Cloudflare is a global cloud platform that provides content delivery, domain management, cybersecurity, and performance services for websites and applications.
In Sim, the Cloudflare integration empowers your agents to automate the management of DNS records, SSL/TLS certificates, domains (zones), cache, zone settings, and more through easy-to-use API tools. Agents can securely list and edit domains, update DNS records, monitor analytics, and manage security and performance—all as part of your automated workflows.
With Cloudflare, you can:
- Manage DNS and Domains: List all your domains (zones), view zone details, and fully control DNS records from your automated agent workflows.
- Handle SSL/TLS Certificates and Settings: Issue, renew, or list certificates and adjust security and performance settings for your sites.
- Purge Cache and Analyze Traffic: Instantly purge edge cache and review real-time DNS analytics directly within your Sim agent processes.
- Automate Security and Operations: Use agents to programmatically manage zones, update settings, and streamline repetitive Cloudflare tasks.
This integration enables streamlined, secure management of your site's infrastructure from within Sim. Your agents can integrate Cloudflare operations directly into processes—keeping DNS records up-to-date, responding to security events, improving site performance, and automating large-scale site and account administration.
Integrate Cloudflare into the workflow. Manage zones (domains), DNS records, SSL/TLS certificates, zone settings, DNS analytics, and cache purging. Configure WAF rulesets, managed rule overrides, and rate limiting rules through the current Rulesets engine. Administer Cloudflare Access (Zero Trust) applications, policies, groups, identity providers, and service tokens, and inspect R2 buckets, Workers scripts and routes, and Cloudflare Tunnels.
Lists all zones (domains) in the Cloudflare account.
| Parameter | Type | Required | Description |
|---|
name | string | No | Filter zones by domain name (e.g., "example.com") |
status | string | No | Filter by zone status: "initializing", "pending", "active", or "moved" |
page | number | No | Page number for pagination (default: 1) |
per_page | number | No | Number of zones per page (default: 20, max: 50) |
accountId | string | No | Filter zones by account ID |
order | string | No | Sort field (name, status, account.id, account.name, plan.id) |
direction | string | No | Sort direction (asc, desc) |
match | string | No | Match logic for filters (any, all). Default: all |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
zones | array | List of zones/domains |
↳ id | string | Zone ID |
↳ name | string | Domain name |
↳ status | string | Zone status (initializing, pending, active, moved) |
↳ paused | boolean | Whether the zone is paused |
↳ type | string | Zone type (full, partial, secondary, or internal) |
↳ name_servers | array | Assigned Cloudflare name servers |
↳ original_name_servers | array | Original name servers before moving to Cloudflare |
↳ created_on | string | ISO 8601 date when the zone was created |
↳ modified_on | string | ISO 8601 date when the zone was last modified |
↳ activated_on | string | ISO 8601 date when the zone was activated |
↳ development_mode | number | Seconds remaining in development mode (0 = off) |
↳ plan | object | Zone plan information |
↳ id | string | Plan identifier |
↳ name | string | Plan name |
↳ price | number | Plan price |
↳ is_subscribed | boolean | Whether the zone is subscribed to the plan |
↳ frequency | string | Plan billing frequency |
↳ currency | string | Plan currency |
↳ legacy_id | string | Legacy plan identifier |
↳ account | object | Account the zone belongs to |
↳ id | string | Account identifier |
↳ name | string | Account name |
↳ owner | object | Zone owner information |
↳ id | string | Owner identifier |
↳ name | string | Owner name |
↳ type | string | Owner type |
↳ meta | object | Zone metadata |
↳ cdn_only | boolean | Whether the zone is CDN only |
↳ custom_certificate_quota | number | Custom certificate quota |
↳ dns_only | boolean | Whether the zone is DNS only |
↳ foundation_dns | boolean | Whether foundation DNS is enabled |
↳ page_rule_quota | number | Page rule quota |
↳ phishing_detected | boolean | Whether phishing was detected |
↳ step | number | Current setup step |
↳ vanity_name_servers | array | Custom vanity name servers |
↳ permissions | array | User permissions for the zone |
total_count | number | Total number of zones matching the query |
Gets details for a specific zone (domain) by its ID.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to retrieve details for |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Zone ID |
name | string | Domain name |
status | string | Zone status (initializing, pending, active, moved) |
paused | boolean | Whether the zone is paused |
type | string | Zone type (full, partial, secondary, or internal) |
name_servers | array | Assigned Cloudflare name servers |
original_name_servers | array | Original name servers before moving to Cloudflare |
created_on | string | ISO 8601 date when the zone was created |
modified_on | string | ISO 8601 date when the zone was last modified |
activated_on | string | ISO 8601 date when the zone was activated |
development_mode | number | Seconds remaining in development mode (0 = off) |
plan | object | Zone plan information |
↳ id | string | Plan identifier |
↳ name | string | Plan name |
↳ price | number | Plan price |
↳ is_subscribed | boolean | Whether the zone is subscribed to the plan |
↳ frequency | string | Plan billing frequency |
↳ currency | string | Plan currency |
↳ legacy_id | string | Legacy plan identifier |
account | object | Account the zone belongs to |
↳ id | string | Account identifier |
↳ name | string | Account name |
owner | object | Zone owner information |
↳ id | string | Owner identifier |
↳ name | string | Owner name |
↳ type | string | Owner type |
meta | object | Zone metadata |
↳ cdn_only | boolean | Whether the zone is CDN only |
↳ custom_certificate_quota | number | Custom certificate quota |
↳ dns_only | boolean | Whether the zone is DNS only |
↳ foundation_dns | boolean | Whether foundation DNS is enabled |
↳ page_rule_quota | number | Page rule quota |
↳ phishing_detected | boolean | Whether phishing was detected |
↳ step | number | Current setup step |
vanity_name_servers | array | Custom vanity name servers |
permissions | array | User permissions for the zone |
Adds a new zone (domain) to the Cloudflare account.
