewall_managed phase entry point ruleset, which this reads. Requires an API token with Zone WAF Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	The zone ID to read managed ruleset deployments and overrides for
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
ruleset_id	string	Ruleset ID of the http_request_firewall_managed entry point, needed to edit a deployment rule
deployments	array	Managed rulesets deployed on the zone and the overrides applied to each
↳ rule_id	string	ID of the execute rule that deploys the managed ruleset
↳ managed_ruleset_id	string	ID of the deployed managed ruleset
↳ description	string	Description of the deployment rule
↳ expression	string	Filter expression scoping which requests the managed ruleset runs on
↳ enabled	boolean	Whether the deployment is enabled
↳ overrides	json	Overrides applied to the managed ruleset, at three levels. Cloudflare documents action, enabled, and sensitivity_level at the ruleset (top) level; category, action, enabled, and sensitivity_level per category; and id, action, enabled, score_threshold, and sensitivity_level per rule. Rule overrides beat category overrides, which beat the ruleset-level override. sensitivity_level applies only to the DDoS phases, so for a WAF managed ruleset the rule-level properties are action, enabled, and score_threshold
total_count	number	Number of managed ruleset deployments found

Cloudflare List R2 Buckets

Lists the R2 object storage buckets in an account. Requires an API token with Account Workers R2 Storage Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
order	string	No	Order buckets by name. Allowed values: name.
accountId	string	Yes	The Cloudflare account ID. R2 buckets are account-scoped
name_contains	string	No	Only return buckets whose name contains this substring
start_after	string	No	Bucket name to start listing after
cursor	string	No	Pagination cursor returned by a previous call
direction	string	No	Sort direction by bucket name: asc or desc
per_page	number	No	Number of buckets per page
jurisdiction	string	No	Data-residency jurisdiction to list within: default, eu, or fedramp
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
buckets	array	Buckets
↳ creation_date	string	Creation timestamp.
↳ jurisdiction	string	Jurisdiction where objects in this bucket are guaranteed to be stored. Values: default, eu, us, fedramp, fedramp-high.
↳ location	string	Location of the bucket. Values: apac, eeur, enam, weur, wnam, oc.
↳ name	string	Name of the bucket.
↳ storage_class	string	Storage class for newly uploaded objects, unless specified otherwise. Values: Standard, InfrequentAccess.
total_count	number	Total active buckets in the requested jurisdiction, independent of filtering or pagination. Eventually consistent for accounts with elevated bucket limits. Falls back to this page’s bucket count when the API omits the total.
result_info	json	Pagination metadata returned by Cloudflare
↳ page	number	Current page
↳ per_page	number	Page size
↳ count	number	Count on the current page
↳ total_count	number	Total active buckets in the requested jurisdiction, independent of filtering or pagination. Eventually consistent for accounts with elevated bucket limits.
↳ total_pages	number	Total pages
↳ cursor	string	Pagination cursor
↳ cursors	json	Directional pagination cursors
↳ before	string
↳ after	string
cursor	string	Cursor for the next page

Cloudflare List Rate Limiting Rules

Lists the rate limiting rules on a zone by reading the http_ratelimit phase entry point ruleset. This uses the current Rulesets-based rate limiting API; the legacy rate_limits endpoint is no longer available. The returned ruleset ID is what "Create Rate Limiting Rule", "Update Rate Limiting Rule", and "Delete Ruleset Rule" need. Requires an API token with Zone WAF Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	The zone ID to list rate limiting rules for
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
description	string	An informative description of the ruleset.
id	string	The unique ID of the ruleset.
last_updated	string	The timestamp of when the ruleset was last modified.
name	string	The human-readable name of the ruleset.
version	string	The version of the ruleset.
kind	string	The kind of the ruleset. Values: managed, custom, root, zone.
phase	string	The phase of the ruleset.
rules	array	The list of rules in the ruleset.
↳ action	string	The action to perform when the rule matches.
↳ action_parameters	json	The parameters configuring the rule's action.
↳ response	json	The response to show when the block is applied.
↳ content	string	The content to return.
↳ content_type	string	The type of the content to return.
↳ status_code	number	The status code to return.
↳ algorithms	array	Custom order for compression algorithms.
↳ name	string	Name of the compression algorithm to enable. Values: none, auto, default, gzip, brotli, zstd.
↳ id	string	The ID of the ruleset to execute.
↳ matched_data	json	The configuration to use for matched data logging.
↳ public_key	string	The public key to encrypt matched data logs with.
↳ overrides	json	A set of overrides to apply to the target ruleset.
↳ action	string	An action to override all rules with. This option has lower precedence than rule and category overrides.
↳ categories	array	A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
↳ action	string	The action to override rules in the category with.
↳ category	string	The name of the category to override.
↳ enabled	boolean	Whether to enable execution of rules in the category.
↳ sensitivity_level	string	The sensitivity level to use for rules in the category. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ enabled	boolean	Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
↳ rules	array	A list of rule-level overrides. This option has the highest precedence.
↳ action	string	The action to override the rule with.
↳ enabled	boolean	Whether to enable execution of the rule.
↳ id	string	The ID of the rule to override.
↳ score_threshold	number	The score threshold to use for the rule.
↳ sensitivity_level	string	The sensitivity level to use for the rule. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ sensitivity_level	string	A sensitivity level to set for all rules. This option has lower precedence than rule and category overrides and is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ cookie_fields	array	The cookie fields to log.
↳ name	string	The name of the cookie.
↳ raw_response_fields	array	The raw response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ request_fields	array	The raw request fields to log.
↳ name	string	The name of the header.
↳ response_fields	array	The transformed response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ transformed_request_fields	array	The transformed request fields to log.
↳ name	string	The name of the header.
↳ from_list	json	A redirect based on a bulk list lookup.
↳ key	string	An expression that evaluates to the list lookup key.
↳ name	string	The name of the list to match against.
↳ from_value	json	A redirect based on the request properties.
↳ preserve_query_string	boolean	Whether to keep the query string of the original request.
↳ status_code	number	The status code to use for the redirect. Values: 301, 302, 303, 307, 308.
↳ target_url	json	A URL to redirect the request to.
↳ expression	string	An expression that evaluates to a URL to redirect the request to.
↳ value	string	A URL to redirect the request to.
↳ headers	json	A map of headers to rewrite.
↳ uri	json	A URI query rewrite.
↳ path	json	A URI path rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI path to.
↳ value	string	A value to rewrite the URI path to.
↳ query	json	A URI query rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI query to.
↳ value	string	A value to rewrite the URI query to.
↳ origin	boolean	Whether to propagate the rewritten URI to origin.
↳ host_header	string	A value to rewrite the HTTP host header to.
↳ origin	json	An origin to route to.
↳ host	string	A resolved host to route to.
↳ port	number	A destination port to route to.
↳ sni	json	A Server Name Indication (SNI) override.
↳ value	string	A value to override the SNI to.
↳ increment	number	A delta to change the score by, which can be either positive or negative.
↳ content_type	string	The content type header to set with the error response. Values: application/json, text/html, text/plain, text/xml.
↳ status_code	number	The status code to use for the error.
↳ content	string	The response content.
↳ asset_name	string	The name of a custom asset to serve as the error response.
↳ immutable	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ max-age	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ must-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ must-understand	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-cache	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ no-store	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-transform	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ private	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ proxy-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ public	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ s-maxage	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-if-error	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-while-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ additional_cacheable_ports	array	A list of additional ports that caching should be enabled on.
↳ browser_ttl	json	How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
↳ default	number	The browser TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The browser TTL mode. Values: respect_origin, bypass_by_default, override_origin, bypass.
↳ cache	boolean	Whether the request's response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
↳ cache_key	json	Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
↳ cache_by_device_type	boolean	Whether to separate cached content based on the visitor's device type.
↳ cache_deception_armor	boolean	Whether to protect from web cache deception attacks, while allowing static assets to be cached.
↳ custom_key	json	Which components of the request are included or excluded from the cache key.
↳ cookie	json	Which cookies to include in the cache key.
↳ check_presence	array	A list of cookies to check for the presence of. The presence of these cookies is included in the cache key.
↳ include	array	A list of cookies to include in the cache key.
↳ header	json	Which headers to include in the cache key.
↳ check_presence	array	A list of headers to check for the presence of. The presence of these headers is included in the cache key.
↳ contains	json	A mapping of header names to a list of values. If a header is present in the request and contains any of the values provided, its value is included in the cache key.
↳ exclude_origin	boolean	Whether to exclude the origin header in the cache key.
↳ include	array	A list of headers to include in the cache key.
↳ host	json	How to use the host in the cache key.
↳ resolved	boolean	Whether to use the resolved host in the cache key.
↳ query_string	json	Which query string parameters to include in or exclude from the cache key.
↳ exclude	json	Which query string parameters to exclude from the cache key.
↳ all	boolean	Whether to exclude all query string parameters from the cache key. Values: True.
↳ list	array	A list of query string parameters to exclude from the cache key.
↳ include	json	Which query string parameters to include in the cache key.
↳ all	boolean	Whether to include all query string parameters in the cache key. Values: True.
↳ list	array	A list of query string parameters to include in the cache key.
↳ user	json	How to use characteristics of the request user agent in the cache key.
↳ device_type	boolean	Whether to use the user agent's device type in the cache key.
↳ geo	boolean	Whether to use the user agents's country in the cache key.
↳ lang	boolean	Whether to use the user agent's language in the cache key.
↳ ignore_query_strings_order	boolean	Whether to treat requests with the same query parameters the same, regardless of the order those query parameters are in.
↳ cache_reserve	json	Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
↳ eligible	boolean	Whether Cache Reserve is enabled. If this is true and a request meets eligibility criteria, Cloudflare will write the resource to Cache Reserve.
↳ minimum_file_size	number	The minimum file size eligible for storage in Cache Reserve.
↳ edge_ttl	json	How long the Cloudflare edge network should cache the response.
↳ default	number	The edge TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The edge TTL mode. Values: respect_origin, bypass_by_default, override_origin.
↳ status_code_ttl	array	A list of TTLs to apply to specific status codes or status code ranges.
↳ status_code	number	A single status code to apply the TTL to.
↳ status_code_range	json	A range of status codes to apply the TTL to.
↳ from	number	The lower bound of the range.
↳ to	number	The upper bound of the range.
↳ value	number	The time to cache the response for (in seconds). A value of 0 is equivalent to setting the cache control header with the value "no-cache". A value of -1 is equivalent to setting the cache control header with the value of "no-store".
↳ origin_cache_control	boolean	Whether Cloudflare will aim to strictly adhere to RFC 7234.
↳ origin_error_page_passthru	boolean	Whether to generate Cloudflare error pages for issues from the origin server.
↳ origin_range_requests	json	Controls whether Cloudflare fetches a large asset from the origin as a series of range requests instead of one whole-body request.
↳ mode	string	Whether to use range requests. default is the behaviour the zone gets without this rule. Values: on, off, default.
↳ read_timeout	number	A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
↳ respect_strong_etags	boolean	Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
↳ serve_stale	json	When to serve stale content from cache.
↳ disable_stale_while_updating	boolean	Whether Cloudflare should disable serving stale content while getting the latest content from the origin.
↳ shared_dictionary	json	Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
↳ match_pattern	string	URL pattern for the Use-As-Dictionary match field. This pattern specifies which URLs can use this response as a dictionary.
↳ strip_etags	boolean	Whether to strip ETag headers from the origin response before caching.
↳ strip_last_modified	boolean	Whether to strip Last-Modified headers from the origin response before caching.
↳ strip_set_cookie	boolean	Whether to strip Set-Cookie headers from the origin response before caching.
↳ vary	json	Controls how cached responses vary based on request headers. default is required by the API and applies to any Vary response header that does not have a per-header override.
↳ default	json	Controls how response Vary headers without a per-header override contribute to the cache key.
↳ action	string	How the header value is treated when building the cache key. Values: bypass, passthrough, normalize.
↳ headers	json	A mapping of lowercase request header names to their vary configuration.
↳ operation	string	The operation to perform on the cache tags. Values: add, remove, set.
↳ values	array	A list of cache tag values.
↳ expression	string	An expression that evaluates to an array of cache tag values.
↳ automatic_https_rewrites	boolean	Whether to enable Automatic HTTPS Rewrites.
↳ autominify	json	Which file extensions to minify automatically.
↳ css	boolean	Whether to minify CSS files.
↳ html	boolean	Whether to minify HTML files.
↳ js	boolean	Whether to minify JavaScript files.
↳ bic	boolean	Whether to enable Browser Integrity Check (BIC).
↳ content_converter	boolean	Whether to enable content conversion (e.g., HTML to Markdown).
↳ disable_apps	boolean	Whether to disable Cloudflare Apps. Values: True.
↳ disable_pay_per_crawl	boolean	Whether to disable Pay Per Crawl. Values: True.
↳ disable_rum	boolean	Whether to disable Real User Monitoring (RUM). Values: True.
↳ disable_zaraz	boolean	Whether to disable Zaraz. Values: True.
↳ email_obfuscation	boolean	Whether to enable Email Obfuscation.
↳ fonts	boolean	Whether to enable Cloudflare Fonts.
↳ hotlink_protection	boolean	Whether to enable Hotlink Protection.
↳ mirage	boolean	Whether to enable Mirage.
↳ opportunistic_encryption	boolean	Whether to enable Opportunistic Encryption.
↳ polish	string	The Polish level to configure. Values: off, lossless, lossy, webp.
↳ redirects_for_ai_training	boolean	Whether to redirect verified AI training crawlers to canonical URLs found in the HTML response.
↳ request_body_buffering	string	The request body buffering mode. Values: none, standard, full.
↳ response_body_buffering	string	The response body buffering mode. Values: none, standard.
↳ rocket_loader	boolean	Whether to enable Rocket Loader.
↳ security_level	string	The Security Level to configure. Values: off, essentially_off, low, medium, high, under_attack.
↳ server_side_excludes	boolean	Whether to enable Server-Side Excludes.
↳ ssl	string	The SSL level to configure. Values: off, flexible, full, strict, origin_pull.
↳ sxg	boolean	Whether to enable Signed Exchanges (SXG).
↳ webmcp_enabled	boolean	Whether to serve the WebMCP bridge script, which exposes the page's tools to browser AI agents.
↳ webmcp_packs	array	Bundled WebMCP tool packs to activate for matching requests. An empty array disables all packs. Omitting this parameter leaves the pack selection unchanged. Does not enable the WebMCP bridge itself.
↳ phase	string	A phase to skip the execution of. This option is only compatible with the products option. Values: current.
↳ phases	array	A list of phases to skip the execution of. This option is incompatible with the rulesets option.
↳ products	array	A list of legacy security products to skip the execution of.
↳ rules	json	A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
↳ ruleset	string	A ruleset to skip the execution of. This option is incompatible with the rulesets option. Values: current.
↳ rulesets	array	A list of ruleset IDs to skip the execution of. This option is incompatible with the ruleset and phases options.
↳ link_maze	json	Enables the link maze transformation on the response.
↳ categories	array	The categories of the rule.
↳ description	string	An informative description of the rule.
↳ enabled	boolean	Whether the rule should be executed.
↳ exposed_credential_check	json	Configuration for exposed credential checking.
↳ password_expression	string	An expression that selects the password used in the credentials check.
↳ username_expression	string	An expression that selects the user ID used in the credentials check.
↳ expression	string	The expression defining which traffic will match the rule.
↳ id	string	The unique ID of the rule.
↳ last_updated	string	The timestamp of when the rule was last modified.
↳ logging	json	An object configuring the rule's logging behavior.
↳ enabled	boolean	Whether to generate a log when the rule matches.
↳ ratelimit	json	An object configuring the rule's rate limit behavior.
↳ characteristics	array	Characteristics of the request on which the rate limit counter will be incremented.
↳ counting_expression	string	An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
↳ mitigation_timeout	number	Period of time in seconds after which the action will be disabled following its first execution.
↳ period	number	Period in seconds over which the counter is being incremented.
↳ requests_per_period	number	The threshold of requests per period after which the action will be executed for the first time.
↳ requests_to_origin	boolean	Whether counting is only performed when an origin is reached.
↳ score_per_period	number	The score threshold per period for which the action will be executed the first time.
↳ score_response_header_name	string	A response header name provided by the origin, which contains the score to increment rate limit counter with.
↳ ref	string	The reference of the rule (the rule's ID by default).
↳ version	string	The version of the rule.