| Parameter | Type | Required | Description |
|---|
name | string | Yes | The domain name to add (e.g., "example.com") |
accountId | string | Yes | The Cloudflare account ID |
type | string | No | Zone type: "full" (Cloudflare manages DNS), "partial" (CNAME setup), or "secondary" (secondary DNS). Cloudflare also defines "internal", which is not creatable through this tool |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Created zone ID |
name | string | Domain name |
status | string | Zone status (initializing, pending, active, moved) |
paused | boolean | Whether the zone is paused |
type | string | Zone type (full, partial, secondary, or internal) |
name_servers | array | Assigned Cloudflare name servers |
original_name_servers | array | Original name servers before moving to Cloudflare |
created_on | string | ISO 8601 date when the zone was created |
modified_on | string | ISO 8601 date when the zone was last modified |
activated_on | string | ISO 8601 date when the zone was activated |
development_mode | number | Seconds remaining in development mode (0 = off) |
plan | object | Zone plan information |
↳ id | string | Plan identifier |
↳ name | string | Plan name |
↳ price | number | Plan price |
↳ is_subscribed | boolean | Whether the zone is subscribed to the plan |
↳ frequency | string | Plan billing frequency |
↳ currency | string | Plan currency |
↳ legacy_id | string | Legacy plan identifier |
account | object | Account the zone belongs to |
↳ id | string | Account identifier |
↳ name | string | Account name |
owner | object | Zone owner information |
↳ id | string | Owner identifier |
↳ name | string | Owner name |
↳ type | string | Owner type |
meta | object | Zone metadata |
↳ cdn_only | boolean | Whether the zone is CDN only |
↳ custom_certificate_quota | number | Custom certificate quota |
↳ dns_only | boolean | Whether the zone is DNS only |
↳ foundation_dns | boolean | Whether foundation DNS is enabled |
↳ page_rule_quota | number | Page rule quota |
↳ phishing_detected | boolean | Whether phishing was detected |
↳ step | number | Current setup step |
vanity_name_servers | array | Custom vanity name servers |
permissions | array | User permissions for the zone |
Deletes a zone (domain) from the Cloudflare account.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to delete |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Deleted zone ID |
Lists DNS records for a specific zone.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to list DNS records for |
type | string | No | Filter by record type (e.g., "A", "AAAA", "CNAME", "MX", "TXT") |
name | string | No | Filter by record name (exact match) |
content | string | No | Filter by record content (exact match) |
page | number | No | Page number for pagination (default: 1) |
per_page | number | No | Number of records per page (default: 100, max: 5000000) |
direction | string | No | Sort direction (asc or desc) |
match | string | No | Match logic for filters: any or all (default: all) |
order | string | No | Sort field (type, name, content, ttl, proxied) |
proxied | boolean | No | Filter by proxy status |
search | string | No | Free-text search across record name, content, and value |
tag | string | No | Filter by an exact tag name |
tag_match | string | No | Tag filter match logic: any or all. Only affects results when combined with multiple tag filter conditions; has no effect with the single exact-match Tag Filter above. |
commentFilter | string | No | Filter records by comment content (substring match) |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
records | array | List of DNS records |
↳ id | string | Unique identifier for the DNS record |
↳ zone_id | string | The ID of the zone the record belongs to |
↳ zone_name | string | The name of the zone |
↳ type | string | Record type (A, AAAA, CNAME, MX, TXT, etc.) |
↳ name | string | Record name (e.g., example.com) |
↳ content | string | Record content (e.g., IP address) |
↳ proxiable | boolean | Whether the record can be proxied |
↳ proxied | boolean | Whether Cloudflare proxy is enabled |
↳ ttl | number | TTL in seconds (1 = automatic) |
↳ locked | boolean | Whether the record is locked |
↳ priority | number | Record priority, returned for MX and URI records |
↳ comment | string | Comment associated with the record |
↳ tags | array | Tags associated with the record |
↳ comment_modified_on | string | ISO 8601 timestamp when the comment was last modified |
↳ tags_modified_on | string | ISO 8601 timestamp when tags were last modified |
↳ meta | object | Record metadata |
↳ source | string | Source of the DNS record |
↳ created_on | string | ISO 8601 timestamp when the record was created |
↳ modified_on | string | ISO 8601 timestamp when the record was last modified |
total_count | number | Total number of DNS records matching the query |
Creates a new DNS record for a zone.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to create the DNS record in |
type | string | Yes | DNS record type (e.g., "A", "AAAA", "CNAME", "MX", "TXT", "NS", "SRV") |
name | string | Yes | DNS record name (e.g., "example.com" or "subdomain.example.com") |
content | string | Yes | DNS record content (e.g., IP address for A records, target for CNAME) |
ttl | number | No | Time to live in seconds (1 = automatic, default: 1) |
proxied | boolean | No | Whether to enable Cloudflare proxy (default: false) |
priority | number | No | Record priority. Cloudflare accepts this top-level field for MX and URI records only; an SRV record carries its priority, weight, port, and target inside the record content instead |
comment | string | No | Comment for the DNS record |
tags | string | No | Comma-separated tags for the DNS record |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Unique identifier for the created DNS record |
zone_id | string | The ID of the zone the record belongs to |
zone_name | string | The name of the zone |
type | string | DNS record type (A, AAAA, CNAME, MX, TXT, etc.) |
name | string | DNS record hostname |
content | string | DNS record value (e.g., IP address, target hostname) |
proxiable | boolean | Whether the record can be proxied through Cloudflare |
proxied | boolean | Whether Cloudflare proxy is enabled |
ttl | number | Time to live in seconds (1 = automatic) |
locked | boolean | Whether the record is locked |
priority | number | Record priority, returned for MX and URI records |
comment | string | Comment associated with the record |
tags | array | Tags associated with the record |
comment_modified_on | string | ISO 8601 timestamp when the comment was last modified |
tags_modified_on | string | ISO 8601 timestamp when tags were last modified |
meta | object | Record metadata |
↳ source | string | Source of the DNS record |
created_on | string | ISO 8601 timestamp when the record was created |
modified_on | string | ISO 8601 timestamp when the record was last modified |
Updates an existing DNS record for a zone.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID containing the DNS record |
recordId | string | Yes | The DNS record ID to update |
type | string | No | DNS record type (e.g., "A", "AAAA", "CNAME", "MX", "TXT") |
name | string | No | DNS record name |
content | string | No | DNS record content (e.g., IP address) |
ttl | number | No | Time to live in seconds (1 = automatic) |
proxied | boolean | No | Whether to enable Cloudflare proxy |
priority | number | No | Record priority. Cloudflare accepts this top-level field for MX and URI records only; an SRV record carries its priority, weight, port, and target inside the record content instead |
comment | string | No | Comment for the DNS record |
tags | string | No | Comma-separated tags for the DNS record |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Unique identifier for the updated DNS record |
zone_id | string | The ID of the zone the record belongs to |
zone_name | string | The name of the zone |
type | string | DNS record type (A, AAAA, CNAME, MX, TXT, etc.) |
name | string | DNS record hostname |
content | string | DNS record value (e.g., IP address, target hostname) |
proxiable | boolean | Whether the record can be proxied through Cloudflare |
proxied | boolean | Whether Cloudflare proxy is enabled |
ttl | number | Time to live in seconds (1 = automatic) |
locked | boolean | Whether the record is locked |
priority | number | Record priority, returned for MX and URI records |
comment | string | Comment associated with the record |
tags | array | Tags associated with the record |
comment_modified_on | string | ISO 8601 timestamp when the comment was last modified |
tags_modified_on | string | ISO 8601 timestamp when tags were last modified |
meta | object | Record metadata |
↳ source | string | Source of the DNS record |
created_on | string | ISO 8601 timestamp when the record was created |
modified_on | string | ISO 8601 timestamp when the record was last modified |
Deletes a DNS record from a zone.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID containing the DNS record |
recordId | string | Yes | The DNS record ID to delete |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Deleted record ID |
Lists SSL/TLS certificate packs for a zone.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to list certificates for |
status | string | No | Set to "all" to include every certificate pack regardless of status. Cloudflare documents no other value for this filter; omitting it returns only active packs |
page | number | No | Page number of paginated results (default: 1) |
per_page | number | No | Number of certificate packs per page (default: 20, min: 5, max: 50) |
deploy | string | No | Filter by deployment environment: "staging" or "production" |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
certificates | array | List of SSL/TLS certificate packs |
↳ id | string | Certificate pack ID |
↳ type | string | Certificate type (e.g., "universal", "advanced") |
↳ hosts | array | Hostnames covered by this certificate pack |
↳ primary_certificate | string | ID of the primary certificate in the pack |
↳ status | string | Certificate pack status (e.g., "active", "pending") |
↳ certificates | array | Individual certificates within the pack |
↳ id | string | Certificate ID |
↳ hosts | array | Hostnames covered by this certificate |
↳ issuer | string | Certificate issuer |
↳ signature | string | Signature algorithm (e.g., "ECDSAWithSHA256") |
↳ status | string | Certificate status |
↳ bundle_method | string | Bundle method (e.g., "ubiquitous") |
↳ zone_id | string | Zone ID the certificate belongs to |
↳ uploaded_on | string | Upload date (ISO 8601) |
↳ modified_on | string | Last modified date (ISO 8601) |
↳ expires_on | string | Expiration date (ISO 8601) |
↳ priority | number | Certificate priority order |
↳ geo_restrictions | object | Geographic restrictions for the certificate |
↳ label | string | Geographic restriction label |
↳ cloudflare_branding | boolean | Whether Cloudflare branding is enabled on the certificate |
↳ validation_method | string | Validation method (e.g., "txt", "http", "cname") |
↳ validity_days | number | Validity period in days |