Cloudflare List Rulesets

Lists every ruleset defined on a zone across all phases (WAF custom rules, managed rules, rate limiting, transform rules, and more). The list response deliberately omits the rules inside each ruleset — use "Get Ruleset" to read them. Requires an API token with Zone WAF Read (or another matching ruleset Read permission).

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	The zone ID to list rulesets for
per_page	number	No	Number of rulesets to return per page
cursor	string	No	Cursor for the next page, taken from the cursor output of a previous call. This endpoint paginates by cursor, not by page number
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
rulesets	array	Rulesets
↳ description	string	An informative description of the ruleset.
↳ id	string	The unique ID of the ruleset.
↳ last_updated	string	The timestamp of when the ruleset was last modified.
↳ name	string	The human-readable name of the ruleset.
↳ version	string	The version of the ruleset.
↳ kind	string	The kind of the ruleset. Values: managed, custom, root, zone.
↳ phase	string	The phase of the ruleset.
total_count	number	Total matching resources, or the number of resources returned on this page when the API omits a total
result_info	json	Pagination metadata returned by Cloudflare
↳ page	number	Current page
↳ per_page	number	Page size
↳ count	number	Count on the current page
↳ total_count	number	Total matching resources
↳ total_pages	number	Total pages
↳ cursor	string	Pagination cursor
↳ cursors	json	Directional pagination cursors
↳ before	string
↳ after	string
cursor	string	Cursor for the next page

Cloudflare List Tunnels

Lists the Cloudflare Tunnels (cloudflared) in an account, with their health status and active connections. Requires an API token with Account Cloudflare Tunnel Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	The Cloudflare account ID. Tunnels are account-scoped
name	string	No	Filter by exact tunnel name
status	string	No	Filter by tunnel health: inactive, degraded, healthy, or down
uuid	string	No	Filter by tunnel UUID
is_deleted	boolean	No	Whether to return deleted tunnels instead of active ones
include_prefix	string	No	Only include tunnels whose name starts with this prefix
exclude_prefix	string	No	Exclude tunnels whose name starts with this prefix
existed_at	string	No	Return tunnels that existed at this RFC 3339 timestamp
was_active_at	string	No	Return tunnels that were active at this RFC 3339 timestamp
was_inactive_at	string	No	Return tunnels that were inactive at this RFC 3339 timestamp
page	number	No	Page number for pagination
per_page	number	No	Number of tunnels per page
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
tunnels	array	Tunnels
↳ account_tag	string	Cloudflare account ID
↳ config_src	string	Indicates if this is a locally or remotely configured tunnel. If local, manage the tunnel using a YAML file on the origin machine. If cloudflare, manage the tunnel on the Zero Trust dashboard. Values: local, cloudflare.
↳ connections	array	The Cloudflare Tunnel connections between your origin and Cloudflare's edge.
↳ client_id	string	UUID of the Cloudflare Tunnel connector.
↳ client_version	string	The cloudflared version used to establish this connection.
↳ colo_name	string	The Cloudflare data center used for this connection.
↳ id	string	UUID of the Cloudflare Tunnel connection.
↳ is_pending_reconnect	boolean	Cloudflare continues to track connections for several minutes after they disconnect. This is an optimization to improve latency and reliability of reconnecting. If true, the connection has disconnected but is still being tracked. If false, the connection is actively serving traffic.
↳ opened_at	string	Timestamp of when the connection was established.
↳ origin_ip	string	The public IP address of the host running cloudflared.
↳ uuid	string	UUID of the Cloudflare Tunnel connection.
↳ conns_active_at	string	Timestamp of when the tunnel established at least one connection to Cloudflare's edge. If null, the tunnel is inactive.
↳ conns_inactive_at	string	Timestamp of when the tunnel became inactive (no connections to Cloudflare's edge). If null, the tunnel is active.
↳ created_at	string	Timestamp of when the resource was created.
↳ deleted_at	string	Timestamp of when the resource was deleted. If null, the resource has not been deleted.
↳ id	string	UUID of the tunnel.
↳ metadata	json	Metadata associated with the tunnel.
↳ name	string	A user-friendly name for a tunnel.
↳ remote_config	boolean	If true, the tunnel can be configured remotely from the Zero Trust dashboard. If false, the tunnel must be configured locally on the origin machine.
↳ status	string	The status of the tunnel.
↳ tun_type	string	The type of tunnel. Values: cfd_tunnel, warp_connector, warp, magic, ip_sec, gre, cni.
total_count	number	Total matching resources, or the number of resources returned on this page when the API omits a total
result_info	json	Pagination metadata returned by Cloudflare
↳ page	number	Current page
↳ per_page	number	Page size
↳ count	number	Count on the current page
↳ total_count	number	Total matching resources
↳ total_pages	number	Total pages
↳ cursor	string	Pagination cursor
↳ cursors	json	Directional pagination cursors
↳ before	string
↳ after	string

Cloudflare List Worker Routes

Lists the Workers routes on a zone, showing which URL patterns are handled by which Worker script. Unlike the Workers script endpoints, routes are zone-scoped. Requires an API token with Zone Workers Routes Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	The zone ID to list Workers routes for. Routes are zone-scoped, not account-scoped
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
routes	array	Routes
↳ id	string	Identifier.
↳ pattern	string	Pattern to match incoming requests against. [Learn more](https://developers.cloudflare.com/workers/configuration/routing/routes/#matching-behavior).
↳ script	string	Name of the script to run if the route matches.
total_count	number	Total matching resources, or the number of resources returned on this page when the API omits a total
result_info	json	Pagination metadata returned by Cloudflare
↳ page	number	Current page
↳ per_page	number	Page size
↳ count	number	Count on the current page
↳ total_count	number	Total matching resources
↳ total_pages	number	Total pages
↳ cursor	string	Pagination cursor
↳ cursors	json	Directional pagination cursors
↳ before	string
↳ after	string

Cloudflare List Worker Scripts

Lists the Workers scripts deployed in an account. Requires an API token with Account Workers Scripts Read.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	The Cloudflare account ID. Workers scripts are account-scoped
tags	string	No	Filter scripts by tag. Cloudflare expects a comma-separated list of tag:allowed pairs where allowed is yes or no, e.g. team:core:yes,deprecated:no
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
scripts	array	Scripts
↳ cache_options	json	Global CacheW configuration for the Worker. When caching is on, the platform provisions a cloudflare.app zone for the Worker. A type: worker entry in the exports map can override this value for a single entrypoint.
↳ cross_version_cache	boolean	Whether cached responses are shared across Worker version uploads. This is independent of enabled. It can stay true while caching is off, so the preference survives turning caching off and back on.
↳ enabled	boolean	Whether caching is enabled for this Worker.
↳ compatibility_date	string	Date indicating targeted support in the Workers runtime. Backwards incompatible fixes to the runtime following this date will not affect this Worker.
↳ compatibility_flags	array	Flags that enable or disable certain features in the Workers runtime. Used to enable upcoming features or opt in or out of specific changes not included in a compatibility_date.
↳ created_on	string	When the script was created.
↳ etag	string	Hashed script content, can be used in a If-None-Match header when updating.
↳ exports	json	Declarative exports for the Worker, keyed by export name. Worker entrypoint entries (type: worker) carry cache configuration for that entrypoint. Durable Object entries (type: durable-object) are also configured here and drive namespace reconciliation. At most 100 entries; class names are at most 128 characters.
↳ handlers	array	The names of handlers exported as part of the default export.
↳ has_assets	boolean	Whether a Worker contains assets.
↳ has_modules	boolean	Whether a Worker contains modules.
↳ id	string	The name used to identify the script.
↳ last_deployed_from	string	The client most recently used to deploy this Worker.
↳ logpush	boolean	Whether Logpush is turned on for the Worker.
↳ migration_tag	string	The tag of the Durable Object migration that was most recently applied for this Worker.
↳ modified_on	string	When the script was last modified.
↳ named_handlers	array	Named exports, such as Durable Object class implementations and named entrypoints.
↳ handlers	array	The names of handlers exported as part of the named export.
↳ name	string	The name of the export.
↳ observability	json	Observability settings for the Worker.
↳ enabled	boolean	Whether observability is enabled for the Worker.
↳ head_sampling_rate	number	The sampling rate for incoming requests. From 0 to 1 (1 = 100%, 0.1 = 10%). Default is 1.
↳ issues	json	Real-time Issues settings for the Worker.
↳ enabled	boolean	Whether real-time Issues are enabled for the Worker.
↳ logs	json	Log settings for the Worker.
↳ destinations	array	A list of destinations where logs will be exported to.
↳ enabled	boolean	Whether logs are enabled for the Worker.
↳ head_sampling_rate	number	The sampling rate for logs. From 0 to 1 (1 = 100%, 0.1 = 10%). Default is 1.
↳ invocation_logs	boolean	Whether [invocation logs](https://developers.cloudflare.com/workers/observability/logs/workers-logs/#invocation-logs) are enabled for the Worker.
↳ persist	boolean	Whether log persistence is enabled for the Worker.
↳ redact_query_string	boolean	Whether query strings are removed from request URLs in logs and traces.
↳ traces	json	Trace settings for the Worker.
↳ destinations	array	A list of destinations where traces will be exported to.
↳ enabled	boolean	Whether traces are enabled for the Worker.
↳ head_sampling_rate	number	The sampling rate for traces. From 0 to 1 (1 = 100%, 0.1 = 10%). Default is 1.
↳ persist	boolean	Whether trace persistence is enabled for the Worker.
↳ propagation_policy	string	Controls how inbound trace context (traceparent/tracestate) headers on incoming requests are handled.
↳ placement	json	Configuration for [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement). Specify mode='smart' for Smart Placement, or one of region/hostname/host.
↳ mode	string	Targeted placement mode. Values: smart, targeted.
↳ region	string	Cloud region for targeted placement in format 'provider:region'.
↳ hostname	string	HTTP hostname for targeted placement.
↳ host	string	TCP host and port for targeted placement.
↳ target	array	Array of placement targets (currently limited to single target).
↳ region	string	Cloud region in format 'provider:region'.
↳ hostname	string	HTTP hostname for targeted placement.
↳ host	string	TCP host:port for targeted placement.
↳ last_analyzed_at	string	The last time the script was analyzed for [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement).
↳ status	string	Status of [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement). Values: SUCCESS, UNSUPPORTED_APPLICATION, INSUFFICIENT_INVOCATIONS.
↳ placement_mode	string	Configuration for [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement). Specify mode='smart' for Smart Placement, or one of region/hostname/host. Values: smart, targeted.
↳ placement_status	string	Status of [Smart Placement](https://developers.cloudflare.com/workers/configuration/smart-placement). Values: SUCCESS, UNSUPPORTED_APPLICATION, INSUFFICIENT_INVOCATIONS.
↳ tag	string	The immutable ID of the script.
↳ tags	array	Tags associated with the Worker.
↳ tail_consumers	array	List of Workers that will consume logs from the attached Worker.
↳ environment	string	Optional environment if the Worker utilizes one.
↳ namespace	string	Optional dispatch namespace the script belongs to.
↳ service	string	Name of Worker that is to be the consumer.
↳ usage_model	string	Usage model for the Worker invocations. Values: standard, bundled, unbound.
↳ routes	array	Routes associated with the Worker.
↳ id	string	Identifier.
↳ pattern	string	Pattern to match incoming requests against. [Learn more](https://developers.cloudflare.com/workers/configuration/routing/routes/#matching-behavior).
↳ script	string	Name of the script to run if the route matches.
total_count	number	Total matching resources, or the number of resources returned on this page when the API omits a total
result_info	json	Pagination metadata returned by Cloudflare
↳ page	number	Current page
↳ per_page	number	Page size
↳ count	number	Count on the current page
↳ total_count	number	Total matching resources
↳ total_pages	number	Total pages
↳ cursor	string	Pagination cursor
↳ cursors	json	Directional pagination cursors
↳ before	string
↳ after	string

Cloudflare List Zones

Lists one page of zones (domains) in the Cloudflare account.

Inputs and outputs

Input

Parameter	Type	Required	Description
type	string	No	Comma-separated zone types: full, partial, secondary, internal
account_name	string	No	Account name; prefix the value with an operator, e.g. contains:Test. Supported operators: * equal (default) * not_equal * starts_with * ends_with * contains * starts_with_case_sensitive * ends_with_case_sensitive * contains_case_sensitive
name	string	No	Filter zones by domain name (e.g., "example.com")
status	string	No	Filter by zone status: "initializing", "pending", "active", or "moved"
page	number	No	Page number for pagination (default: 1)
per_page	number	No	Number of zones per page (default: 20, max: 50)
accountId	string	No	Filter zones by account ID
order	string	No	Sort field (name, status, account.id, account.name, plan.id)
direction	string	No	Sort direction (asc, desc)
match	string	No	Match logic for filters (any, all). Default: all
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
zones	array	Zones
↳ account	json	The account the zone belongs to.
↳ id	string	Identifier
↳ name	string	The name of the account.
↳ activated_on	string	The last time proof of ownership was detected and the zone was made active.
↳ cname_suffix	string	Allows the customer to use a custom apex. Tenants Only Configuration.
↳ created_on	string	When the zone was created.
↳ development_mode	number	The interval (in seconds) from when development mode expires (positive integer) or last expired (negative integer) for the domain. If development mode has never been enabled, this value is 0.
↳ id	string	Identifier
↳ meta	json	Metadata about the zone.
↳ cdn_only	boolean	The zone is only configured for CDN.
↳ custom_certificate_quota	number	Number of Custom Certificates the zone can have.
↳ dns_only	boolean	The zone is only configured for DNS.
↳ foundation_dns	boolean	The zone is setup with Foundation DNS.
↳ page_rule_quota	number	Number of Page Rules a zone can have.
↳ phishing_detected	boolean	The zone has been flagged for phishing.
↳ step	number	step
↳ modified_on	string	When the zone was last modified.
↳ name	string	The domain name. Per [RFC 1035](https://datatracker.ietf.org/doc/html/rfc1035#section-2.3.4) the overall zone name can be up to 253 characters, with each segment ("label") not exceeding 63 characters.
↳ name_servers	array	The name servers Cloudflare assigns to a zone.
↳ original_dnshost	string	DNS host at the time of switching to Cloudflare.
↳ original_name_servers	array	Original name servers before moving to Cloudflare.
↳ original_registrar	string	Registrar for the domain at the time of switching to Cloudflare.
↳ owner	json	The owner of the zone.
↳ id	string	Identifier
↳ name	string	Name of the owner.
↳ type	string	The type of owner.
↳ paused	boolean	Indicates whether the zone is only using Cloudflare DNS services. A true value means the zone will not receive security or performance benefits.
↳ permissions	array	Legacy permissions based on legacy user membership information.
↳ plan	json	A Zones subscription information.
↳ can_subscribe	boolean	States if the subscription can be activated.
↳ currency	string	The denomination of the customer.
↳ externally_managed	boolean	If this Zone is managed by another company.
↳ frequency	string	How often the customer is billed.
↳ id	string	Identifier
↳ is_subscribed	boolean	States if the subscription active.
↳ legacy_discount	boolean	If the legacy discount applies to this Zone.
↳ legacy_id	string	The legacy name of the plan.
↳ name	string	Name of the owner.
↳ price	number	How much the customer is paying.
↳ status	string	The zone status on Cloudflare. Values: initializing, pending, active, moved.
↳ tenant	json	The root organizational unit that this zone belongs to (such as a tenant or organization).
↳ id	string	Identifier
↳ name	string	The name of the Tenant account.
↳ tenant_unit	json	The immediate parent organizational unit that this zone belongs to (such as under a tenant or sub-organization).
↳ id	string	Identifier
↳ type	string	A full zone implies that DNS is hosted with Cloudflare. A partial zone is typically a partner-hosted zone or a CNAME setup. Values: full, partial, secondary, internal.
↳ vanity_name_servers	array	An array of domains used for custom name servers. This is only available for Business and Enterprise plans.
↳ verification_key	string	Verification key for partial zone setup.
total_count	number	Total matching resources, or the number of resources returned on this page when the API omits a total
result_info	json	Pagination metadata returned by Cloudflare
↳ page	number	Current page
↳ per_page	number	Page size
↳ count	number	Count on the current page
↳ total_count	number	Total matching resources
↳ total_pages	number	Total pages
↳ cursor	string	Pagination cursor
↳ cursors	json	Directional pagination cursors
↳ before	string
↳ after	string

Cloudflare Purge Cache

Purges cached content for a zone. Can purge everything or specific files/tags/hosts/prefixes.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	The zone ID to purge cache for
purge_everything	boolean	No	Set to true to purge all cached content. Mutually exclusive with files, tags, hosts, and prefixes
files	string	No	Comma-separated URLs or a JSON array of URL strings and {url, headers} objects. Use headers for custom cache keys, for example [{"url":"https://example.com/a","headers":\{"CF-IPCountry":"US"\}\}]
tags	string	No	Comma-separated list of cache tags to purge
hosts	string	No	Comma-separated list of hostnames to purge
prefixes	string	No	Comma-separated list of URL prefixes to purge
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
id	string	Purge request identifier returned by Cloudflare

Cloudflare Refresh Access Service Token

Refreshes the expiration of a service token.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
serviceTokenId	string	Yes	Service token id
apiKey	string	Yes	Cloudflare API token

Output

Parameter	Type	Description
client_id	string	The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
created_at	string	created at
duration	string	The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m, or the special value forever for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).
enabled	boolean	Whether the service token is enabled.
expires_at	string	expires at
id	string	UUID.
last_seen_at	string	last seen at
leak_report_url	string	Where the leaked client_secret was found, if provided by the reporter. Omitted if the token has not been reported as leaked.
leak_reported_at	string	When a secret scanning partner reported this service token's client_secret as leaked. A leaked service token is disabled and must be rotated before it can be re-enabled. Cleared once the secret is rotated. Omitted if the token has not been reported as leaked.
leak_reporter	string	The secret scanning partner that reported the leak. Omitted if the token has not been reported as leaked.
name	string	The name of the service token.
updated_at	string	updated at

Cloudflare Revoke Access Service Token

Permanently deletes a Cloudflare Access (Zero Trust) service token, revoking it. Every machine or integration still presenting that client ID and secret is locked out of the Access-protected applications immediately, and the secret cannot be recovered. This cannot be undone. Requires an API token with Account Access: Service Tokens Edit.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	The Cloudflare account ID. Service tokens are account-scoped
serviceTokenId	string	Yes	The service token ID to revoke permanently
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
client_id	string	The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
created_at	string	created at
duration	string	The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m, or the special value forever for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).
enabled	boolean	Whether the service token is enabled.
expires_at	string	expires at
id	string	UUID.
last_seen_at	string	last seen at
leak_report_url	string	Where the leaked client_secret was found, if provided by the reporter. Omitted if the token has not been reported as leaked.
leak_reported_at	string	When a secret scanning partner reported this service token's client_secret as leaked. A leaked service token is disabled and must be rotated before it can be re-enabled. Cleared once the secret is rotated. Omitted if the token has not been reported as leaked.
leak_reporter	string	The secret scanning partner that reported the leak. Omitted if the token has not been reported as leaked.
name	string	The name of the service token.
updated_at	string	updated at

Cloudflare Rotate Access Service Token

Generates a new Client Secret. The previous secret expires immediately unless previous_client_secret_expires_at schedules a later expiration.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
serviceTokenId	string	Yes	Service token id
apiKey	string	Yes	Cloudflare API token
previous_client_secret_expires_at	string	No	The expiration of the previous client_secret. If not provided, it defaults to the current timestamp in order to immediately expire the previous secret. If the service token was reported as leaked, this must not be in the future; the leaked secret is discarded immediately.

Output

Parameter	Type	Description
client_id	string	The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
client_secret	string	The Client Secret for the service token. Access will check for this value in the CF-Access-Client-Secret request header.
created_at	string	created at
duration	string	The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m, or the special value forever for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).
enabled	boolean	Whether the service token is enabled.
id	string	The ID of the service token.
name	string	The name of the service token.
updated_at	string	updated at
expires_at	string	Service token expires at when returned by Cloudflare; retained for existing workflows
last_seen_at	string	Service token last seen at when returned by Cloudflare; retained for existing workflows

Cloudflare Update Access Application

Updates a Cloudflare Access (Zero Trust) application. Cloudflare does not document merge behavior for this PUT, so treat it as a replace: send every field the application should keep, because an omitted field may revert to its default and widen or break access. Read the current configuration with "Get Access Application" first. Requires an API token with Account Access: Apps and Policies Edit.

Inputs and outputs

Input

Parameter	Type	Required	Description
destinations	json	No	JSON array. List of destinations secured by Access. This supersedes self_hosted_domains to allow for more flexibility in defining different types of domains. If destinations are provided, then self_hosted_domains will be ignored. Fields: overrides, type, uri, cidr, hostname, l4_protocol, port_range, vnet_id, mcp_server_id, worker_id.
oauth_configuration	json	No	JSON object. Required for end_user applications. Beta: Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta. Fields: dynamic_client_registration, enabled, grant.
self_hosted_domains	json	No	JSON array. List of public domains that Access will secure. This field is deprecated in favor of destinations and will be supported until November 21, 2025. If destinations are provided, then self_hosted_domains will be ignored.
user_populations	json	No	JSON array. Required for end_user applications. The single user population associated with this application.
allow_authenticate_via_warp	boolean	No	When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.
allow_iframe	boolean	No	Enables loading application content in an iFrame.
cors_headers	json	No	JSON object. cors headers Fields: allow_all_headers, allow_all_methods, allow_all_origins, allow_credentials, allowed_headers, allowed_methods, allowed_origins, max_age.
custom_non_identity_deny_url	string	No	The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.
custom_pages	json	No	JSON array. The custom pages that will be displayed when applicable for this application
eager_redirect_cookie_setting	boolean	No	Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
enable_binding_cookie	boolean	No	Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
http_only_cookie_attribute	boolean	No	Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
mfa_config	json	No	JSON object. Configures multi-factor authentication (MFA) settings. Fields: allowed_authenticators, mfa_disabled, session_duration.
options_preflight_bypass	boolean	No	Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
path_cookie_attribute	boolean	No	Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default
read_service_tokens_from_header	string	No	Allows matching Access Service Tokens passed HTTP in a single header with this name. This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers. The header value will be interpreted as a json object similar to: { "cf-access-client-id": "<CLIENT_ID>", "cf-access-client-secret": "<CLIENT_SECRET>" }
same_site_cookie_attribute	string	No	Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
scim_config	json	No	JSON object. Configuration for provisioning to this application via SCIM. This is currently in closed beta. Fields: authentication, deactivate_on_delete, enabled, idp_uid, mappings, remote_uri.
service_auth_401_redirect	boolean	No	Returns a 401 status code when the request is blocked by a Service Auth policy.
skip_interstitial	boolean	No	Enables automatic authentication through cloudflared.
use_clientless_isolation_app_launcher_url	boolean	No	Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.
app_launcher_logo_url	string	No	The image URL of the logo shown in the App Launcher header.
bg_color	string	No	The background color of the App Launcher page.
footer_links	json	No	JSON array. The links in the App Launcher footer. Fields: name, url.
header_bg_color	string	No	The background color of the App Launcher header.
landing_page_design	json	No	JSON object. The design of the App Launcher landing page shown to users when they log in. Fields: button_color, button_text_color, image_url, message, title.
skip_app_launcher_login_page	boolean	No	Determines when to skip the App Launcher landing page.
accountId	string	Yes	The Cloudflare account ID. Access applications are account-scoped
appId	string	Yes	The Access application ID to update
type	string	Yes	Application type: self_hosted, end_user, saas, ssh, vnc, app_launcher, warp, biso, bookmark, infrastructure, rdp, mcp, mcp_portal, or proxy_endpoint. dash_sso has no request variant and cannot be written through the API
domain	string	No	The primary hostname and path secured by Access. Required for the self_hosted, ssh, vnc, and rdp types; optional for bookmark and mcp_portal; read-only for app_launcher, warp, biso, and proxy_endpoint; and absent from the saas, infrastructure, and mcp variants
name	string	No	Friendly name shown in the dashboard and App Launcher
sessionDuration	string	No	How long an Access session stays valid, e.g. 24h or 30m
allowedIdps	string	No	Comma-separated identity provider IDs users may authenticate with
appLauncherVisible	boolean	No	Whether the application is shown in the App Launcher
autoRedirectToIdentity	boolean	No	Whether users skip the identity provider picker
customDenyMessage	string	No	Message shown to users who are denied access
customDenyUrl	string	No	URL denied users are redirected to
logoUrl	string	No	Logo image URL shown in the dashboard and App Launcher
tags	string	No	Comma-separated tag names categorizing the application
saasApp	string	No	JSON SaaS configuration, required for the saas type and rejected on every other type. SAML, e.g. { "auth_type": "saml", "consumer_service_url": "https://example.com/acs", "sp_entity_id": "https://example.com" }; OIDC, e.g. { "auth_type": "oidc", "client_id": "...", "redirect_uris": [ "https://example.com/callback" ] }
targetCriteria	string	No	JSON array of infrastructure target criteria, required for the infrastructure and rdp types and rejected on every other type, e.g. [{"port":22,"protocol":"SSH","target_attributes":{"hostname":["production"]}}]
policies	string	No	JSON array of policies to attach. Entries may be reusable policy IDs or inline policy objects
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
aud	string	Audience tag.
created_at	string	created at
id	string	UUID.
updated_at	string	updated at
allowed_idps	array	The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
destinations	array	List of destinations secured by Access. This supersedes self_hosted_domains to allow for more flexibility in defining different types of domains. If destinations are provided, then self_hosted_domains will be ignored.
↳ overrides	array	Rules that override how Access handles requests to this destination. Each rule can make a matching path public, bypassing Access authentication. Overrides are supported for public destinations and Worker destinations.
↳ behavior	string	The behavior to apply to matching requests. Values: public.
↳ path_pattern	string	The request path pattern to match. Wildcards (*) are supported, but each path segment may have at most one wildcard. Unlike the uri in public destinations, override path patterns do not implicitly cover subpaths; to do that, use a wildcard.
↳ type	string	type Values: public, private, via_mcp_server_portal, worker, preview_worker, all_workers, all_preview_workers.
↳ uri	string	The URI of the destination. Public destinations' URIs can include a domain and path with [wildcards](https://developers.cloudflare.com/cloudflare-one/policies/access/app-paths/).
↳ cidr	string	The CIDR range of the destination. Single IPs will be computed as /32.
↳ hostname	string	The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
↳ l4_protocol	string	The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match. Values: tcp, udp.
↳ port_range	string	The port range of the destination. Can be a single port or a range of ports. When omitted, all ports will match.
↳ vnet_id	string	The VNET ID to match the destination. When omitted, all VNETs will match.
↳ mcp_server_id	string	The MCP server id configured in ai-controls.
↳ worker_id	string	The ID of the Cloudflare Worker whose preview deployments to protect with Access.
domain	string	The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.
name	string	The name of the application.
oauth_configuration	json	Beta: Optional configuration for managing an OAuth authorization flow controlled by Access.
↳ dynamic_client_registration	json	Settings for OAuth dynamic client registration.
↳ allow_any_on_localhost	boolean	Allows any client with redirect URIs on localhost.
↳ allow_any_on_loopback	boolean	Allows any client with redirect URIs on 127.0.0.1.
↳ allowed_uris	array	The URIs that are allowed as redirect URIs for dynamically registered clients. HTTP and HTTPS paths may end in /* to match all sub-paths. Custom-scheme URIs must be explicitly configured and match exactly.
↳ enabled	boolean	Whether dynamic client registration is enabled.
↳ enabled	boolean	Whether the OAuth configuration is enabled for this application. When set to false, Access will not handle OAuth for this application. Defaults to true if omitted. Values: True.
↳ grant	json	Settings for OAuth grant behavior.
↳ access_token_lifetime	string	The lifetime of the access token. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h.
↳ session_duration	string	The duration of the OAuth session. Must be in the format 300ms or 2h45m. Valid time units are ns, us (or µs), ms, s, m, h.
self_hosted_domains	array	List of public domains that Access will secure. This field is deprecated in favor of destinations and will be supported until November 21, 2025. If destinations are provided, then self_hosted_domains will be ignored.
type	string	The application type. Values: end_user, self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, dash_sso, infrastructure, rdp, mcp, mcp_portal, proxy_endpoint.
user_populations	array	The single user population associated with this application.
allow_authenticate_via_warp	boolean	When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.
allow_iframe	boolean	Enables loading application content in an iFrame.
app_launcher_visible	boolean	Displays the application in the App Launcher.
auto_redirect_to_identity	boolean	When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
cors_headers	json	cors headers
↳ allow_all_headers	boolean	Allows all HTTP request headers.
↳ allow_all_methods	boolean	Allows all HTTP request methods.
↳ allow_all_origins	boolean	Allows all origins.
↳ allow_credentials	boolean	When set to true, includes credentials (cookies, authorization headers, or TLS client certificates) with requests.
↳ allowed_headers	array	Allowed HTTP request headers.
↳ allowed_methods	array	Allowed HTTP request methods.
↳ allowed_origins	array	Allowed origins.
↳ max_age	number	The maximum number of seconds the results of a preflight request can be cached.
custom_deny_message	string	The custom error message shown to a user when they are denied access to the application.
custom_deny_url	string	The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.
custom_non_identity_deny_url	string	The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.
custom_pages	array	The custom pages that will be displayed when applicable for this application
eager_redirect_cookie_setting	boolean	Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
enable_binding_cookie	boolean	Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
http_only_cookie_attribute	boolean	Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
logo_url	string	The image URL for the logo shown in the App Launcher dashboard.
mfa_config	json	Configures multi-factor authentication (MFA) settings.
↳ allowed_authenticators	array	Lists the MFA methods that users can authenticate with.
↳ mfa_disabled	boolean	Indicates whether to disable MFA for this resource. This option is available at the application and policy level.
↳ session_duration	string	Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
options_preflight_bypass	boolean	Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
path_cookie_attribute	boolean	Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default
read_service_tokens_from_header	string	Allows matching Access Service Tokens passed HTTP in a single header with this name.
same_site_cookie_attribute	string	Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
scim_config	json	Configuration for provisioning to this application via SCIM. This is currently in closed beta.
↳ authentication	json	Multiple authentication schemes
↳ password	string	Password used to authenticate with the remote SCIM service.
↳ scheme	string	The authentication scheme to use when making SCIM requests to this application. Values: httpbasic, oauthbearertoken, oauth2, access_service_token.
↳ user	string	User name used to authenticate with the remote SCIM service.
↳ token	string	Token used to authenticate with the remote SCIM service.
↳ authorization_url	string	URL used to generate the auth code used during token generation.
↳ client_id	string	Client ID of the Access service token used to authenticate with the remote service.
↳ client_secret	string	Client secret of the Access service token used to authenticate with the remote service.
↳ scopes	array	The authorization scopes to request when generating the token used to authenticate with the remove SCIM service.
↳ token_url	string	URL used to generate the token used to authenticate with the remote SCIM service.
↳ deactivate_on_delete	boolean	If false, propagates DELETE requests to the target application for SCIM resources. If true, sets 'active' to false on the SCIM resource. Note: Some targets do not support DELETE operations.
↳ enabled	boolean	Whether SCIM provisioning is turned on for this application.
↳ idp_uid	string	The UID of the IdP to use as the source for SCIM resources to provision to this application.
↳ mappings	array	A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
↳ enabled	boolean	Whether or not this mapping is enabled.
↳ filter	string	A [SCIM filter expression](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2) that matches resources that should be provisioned to this application.
↳ operations	json	Whether or not this mapping applies to creates, updates, or deletes.
↳ create	boolean	Whether or not this mapping applies to create (POST) operations.
↳ delete	boolean	Whether or not this mapping applies to DELETE operations.
↳ update	boolean	Whether or not this mapping applies to update (PATCH/PUT) operations.
↳ schema	string	Which SCIM resource type this mapping applies to.
↳ strictness	string	The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target. Values: strict, passthrough.
↳ transform_jsonata	string	A [JSONata](https://jsonata.org/) expression that transforms the resource before provisioning it in the application.
↳ remote_uri	string	The base URI for the application's SCIM-compatible API.
service_auth_401_redirect	boolean	Returns a 401 status code when the request is blocked by a Service Auth policy.
session_duration	string	The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
skip_interstitial	boolean	Enables automatic authentication through cloudflared.
tags	array	The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.
use_clientless_isolation_app_launcher_url	boolean	Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.
policies	array	policies
↳ approval_groups	array	Administrators who can approve a temporary authentication request.
↳ approvals_needed	number	The number of approvals needed to obtain access.
↳ email_addresses	array	A list of emails that can approve the access request.
↳ email_list_uuid	string	The UUID of an re-usable email list.
↳ approval_required	boolean	Requires the user to request access from an administrator at the start of each session.
↳ connection_rules	json	The rules that define how users may connect to targets secured by your application.
↳ rdp	json	The RDP-specific rules that define clipboard behavior for RDP connections.
↳ allowed_clipboard_local_to_remote_formats	array	Clipboard formats allowed when copying from local machine to remote RDP session.
↳ allowed_clipboard_remote_to_local_formats	array	Clipboard formats allowed when copying from remote RDP session to local machine.
↳ isolation_required	boolean	Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
↳ mfa_config	json	Configures multi-factor authentication (MFA) settings.
↳ allowed_authenticators	array	Lists the MFA methods that users can authenticate with.
↳ mfa_disabled	boolean	Indicates whether to disable MFA for this resource. This option is available at the application and policy level.
↳ session_duration	string	Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
↳ purpose_justification_prompt	string	A custom message that will appear on the purpose justification screen.
↳ purpose_justification_required	boolean	Require users to enter a justification when they log in to the application.
↳ session_duration	string	The amount of time that tokens issued for the application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
↳ created_at	string	created at
↳ decision	string	The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Values: allow, deny, non_identity, bypass.
↳ exclude	array	Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ id	string	The UUID of the policy
↳ include	array	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ name	string	The name of the Access policy.
↳ require	array	Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
↳ updated_at	string	updated at
↳ account_id	string	Identifier.
↳ precedence	number	The order of execution for this policy. Must be unique for each policy within an app.
saas_app	json	saas app
↳ auth_type	string	Identifier of the authentication protocol used for the saas app. Required for OIDC. Values: saml, oidc.
↳ consumer_service_url	string	The service provider's endpoint that is responsible for receiving and parsing a SAML assertion.
↳ created_at	string	created at
↳ custom_attributes	array	custom attributes
↳ friendly_name	string	The SAML FriendlyName of the attribute.
↳ name	string	The name of the attribute.
↳ name_format	string	A globally unique name for an identity or service provider. Values: urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified, urn:oasis:names:tc:SAML:2.0:attrname-format:basic, urn:oasis:names:tc:SAML:2.0:attrname-format:uri.
↳ required	boolean	If the attribute is required when building a SAML assertion.
↳ source	json	source
↳ name	string	The name of the IdP attribute.
↳ name_by_idp	array	A mapping from IdP ID to attribute name.
↳ idp_id	string	The UID of the IdP.
↳ source_name	string	The name of the IdP provided attribute.
↳ default_relay_state	string	The URL that the user will be redirected to after a successful login for IDP initiated logins.
↳ idp_entity_id	string	The unique identifier for your SaaS application.
↳ name_id_format	string	The format of the name identifier sent to the SaaS application. Values: id, email.
↳ name_id_transform_jsonata	string	A [JSONata](https://jsonata.org/) expression that transforms an application's user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting.
↳ public_key	string	The Access public certificate that will be used to verify your identity.
↳ saml_attribute_transform_jsonata	string	A [JSONata] (https://jsonata.org/) expression that transforms an application's user identities into attribute assertions in the SAML response.
↳ sp_entity_id	string	A globally unique name for an identity or service provider.
↳ sso_endpoint	string	The endpoint where your SaaS application will send login requests.
↳ updated_at	string	updated at
↳ access_token_lifetime	string	The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.
↳ allow_pkce_without_client_secret	boolean	If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.
↳ app_launcher_url	string	The URL where this applications tile redirects users
↳ client_id	string	The application client id
↳ client_secret	string	The application client secret, only returned on POST request.
↳ custom_claims	array	custom claims
↳ name	string	The name of the claim.
↳ required	boolean	If the claim is required when building an OIDC token.
↳ scope	string	The scope of the claim. Values: groups, profile, email, openid.
↳ source	json	source
↳ name	string	The name of the IdP claim.
↳ name_by_idp	json	A mapping from IdP ID to claim name.
↳ grant_types	array	The OIDC flows supported by this application
↳ group_filter_regex	string	A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
↳ hybrid_and_implicit_options	json	hybrid and implicit options
↳ return_access_token_from_authorization_endpoint	boolean	If an Access Token should be returned from the OIDC Authorization endpoint
↳ return_id_token_from_authorization_endpoint	boolean	If an ID Token should be returned from the OIDC Authorization endpoint
↳ redirect_uris	array	The permitted URL's for Cloudflare to return Authorization codes and Access/ID tokens
↳ refresh_token_options	json	refresh token options
↳ lifetime	string	How long a refresh token will be valid for after creation. Valid units are m,h,d. Must be longer than 1m.
↳ scopes	array	Define the user information shared with access, "offline_access" scope will be automatically enabled if refresh tokens are enabled
app_launcher_logo_url	string	The image URL of the logo shown in the App Launcher header.
bg_color	string	The background color of the App Launcher page.
footer_links	array	The links in the App Launcher footer.
↳ name	string	The hypertext in the footer link.
↳ url	string	the hyperlink in the footer link.
header_bg_color	string	The background color of the App Launcher header.
landing_page_design	json	The design of the App Launcher landing page shown to users when they log in.
↳ button_color	string	The background color of the log in button on the landing page.
↳ button_text_color	string	The color of the text in the log in button on the landing page.
↳ image_url	string	The URL of the image shown on the landing page.
↳ message	string	The message shown on the landing page.
↳ title	string	The title shown on the landing page.
skip_app_launcher_login_page	boolean	Determines when to skip the App Launcher landing page.
target_criteria	array	target criteria
↳ exclude	json	Selectors within an include, require, or exclude rule. At least one of target_attributes or tags must be non-empty.
↳ tags	json	Map of target tag keys to values. Values within a key are OR'd.
↳ target_attributes	json	Hostname selector map for include, require, or exclude rules. This is distinct from the deprecated top-level target_attributes field and only supports the hostname key.
↳ hostname	array	hostname
↳ include	json	Selectors within an include, require, or exclude rule. At least one of target_attributes or tags must be non-empty.
↳ tags	json	Map of target tag keys to values. Values within a key are OR'd.
↳ target_attributes	json	Hostname selector map for include, require, or exclude rules. This is distinct from the deprecated top-level target_attributes field and only supports the hostname key.
↳ hostname	array	hostname
↳ port	number	The port that the targets use for the chosen communication protocol. A port cannot be assigned to multiple protocols.
↳ require	json	Selectors within an include, require, or exclude rule. At least one of target_attributes or tags must be non-empty.
↳ tags	json	Map of target tag keys to values. Values within a key are OR'd.
↳ target_attributes	json	Hostname selector map for include, require, or exclude rules. This is distinct from the deprecated top-level target_attributes field and only supports the hostname key.
↳ hostname	array	hostname
↳ target_attributes	json	Contains a map of target attribute keys to target attribute values.
↳ protocol	string	The communication protocol your application secures. Values: RDP.