↳ certificate_authority | string | Certificate authority (e.g., "lets_encrypt", "google") |
↳ validation_errors | array | Validation issues for the certificate pack |
↳ message | string | Validation error message |
↳ validation_records | array | Validation records for the certificate pack |
↳ cname | string | CNAME record name |
↳ cname_target | string | CNAME record target |
↳ emails | array | Email addresses for validation |
↳ http_body | string | HTTP validation body content |
↳ http_url | string | HTTP validation URL |
↳ status | string | Validation record status |
↳ txt_name | string | TXT record name |
↳ txt_value | string | TXT record value |
↳ dcv_delegation_records | array | Domain control validation delegation records |
↳ cname | string | CNAME record name |
↳ cname_target | string | CNAME record target |
↳ emails | array | Email addresses for validation |
↳ http_body | string | HTTP validation body content |
↳ http_url | string | HTTP validation URL |
↳ status | string | Delegation record status |
↳ txt_name | string | TXT record name |
↳ txt_value | string | TXT record value |
total_count | number | Total number of certificate packs |
Reads zone settings such as SSL mode, minimum TLS version, security level, and caching level. Cloudflare retired the endpoint that read every setting in one request, so each setting is read individually — name the ones you need to keep the read small. Defaults to ${DEFAULT_ZONE_SETTING_IDS.join(', ')}.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to get settings for |
settingIds | string | No | Comma-separated setting IDs to read, e.g. "ssl,min_tls_version,security_level". Leave blank to read the default set (${DEFAULT_ZONE_SETTING_IDS.join(', ')}). At most ${MAX_ZONE_SETTING_IDS} settings per call. |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
settings | array | The zone settings that were readable |
↳ id | string | Setting identifier (e.g., ssl, cache_level, security_level, always_use_https) |
↳ value | string | Setting value as a string. Simple values returned as-is (e.g., "full", "on"). Complex values are JSON-stringified (e.g., {"css":"on","html":"on","js":"on"}). |
↳ editable | boolean | Whether the setting can be modified for the current zone plan |
↳ modified_on | string | ISO 8601 timestamp when the setting was last modified |
↳ time_remaining | number | Development mode countdown, in seconds. Cloudflare documents this only on the zones_development_mode setting, where it is the interval from when development mode expires (positive) or last expired (negative) |
unreadable | array | Requested settings Cloudflare refused, typically because the zone plan does not expose them or the setting ID does not exist |
↳ id | string | The requested setting identifier |
↳ error | string | Why Cloudflare would not return the setting |
Updates a specific zone setting such as SSL mode, security level, cache level, or other configuration.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to update settings for |
settingId | string | Yes | Setting to update (e.g., "ssl", "security_level", "cache_level", "always_use_https", "browser_cache_ttl", "http3", "min_tls_version", "ciphers") |
value | string | Yes | New value for the setting as a string, or a JSON string for complex values (e.g., "full" for SSL, "medium" for security_level, "aggressive" for cache_level, ["ECDHE-RSA-AES128-GCM-SHA256"] for ciphers) |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Setting identifier (e.g., ssl, cache_level, security_level) |
value | string | Updated setting value as a string. Simple values returned as-is (e.g., "full", "on"). Complex values are JSON-stringified. |
editable | boolean | Whether the setting can be modified for the current zone plan |
modified_on | string | ISO 8601 timestamp when the setting was last modified |
time_remaining | number | Development mode countdown, in seconds. Cloudflare documents this only on the zones_development_mode setting, where it is the interval from when development mode expires (positive) or last expired (negative) |
Gets DNS analytics report for a zone including query counts and trends.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to get DNS analytics for |
since | string | No | Start date for analytics (ISO 8601, e.g., "2024-01-01T00:00:00Z") or relative (e.g., "-6h") |
until | string | No | End date for analytics (ISO 8601, e.g., "2024-01-31T23:59:59Z") or relative (e.g., "now") |
metrics | string | No | Comma-separated metrics to retrieve (e.g., "queryCount,uncachedCount,staleCount,responseTimeAvg,responseTimeMedian,responseTime90th,responseTime99th"). Optional in the API |
dimensions | string | No | Comma-separated dimensions to group by (e.g., "queryName,queryType,responseCode,responseCached,coloName,origin,dayOfWeek,tcp,ipVersion,querySizeBucket,responseSizeBucket") |
filters | string | No | Filters to apply to the data (e.g., "queryType==A") |
sort | string | No | Sort order for the result set. Fields must be included in metrics or dimensions (e.g., "+queryCount" or "-responseTimeAvg") |
limit | number | No | Maximum number of results to return |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
totals | object | Aggregate DNS analytics totals for the entire queried period. Only the metrics that were requested are present. |
↳ queryCount | number | Total number of DNS queries. Absent when queryCount was not requested |
↳ uncachedCount | number | Number of uncached DNS queries. Absent when uncachedCount was not requested |
↳ staleCount | number | Number of stale DNS queries. Absent when staleCount was not requested |
↳ responseTimeAvg | number | Average response time in milliseconds |
↳ responseTimeMedian | number | Median response time in milliseconds |
↳ responseTime90th | number | 90th percentile response time in milliseconds |
↳ responseTime99th | number | 99th percentile response time in milliseconds |
min | json | Per-metric minimums. Cloudflare documents this field as currently always an empty object, so treat a populated value as unexpected rather than relied upon. |
max | json | Per-metric maximums. Cloudflare documents this field as currently always an empty object, so treat a populated value as unexpected rather than relied upon. |
data | array | Raw analytics data rows returned by the Cloudflare DNS analytics report |
↳ dimensions | array | Dimension values for this data row, parallel to the requested dimensions list |
↳ metrics | array | Metric values for this data row, parallel to the requested metrics list |
data_lag | number | Processing lag in seconds before analytics data becomes available |
rows | number | Total number of rows in the result set |
query | object | Echo of the query parameters sent to the API |
↳ since | string | Start date of the analytics query |
↳ until | string | End date of the analytics query |
↳ metrics | array | Metrics requested in the query |
↳ dimensions | array | Dimensions requested in the query |
↳ filters | string | Filters applied to the query |
↳ sort | array | Sort order applied to the query |
↳ limit | number | Maximum number of results requested |
Purges cached content for a zone. Can purge everything or specific files/tags/hosts/prefixes.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to purge cache for |
purge_everything | boolean | No | Set to true to purge all cached content. Mutually exclusive with files, tags, hosts, and prefixes |
files | string | No | Comma-separated list of URLs to purge from cache |
tags | string | No | Comma-separated list of cache tags to purge (Enterprise only) |
hosts | string | No | Comma-separated list of hostnames to purge (Enterprise only) |
prefixes | string | No | Comma-separated list of URL prefixes to purge (Enterprise only) |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Purge request identifier returned by Cloudflare |
Lists every ruleset defined on a zone across all phases (WAF custom rules, managed rules, rate limiting, transform rules, and more). The list response deliberately omits the rules inside each ruleset — use "Get Ruleset" to read them. Requires an API token with Zone WAF Read (or another matching ruleset Read permission).
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to list rulesets for |
per_page | number | No | Number of rulesets to return per page |
cursor | string | No | Cursor for the next page, taken from the cursor output of a previous call. This endpoint paginates by cursor, not by page number |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
rulesets | array | Rulesets defined on the zone |
↳ id | string | Ruleset identifier |
↳ name | string | Ruleset name |
↳ description | string | Ruleset description |
↳ kind | string | Ruleset kind (managed, custom, root, or zone) |
↳ phase | string | Phase the ruleset runs in (e.g., http_request_firewall_custom, http_request_firewall_managed, http_ratelimit) |
↳ version | string | Ruleset version |
↳ last_updated | string | RFC 3339 timestamp of the last change |
total_count | number | Number of rulesets returned on this page |
cursor | string | Cursor to pass to the next call to read the following page, when more remain |
Reads a single zone ruleset including every rule it contains, in evaluation order. Requires an API token with Zone WAF Read (or another matching ruleset Read permission).
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID that owns the ruleset |
rulesetId | string | Yes | The ruleset ID to read |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Ruleset identifier |
name | string | Ruleset name |
description | string | Ruleset description |
kind | string | Ruleset kind (managed, custom, root, or zone) |
phase | string | Phase the ruleset runs in |
version | string | Ruleset version |
last_updated | string | RFC 3339 timestamp of the last change |
rules | array | Rules contained in the ruleset, in evaluation order |
↳ id | string | Rule identifier |
↳ version | string | Rule version |
↳ action | string | Action the rule performs (e.g., block, challenge, log, skip, execute) |
↳ action_parameters | json | Action-specific parameters, including managed-ruleset overrides on execute rules |
↳ expression | string | Filter expression selecting matching requests. Empty on managed-ruleset rules |
↳ description | string | Rule description |
↳ enabled | boolean | Whether the rule is enabled |
↳ ref | string | Rule reference tag that survives rule updates |
↳ last_updated | string | RFC 3339 timestamp of the last change |
↳ categories | array | Managed-rule categories |
↳ logging | json | Logging configuration |
↳ ratelimit | json | Rate limiting configuration for rules in the http_ratelimit phase |
Reads the entry point ruleset for a phase on a zone, including all of its rules. This is how you find the ruleset ID you need before adding, updating, or deleting a rule — for example http_request_firewall_custom for WAF custom rules, http_request_firewall_managed for managed-ruleset deployments and overrides, or http_ratelimit for rate limiting rules. Requires an API token with Zone WAF Read (or another matching ruleset Read permission).