Cloudflare Update Access Group

Updates a configured Access group. Replaces the configuration; resend all values to retain.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
groupId	string	Yes	Group id
apiKey	string	Yes	Cloudflare API token
exclude	json	No	JSON array. Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules. Fields: group, any_valid_service_token, auth_context, auth_method, azureAD, certificate, common_name, geo, device_posture, email_domain, email_list, email, everyone, external_evaluation, github-organization, gsuite, login_method, ip_list, ip, okta, saml, oidc, service_token, linked_app_token, user_risk_score, cloudflare_account_member.
include	json	Yes	JSON array. Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. Fields: group, any_valid_service_token, auth_context, auth_method, azureAD, certificate, common_name, geo, device_posture, email_domain, email_list, email, everyone, external_evaluation, github-organization, gsuite, login_method, ip_list, ip, okta, saml, oidc, service_token, linked_app_token, user_risk_score, cloudflare_account_member.
is_default	boolean	No	Whether this is the default group
name	string	Yes	The name of the Access group.
require	json	No	JSON array. Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules. Fields: group, any_valid_service_token, auth_context, auth_method, azureAD, certificate, common_name, geo, device_posture, email_domain, email_list, email, everyone, external_evaluation, github-organization, gsuite, login_method, ip_list, ip, okta, saml, oidc, service_token, linked_app_token, user_risk_score, cloudflare_account_member.

Output

Parameter	Type	Description
created_at	string	created at
exclude	array	Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
id	string	UUID.
include	array	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
is_default	array	Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
name	string	The name of the Access group.
require	array	Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
updated_at	string	updated at

Cloudflare Update Access Policy

Updates a Cloudflare Access (Zero Trust) policy on an application. Cloudflare does not document merge behavior for this PUT, so treat it as a replace: resend all settings to retain, including exclude, require, approval_groups, connection_rules, and mfa_config; omitted rules or security settings may be dropped and widen access. The change applies to live traffic immediately. Read the current policy with "List Access Policies" first. Requires an API token with Account Access: Apps and Policies Edit.

Inputs and outputs

Input

Parameter	Type	Required	Description
approval_groups	json	No	JSON array. Administrators who can approve a temporary authentication request. Fields: approvals_needed, email_addresses, email_list_uuid.
connection_rules	json	No	JSON object. The rules that define how users may connect to the targets secured by your application. Fields: rdp, ssh.
mfa_config	json	No	JSON object. Configures multi-factor authentication (MFA) settings for infrastructure applications. Fields: allowed_authenticators, mfa_disabled, session_duration.
accountId	string	Yes	The Cloudflare account ID. Access applications are account-scoped
appId	string	Yes	The Access application ID that owns the policy
policyId	string	Yes	The Access policy ID to update
name	string	Yes	Name of the policy
decision	string	Yes	What the policy does when it matches: allow, deny, non_identity, or bypass (skip Access entirely)
include	string	Yes	JSON array of Access rules evaluated with OR logic. Example: [{"email_domain":{"domain":"example.com"}}]
exclude	string	No	JSON array of Access rules evaluated with NOT logic
require	string	No	JSON array of Access rules evaluated with AND logic
precedence	number	No	Evaluation order of the policy within the application
sessionDuration	string	No	How long a session granted by this policy stays valid, e.g. 24h. Leave it unset on a policy attached to an infrastructure-typed application — Cloudflare rejects those with error 12130
approvalRequired	boolean	No	Whether an approver must grant each access request
isolationRequired	boolean	No	Whether the session must run in a remote isolated browser
purposeJustificationRequired	boolean	No	Whether users must state a reason for access
purposeJustificationPrompt	string	No	Prompt shown when a justification is required
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
approval_groups	array	Administrators who can approve a temporary authentication request.
↳ approvals_needed	number	The number of approvals needed to obtain access.
↳ email_addresses	array	A list of emails that can approve the access request.
↳ email_list_uuid	string	The UUID of an re-usable email list.
approval_required	boolean	Requires the user to request access from an administrator at the start of each session.
connection_rules	json	The rules that define how users may connect to the targets secured by your application.
↳ rdp	json	The RDP-specific rules that define clipboard behavior for RDP connections.
↳ allowed_clipboard_local_to_remote_formats	array	Clipboard formats allowed when copying from local machine to remote RDP session.
↳ allowed_clipboard_remote_to_local_formats	array	Clipboard formats allowed when copying from remote RDP session to local machine.
↳ ssh	json	The SSH-specific rules that define how users may connect to the targets secured by your application.
↳ allow_email_alias	boolean	Enables using Identity Provider email alias as SSH username.
↳ usernames	array	Contains the Unix usernames that may be used when connecting over SSH.
isolation_required	boolean	Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
mfa_config	json	Configures multi-factor authentication (MFA) settings for infrastructure applications.
↳ allowed_authenticators	array	Lists the MFA methods that users can authenticate with. For infrastructure applications, supported values are piv_key and ssh_fido2_key.
↳ mfa_disabled	boolean	Indicates whether to disable MFA for this resource. This option is available at the application and policy level.
↳ session_duration	string	Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples: 5m or 24h.
purpose_justification_prompt	string	A custom message that will appear on the purpose justification screen.
purpose_justification_required	boolean	Require users to enter a justification when they log in to the application.
session_duration	string	The amount of time that tokens issued for the application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
created_at	string	created at
decision	string	The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. Values: allow, deny, non_identity, bypass.
exclude	array	Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
id	string	The UUID of the policy
include	array	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
name	string	The name of the Access policy.
require	array	Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
↳ group	json	group
↳ id	string	The ID of a previously created Access group.
↳ any_valid_service_token	json	An empty object which matches on all service tokens.
↳ auth_context	json	auth context
↳ ac_id	string	The ACID of an Authentication context.
↳ id	string	The ID of an Authentication context.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ auth_method	json	auth method
↳ auth_method	string	The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
↳ azureAD	json	azureAD
↳ id	string	The ID of an Azure group.
↳ identity_provider_id	string	The ID of your Azure identity provider.
↳ certificate	json	certificate
↳ common_name	json	common name
↳ common_name	string	The common name to match.
↳ geo	json	geo
↳ country_code	string	The country code that should be matched.
↳ device_posture	json	device posture
↳ account_id	string	Identifier.
↳ integration_uid	string	The ID of a device posture integration.
↳ email_domain	json	email domain
↳ domain	string	The email domain to match.
↳ email_list	json	email list
↳ id	string	The ID of a previously created email list.
↳ email	json	email
↳ email	string	The email of the user.
↳ everyone	json	An empty object which matches on all users.
↳ external_evaluation	json	external evaluation
↳ evaluate_url	string	The API endpoint containing your business logic.
↳ keys_url	string	The API endpoint containing the key that Access uses to verify that the response came from your API.
↳ github-organization	json	github-organization
↳ identity_provider_id	string	The ID of your Github identity provider.
↳ name	string	The name of the organization.
↳ team	string	The name of the team
↳ gsuite	json	gsuite
↳ email	string	The email of the Google Workspace group.
↳ identity_provider_id	string	The ID of your Google Workspace identity provider.
↳ login_method	json	login method
↳ id	string	The ID of an identity provider.
↳ ip_list	json	ip list
↳ id	string	The ID of a previously created IP list.
↳ ip	json	ip
↳ ip	string	An IPv4 or IPv6 CIDR block.
↳ okta	json	okta
↳ identity_provider_id	string	The ID of your Okta identity provider.
↳ name	string	The name of the Okta group.
↳ saml	json	saml
↳ attribute_name	string	The name of the SAML attribute.
↳ attribute_value	string	The SAML attribute value to look for.
↳ identity_provider_id	string	The ID of your SAML identity provider.
↳ oidc	json	oidc
↳ claim_name	string	The name of the OIDC claim.
↳ claim_value	string	The OIDC claim value to look for.
↳ identity_provider_id	string	The ID of your OIDC identity provider.
↳ service_token	json	service token
↳ token_id	string	The ID of a Service Token.
↳ linked_app_token	json	linked app token
↳ app_uid	string	The ID of an Access OIDC SaaS application
↳ user_risk_score	json	user risk score
↳ user_risk_score	array	A list of risk score levels to match. Values can be low, medium, high, or unscored.
↳ cloudflare_account_member	json	cloudflare account member
↳ account_id	string	Identifier.
updated_at	string	updated at
account_id	string	Identifier.
precedence	number	The order of execution for this policy. Must be unique for each policy within an app.

Cloudflare Update Access Service Token

Updates a configured service token. Replaces the configuration; resend all values to retain.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
serviceTokenId	string	Yes	Service token id
apiKey	string	Yes	Cloudflare API token
client_secret_version	number	No	A version number identifying the current client_secret associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by previous_client_secret_expires_at. If the service token was reported as leaked, previous_client_secret_expires_at is not required, may not be in the future, and the previous secret is discarded immediately.
duration	string	No	The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m, or the special value forever for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).
enabled	boolean	No	Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous client_secret stop being accepted, but the token itself is preserved and can be re-enabled. A service token reported as leaked is disabled automatically and cannot be re-enabled until its secret is rotated; attempting to do so returns a 409. Defaults to enabled when omitted on create.
name	string	No	The name of the service token.
previous_client_secret_expires_at	string	No	The expiration of the previous client_secret. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise. Rotating a service token that was reported as leaked discards the previous secret entirely, so no grace period can be set.