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to read the phase entry point for |
phase | string | Yes | The ruleset phase, e.g. http_request_firewall_custom, http_request_firewall_managed, http_ratelimit, http_request_transform, http_request_dynamic_redirect |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Entry point ruleset identifier |
name | string | Ruleset name |
description | string | Ruleset description |
kind | string | Ruleset kind (managed, custom, root, or zone) |
phase | string | Phase the ruleset runs in |
version | string | Ruleset version |
last_updated | string | RFC 3339 timestamp of the last change |
rules | array | Rules contained in the ruleset, in evaluation order |
↳ id | string | Rule identifier |
↳ version | string | Rule version |
↳ action | string | Action the rule performs (e.g., block, challenge, log, skip, execute) |
↳ action_parameters | json | Action-specific parameters, including managed-ruleset overrides on execute rules |
↳ expression | string | Filter expression selecting matching requests. Empty on managed-ruleset rules |
↳ description | string | Rule description |
↳ enabled | boolean | Whether the rule is enabled |
↳ ref | string | Rule reference tag that survives rule updates |
↳ last_updated | string | RFC 3339 timestamp of the last change |
↳ categories | array | Managed-rule categories |
↳ logging | json | Logging configuration |
↳ ratelimit | json | Rate limiting configuration for rules in the http_ratelimit phase |
Creates a zone ruleset for a phase, optionally seeded with its first rules. Use this when a phase has no entry point ruleset yet — reading the entry point returns 404 on a zone that has never had a rule in that phase, and rules can only be appended to a ruleset that already exists. Create the entry point with kind "zone" and the target phase (for example http_ratelimit for rate limiting rules or http_request_firewall_custom for WAF custom rules), then use the returned ruleset ID for later rule operations. Requires an API token with Zone WAF Edit (or another matching ruleset Edit permission).
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to create the ruleset in |
name | string | Yes | Human-readable name for the ruleset |
phase | string | Yes | The ruleset phase, e.g. http_ratelimit, http_request_firewall_custom, http_request_firewall_managed, http_request_transform, http_request_dynamic_redirect |
kind | string | No | Ruleset kind: zone or custom. Use zone to create a phase entry point ruleset and custom for a ruleset an execute rule deploys. Defaults to zone. "root" is the account-level phase entry point and "managed" is Cloudflare-owned, so neither can be created on this zone-scoped endpoint |
description | string | No | Description of the ruleset |
rules | json | No | JSON array of rules to seed the ruleset with, in evaluation order. Each rule takes action, expression, and optionally description, enabled, action_parameters, and ratelimit |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Ruleset identifier |
name | string | Ruleset name |
description | string | Ruleset description |
kind | string | Ruleset kind (managed, custom, root, or zone) |
phase | string | Phase the ruleset runs in |
version | string | Ruleset version |
last_updated | string | RFC 3339 timestamp of the last change |
rules | array | Rules contained in the ruleset, in evaluation order |
↳ id | string | Rule identifier |
↳ version | string | Rule version |
↳ action | string | Action the rule performs (e.g., block, challenge, log, skip, execute) |
↳ action_parameters | json | Action-specific parameters, including managed-ruleset overrides on execute rules |
↳ expression | string | Filter expression selecting matching requests. Empty on managed-ruleset rules |
↳ description | string | Rule description |
↳ enabled | boolean | Whether the rule is enabled |
↳ ref | string | Rule reference tag that survives rule updates |
↳ last_updated | string | RFC 3339 timestamp of the last change |
↳ categories | array | Managed-rule categories |
↳ logging | json | Logging configuration |
↳ ratelimit | json | Rate limiting configuration for rules in the http_ratelimit phase |
Adds a rule to a zone ruleset. Use "Get Phase Entry Point Ruleset" first to find the ruleset ID for the phase you want (for example http_request_firewall_custom for a WAF custom rule, or http_request_firewall_managed with action "execute" to deploy a managed ruleset). The rule is appended to the end of the ruleset unless a position is given. Requires an API token with Zone WAF Edit (or another matching ruleset Write permission).
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID that owns the ruleset |
rulesetId | string | Yes | The ruleset ID to add the rule to |
action | string | Yes | The action the rule performs. Valid values depend on the phase — e.g. block, challenge, js_challenge, managed_challenge, log, skip, or execute (to deploy a managed ruleset) |
expression | string | Yes | Cloudflare filter expression selecting matching requests, e.g. (ip.src.country in {"GB" "FR"}). Use "true" to match every request |
description | string | No | Human-readable description of the rule |
enabled | boolean | No | Whether the rule is enabled |
ref | string | No | Reference tag that stays stable across rule updates |
actionParameters | string | No | JSON object of action-specific parameters. For an "execute" rule this carries the managed ruleset id and any overrides, e.g. {"id":"<MANAGED_RULESET_ID>","overrides":{"action":"log"}} |
position | string | No | JSON object placing the rule within the ruleset. Exactly one of {"before":"<RULE_ID>"}, {"after":"<RULE_ID>"}, or {"index":<1-based position>} |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Ruleset identifier |
name | string | Ruleset name |
description | string | Ruleset description |
kind | string | Ruleset kind (managed, custom, root, or zone) |
phase | string | Phase the ruleset runs in |
version | string | Ruleset version after the change |
last_updated | string | RFC 3339 timestamp of the last change |
rules | array | Rules in the ruleset after the change, in evaluation order |
↳ id | string | Rule identifier |
↳ version | string | Rule version |
↳ action | string | Action the rule performs |
↳ action_parameters | json | Action-specific parameters |
↳ expression | string | Filter expression |
↳ description | string | Rule description |
↳ enabled | boolean | Whether the rule is enabled |
↳ ref | string | Rule reference tag |
↳ last_updated | string | RFC 3339 timestamp of the last change |
↳ categories | array | Managed-rule categories |
↳ logging | json | Logging configuration |
↳ ratelimit | json | Rate limiting configuration |
Updates a rule in a zone ruleset. Cloudflare replaces the rule definition rather than merging it, so you must send every field you want the rule to keep — any field you omit is reset to its default. Read the current rule with "Get Ruleset" first. Requires an API token with Zone WAF Edit (or another matching ruleset Write permission).
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID that owns the ruleset |
rulesetId | string | Yes | The ruleset ID containing the rule |
ruleId | string | Yes | The rule ID to update |
action | string | Yes | The action the rule performs, e.g. block, challenge, js_challenge, managed_challenge, log, skip, or execute. Required because this endpoint replaces the rule definition — omitting it resets the stored action |
expression | string | Yes | Cloudflare filter expression selecting matching requests. Required because this endpoint replaces the rule definition — omitting it resets the stored expression |
description | string | No | Human-readable description of the rule |
enabled | boolean | No | Whether the rule is enabled |
ref | string | No | Reference tag that stays stable across rule updates. Because the update replaces the rule, omitting it resets the tag to the rule ID and breaks anything matching on the old value |
actionParameters | string | No | JSON object of action-specific parameters, e.g. {"id":"<MANAGED_RULESET_ID>","overrides":{"rules":[{"id":"<RULE_ID>","action":"log","enabled":true,"score_threshold":40}]}}. Required on an execute rule and must be sent on every update: the endpoint replaces the rule, so omitting it resets action_parameters to {} — which unbinds the managed ruleset the rule deploys and every override under it |
ratelimit | string | No | JSON rate limiting configuration to preserve on a rule in the http_ratelimit phase, e.g. {"characteristics":["cf.colo.id","ip.src"],"period":60,"requests_per_period":100}. Because the update replaces the rule, omitting this on a rate limiting rule stops it rate limiting |
logging | string | No | JSON logging configuration to preserve, e.g. {"enabled":true}. Omitting it on a rule that had logging configured resets it to the default |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Ruleset identifier |
name | string | Ruleset name |
description | string | Ruleset description |
kind | string | Ruleset kind (managed, custom, root, or zone) |
phase | string | Phase the ruleset runs in |
version | string | Ruleset version after the change |
last_updated | string | RFC 3339 timestamp of the last change |
rules | array | Rules in the ruleset after the change, in evaluation order |
↳ id | string | Rule identifier |
↳ version | string | Rule version |
↳ action | string | Action the rule performs |
↳ action_parameters | json | Action-specific parameters |
↳ expression | string | Filter expression |
↳ description | string | Rule description |
↳ enabled | boolean | Whether the rule is enabled |
↳ ref | string | Rule reference tag |
↳ last_updated | string | RFC 3339 timestamp of the last change |
↳ categories | array | Managed-rule categories |
↳ logging | json | Logging configuration |
↳ ratelimit | json | Rate limiting configuration |
Permanently deletes a rule from a zone ruleset. This takes effect immediately on live traffic and cannot be undone — deleting a WAF custom rule, a managed-ruleset deployment, or a rate limiting rule removes that protection from the zone. Also use this to delete rate limiting rules, which live in the http_ratelimit phase ruleset. Requires an API token with Zone WAF Edit (or another matching ruleset Write permission).