Output

Parameter	Type	Description
client_id	string	The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
created_at	string	created at
duration	string	The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m, or the special value forever for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).
enabled	boolean	Whether the service token is enabled.
expires_at	string	expires at
id	string	UUID.
last_seen_at	string	last seen at
leak_report_url	string	Where the leaked client_secret was found, if provided by the reporter. Omitted if the token has not been reported as leaked.
leak_reported_at	string	When a secret scanning partner reported this service token's client_secret as leaked. A leaked service token is disabled and must be rotated before it can be re-enabled. Cleared once the secret is rotated. Omitted if the token has not been reported as leaked.
leak_reporter	string	The secret scanning partner that reported the leak. Omitted if the token has not been reported as leaked.
name	string	The name of the service token.
updated_at	string	updated at

Cloudflare Update DNS Record

Updates an existing DNS record for a zone.

Inputs and outputs

Input

Parameter	Type	Required	Description
clearComment	boolean	No	Clear the stored DNS record comment
settings	json	No	JSON object. Settings for the DNS record. Fields: ipv4_only, ipv6_only, flatten_cname.
private_routing	boolean	No	Enables private network routing to the origin.
data	json	No	JSON object. Structured record data. The available fields depend on the DNS record type. Fields: flags, tag, value, algorithm, certificate, key_tag, type, protocol, public_key, digest, digest_type, priority, target, altitude, lat_degrees, lat_direction, lat_minutes, lat_seconds, long_degrees, long_direction, long_minutes, long_seconds, precision_horz, precision_vert, size, order, preference, regex, replacement, service, matching_type, selector, usage, port, weight, fingerprint.
include_shadow_metadata	boolean	No	Whether to include shadow metadata in the meta field of each record in the response. See [Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records).
zoneId	string	Yes	The zone ID containing the DNS record
recordId	string	Yes	The DNS record ID to update
type	string	No	DNS record type (e.g., "A", "AAAA", "CNAME", "MX", "TXT")
name	string	No	DNS record name
content	string	No	DNS record content (e.g., IP address)
ttl	number	No	Time to live in seconds (1 = automatic)
proxied	boolean	No	Whether to enable Cloudflare proxy
priority	number	No	Record priority. Cloudflare accepts this top-level field for MX and URI records only; use the data object for structured records such as SRV (priority, weight, port, target)
comment	string	No	Comment for the DNS record
tags	string	No	Comma-separated tags for the DNS record
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
comment	string	Comments or notes about the DNS record. This field has no effect on DNS responses.
name	string	Complete DNS record name, including the zone name, in Punycode.
proxied	boolean	Whether the record is receiving the performance and security benefits of Cloudflare.
settings	json	Settings for the DNS record.
↳ ipv4_only	boolean	When enabled, only A records will be generated, and AAAA records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
↳ ipv6_only	boolean	When enabled, only AAAA records will be generated, and A records will not be created. This setting is intended for exceptional cases. Note that this option only applies to proxied records and it has no effect on whether Cloudflare communicates with the origin using IPv4 or IPv6.
↳ flatten_cname	boolean	If enabled, causes the CNAME record to be resolved externally and the resulting address records (e.g., A and AAAA) to be returned instead of the CNAME record itself. This setting is unavailable for proxied records, since they are always flattened.
tags	array	Custom tags for the DNS record. This field has no effect on DNS responses.
ttl	number	Time To Live (TTL) of the DNS record in seconds. Setting to 1 means 'automatic'. Value must be between 60 and 86400, with the minimum reduced to 30 for Enterprise zones. Values: 1.
content	string	Formatted URI content. See 'data' to set URI properties.
private_routing	boolean	Enables private network routing to the origin.
type	string	Record type. Values: A, AAAA, CNAME, MX, NS, OPENPGPKEY, PTR, TXT, CAA, CERT, DNSKEY, DS, HTTPS, LOC, NAPTR, SMIMEA, SRV, SSHFP, SVCB, TLSA, URI.
priority	number	Required for MX and URI records; ignored for other record types (but may still be returned by the API). Records with lower priorities are preferred. This field is to be deprecated in favor of the priority field within the data map.
data	json	Structured record data. The available fields depend on the DNS record type.
↳ flags	json	Flags.
↳ tag	string	Name of the property controlled by this record (e.g.: issue, issuewild, iodef).
↳ value	string	Value.
↳ algorithm	number	Algorithm.
↳ certificate	string	Certificate.
↳ key_tag	number	Key Tag.
↳ type	number	Type.
↳ protocol	number	Protocol.
↳ public_key	string	Public Key.
↳ digest	string	Digest.
↳ digest_type	number	Digest Type.
↳ priority	number	Priority.
↳ target	string	The record content.
↳ altitude	number	Altitude of location in meters.
↳ lat_degrees	number	Degrees of latitude.
↳ lat_direction	string	Latitude direction. Values: N, S.
↳ lat_minutes	number	Minutes of latitude.
↳ lat_seconds	number	Seconds of latitude.
↳ long_degrees	number	Degrees of longitude.
↳ long_direction	string	Longitude direction. Values: E, W.
↳ long_minutes	number	Minutes of longitude.
↳ long_seconds	number	Seconds of longitude.
↳ precision_horz	number	Horizontal precision of location.
↳ precision_vert	number	Vertical precision of location.
↳ size	number	Size of location in meters.
↳ order	number	Order.
↳ preference	number	Preference.
↳ regex	string	Regex.
↳ replacement	string	Replacement.
↳ service	string	Service.
↳ matching_type	number	Matching Type.
↳ selector	number	Selector.
↳ usage	number	Usage.
↳ port	number	The port of the service.
↳ weight	number	The record weight.
↳ fingerprint	string	Fingerprint.
comment_modified_on	string	When the record comment was last modified. Omitted if there is no comment.
created_on	string	When the record was created.
id	string	Identifier.
meta	json	Extra Cloudflare-specific metadata about the record.
↳ dead_glue	boolean	Whether this glue record is not served because a shallower NS delegation takes precedence over the deeper delegation that needs it.
↳ is_glue	boolean	Whether this A or AAAA record is glue for a subdomain NS delegation. See [Glue records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records#glue-records).
↳ shadowed_by	array	IDs of the NS records that shadow this record. See [Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records).
↳ shadowed_records_count	number	Number of records shadowed by this NS delegation. See [Shadowed records](https://developers.cloudflare.com/dns/manage-dns-records/reference/shadowed-records).
modified_on	string	When the record was last modified.
proxiable	boolean	Whether the record can be proxied by Cloudflare or not.
tags_modified_on	string	When the record tags were last modified. Omitted if there are no tags.
zone_id	string	Legacy DNS response zone ID when returned by Cloudflare
zone_name	string	Legacy DNS response zone name when returned by Cloudflare
locked	boolean	Legacy DNS response lock flag when returned by Cloudflare

Cloudflare Update R2 Bucket Cors

Replaces the Cross-Origin Resource Sharing (CORS) rules for an R2 bucket. Rules specify which origins, methods, and headers are allowed for browser requests to objects in the bucket. Replaces the configuration; resend all values to retain.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
bucketName	string	Yes	Bucket name
apiKey	string	Yes	Cloudflare API token
rules	json	No	JSON array. rules Fields: allowed, exposeHeaders, id, maxAgeSeconds.
jurisdiction	string	No	Jurisdiction where objects in this bucket are guaranteed to be stored.

Output

Parameter	Type	Description
success	boolean	Whether Cloudflare accepted the operation

Cloudflare Update R2 Bucket Lifecycle

Replaces the object lifecycle rules for an R2 bucket. Rules match object-key prefixes and can expire objects, abort incomplete multipart uploads, or transition objects to Infrequent Access storage. Replaces the configuration; resend all values to retain.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
bucketName	string	Yes	Bucket name
apiKey	string	Yes	Cloudflare API token
rules	string	Yes	Complete JSON array of lifecycle rules. Read the current rules first and include every rule to retain. Use [] only to remove all lifecycle rules. Fields: abortMultipartUploadsTransition, conditions, deleteObjectsTransition, enabled, id, storageClassTransitions.
jurisdiction	string	No	Jurisdiction where objects in this bucket are guaranteed to be stored.

Output

Parameter	Type	Description
success	boolean	Whether Cloudflare accepted the operation

Cloudflare Update Rate Limiting Rule

Updates a rate limiting rule in the http_ratelimit phase entry point ruleset of a zone, using the current Rulesets-based rate limiting API. Cloudflare replaces the rule definition rather than merging it, so send the complete rule — every field you omit is reset. Run "List Rate Limiting Rules" first to read the current definition and get the ruleset ID. Requires an API token with Zone WAF Edit.

Inputs and outputs

Input

Parameter	Type	Required	Description
exposed_credential_check	json	No	JSON object. Configuration for exposed credential checking. Fields: password_expression, username_expression.
position	json	No	JSON object. An object configuring where the rule will be placed. Fields: before, after, index.
score_per_period	number	No	The score threshold per period for which the action will be executed the first time.
score_response_header_name	string	No	A response header name provided by the origin, which contains the score to increment rate limit counter with.
dry_run	boolean	No	dry run
zoneId	string	Yes	The zone ID that owns the rule
rulesetId	string	Yes	The http_ratelimit entry point ruleset ID, as returned by "List Rate Limiting Rules"
ruleId	string	Yes	The rate limiting rule ID to update
expression	string	Yes	Cloudflare filter expression selecting the requests the rule applies to
characteristics	string	Yes	Comma-separated counting characteristics. cf.colo.id is mandatory. ip.src and cf.unique_visitor_id are mutually exclusive — include at most one.
period	number	Yes	Counting window in seconds. Cloudflare accepts only 10, 60, 120, 300, 600, or 3600
requestsPerPeriod	number	Yes	Number of requests allowed within the counting period before the action fires
action	string	Yes	Action applied once the limit is exceeded: block, managed_challenge, js_challenge, challenge, or log. Required because this endpoint replaces the rule rather than merging into it — a defaulted action would silently convert an existing log or challenge rule into a hard block
mitigationTimeout	number	No	Seconds the action stays applied. Cloudflare accepts only 0, 10, 60, 120, 300, 600, 3600, or 86400
counting_expression	string	No	Optional expression defining which requests are counted
requestsToOrigin	boolean	No	When true, only requests that reach the origin are counted
description	string	No	Human-readable description of the rule
enabled	boolean	No	Whether the rule is enabled
ref	string	No	Reference tag that stays stable across rule updates. Because the update replaces the rule, omitting it resets the tag to the rule ID and breaks anything matching on the old value
actionParameters	string	No	JSON object of action-specific parameters for the mitigation action, e.g. {"response":{"status_code":429,"content":"{"error":"rate limited"}","content_type":"application/json"}} for a custom block response. Because the update replaces the rule, omitting it resets action_parameters to {} and the rule falls back to Cloudflare's default block page
logging	string	No	JSON logging configuration to preserve, e.g. {"enabled":true}. Omitting it on a rule that had logging configured resets it to the default
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
description	string	An informative description of the ruleset.
id	string	The unique ID of the ruleset.
last_updated	string	The timestamp of when the ruleset was last modified.
name	string	The human-readable name of the ruleset.
version	string	The version of the ruleset.
kind	string	The kind of the ruleset. Values: managed, custom, root, zone.
phase	string	The phase of the ruleset.
rules	array	The list of rules in the ruleset.
↳ action	string	The action to perform when the rule matches.
↳ action_parameters	json	The parameters configuring the rule's action.
↳ response	json	The response to show when the block is applied.
↳ content	string	The content to return.
↳ content_type	string	The type of the content to return.
↳ status_code	number	The status code to return.
↳ algorithms	array	Custom order for compression algorithms.
↳ name	string	Name of the compression algorithm to enable. Values: none, auto, default, gzip, brotli, zstd.
↳ id	string	The ID of the ruleset to execute.
↳ matched_data	json	The configuration to use for matched data logging.
↳ public_key	string	The public key to encrypt matched data logs with.
↳ overrides	json	A set of overrides to apply to the target ruleset.
↳ action	string	An action to override all rules with. This option has lower precedence than rule and category overrides.
↳ categories	array	A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
↳ action	string	The action to override rules in the category with.
↳ category	string	The name of the category to override.
↳ enabled	boolean	Whether to enable execution of rules in the category.
↳ sensitivity_level	string	The sensitivity level to use for rules in the category. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ enabled	boolean	Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
↳ rules	array	A list of rule-level overrides. This option has the highest precedence.
↳ action	string	The action to override the rule with.
↳ enabled	boolean	Whether to enable execution of the rule.
↳ id	string	The ID of the rule to override.
↳ score_threshold	number	The score threshold to use for the rule.
↳ sensitivity_level	string	The sensitivity level to use for the rule. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ sensitivity_level	string	A sensitivity level to set for all rules. This option has lower precedence than rule and category overrides and is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ cookie_fields	array	The cookie fields to log.
↳ name	string	The name of the cookie.
↳ raw_response_fields	array	The raw response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ request_fields	array	The raw request fields to log.
↳ name	string	The name of the header.
↳ response_fields	array	The transformed response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ transformed_request_fields	array	The transformed request fields to log.
↳ name	string	The name of the header.
↳ from_list	json	A redirect based on a bulk list lookup.
↳ key	string	An expression that evaluates to the list lookup key.
↳ name	string	The name of the list to match against.
↳ from_value	json	A redirect based on the request properties.
↳ preserve_query_string	boolean	Whether to keep the query string of the original request.
↳ status_code	number	The status code to use for the redirect. Values: 301, 302, 303, 307, 308.
↳ target_url	json	A URL to redirect the request to.
↳ expression	string	An expression that evaluates to a URL to redirect the request to.
↳ value	string	A URL to redirect the request to.
↳ headers	json	A map of headers to rewrite.
↳ uri	json	A URI query rewrite.
↳ path	json	A URI path rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI path to.
↳ value	string	A value to rewrite the URI path to.
↳ query	json	A URI query rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI query to.
↳ value	string	A value to rewrite the URI query to.
↳ origin	boolean	Whether to propagate the rewritten URI to origin.
↳ host_header	string	A value to rewrite the HTTP host header to.
↳ origin	json	An origin to route to.
↳ host	string	A resolved host to route to.
↳ port	number	A destination port to route to.
↳ sni	json	A Server Name Indication (SNI) override.
↳ value	string	A value to override the SNI to.
↳ increment	number	A delta to change the score by, which can be either positive or negative.
↳ content_type	string	The content type header to set with the error response. Values: application/json, text/html, text/plain, text/xml.
↳ status_code	number	The status code to use for the error.
↳ content	string	The response content.
↳ asset_name	string	The name of a custom asset to serve as the error response.
↳ immutable	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ max-age	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ must-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ must-understand	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-cache	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ no-store	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-transform	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ private	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ proxy-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ public	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ s-maxage	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-if-error	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-while-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ additional_cacheable_ports	array	A list of additional ports that caching should be enabled on.
↳ browser_ttl	json	How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
↳ default	number	The browser TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The browser TTL mode. Values: respect_origin, bypass_by_default, override_origin, bypass.
↳ cache	boolean	Whether the request's response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
↳ cache_key	json	Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
↳ cache_by_device_type	boolean	Whether to separate cached content based on the visitor's device type.
↳ cache_deception_armor	boolean	Whether to protect from web cache deception attacks, while allowing static assets to be cached.
↳ custom_key	json	Which components of the request are included or excluded from the cache key.
↳ cookie	json	Which cookies to include in the cache key.
↳ check_presence	array	A list of cookies to check for the presence of. The presence of these cookies is included in the cache key.
↳ include	array	A list of cookies to include in the cache key.
↳ header	json	Which headers to include in the cache key.
↳ check_presence	array	A list of headers to check for the presence of. The presence of these headers is included in the cache key.
↳ contains	json	A mapping of header names to a list of values. If a header is present in the request and contains any of the values provided, its value is included in the cache key.
↳ exclude_origin	boolean	Whether to exclude the origin header in the cache key.
↳ include	array	A list of headers to include in the cache key.
↳ host	json	How to use the host in the cache key.
↳ resolved	boolean	Whether to use the resolved host in the cache key.
↳ query_string	json	Which query string parameters to include in or exclude from the cache key.
↳ exclude	json	Which query string parameters to exclude from the cache key.
↳ all	boolean	Whether to exclude all query string parameters from the cache key. Values: True.
↳ list	array	A list of query string parameters to exclude from the cache key.
↳ include	json	Which query string parameters to include in the cache key.
↳ all	boolean	Whether to include all query string parameters in the cache key. Values: True.
↳ list	array	A list of query string parameters to include in the cache key.
↳ user	json	How to use characteristics of the request user agent in the cache key.
↳ device_type	boolean	Whether to use the user agent's device type in the cache key.
↳ geo	boolean	Whether to use the user agents's country in the cache key.
↳ lang	boolean	Whether to use the user agent's language in the cache key.
↳ ignore_query_strings_order	boolean	Whether to treat requests with the same query parameters the same, regardless of the order those query parameters are in.
↳ cache_reserve	json	Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
↳ eligible	boolean	Whether Cache Reserve is enabled. If this is true and a request meets eligibility criteria, Cloudflare will write the resource to Cache Reserve.
↳ minimum_file_size	number	The minimum file size eligible for storage in Cache Reserve.
↳ edge_ttl	json	How long the Cloudflare edge network should cache the response.
↳ default	number	The edge TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The edge TTL mode. Values: respect_origin, bypass_by_default, override_origin.
↳ status_code_ttl	array	A list of TTLs to apply to specific status codes or status code ranges.
↳ status_code	number	A single status code to apply the TTL to.
↳ status_code_range	json	A range of status codes to apply the TTL to.
↳ from	number	The lower bound of the range.
↳ to	number	The upper bound of the range.
↳ value	number	The time to cache the response for (in seconds). A value of 0 is equivalent to setting the cache control header with the value "no-cache". A value of -1 is equivalent to setting the cache control header with the value of "no-store".
↳ origin_cache_control	boolean	Whether Cloudflare will aim to strictly adhere to RFC 7234.
↳ origin_error_page_passthru	boolean	Whether to generate Cloudflare error pages for issues from the origin server.
↳ origin_range_requests	json	Controls whether Cloudflare fetches a large asset from the origin as a series of range requests instead of one whole-body request.
↳ mode	string	Whether to use range requests. default is the behaviour the zone gets without this rule. Values: on, off, default.
↳ read_timeout	number	A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
↳ respect_strong_etags	boolean	Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
↳ serve_stale	json	When to serve stale content from cache.
↳ disable_stale_while_updating	boolean	Whether Cloudflare should disable serving stale content while getting the latest content from the origin.
↳ shared_dictionary	json	Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
↳ match_pattern	string	URL pattern for the Use-As-Dictionary match field. This pattern specifies which URLs can use this response as a dictionary.
↳ strip_etags	boolean	Whether to strip ETag headers from the origin response before caching.
↳ strip_last_modified	boolean	Whether to strip Last-Modified headers from the origin response before caching.
↳ strip_set_cookie	boolean	Whether to strip Set-Cookie headers from the origin response before caching.
↳ vary	json	Controls how cached responses vary based on request headers. default is required by the API and applies to any Vary response header that does not have a per-header override.
↳ default	json	Controls how response Vary headers without a per-header override contribute to the cache key.
↳ action	string	How the header value is treated when building the cache key. Values: bypass, passthrough, normalize.
↳ headers	json	A mapping of lowercase request header names to their vary configuration.
↳ operation	string	The operation to perform on the cache tags. Values: add, remove, set.
↳ values	array	A list of cache tag values.
↳ expression	string	An expression that evaluates to an array of cache tag values.
↳ automatic_https_rewrites	boolean	Whether to enable Automatic HTTPS Rewrites.
↳ autominify	json	Which file extensions to minify automatically.
↳ css	boolean	Whether to minify CSS files.
↳ html	boolean	Whether to minify HTML files.
↳ js	boolean	Whether to minify JavaScript files.
↳ bic	boolean	Whether to enable Browser Integrity Check (BIC).
↳ content_converter	boolean	Whether to enable content conversion (e.g., HTML to Markdown).
↳ disable_apps	boolean	Whether to disable Cloudflare Apps. Values: True.
↳ disable_pay_per_crawl	boolean	Whether to disable Pay Per Crawl. Values: True.
↳ disable_rum	boolean	Whether to disable Real User Monitoring (RUM). Values: True.
↳ disable_zaraz	boolean	Whether to disable Zaraz. Values: True.
↳ email_obfuscation	boolean	Whether to enable Email Obfuscation.
↳ fonts	boolean	Whether to enable Cloudflare Fonts.
↳ hotlink_protection	boolean	Whether to enable Hotlink Protection.
↳ mirage	boolean	Whether to enable Mirage.
↳ opportunistic_encryption	boolean	Whether to enable Opportunistic Encryption.
↳ polish	string	The Polish level to configure. Values: off, lossless, lossy, webp.
↳ redirects_for_ai_training	boolean	Whether to redirect verified AI training crawlers to canonical URLs found in the HTML response.
↳ request_body_buffering	string	The request body buffering mode. Values: none, standard, full.
↳ response_body_buffering	string	The response body buffering mode. Values: none, standard.
↳ rocket_loader	boolean	Whether to enable Rocket Loader.
↳ security_level	string	The Security Level to configure. Values: off, essentially_off, low, medium, high, under_attack.
↳ server_side_excludes	boolean	Whether to enable Server-Side Excludes.
↳ ssl	string	The SSL level to configure. Values: off, flexible, full, strict, origin_pull.
↳ sxg	boolean	Whether to enable Signed Exchanges (SXG).
↳ webmcp_enabled	boolean	Whether to serve the WebMCP bridge script, which exposes the page's tools to browser AI agents.
↳ webmcp_packs	array	Bundled WebMCP tool packs to activate for matching requests. An empty array disables all packs. Omitting this parameter leaves the pack selection unchanged. Does not enable the WebMCP bridge itself.
↳ phase	string	A phase to skip the execution of. This option is only compatible with the products option. Values: current.
↳ phases	array	A list of phases to skip the execution of. This option is incompatible with the rulesets option.
↳ products	array	A list of legacy security products to skip the execution of.
↳ rules	json	A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
↳ ruleset	string	A ruleset to skip the execution of. This option is incompatible with the rulesets option. Values: current.
↳ rulesets	array	A list of ruleset IDs to skip the execution of. This option is incompatible with the ruleset and phases options.
↳ link_maze	json	Enables the link maze transformation on the response.
↳ categories	array	The categories of the rule.
↳ description	string	An informative description of the rule.
↳ enabled	boolean	Whether the rule should be executed.
↳ exposed_credential_check	json	Configuration for exposed credential checking.
↳ password_expression	string	An expression that selects the password used in the credentials check.
↳ username_expression	string	An expression that selects the user ID used in the credentials check.
↳ expression	string	The expression defining which traffic will match the rule.
↳ id	string	The unique ID of the rule.
↳ last_updated	string	The timestamp of when the rule was last modified.
↳ logging	json	An object configuring the rule's logging behavior.
↳ enabled	boolean	Whether to generate a log when the rule matches.
↳ ratelimit	json	An object configuring the rule's rate limit behavior.
↳ characteristics	array	Characteristics of the request on which the rate limit counter will be incremented.
↳ counting_expression	string	An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
↳ mitigation_timeout	number	Period of time in seconds after which the action will be disabled following its first execution.
↳ period	number	Period in seconds over which the counter is being incremented.
↳ requests_per_period	number	The threshold of requests per period after which the action will be executed for the first time.
↳ requests_to_origin	boolean	Whether counting is only performed when an origin is reached.
↳ score_per_period	number	The score threshold per period for which the action will be executed the first time.
↳ score_response_header_name	string	A response header name provided by the origin, which contains the score to increment rate limit counter with.
↳ ref	string	The reference of the rule (the rule's ID by default).
↳ version	string	The version of the rule.