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID that owns the ruleset |
rulesetId | string | Yes | The ruleset ID containing the rule |
ruleId | string | Yes | The rule ID to delete permanently |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Ruleset identifier |
name | string | Ruleset name |
description | string | Ruleset description |
kind | string | Ruleset kind (managed, custom, root, or zone) |
phase | string | Phase the ruleset runs in |
version | string | Ruleset version after the change |
last_updated | string | RFC 3339 timestamp of the last change |
rules | array | Rules remaining in the ruleset, in evaluation order |
↳ id | string | Rule identifier |
↳ version | string | Rule version |
↳ action | string | Action the rule performs |
↳ action_parameters | json | Action-specific parameters |
↳ expression | string | Filter expression |
↳ description | string | Rule description |
↳ enabled | boolean | Whether the rule is enabled |
↳ ref | string | Rule reference tag |
↳ last_updated | string | RFC 3339 timestamp of the last change |
↳ categories | array | Managed-rule categories |
↳ logging | json | Logging configuration |
↳ ratelimit | json | Rate limiting configuration |
Lists the WAF managed rulesets deployed on a zone together with the overrides applied to each one. Cloudflare has no dedicated overrides endpoint — overrides live on the "execute" rules of the http_request_firewall_managed phase entry point ruleset, which this reads. Requires an API token with Zone WAF Read.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to read managed ruleset deployments and overrides for |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
ruleset_id | string | Ruleset ID of the http_request_firewall_managed entry point, needed to edit a deployment rule |
deployments | array | Managed rulesets deployed on the zone and the overrides applied to each |
↳ rule_id | string | ID of the execute rule that deploys the managed ruleset |
↳ managed_ruleset_id | string | ID of the deployed managed ruleset |
↳ description | string | Description of the deployment rule |
↳ expression | string | Filter expression scoping which requests the managed ruleset runs on |
↳ enabled | boolean | Whether the deployment is enabled |
↳ overrides | json | Overrides applied to the managed ruleset, at three levels. Cloudflare documents action, enabled, and sensitivity_level at the ruleset (top) level; category, action, enabled, and sensitivity_level per category; and id, action, enabled, score_threshold, and sensitivity_level per rule. Rule overrides beat category overrides, which beat the ruleset-level override. sensitivity_level applies only to the DDoS phases, so for a WAF managed ruleset the rule-level properties are action, enabled, and score_threshold |
total_count | number | Number of managed ruleset deployments found |
Lists the rate limiting rules on a zone by reading the http_ratelimit phase entry point ruleset. This uses the current Rulesets-based rate limiting API; the legacy rate_limits endpoint is no longer available. The returned ruleset ID is what "Create Rate Limiting Rule", "Update Rate Limiting Rule", and "Delete Ruleset Rule" need. Requires an API token with Zone WAF Read.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to list rate limiting rules for |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Ruleset ID of the http_ratelimit entry point, needed to create or edit rules |
name | string | Ruleset name |
description | string | Ruleset description |
kind | string | Ruleset kind |
phase | string | Phase the ruleset runs in (http_ratelimit) |
version | string | Ruleset version |
last_updated | string | RFC 3339 timestamp of the last change |
rules | array | Rate limiting rules, in evaluation order |
↳ id | string | Rule identifier |
↳ version | string | Rule version |
↳ action | string | Action applied once the rate limit is exceeded |
↳ action_parameters | json | Action-specific parameters, such as a custom block response |
↳ expression | string | Filter expression selecting the requests the rule applies to |
↳ description | string | Rule description |
↳ enabled | boolean | Whether the rule is enabled |
↳ ref | string | Rule reference tag |
↳ last_updated | string | RFC 3339 timestamp of the last change |
↳ categories | array | Managed-rule categories |
↳ logging | json | Logging configuration |
↳ ratelimit | json | Rate limiting configuration (characteristics, period, requests_per_period, mitigation_timeout, counting_expression, requests_to_origin) |
Creates a rate limiting rule in the http_ratelimit phase entry point ruleset of a zone, using the current Rulesets-based rate limiting API (the legacy rate_limits endpoint is no longer available). Run "List Rate Limiting Rules" first to get the ruleset ID. Requires an API token with Zone WAF Edit.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to add the rate limiting rule to |
rulesetId | string | Yes | The http_ratelimit entry point ruleset ID, as returned by "List Rate Limiting Rules" |
expression | string | Yes | Cloudflare filter expression selecting the requests the rule applies to, e.g. (http.request.uri.path matches "^/api/") |
characteristics | string | Yes | Comma-separated counting characteristics. cf.colo.id is mandatory. ip.src and cf.unique_visitor_id are mutually exclusive — include at most one. Example: cf.colo.id,ip.src |
period | number | Yes | Counting window in seconds. Cloudflare accepts only 10, 60, 120, 300, 600, or 3600 |
requestsPerPeriod | number | Yes | Number of requests allowed within the counting period before the action fires |
action | string | No | Action applied once the limit is exceeded, e.g. block, managed_challenge, js_challenge, challenge, or log. Defaults to block |
mitigationTimeout | number | No | Seconds the action stays applied after the limit is exceeded. Cloudflare accepts only 0, 10, 60, 120, 300, 600, 3600, or 86400 |
counting_expression | string | No | Optional expression defining which requests are counted, when it differs from the matching expression |
requestsToOrigin | boolean | No | When true, only requests that reach the origin are counted |
description | string | No | Human-readable description of the rule |
enabled | boolean | No | Whether the rule is enabled |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Ruleset ID of the http_ratelimit entry point |
name | string | Ruleset name |
description | string | Ruleset description |
kind | string | Ruleset kind |
phase | string | Phase the ruleset runs in (http_ratelimit) |
version | string | Ruleset version after the change |
last_updated | string | RFC 3339 timestamp of the last change |
rules | array | Rate limiting rules after the change, in evaluation order |
↳ id | string | Rule identifier |
↳ version | string | Rule version |
↳ action | string | Action applied once the limit is exceeded |
↳ action_parameters | json | Action-specific parameters |
↳ expression | string | Filter expression |
↳ description | string | Rule description |
↳ enabled | boolean | Whether the rule is enabled |
↳ ref | string | Rule reference tag |
↳ last_updated | string | RFC 3339 timestamp of the last change |
↳ categories | array | Managed-rule categories |
↳ logging | json | Logging configuration |
↳ ratelimit | json | Rate limiting configuration applied to the rule |
Updates a rate limiting rule in the http_ratelimit phase entry point ruleset of a zone, using the current Rulesets-based rate limiting API. Cloudflare replaces the rule definition rather than merging it, so send the complete rule — every field you omit is reset. Run "List Rate Limiting Rules" first to read the current definition and get the ruleset ID. Requires an API token with Zone WAF Edit.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID that owns the rule |
rulesetId | string | Yes | The http_ratelimit entry point ruleset ID, as returned by "List Rate Limiting Rules" |
ruleId | string | Yes | The rate limiting rule ID to update |
expression | string | Yes | Cloudflare filter expression selecting the requests the rule applies to |
characteristics | string | Yes | Comma-separated counting characteristics. cf.colo.id is mandatory. ip.src and cf.unique_visitor_id are mutually exclusive — include at most one. |
period | number | Yes | Counting window in seconds. Cloudflare accepts only 10, 60, 120, 300, 600, or 3600 |
requestsPerPeriod | number | Yes | Number of requests allowed within the counting period before the action fires |
action | string | Yes | Action applied once the limit is exceeded: block, managed_challenge, js_challenge, challenge, or log. Required because this endpoint replaces the rule rather than merging into it — a defaulted action would silently convert an existing log or challenge rule into a hard block |
mitigationTimeout | number | No | Seconds the action stays applied. Cloudflare accepts only 0, 10, 60, 120, 300, 600, 3600, or 86400 |
counting_expression | string | No | Optional expression defining which requests are counted |
requestsToOrigin | boolean | No | When true, only requests that reach the origin are counted |
description | string | No | Human-readable description of the rule |
enabled | boolean | No | Whether the rule is enabled |
ref | string | No | Reference tag that stays stable across rule updates. Because the update replaces the rule, omitting it resets the tag to the rule ID and breaks anything matching on the old value |
actionParameters | string | No | JSON object of action-specific parameters for the mitigation action, e.g. {"response":{"status_code":429,"content":"{\"error\":\"rate limited\"}","content_type":"application/json"}} for a custom block response. Because the update replaces the rule, omitting it resets action_parameters to {} and the rule falls back to Cloudflare's default block page |
logging | string | No | JSON logging configuration to preserve, e.g. {"enabled":true}. Omitting it on a rule that had logging configured resets it to the default |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Ruleset ID of the http_ratelimit entry point |