Cloudflare Update Ruleset

Updates the description and rules of a zone ruleset, creating a new version. Read the current rules with "Get Ruleset" before replacing the list. The rules array replaces the complete list: include every existing rule you want to keep; omitted rules are removed. Use "Create Ruleset Rule" to add a single rule without replacing the list.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	Zone id
rulesetId	string	Yes	Ruleset id
apiKey	string	Yes	Cloudflare API token
description	string	No	An informative description of the ruleset.
rules	json	No	JSON array replacing the complete rule list. Read "Get Ruleset" first and include every rule to retain; omitted rules are removed, and [] removes all rules. Fields: action, action_parameters, categories, description, enabled, exposed_credential_check, expression, id, last_updated, logging, ratelimit, ref, version.
dry_run	boolean	No	Validates the request without persisting changes when set to true. Responses that normally return 200 return result: null; endpoints that normally return 204 continue to return 204.

Output

Parameter	Type	Description
description	string	An informative description of the ruleset.
id	string	The unique ID of the ruleset.
last_updated	string	The timestamp of when the ruleset was last modified.
name	string	The human-readable name of the ruleset.
version	string	The version of the ruleset.
kind	string	The kind of the ruleset. Values: managed, custom, root, zone.
phase	string	The phase of the ruleset.
rules	array	The list of rules in the ruleset.
↳ action	string	The action to perform when the rule matches.
↳ action_parameters	json	The parameters configuring the rule's action.
↳ response	json	The response to show when the block is applied.
↳ content	string	The content to return.
↳ content_type	string	The type of the content to return.
↳ status_code	number	The status code to return.
↳ algorithms	array	Custom order for compression algorithms.
↳ name	string	Name of the compression algorithm to enable. Values: none, auto, default, gzip, brotli, zstd.
↳ id	string	The ID of the ruleset to execute.
↳ matched_data	json	The configuration to use for matched data logging.
↳ public_key	string	The public key to encrypt matched data logs with.
↳ overrides	json	A set of overrides to apply to the target ruleset.
↳ action	string	An action to override all rules with. This option has lower precedence than rule and category overrides.
↳ categories	array	A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
↳ action	string	The action to override rules in the category with.
↳ category	string	The name of the category to override.
↳ enabled	boolean	Whether to enable execution of rules in the category.
↳ sensitivity_level	string	The sensitivity level to use for rules in the category. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ enabled	boolean	Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
↳ rules	array	A list of rule-level overrides. This option has the highest precedence.
↳ action	string	The action to override the rule with.
↳ enabled	boolean	Whether to enable execution of the rule.
↳ id	string	The ID of the rule to override.
↳ score_threshold	number	The score threshold to use for the rule.
↳ sensitivity_level	string	The sensitivity level to use for the rule. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ sensitivity_level	string	A sensitivity level to set for all rules. This option has lower precedence than rule and category overrides and is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ cookie_fields	array	The cookie fields to log.
↳ name	string	The name of the cookie.
↳ raw_response_fields	array	The raw response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ request_fields	array	The raw request fields to log.
↳ name	string	The name of the header.
↳ response_fields	array	The transformed response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ transformed_request_fields	array	The transformed request fields to log.
↳ name	string	The name of the header.
↳ from_list	json	A redirect based on a bulk list lookup.
↳ key	string	An expression that evaluates to the list lookup key.
↳ name	string	The name of the list to match against.
↳ from_value	json	A redirect based on the request properties.
↳ preserve_query_string	boolean	Whether to keep the query string of the original request.
↳ status_code	number	The status code to use for the redirect. Values: 301, 302, 303, 307, 308.
↳ target_url	json	A URL to redirect the request to.
↳ expression	string	An expression that evaluates to a URL to redirect the request to.
↳ value	string	A URL to redirect the request to.
↳ headers	json	A map of headers to rewrite.
↳ uri	json	A URI query rewrite.
↳ path	json	A URI path rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI path to.
↳ value	string	A value to rewrite the URI path to.
↳ query	json	A URI query rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI query to.
↳ value	string	A value to rewrite the URI query to.
↳ origin	boolean	Whether to propagate the rewritten URI to origin.
↳ host_header	string	A value to rewrite the HTTP host header to.
↳ origin	json	An origin to route to.
↳ host	string	A resolved host to route to.
↳ port	number	A destination port to route to.
↳ sni	json	A Server Name Indication (SNI) override.
↳ value	string	A value to override the SNI to.
↳ increment	number	A delta to change the score by, which can be either positive or negative.
↳ content_type	string	The content type header to set with the error response. Values: application/json, text/html, text/plain, text/xml.
↳ status_code	number	The status code to use for the error.
↳ content	string	The response content.
↳ asset_name	string	The name of a custom asset to serve as the error response.
↳ immutable	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ max-age	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ must-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ must-understand	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-cache	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ no-store	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-transform	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ private	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ proxy-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ public	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ s-maxage	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-if-error	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-while-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ additional_cacheable_ports	array	A list of additional ports that caching should be enabled on.
↳ browser_ttl	json	How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
↳ default	number	The browser TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The browser TTL mode. Values: respect_origin, bypass_by_default, override_origin, bypass.
↳ cache	boolean	Whether the request's response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
↳ cache_key	json	Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
↳ cache_by_device_type	boolean	Whether to separate cached content based on the visitor's device type.
↳ cache_deception_armor	boolean	Whether to protect from web cache deception attacks, while allowing static assets to be cached.
↳ custom_key	json	Which components of the request are included or excluded from the cache key.
↳ cookie	json	Which cookies to include in the cache key.
↳ check_presence	array	A list of cookies to check for the presence of. The presence of these cookies is included in the cache key.
↳ include	array	A list of cookies to include in the cache key.
↳ header	json	Which headers to include in the cache key.
↳ check_presence	array	A list of headers to check for the presence of. The presence of these headers is included in the cache key.
↳ contains	json	A mapping of header names to a list of values. If a header is present in the request and contains any of the values provided, its value is included in the cache key.
↳ exclude_origin	boolean	Whether to exclude the origin header in the cache key.
↳ include	array	A list of headers to include in the cache key.
↳ host	json	How to use the host in the cache key.
↳ resolved	boolean	Whether to use the resolved host in the cache key.
↳ query_string	json	Which query string parameters to include in or exclude from the cache key.
↳ exclude	json	Which query string parameters to exclude from the cache key.
↳ all	boolean	Whether to exclude all query string parameters from the cache key. Values: True.
↳ list	array	A list of query string parameters to exclude from the cache key.
↳ include	json	Which query string parameters to include in the cache key.
↳ all	boolean	Whether to include all query string parameters in the cache key. Values: True.
↳ list	array	A list of query string parameters to include in the cache key.
↳ user	json	How to use characteristics of the request user agent in the cache key.
↳ device_type	boolean	Whether to use the user agent's device type in the cache key.
↳ geo	boolean	Whether to use the user agents's country in the cache key.
↳ lang	boolean	Whether to use the user agent's language in the cache key.
↳ ignore_query_strings_order	boolean	Whether to treat requests with the same query parameters the same, regardless of the order those query parameters are in.
↳ cache_reserve	json	Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
↳ eligible	boolean	Whether Cache Reserve is enabled. If this is true and a request meets eligibility criteria, Cloudflare will write the resource to Cache Reserve.
↳ minimum_file_size	number	The minimum file size eligible for storage in Cache Reserve.
↳ edge_ttl	json	How long the Cloudflare edge network should cache the response.
↳ default	number	The edge TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The edge TTL mode. Values: respect_origin, bypass_by_default, override_origin.
↳ status_code_ttl	array	A list of TTLs to apply to specific status codes or status code ranges.
↳ status_code	number	A single status code to apply the TTL to.
↳ status_code_range	json	A range of status codes to apply the TTL to.
↳ from	number	The lower bound of the range.
↳ to	number	The upper bound of the range.
↳ value	number	The time to cache the response for (in seconds). A value of 0 is equivalent to setting the cache control header with the value "no-cache". A value of -1 is equivalent to setting the cache control header with the value of "no-store".
↳ origin_cache_control	boolean	Whether Cloudflare will aim to strictly adhere to RFC 7234.
↳ origin_error_page_passthru	boolean	Whether to generate Cloudflare error pages for issues from the origin server.
↳ origin_range_requests	json	Controls whether Cloudflare fetches a large asset from the origin as a series of range requests instead of one whole-body request.
↳ mode	string	Whether to use range requests. default is the behaviour the zone gets without this rule. Values: on, off, default.
↳ read_timeout	number	A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
↳ respect_strong_etags	boolean	Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
↳ serve_stale	json	When to serve stale content from cache.
↳ disable_stale_while_updating	boolean	Whether Cloudflare should disable serving stale content while getting the latest content from the origin.
↳ shared_dictionary	json	Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
↳ match_pattern	string	URL pattern for the Use-As-Dictionary match field. This pattern specifies which URLs can use this response as a dictionary.
↳ strip_etags	boolean	Whether to strip ETag headers from the origin response before caching.
↳ strip_last_modified	boolean	Whether to strip Last-Modified headers from the origin response before caching.
↳ strip_set_cookie	boolean	Whether to strip Set-Cookie headers from the origin response before caching.
↳ vary	json	Controls how cached responses vary based on request headers. default is required by the API and applies to any Vary response header that does not have a per-header override.
↳ default	json	Controls how response Vary headers without a per-header override contribute to the cache key.
↳ action	string	How the header value is treated when building the cache key. Values: bypass, passthrough, normalize.
↳ headers	json	A mapping of lowercase request header names to their vary configuration.
↳ operation	string	The operation to perform on the cache tags. Values: add, remove, set.
↳ values	array	A list of cache tag values.
↳ expression	string	An expression that evaluates to an array of cache tag values.
↳ automatic_https_rewrites	boolean	Whether to enable Automatic HTTPS Rewrites.
↳ autominify	json	Which file extensions to minify automatically.
↳ css	boolean	Whether to minify CSS files.
↳ html	boolean	Whether to minify HTML files.
↳ js	boolean	Whether to minify JavaScript files.
↳ bic	boolean	Whether to enable Browser Integrity Check (BIC).
↳ content_converter	boolean	Whether to enable content conversion (e.g., HTML to Markdown).
↳ disable_apps	boolean	Whether to disable Cloudflare Apps. Values: True.
↳ disable_pay_per_crawl	boolean	Whether to disable Pay Per Crawl. Values: True.
↳ disable_rum	boolean	Whether to disable Real User Monitoring (RUM). Values: True.
↳ disable_zaraz	boolean	Whether to disable Zaraz. Values: True.
↳ email_obfuscation	boolean	Whether to enable Email Obfuscation.
↳ fonts	boolean	Whether to enable Cloudflare Fonts.
↳ hotlink_protection	boolean	Whether to enable Hotlink Protection.
↳ mirage	boolean	Whether to enable Mirage.
↳ opportunistic_encryption	boolean	Whether to enable Opportunistic Encryption.
↳ polish	string	The Polish level to configure. Values: off, lossless, lossy, webp.
↳ redirects_for_ai_training	boolean	Whether to redirect verified AI training crawlers to canonical URLs found in the HTML response.
↳ request_body_buffering	string	The request body buffering mode. Values: none, standard, full.
↳ response_body_buffering	string	The response body buffering mode. Values: none, standard.
↳ rocket_loader	boolean	Whether to enable Rocket Loader.
↳ security_level	string	The Security Level to configure. Values: off, essentially_off, low, medium, high, under_attack.
↳ server_side_excludes	boolean	Whether to enable Server-Side Excludes.
↳ ssl	string	The SSL level to configure. Values: off, flexible, full, strict, origin_pull.
↳ sxg	boolean	Whether to enable Signed Exchanges (SXG).
↳ webmcp_enabled	boolean	Whether to serve the WebMCP bridge script, which exposes the page's tools to browser AI agents.
↳ webmcp_packs	array	Bundled WebMCP tool packs to activate for matching requests. An empty array disables all packs. Omitting this parameter leaves the pack selection unchanged. Does not enable the WebMCP bridge itself.
↳ phase	string	A phase to skip the execution of. This option is only compatible with the products option. Values: current.
↳ phases	array	A list of phases to skip the execution of. This option is incompatible with the rulesets option.
↳ products	array	A list of legacy security products to skip the execution of.
↳ rules	json	A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
↳ ruleset	string	A ruleset to skip the execution of. This option is incompatible with the rulesets option. Values: current.
↳ rulesets	array	A list of ruleset IDs to skip the execution of. This option is incompatible with the ruleset and phases options.
↳ link_maze	json	Enables the link maze transformation on the response.
↳ categories	array	The categories of the rule.
↳ description	string	An informative description of the rule.
↳ enabled	boolean	Whether the rule should be executed.
↳ exposed_credential_check	json	Configuration for exposed credential checking.
↳ password_expression	string	An expression that selects the password used in the credentials check.
↳ username_expression	string	An expression that selects the user ID used in the credentials check.
↳ expression	string	The expression defining which traffic will match the rule.
↳ id	string	The unique ID of the rule.
↳ last_updated	string	The timestamp of when the rule was last modified.
↳ logging	json	An object configuring the rule's logging behavior.
↳ enabled	boolean	Whether to generate a log when the rule matches.
↳ ratelimit	json	An object configuring the rule's rate limit behavior.
↳ characteristics	array	Characteristics of the request on which the rate limit counter will be incremented.
↳ counting_expression	string	An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
↳ mitigation_timeout	number	Period of time in seconds after which the action will be disabled following its first execution.
↳ period	number	Period in seconds over which the counter is being incremented.
↳ requests_per_period	number	The threshold of requests per period after which the action will be executed for the first time.
↳ requests_to_origin	boolean	Whether counting is only performed when an origin is reached.
↳ score_per_period	number	The score threshold per period for which the action will be executed the first time.
↳ score_response_header_name	string	A response header name provided by the origin, which contains the score to increment rate limit counter with.
↳ ref	string	The reference of the rule (the rule's ID by default).
↳ version	string	The version of the rule.

Cloudflare Update Ruleset Rule

Updates a rule in a zone ruleset. Cloudflare replaces the rule definition rather than merging it, so you must send every field you want the rule to keep — any field you omit is reset to its default. Read the current rule with "Get Ruleset" first. Requires an API token with Zone WAF Edit (or another matching ruleset Write permission).

Inputs and outputs

Input

Parameter	Type	Required	Description
exposed_credential_check	json	No	JSON object. Configuration for exposed credential checking. Fields: password_expression, username_expression.
position	json	No	JSON object. An object configuring where the rule will be placed. Fields: before, after, index.
dry_run	boolean	No	dry run
zoneId	string	Yes	The zone ID that owns the ruleset
rulesetId	string	Yes	The ruleset ID containing the rule
ruleId	string	Yes	The rule ID to update
action	string	Yes	The action the rule performs, e.g. block, challenge, js_challenge, managed_challenge, log, skip, or execute. Required because this endpoint replaces the rule definition — omitting it resets the stored action
expression	string	Yes	Cloudflare filter expression selecting matching requests. Required because this endpoint replaces the rule definition — omitting it resets the stored expression
description	string	No	Human-readable description of the rule
enabled	boolean	No	Whether the rule is enabled
ref	string	No	Reference tag that stays stable across rule updates. Because the update replaces the rule, omitting it resets the tag to the rule ID and breaks anything matching on the old value
actionParameters	string	No	JSON object of action-specific parameters, e.g. {"id":"<MANAGED_RULESET_ID>","overrides":{"rules":[{"id":"<RULE_ID>","action":"log","enabled":true,"score_threshold":40}]}}. Required on an execute rule and must be sent on every update: the endpoint replaces the rule, so omitting it resets action_parameters to {} — which unbinds the managed ruleset the rule deploys and every override under it
ratelimit	string	No	JSON rate limiting configuration to preserve on a rule in the http_ratelimit phase, e.g. {"characteristics":["cf.colo.id","ip.src"],"period":60,"requests_per_period":100}. Because the update replaces the rule, omitting this on a rate limiting rule stops it rate limiting
logging	string	No	JSON logging configuration to preserve, e.g. {"enabled":true}. Omitting it on a rule that had logging configured resets it to the default
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
description	string	An informative description of the ruleset.
id	string	The unique ID of the ruleset.
last_updated	string	The timestamp of when the ruleset was last modified.
name	string	The human-readable name of the ruleset.
version	string	The version of the ruleset.
kind	string	The kind of the ruleset. Values: managed, custom, root, zone.
phase	string	The phase of the ruleset.
rules	array	The list of rules in the ruleset.
↳ action	string	The action to perform when the rule matches.
↳ action_parameters	json	The parameters configuring the rule's action.
↳ response	json	The response to show when the block is applied.
↳ content	string	The content to return.
↳ content_type	string	The type of the content to return.
↳ status_code	number	The status code to return.
↳ algorithms	array	Custom order for compression algorithms.
↳ name	string	Name of the compression algorithm to enable. Values: none, auto, default, gzip, brotli, zstd.
↳ id	string	The ID of the ruleset to execute.
↳ matched_data	json	The configuration to use for matched data logging.
↳ public_key	string	The public key to encrypt matched data logs with.
↳ overrides	json	A set of overrides to apply to the target ruleset.
↳ action	string	An action to override all rules with. This option has lower precedence than rule and category overrides.
↳ categories	array	A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
↳ action	string	The action to override rules in the category with.
↳ category	string	The name of the category to override.
↳ enabled	boolean	Whether to enable execution of rules in the category.
↳ sensitivity_level	string	The sensitivity level to use for rules in the category. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ enabled	boolean	Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
↳ rules	array	A list of rule-level overrides. This option has the highest precedence.
↳ action	string	The action to override the rule with.
↳ enabled	boolean	Whether to enable execution of the rule.
↳ id	string	The ID of the rule to override.
↳ score_threshold	number	The score threshold to use for the rule.
↳ sensitivity_level	string	The sensitivity level to use for the rule. This option is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ sensitivity_level	string	A sensitivity level to set for all rules. This option has lower precedence than rule and category overrides and is only applicable for DDoS phases. Values: default, medium, low, eoff.
↳ cookie_fields	array	The cookie fields to log.
↳ name	string	The name of the cookie.
↳ raw_response_fields	array	The raw response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ request_fields	array	The raw request fields to log.
↳ name	string	The name of the header.
↳ response_fields	array	The transformed response fields to log.
↳ name	string	The name of the response header.
↳ preserve_duplicates	boolean	Whether to log duplicate values of the same header.
↳ transformed_request_fields	array	The transformed request fields to log.
↳ name	string	The name of the header.
↳ from_list	json	A redirect based on a bulk list lookup.
↳ key	string	An expression that evaluates to the list lookup key.
↳ name	string	The name of the list to match against.
↳ from_value	json	A redirect based on the request properties.
↳ preserve_query_string	boolean	Whether to keep the query string of the original request.
↳ status_code	number	The status code to use for the redirect. Values: 301, 302, 303, 307, 308.
↳ target_url	json	A URL to redirect the request to.
↳ expression	string	An expression that evaluates to a URL to redirect the request to.
↳ value	string	A URL to redirect the request to.
↳ headers	json	A map of headers to rewrite.
↳ uri	json	A URI query rewrite.
↳ path	json	A URI path rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI path to.
↳ value	string	A value to rewrite the URI path to.
↳ query	json	A URI query rewrite.
↳ expression	string	An expression that evaluates to a value to rewrite the URI query to.
↳ value	string	A value to rewrite the URI query to.
↳ origin	boolean	Whether to propagate the rewritten URI to origin.
↳ host_header	string	A value to rewrite the HTTP host header to.
↳ origin	json	An origin to route to.
↳ host	string	A resolved host to route to.
↳ port	number	A destination port to route to.
↳ sni	json	A Server Name Indication (SNI) override.
↳ value	string	A value to override the SNI to.
↳ increment	number	A delta to change the score by, which can be either positive or negative.
↳ content_type	string	The content type header to set with the error response. Values: application/json, text/html, text/plain, text/xml.
↳ status_code	number	The status code to use for the error.
↳ content	string	The response content.
↳ asset_name	string	The name of a custom asset to serve as the error response.
↳ immutable	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ max-age	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ must-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ must-understand	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-cache	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ no-store	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ no-transform	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ private	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ qualifiers	array	Optional list of header names to qualify the directive (e.g., for "private" or "no-cache" directives).
↳ proxy-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ public	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ s-maxage	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-if-error	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ stale-while-revalidate	json	Remove the directive.
↳ cloudflare_only	boolean	Whether the directive should only be applied to the Cloudflare CDN cache.
↳ operation	string	The operation to perform on the cache-control directive. Values: set, remove.
↳ value	number	The duration value in seconds for the directive.
↳ additional_cacheable_ports	array	A list of additional ports that caching should be enabled on.
↳ browser_ttl	json	How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
↳ default	number	The browser TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The browser TTL mode. Values: respect_origin, bypass_by_default, override_origin, bypass.
↳ cache	boolean	Whether the request's response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
↳ cache_key	json	Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
↳ cache_by_device_type	boolean	Whether to separate cached content based on the visitor's device type.
↳ cache_deception_armor	boolean	Whether to protect from web cache deception attacks, while allowing static assets to be cached.
↳ custom_key	json	Which components of the request are included or excluded from the cache key.
↳ cookie	json	Which cookies to include in the cache key.
↳ check_presence	array	A list of cookies to check for the presence of. The presence of these cookies is included in the cache key.
↳ include	array	A list of cookies to include in the cache key.
↳ header	json	Which headers to include in the cache key.
↳ check_presence	array	A list of headers to check for the presence of. The presence of these headers is included in the cache key.
↳ contains	json	A mapping of header names to a list of values. If a header is present in the request and contains any of the values provided, its value is included in the cache key.
↳ exclude_origin	boolean	Whether to exclude the origin header in the cache key.
↳ include	array	A list of headers to include in the cache key.
↳ host	json	How to use the host in the cache key.
↳ resolved	boolean	Whether to use the resolved host in the cache key.
↳ query_string	json	Which query string parameters to include in or exclude from the cache key.
↳ exclude	json	Which query string parameters to exclude from the cache key.
↳ all	boolean	Whether to exclude all query string parameters from the cache key. Values: True.
↳ list	array	A list of query string parameters to exclude from the cache key.
↳ include	json	Which query string parameters to include in the cache key.
↳ all	boolean	Whether to include all query string parameters in the cache key. Values: True.
↳ list	array	A list of query string parameters to include in the cache key.
↳ user	json	How to use characteristics of the request user agent in the cache key.
↳ device_type	boolean	Whether to use the user agent's device type in the cache key.
↳ geo	boolean	Whether to use the user agents's country in the cache key.
↳ lang	boolean	Whether to use the user agent's language in the cache key.
↳ ignore_query_strings_order	boolean	Whether to treat requests with the same query parameters the same, regardless of the order those query parameters are in.
↳ cache_reserve	json	Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
↳ eligible	boolean	Whether Cache Reserve is enabled. If this is true and a request meets eligibility criteria, Cloudflare will write the resource to Cache Reserve.
↳ minimum_file_size	number	The minimum file size eligible for storage in Cache Reserve.
↳ edge_ttl	json	How long the Cloudflare edge network should cache the response.
↳ default	number	The edge TTL (in seconds) if you choose the "override_origin" mode.
↳ mode	string	The edge TTL mode. Values: respect_origin, bypass_by_default, override_origin.
↳ status_code_ttl	array	A list of TTLs to apply to specific status codes or status code ranges.
↳ status_code	number	A single status code to apply the TTL to.
↳ status_code_range	json	A range of status codes to apply the TTL to.
↳ from	number	The lower bound of the range.
↳ to	number	The upper bound of the range.
↳ value	number	The time to cache the response for (in seconds). A value of 0 is equivalent to setting the cache control header with the value "no-cache". A value of -1 is equivalent to setting the cache control header with the value of "no-store".
↳ origin_cache_control	boolean	Whether Cloudflare will aim to strictly adhere to RFC 7234.
↳ origin_error_page_passthru	boolean	Whether to generate Cloudflare error pages for issues from the origin server.
↳ origin_range_requests	json	Controls whether Cloudflare fetches a large asset from the origin as a series of range requests instead of one whole-body request.
↳ mode	string	Whether to use range requests. default is the behaviour the zone gets without this rule. Values: on, off, default.
↳ read_timeout	number	A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
↳ respect_strong_etags	boolean	Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
↳ serve_stale	json	When to serve stale content from cache.
↳ disable_stale_while_updating	boolean	Whether Cloudflare should disable serving stale content while getting the latest content from the origin.
↳ shared_dictionary	json	Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
↳ match_pattern	string	URL pattern for the Use-As-Dictionary match field. This pattern specifies which URLs can use this response as a dictionary.
↳ strip_etags	boolean	Whether to strip ETag headers from the origin response before caching.
↳ strip_last_modified	boolean	Whether to strip Last-Modified headers from the origin response before caching.
↳ strip_set_cookie	boolean	Whether to strip Set-Cookie headers from the origin response before caching.
↳ vary	json	Controls how cached responses vary based on request headers. default is required by the API and applies to any Vary response header that does not have a per-header override.
↳ default	json	Controls how response Vary headers without a per-header override contribute to the cache key.
↳ action	string	How the header value is treated when building the cache key. Values: bypass, passthrough, normalize.
↳ headers	json	A mapping of lowercase request header names to their vary configuration.
↳ operation	string	The operation to perform on the cache tags. Values: add, remove, set.
↳ values	array	A list of cache tag values.
↳ expression	string	An expression that evaluates to an array of cache tag values.
↳ automatic_https_rewrites	boolean	Whether to enable Automatic HTTPS Rewrites.
↳ autominify	json	Which file extensions to minify automatically.
↳ css	boolean	Whether to minify CSS files.
↳ html	boolean	Whether to minify HTML files.
↳ js	boolean	Whether to minify JavaScript files.
↳ bic	boolean	Whether to enable Browser Integrity Check (BIC).
↳ content_converter	boolean	Whether to enable content conversion (e.g., HTML to Markdown).
↳ disable_apps	boolean	Whether to disable Cloudflare Apps. Values: True.
↳ disable_pay_per_crawl	boolean	Whether to disable Pay Per Crawl. Values: True.
↳ disable_rum	boolean	Whether to disable Real User Monitoring (RUM). Values: True.
↳ disable_zaraz	boolean	Whether to disable Zaraz. Values: True.
↳ email_obfuscation	boolean	Whether to enable Email Obfuscation.
↳ fonts	boolean	Whether to enable Cloudflare Fonts.
↳ hotlink_protection	boolean	Whether to enable Hotlink Protection.
↳ mirage	boolean	Whether to enable Mirage.
↳ opportunistic_encryption	boolean	Whether to enable Opportunistic Encryption.
↳ polish	string	The Polish level to configure. Values: off, lossless, lossy, webp.
↳ redirects_for_ai_training	boolean	Whether to redirect verified AI training crawlers to canonical URLs found in the HTML response.
↳ request_body_buffering	string	The request body buffering mode. Values: none, standard, full.
↳ response_body_buffering	string	The response body buffering mode. Values: none, standard.
↳ rocket_loader	boolean	Whether to enable Rocket Loader.
↳ security_level	string	The Security Level to configure. Values: off, essentially_off, low, medium, high, under_attack.
↳ server_side_excludes	boolean	Whether to enable Server-Side Excludes.
↳ ssl	string	The SSL level to configure. Values: off, flexible, full, strict, origin_pull.
↳ sxg	boolean	Whether to enable Signed Exchanges (SXG).
↳ webmcp_enabled	boolean	Whether to serve the WebMCP bridge script, which exposes the page's tools to browser AI agents.
↳ webmcp_packs	array	Bundled WebMCP tool packs to activate for matching requests. An empty array disables all packs. Omitting this parameter leaves the pack selection unchanged. Does not enable the WebMCP bridge itself.
↳ phase	string	A phase to skip the execution of. This option is only compatible with the products option. Values: current.
↳ phases	array	A list of phases to skip the execution of. This option is incompatible with the rulesets option.
↳ products	array	A list of legacy security products to skip the execution of.
↳ rules	json	A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
↳ ruleset	string	A ruleset to skip the execution of. This option is incompatible with the rulesets option. Values: current.
↳ rulesets	array	A list of ruleset IDs to skip the execution of. This option is incompatible with the ruleset and phases options.
↳ link_maze	json	Enables the link maze transformation on the response.
↳ categories	array	The categories of the rule.
↳ description	string	An informative description of the rule.
↳ enabled	boolean	Whether the rule should be executed.
↳ exposed_credential_check	json	Configuration for exposed credential checking.
↳ password_expression	string	An expression that selects the password used in the credentials check.
↳ username_expression	string	An expression that selects the user ID used in the credentials check.
↳ expression	string	The expression defining which traffic will match the rule.
↳ id	string	The unique ID of the rule.
↳ last_updated	string	The timestamp of when the rule was last modified.
↳ logging	json	An object configuring the rule's logging behavior.
↳ enabled	boolean	Whether to generate a log when the rule matches.
↳ ratelimit	json	An object configuring the rule's rate limit behavior.
↳ characteristics	array	Characteristics of the request on which the rate limit counter will be incremented.
↳ counting_expression	string	An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
↳ mitigation_timeout	number	Period of time in seconds after which the action will be disabled following its first execution.
↳ period	number	Period in seconds over which the counter is being incremented.
↳ requests_per_period	number	The threshold of requests per period after which the action will be executed for the first time.
↳ requests_to_origin	boolean	Whether counting is only performed when an origin is reached.
↳ score_per_period	number	The score threshold per period for which the action will be executed the first time.
↳ score_response_header_name	string	A response header name provided by the origin, which contains the score to increment rate limit counter with.
↳ ref	string	The reference of the rule (the rule's ID by default).
↳ version	string	The version of the rule.