name | string | Ruleset name |
description | string | Ruleset description |
kind | string | Ruleset kind |
phase | string | Phase the ruleset runs in (http_ratelimit) |
version | string | Ruleset version after the change |
last_updated | string | RFC 3339 timestamp of the last change |
rules | array | Rate limiting rules after the change, in evaluation order |
↳ id | string | Rule identifier |
↳ version | string | Rule version |
↳ action | string | Action applied once the limit is exceeded |
↳ action_parameters | json | Action-specific parameters |
↳ expression | string | Filter expression |
↳ description | string | Rule description |
↳ enabled | boolean | Whether the rule is enabled |
↳ ref | string | Rule reference tag |
↳ last_updated | string | RFC 3339 timestamp of the last change |
↳ categories | array | Managed-rule categories |
↳ logging | json | Logging configuration |
↳ ratelimit | json | Rate limiting configuration applied to the rule |
Lists the Cloudflare Access (Zero Trust) applications protecting an account. Requires an API token with Account Access: Apps and Policies Read.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Access applications are account-scoped |
name | string | No | Filter by application name |
domain | string | No | Filter by the primary hostname the application secures |
aud | string | No | Filter by application audience (AUD) tag |
search | string | No | Free-text search across applications |
exact | boolean | No | Whether the name and domain filters must match exactly |
page | number | No | Page number for pagination |
per_page | number | No | Number of applications per page |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
applications | array | Access applications in the account |
↳ id | string | Access application identifier |
↳ name | string | Application name |
↳ domain | string | Primary hostname and path secured by Access |
↳ type | string | Application type (e.g., self_hosted, saas, ssh, app_launcher, bookmark) |
↳ aud | string | Audience tag used to verify Access JWTs |
↳ session_duration | string | How long an Access session stays valid (e.g., 24h) |
↳ allowed_idps | array | Identity provider IDs users may authenticate with |
↳ app_launcher_visible | boolean | Whether the app appears in the App Launcher |
↳ auto_redirect_to_identity | boolean | Whether users skip the identity provider picker |
↳ custom_deny_message | string | Message shown when access is denied |
↳ custom_deny_url | string | URL users are redirected to when access is denied |
↳ logo_url | string | Logo image URL |
↳ self_hosted_domains | array | Additional hostnames and paths secured by the application. Cloudflare deprecated this field in favour of destinations, which is the one to read on a current application |
↳ destinations | json | Public and private destinations secured by the application |
↳ tags | array | Tags categorizing the application |
↳ policies | json | Access policies attached to the application |
total_count | number | Total number of Access applications |
Reads a single Cloudflare Access (Zero Trust) application, including its attached policies. Requires an API token with Account Access: Apps and Policies Read.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Access applications are account-scoped |
appId | string | Yes | The Access application ID (or audience tag) to read |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Access application identifier |
name | string | Application name |
domain | string | Primary hostname and path secured by Access |
type | string | Application type (e.g., self_hosted, saas, ssh, app_launcher, bookmark) |
aud | string | Audience tag used to verify Access JWTs |
session_duration | string | How long an Access session stays valid (e.g., 24h) |
allowed_idps | array | Identity provider IDs users may authenticate with |
app_launcher_visible | boolean | Whether the app appears in the App Launcher |
auto_redirect_to_identity | boolean | Whether users skip the identity provider picker |
custom_deny_message | string | Message shown when access is denied |
custom_deny_url | string | URL users are redirected to when access is denied |
logo_url | string | Logo image URL |
self_hosted_domains | array | Additional hostnames and paths secured by the application. Cloudflare deprecated this field in favour of destinations, which is the one to read on a current application |
destinations | json | Public and private destinations secured by the application |
tags | array | Tags categorizing the application |
policies | json | Access policies attached to the application |
Creates a Cloudflare Access (Zero Trust) application that puts an identity check in front of a hostname. Until at least one policy is attached the application denies everyone, so pair this with "Create Access Policy". Requires an API token with Account Access: Apps and Policies Edit.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Access applications are account-scoped |
type | string | Yes | Application type: self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, infrastructure, rdp, mcp, mcp_portal, or proxy_endpoint. dash_sso has no request variant and cannot be created through the API |
domain | string | No | The primary hostname and path secured by Access, e.g. internal.example.com or example.com/admin. Required for the self_hosted, ssh, vnc, and rdp types; optional for bookmark and mcp_portal; read-only for app_launcher, warp, biso, and proxy_endpoint; and absent from the saas, infrastructure, and mcp variants |
name | string | No | Friendly name shown in the dashboard and App Launcher |
sessionDuration | string | No | How long an Access session stays valid, e.g. 24h or 30m |
allowedIdps | string | No | Comma-separated identity provider IDs users may authenticate with. Leave empty to allow all configured providers |
appLauncherVisible | boolean | No | Whether the application is shown in the App Launcher |
autoRedirectToIdentity | boolean | No | Whether users skip the identity provider picker |
customDenyMessage | string | No | Message shown to users who are denied access |
customDenyUrl | string | No | URL denied users are redirected to |
logoUrl | string | No | Logo image URL shown in the dashboard and App Launcher |
tags | string | No | Comma-separated tag names categorizing the application |
policies | string | No | JSON array of policies to attach. Entries may be reusable policy IDs or inline policy objects, e.g. ["<POLICY_ID>"] |
saasApp | string | No | JSON SaaS configuration, required for the saas type and rejected on every other type. SAML, e.g. {"auth_type":"saml","consumer_service_url":"https://example.com/acs","sp_entity_id":"https://example.com"\}; OIDC, e.g. {"auth_type":"oidc","client_id":"...","redirect_uris":["https://example.com/callback"\]\} |
targetCriteria | string | No | JSON array of infrastructure target criteria, required for the infrastructure and rdp types and rejected on every other type, e.g. [{"port":22,"protocol":"SSH","target_attributes":{"hostname":["production"]}}] |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Created Access application identifier |
name | string | Application name |
domain | string | Primary hostname and path secured by Access |
type | string | Application type |
aud | string | Audience tag used to verify Access JWTs |
session_duration | string | How long an Access session stays valid |
allowed_idps | array | Identity provider IDs users may authenticate with |
app_launcher_visible | boolean | Whether the app appears in the App Launcher |
auto_redirect_to_identity | boolean | Whether users skip the identity provider picker |
custom_deny_message | string | Message shown when access is denied |
custom_deny_url | string | URL users are redirected to when access is denied |
logo_url | string | Logo image URL |
self_hosted_domains | array | Additional hostnames and paths secured by the application. Cloudflare deprecated this field in favour of destinations, which is the one to read on a current application |
destinations | json | Public and private destinations secured by the application |
tags | array | Tags categorizing the application |
policies | json | Access policies attached to the application |
Updates a Cloudflare Access (Zero Trust) application. Cloudflare does not document merge behavior for this PUT, so treat it as a replace: send every field the application should keep, because an omitted field may revert to its default and widen or break access. Read the current configuration with "Get Access Application" first. Requires an API token with Account Access: Apps and Policies Edit.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Access applications are account-scoped |
appId | string | Yes | The Access application ID to update |
type | string | Yes | Application type: self_hosted, saas, ssh, vnc, app_launcher, warp, biso, bookmark, infrastructure, rdp, mcp, mcp_portal, or proxy_endpoint. dash_sso has no request variant and cannot be written through the API |
domain | string | No | The primary hostname and path secured by Access. Required for the self_hosted, ssh, vnc, and rdp types; optional for bookmark and mcp_portal; read-only for app_launcher, warp, biso, and proxy_endpoint; and absent from the saas, infrastructure, and mcp variants |
name | string | No | Friendly name shown in the dashboard and App Launcher |
sessionDuration | string | No | How long an Access session stays valid, e.g. 24h or 30m |
allowedIdps | string | No | Comma-separated identity provider IDs users may authenticate with |
appLauncherVisible | boolean | No | Whether the application is shown in the App Launcher |
autoRedirectToIdentity | boolean | No | Whether users skip the identity provider picker |
customDenyMessage | string | No | Message shown to users who are denied access |
customDenyUrl | string | No | URL denied users are redirected to |
logoUrl | string | No | Logo image URL shown in the dashboard and App Launcher |
tags | string | No | Comma-separated tag names categorizing the application |