Cloudflare Update Tunnel

Updates the name or secret of an existing Cloudflare Tunnel.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
tunnelId	string	Yes	Tunnel id
apiKey	string	Yes	Cloudflare API token
name	string	No	A user-friendly name for a tunnel.
tunnel_secret	string	No	Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.

Output

Parameter	Type	Description
account_tag	string	Cloudflare account ID
config_src	string	Indicates if this is a locally or remotely configured tunnel. If local, manage the tunnel using a YAML file on the origin machine. If cloudflare, manage the tunnel on the Zero Trust dashboard. Values: local, cloudflare.
connections	array	The Cloudflare Tunnel connections between your origin and Cloudflare's edge.
↳ client_id	string	UUID of the Cloudflare Tunnel connector.
↳ client_version	string	The cloudflared version used to establish this connection.
↳ colo_name	string	The Cloudflare data center used for this connection.
↳ id	string	UUID of the Cloudflare Tunnel connection.
↳ is_pending_reconnect	boolean	Cloudflare continues to track connections for several minutes after they disconnect. This is an optimization to improve latency and reliability of reconnecting. If true, the connection has disconnected but is still being tracked. If false, the connection is actively serving traffic.
↳ opened_at	string	Timestamp of when the connection was established.
↳ origin_ip	string	The public IP address of the host running cloudflared.
↳ uuid	string	UUID of the Cloudflare Tunnel connection.
conns_active_at	string	Timestamp of when the tunnel established at least one connection to Cloudflare's edge. If null, the tunnel is inactive.
conns_inactive_at	string	Timestamp of when the tunnel became inactive (no connections to Cloudflare's edge). If null, the tunnel is active.
created_at	string	Timestamp of when the resource was created.
deleted_at	string	Timestamp of when the resource was deleted. If null, the resource has not been deleted.
id	string	UUID of the tunnel.
metadata	json	Metadata associated with the tunnel.
name	string	A user-friendly name for a tunnel.
remote_config	boolean	If true, the tunnel can be configured remotely from the Zero Trust dashboard. If false, the tunnel must be configured locally on the origin machine.
status	string	The status of the tunnel.
tun_type	string	The type of tunnel. Values: cfd_tunnel, warp_connector, warp, magic, ip_sec, gre, cni.

Cloudflare Update Tunnel Configuration

Replaces the configuration for a remotely managed Cloudflare Tunnel, including its ingress rules and origin request settings. Replaces the configuration; resend all values to retain.

Inputs and outputs

Input

Parameter	Type	Required	Description
accountId	string	Yes	Account id
tunnelId	string	Yes	Tunnel id
apiKey	string	Yes	Cloudflare API token
config	json	No	JSON object. The tunnel configuration and ingress rules. Fields: ingress, originRequest, warp-routing.

Output

Parameter	Type	Description
account_id	string	Identifier.
config	json	The tunnel configuration and ingress rules.
↳ ingress	array	List of public hostname definitions. At least one ingress rule needs to be defined for the tunnel.
↳ hostname	string	Public hostname for this service.
↳ originRequest	json	Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.
↳ access	json	For all L7 requests to this hostname, cloudflared will validate each request's Cf-Access-Jwt-Assertion request header.
↳ audTag	array	Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.
↳ required	boolean	Deny traffic that has not fulfilled Access authorization.
↳ teamName	string	teamName
↳ caPool	string	Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
↳ connectTimeout	number	Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.
↳ disableChunkedEncoding	boolean	Disables chunked transfer encoding. Useful if you are running a WSGI server.
↳ http2Origin	boolean	Attempt to connect to origin using HTTP2. Origin must be configured as https.
↳ httpHostHeader	string	Sets the HTTP Host header on requests sent to the local service.
↳ keepAliveConnections	number	Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
↳ keepAliveTimeout	number	Timeout after which an idle keepalive connection can be discarded.
↳ matchSNItoHost	boolean	Auto configure the Hostname on the origin server certificate.
↳ noHappyEyeballs	boolean	Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
↳ noTLSVerify	boolean	Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
↳ originServerName	string	Hostname that cloudflared should expect from your origin server certificate.
↳ proxyType	string	cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
↳ tcpKeepAlive	number	The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
↳ tlsTimeout	number	Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
↳ path	string	Requests with this path route to this public hostname.
↳ service	string	Protocol and address of destination server. Supported protocols: http://, https://, unix://, tcp://, ssh://, rdp://, unix+tls://, smb://. Alternatively can return a HTTP status code http_status:[code] e.g. 'http_status:404'.
↳ originRequest	json	Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.
↳ access	json	For all L7 requests to this hostname, cloudflared will validate each request's Cf-Access-Jwt-Assertion request header.
↳ audTag	array	Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.
↳ required	boolean	Deny traffic that has not fulfilled Access authorization.
↳ teamName	string	teamName
↳ caPool	string	Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
↳ connectTimeout	number	Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.
↳ disableChunkedEncoding	boolean	Disables chunked transfer encoding. Useful if you are running a WSGI server.
↳ http2Origin	boolean	Attempt to connect to origin using HTTP2. Origin must be configured as https.
↳ httpHostHeader	string	Sets the HTTP Host header on requests sent to the local service.
↳ keepAliveConnections	number	Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.
↳ keepAliveTimeout	number	Timeout after which an idle keepalive connection can be discarded.
↳ matchSNItoHost	boolean	Auto configure the Hostname on the origin server certificate.
↳ noHappyEyeballs	boolean	Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
↳ noTLSVerify	boolean	Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.
↳ originServerName	string	Hostname that cloudflared should expect from your origin server certificate.
↳ proxyType	string	cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
↳ tcpKeepAlive	number	The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.
↳ tlsTimeout	number	Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
↳ warp-routing	json	Enable private network access from WARP users to private network routes. This is enabled if the tunnel has an assigned route.
↳ enabled	boolean	enabled
created_at	string	created at
source	string	Indicates if this is a locally or remotely configured tunnel. If local, manage the tunnel using a YAML file on the origin machine. If cloudflare, manage the tunnel's configuration on the Zero Trust dashboard. Values: local, cloudflare.
tunnel_id	string	UUID of the tunnel.
version	number	The version of the Tunnel Configuration.

Cloudflare Update Worker Route

Replaces the URL pattern or Worker associated with a Worker route. Replaces the configuration; resend all values to retain.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	Zone id
routeId	string	Yes	Route id
apiKey	string	Yes	Cloudflare API token
pattern	string	Yes	Pattern to match incoming requests against. [Learn more](https://developers.cloudflare.com/workers/configuration/routing/routes/#matching-behavior).
script	string	No	Name of the script to run if the route matches.

Output

Parameter	Type	Description
id	string	Identifier.
pattern	string	Pattern to match incoming requests against. [Learn more](https://developers.cloudflare.com/workers/configuration/routing/routes/#matching-behavior).
script	string	Name of the script to run if the route matches.

Cloudflare Update Zone

Edits a zone. Only one zone property can be changed at a time.

Inputs and outputs

Input

Parameter	Type	Required	Description
zoneId	string	Yes	Zone id
apiKey	string	Yes	Cloudflare API token
paused	boolean	No	Indicates whether the zone is only using Cloudflare DNS services. A true value means the zone will not receive security or performance benefits.
plan	json	No	JSON object. (Deprecated) Please use the /zones/\{zone_id\}/subscription API to update a zone's plan. Changing this value will create/cancel associated subscriptions. To view available plans for this zone, see Zone Plans. Fields: id.
type	string	No	A full zone implies that DNS is hosted with Cloudflare. A partial zone is typically a partner-hosted zone or a CNAME setup. This parameter is only available to Enterprise customers or if it has been explicitly enabled on a zone. Allowed values: full, partial, secondary, internal.
vanity_name_servers	json	No	JSON array. An array of domains used for custom name servers. This is only available for Business and Enterprise plans.

Output

Parameter	Type	Description
account	json	The account the zone belongs to.
↳ id	string	Identifier
↳ name	string	The name of the account.
activated_on	string	The last time proof of ownership was detected and the zone was made active.
cname_suffix	string	Allows the customer to use a custom apex. Tenants Only Configuration.
created_on	string	When the zone was created.
development_mode	number	The interval (in seconds) from when development mode expires (positive integer) or last expired (negative integer) for the domain. If development mode has never been enabled, this value is 0.
id	string	Identifier
meta	json	Metadata about the zone.
↳ cdn_only	boolean	The zone is only configured for CDN.
↳ custom_certificate_quota	number	Number of Custom Certificates the zone can have.
↳ dns_only	boolean	The zone is only configured for DNS.
↳ foundation_dns	boolean	The zone is setup with Foundation DNS.
↳ page_rule_quota	number	Number of Page Rules a zone can have.
↳ phishing_detected	boolean	The zone has been flagged for phishing.
↳ step	number	step
modified_on	string	When the zone was last modified.
name	string	The domain name. Per [RFC 1035](https://datatracker.ietf.org/doc/html/rfc1035#section-2.3.4) the overall zone name can be up to 253 characters, with each segment ("label") not exceeding 63 characters.
name_servers	array	The name servers Cloudflare assigns to a zone.
original_dnshost	string	DNS host at the time of switching to Cloudflare.
original_name_servers	array	Original name servers before moving to Cloudflare.
original_registrar	string	Registrar for the domain at the time of switching to Cloudflare.
owner	json	The owner of the zone.
↳ id	string	Identifier
↳ name	string	Name of the owner.
↳ type	string	The type of owner.
paused	boolean	Indicates whether the zone is only using Cloudflare DNS services. A true value means the zone will not receive security or performance benefits.
permissions	array	Legacy permissions based on legacy user membership information.
plan	json	A Zones subscription information.
↳ can_subscribe	boolean	States if the subscription can be activated.
↳ currency	string	The denomination of the customer.
↳ externally_managed	boolean	If this Zone is managed by another company.
↳ frequency	string	How often the customer is billed.
↳ id	string	Identifier
↳ is_subscribed	boolean	States if the subscription active.
↳ legacy_discount	boolean	If the legacy discount applies to this Zone.
↳ legacy_id	string	The legacy name of the plan.
↳ name	string	Name of the owner.
↳ price	number	How much the customer is paying.
status	string	The zone status on Cloudflare. Values: initializing, pending, active, moved.
tenant	json	The root organizational unit that this zone belongs to (such as a tenant or organization).
↳ id	string	Identifier
↳ name	string	The name of the Tenant account.
tenant_unit	json	The immediate parent organizational unit that this zone belongs to (such as under a tenant or sub-organization).
↳ id	string	Identifier
type	string	A full zone implies that DNS is hosted with Cloudflare. A partial zone is typically a partner-hosted zone or a CNAME setup. Values: full, partial, secondary, internal.
vanity_name_servers	array	An array of domains used for custom name servers. This is only available for Business and Enterprise plans.
verification_key	string	Verification key for partial zone setup.

Cloudflare Update Zone Setting

Updates a specific zone setting such as SSL mode, security level, cache level, or other configuration.

Inputs and outputs

Input

Parameter	Type	Required	Description
enabled	boolean	No	Enrollment value for ssl_recommender; this setting uses enabled instead of value
zoneId	string	Yes	The zone ID to update settings for
settingId	string	Yes	Setting to update (e.g., "ssl", "security_level", "cache_level", "always_use_https", "browser_cache_ttl", "http3", "min_tls_version", "ciphers")
value	string	No	Required except for ssl_recommender. New value as a string, or a JSON string for complex values (e.g., "full" for SSL, "medium" for security_level, "aggressive" for cache_level, ["ECDHE-RSA-AES128-GCM-SHA256"] for ciphers)
apiKey	string	Yes	Cloudflare API Token

Output

Parameter	Type	Description
id	string	Setting identifier (e.g., ssl, cache_level, security_level)
value	string	Updated setting value as a string. Simple values returned as-is (e.g., "full", "on"). SSL Recommender returns its enabled flag. Complex values are JSON-stringified.
editable	boolean	Whether the setting can be modified for the current zone plan
modified_on	string	ISO 8601 timestamp when the setting was last modified
time_remaining	number	Development mode countdown, in seconds. Cloudflare documents this only on the zones_development_mode setting, where it is the interval from when development mode expires (positive) or last expired (negative)