saasApp | string | No | JSON SaaS configuration, required for the saas type and rejected on every other type. SAML, e.g. {"auth_type":"saml","consumer_service_url":"https://example.com/acs","sp_entity_id":"https://example.com"\}; OIDC, e.g. {"auth_type":"oidc","client_id":"...","redirect_uris":["https://example.com/callback"\]\} |
targetCriteria | string | No | JSON array of infrastructure target criteria, required for the infrastructure and rdp types and rejected on every other type, e.g. [{"port":22,"protocol":"SSH","target_attributes":{"hostname":["production"]}}] |
policies | string | No | JSON array of policies to attach. Entries may be reusable policy IDs or inline policy objects |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Access application identifier |
name | string | Application name |
domain | string | Primary hostname and path secured by Access |
type | string | Application type |
aud | string | Audience tag used to verify Access JWTs |
session_duration | string | How long an Access session stays valid |
allowed_idps | array | Identity provider IDs users may authenticate with |
app_launcher_visible | boolean | Whether the app appears in the App Launcher |
auto_redirect_to_identity | boolean | Whether users skip the identity provider picker |
custom_deny_message | string | Message shown when access is denied |
custom_deny_url | string | URL users are redirected to when access is denied |
logo_url | string | Logo image URL |
self_hosted_domains | array | Additional hostnames and paths secured by the application. Cloudflare deprecated this field in favour of destinations, which is the one to read on a current application |
destinations | json | Public and private destinations secured by the application |
tags | array | Tags categorizing the application |
policies | json | Access policies attached to the application |
Permanently deletes a Cloudflare Access (Zero Trust) application and every policy attached to it. The hostname it protected is immediately left without an Access identity check, so anyone who can reach it can reach the origin. This cannot be undone. Requires an API token with Account Access: Apps and Policies Edit.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Access applications are account-scoped |
appId | string | Yes | The Access application ID to delete permanently |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Identifier of the deleted Access application |
Lists the Cloudflare Access (Zero Trust) policies attached to an application, in precedence order. Requires an API token with Account Access: Apps and Policies Read.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Access applications are account-scoped |
appId | string | Yes | The Access application ID whose policies should be listed |
page | number | No | Page number for pagination |
per_page | number | No | Number of policies per page |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
policies | array | Access policies attached to the application |
↳ id | string | Policy identifier |
↳ name | string | Policy name |
↳ decision | string | Decision the policy applies: allow, deny, non_identity, or bypass |
↳ precedence | number | Evaluation order of the policy within the application |
↳ include | json | Rules evaluated with OR logic — matching any one selects the policy |
↳ exclude | json | Rules evaluated with NOT logic — matching any one rejects the request |
↳ require | json | Rules evaluated with AND logic — all must match |
↳ session_duration | string | How long a session granted by this policy stays valid |
↳ approval_required | boolean | Whether an approver must grant each access request |
↳ isolation_required | boolean | Whether the session must run in a remote browser |
↳ purpose_justification_required | boolean | Whether users must state a reason for access |
↳ purpose_justification_prompt | string | Prompt shown when a justification is required |
↳ created_at | string | Creation timestamp |
↳ updated_at | string | Last update timestamp |
total_count | number | Total number of policies |
Creates a Cloudflare Access (Zero Trust) policy on an application, deciding who may reach it. A policy takes effect on live traffic as soon as it is created — an allow policy with a broad include rule grants access immediately. Requires an API token with Account Access: Apps and Policies Edit.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Access applications are account-scoped |
appId | string | Yes | The Access application ID to attach the policy to |
name | string | Yes | Name of the policy |
decision | string | Yes | What the policy does when it matches: allow, deny, non_identity (service tokens and other non-identity rules), or bypass (skip Access entirely) |
include | string | Yes | JSON array of Access rules evaluated with OR logic — matching any one selects the policy. Example: [{"email":{"email":"user@example.com"}}] or [{"email_domain":{"domain":"example.com"}}] |
exclude | string | No | JSON array of Access rules evaluated with NOT logic — matching any one rejects the request |
require | string | No | JSON array of Access rules evaluated with AND logic — all of them must match |
precedence | number | No | Evaluation order of the policy within the application |
sessionDuration | string | No | How long a session granted by this policy stays valid, e.g. 24h. Leave it unset on a policy attached to an infrastructure-typed application — Cloudflare rejects those with error 12130 |
approvalRequired | boolean | No | Whether an approver must grant each access request |
isolationRequired | boolean | No | Whether the session must run in a remote isolated browser |
purposeJustificationRequired | boolean | No | Whether users must state a reason for access |
purposeJustificationPrompt | string | No | Prompt shown when a justification is required |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Created policy identifier |
name | string | Policy name |
decision | string | Decision the policy applies: allow, deny, non_identity, or bypass |
precedence | number | Evaluation order of the policy within the application |
include | json | Rules evaluated with OR logic |
exclude | json | Rules evaluated with NOT logic |
require | json | Rules evaluated with AND logic |
session_duration | string | How long a session granted by this policy stays valid |
approval_required | boolean | Whether an approver must grant each access request |
isolation_required | boolean | Whether the session must run in a remote browser |
purpose_justification_required | boolean | Whether users must state a reason for access |
purpose_justification_prompt | string | Prompt shown when a justification is required |
created_at | string | Creation timestamp |
updated_at | string | Last update timestamp |
Updates a Cloudflare Access (Zero Trust) policy on an application. Cloudflare does not document merge behavior for this PUT, so treat it as a replace: send every rule the policy should keep, because an omitted exclude or require rule may be dropped and widen who gets in. The change applies to live traffic immediately. Read the current policy with "List Access Policies" first. Requires an API token with Account Access: Apps and Policies Edit.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Access applications are account-scoped |
appId | string | Yes | The Access application ID that owns the policy |
policyId | string | Yes | The Access policy ID to update |
name | string | Yes | Name of the policy |
decision | string | Yes | What the policy does when it matches: allow, deny, non_identity, or bypass (skip Access entirely) |
include | string | Yes | JSON array of Access rules evaluated with OR logic. Example: [{"email_domain":{"domain":"example.com"}}] |
exclude | string | No | JSON array of Access rules evaluated with NOT logic |
require | string | No | JSON array of Access rules evaluated with AND logic |
precedence | number | No | Evaluation order of the policy within the application |
sessionDuration | string | No | How long a session granted by this policy stays valid, e.g. 24h. Leave it unset on a policy attached to an infrastructure-typed application — Cloudflare rejects those with error 12130 |
approvalRequired | boolean | No | Whether an approver must grant each access request |
isolationRequired | boolean | No | Whether the session must run in a remote isolated browser |
purposeJustificationRequired | boolean | No | Whether users must state a reason for access |
purposeJustificationPrompt | string | No | Prompt shown when a justification is required |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Policy identifier |
name | string | Policy name |
decision | string | Decision the policy applies: allow, deny, non_identity, or bypass |
precedence | number | Evaluation order of the policy within the application |
include | json | Rules evaluated with OR logic |
exclude | json | Rules evaluated with NOT logic |
require | json | Rules evaluated with AND logic |
session_duration | string | How long a session granted by this policy stays valid |
approval_required | boolean | Whether an approver must grant each access request |
isolation_required | boolean | Whether the session must run in a remote browser |
purpose_justification_required | boolean | Whether users must state a reason for access |
purpose_justification_prompt | string | Prompt shown when a justification is required |
created_at | string | Creation timestamp |
updated_at | string | Last update timestamp |
Permanently deletes a Cloudflare Access (Zero Trust) policy from an application. This changes who can reach the application the moment it runs: removing an allow policy locks out everyone it covered, and removing a deny or require policy drops that restriction. This cannot be undone. Requires an API token with Account Access: Apps and Policies Edit.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Access applications are account-scoped |
appId | string | Yes | The Access application ID that owns the policy |
policyId | string | Yes | The Access policy ID to delete permanently |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Identifier of the deleted Access policy |
Lists the reusable Cloudflare Access (Zero Trust) groups in an account. Groups bundle identity rules that policies can reference by ID. Requires an API token with Account Access: Organizations, Identity Providers, and Groups Read.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Access groups are account-scoped |
name | string | No | Filter by group name |
search | string | No | Free-text search across groups |
page | number | No | Page number for pagination |
per_page | number | No | Number of groups per page |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
groups | array | Access groups in the account |
↳ id | string | Access group identifier |
↳ name | string | Group name |
↳ is_default | json | Rules that place this group in every Access application by default. Cloudflare returns an array of rule objects here, not a boolean |
↳ include | json | Rules evaluated with OR logic |
↳ exclude | json | Rules evaluated with NOT logic |
↳ require | json | Rules evaluated with AND logic |
↳ created_at | string | Creation timestamp |
↳ updated_at | string | Last update timestamp |
total_count | number | Total number of Access groups |
Lists the identity providers configured for Cloudflare Access (Zero Trust) in an account, such as Okta, Entra ID, Google Workspace, or a one-time PIN. Use the returned IDs to restrict an application with allowed_idps. Requires an API token with Account Access: Organizations, Identity Providers, and Groups Read.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Identity providers are account-scoped |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
identity_providers | array | Identity providers configured for Access |
↳ id | string | Identity provider identifier |
↳ name | string | Display name shown to users on the login page |
↳ type | string | Provider type, e.g. azureAD, okta, google, saml, oidc, or onetimepin |
↳ read_only | boolean | Whether the provider is immutable through the API |
↳ config | json | Provider-specific configuration parameters |
↳ scim_config | json | SCIM user and group provisioning configuration |
total_count | number | Total number of identity providers |
Lists the Cloudflare Access (Zero Trust) service tokens in an account, which let machines authenticate to Access-protected applications. Client secrets are never returned by this endpoint — only on creation. Requires an API token with Account Access: Service Tokens Read.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Service tokens are account-scoped |
name | string | No | Filter by service token name |
search | string | No | Free-text search across service tokens |
page | number | No | Page number for pagination |
per_page | number | No | Number of service tokens per page |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
service_tokens | array | Access service tokens in the account |
↳ id | string | Service token identifier |
↳ name | string | Service token name |
↳ client_id | string | Client ID sent in the CF-Access-Client-Id header |
↳ duration | string | How long the token stays valid before it expires |
↳ enabled | boolean | Whether the token is active |
↳ expires_at | string | Expiry timestamp |
↳ last_seen_at | string | When the token was last used |
↳ created_at | string | Creation timestamp |
↳ updated_at | string | Last update timestamp |
total_count | number | Total number of service tokens |
Creates a Cloudflare Access (Zero Trust) service token so a machine can authenticate to Access-protected applications. This is the only response that ever contains the client secret — Cloudflare will not return it again, so capture it in the same run. Requires an API token with Account Access: Service Tokens Edit.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Service tokens are account-scoped |
name | string | Yes | Name of the service token |
duration | string | No | How long the token stays valid before it expires, e.g. 8760h. Defaults to Cloudflare's standard lifetime |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Created service token identifier |
name | string | Service token name |
client_id | string | Client ID sent in the CF-Access-Client-Id header |
client_secret | string | Client secret sent in the CF-Access-Client-Secret header. Returned only once, at creation |
duration | string | How long the token stays valid before it expires |
enabled | boolean | Whether the token is active |
expires_at | string | Expiry timestamp |
last_seen_at | string | When the token was last used |
created_at | string | Creation timestamp |
updated_at | string | Last update timestamp |
Permanently deletes a Cloudflare Access (Zero Trust) service token, revoking it. Every machine or integration still presenting that client ID and secret is locked out of the Access-protected applications immediately, and the secret cannot be recovered. This cannot be undone. Requires an API token with Account Access: Service Tokens Edit.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Service tokens are account-scoped |
serviceTokenId | string | Yes | The service token ID to revoke permanently |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Identifier of the revoked service token |
name | string | Service token name |
client_id | string | Client ID that is no longer accepted |
duration | string | Configured token lifetime |
enabled | boolean | Whether the token was active |
expires_at | string | Expiry timestamp |
last_seen_at | string | When the token was last used |
created_at | string | Creation timestamp |
updated_at | string | Last update timestamp |
Lists the R2 object storage buckets in an account. Requires an API token with Account Workers R2 Storage Read.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. R2 buckets are account-scoped |
name_contains | string | No | Only return buckets whose name contains this substring |
start_after | string | No | Bucket name to start listing after |
cursor | string | No | Pagination cursor returned by a previous call |
direction | string | No | Sort direction by bucket name: asc or desc |
per_page | number | No | Number of buckets per page |
jurisdiction | string | No | Data-residency jurisdiction to list within: default, eu, or fedramp |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
buckets | array | R2 buckets in the account |
↳ name | string | Bucket name |
↳ creation_date | string | Creation timestamp |
↳ location | string | Location hint the bucket was created with (apac, eeur, enam, weur, wnam, or oc) |
↳ storage_class | string | Default storage class (Standard or InfrequentAccess) |
↳ jurisdiction | string | Data-residency jurisdiction (default, eu, or fedramp) |
cursor | string | Pagination cursor to pass to the next call |
Reads the metadata of a single R2 object storage bucket. Requires an API token with Account Workers R2 Storage Read.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. R2 buckets are account-scoped |
bucketName | string | Yes | The name of the bucket to read |
jurisdiction | string | No | Data-residency jurisdiction the bucket lives in: default, eu, or fedramp |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
name | string | Bucket name |
creation_date | string | Creation timestamp |
location | string | Location hint the bucket was created with (apac, eeur, enam, weur, wnam, or oc) |
storage_class | string | Default storage class (Standard or InfrequentAccess) |
jurisdiction | string | Data-residency jurisdiction (default, eu, or fedramp) |
Creates an R2 object storage bucket in an account. The location hint and jurisdiction are fixed at creation and cannot be changed later. Requires an API token with Account Workers R2 Storage Edit.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. R2 buckets are account-scoped |
bucketName | string | Yes | Name for the new bucket |
locationHint | string | No | Region hint for where the bucket should live: apac, eeur, enam, weur, wnam, or oc. Cannot be changed after creation |
storageClass | string | No | Default storage class for objects: Standard or InfrequentAccess |
jurisdiction | string | No | Data-residency jurisdiction to create the bucket in: default, eu, or fedramp. Cannot be changed after creation |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
name | string | Created bucket name |
creation_date | string | Creation timestamp |
location | string | Location the bucket was created in |
storage_class | string | Default storage class (Standard or InfrequentAccess) |
jurisdiction | string | Data-residency jurisdiction (default, eu, or fedramp) |
Permanently deletes an R2 object storage bucket. Cloudflare only deletes an empty bucket, and the deletion cannot be undone. Requires an API token with Account Workers R2 Storage Edit.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. R2 buckets are account-scoped |
bucketName | string | Yes | The name of the bucket to delete permanently |
jurisdiction | string | No | Data-residency jurisdiction the bucket lives in: default, eu, or fedramp |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
name | string | Name of the deleted bucket. Cloudflare returns an empty result body for this endpoint, so the name is echoed from the request |
Lists the Workers scripts deployed in an account. Requires an API token with Account Workers Scripts Read.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Workers scripts are account-scoped |
tags | string | No | Filter scripts by tag. Cloudflare expects a comma-separated list of tag:allowed pairs where allowed is yes or no, e.g. team:core:yes,deprecated:no |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
scripts | array | Workers scripts in the account |
↳ id | string | Script name |
↳ tag | string | Immutable script identifier, distinct from the script name |
↳ etag | string | Hash of the script content |
↳ created_on | string | Creation timestamp |
↳ modified_on | string | Last deployment timestamp |
↳ usage_model | string | Billing usage model (standard, bundled, or unbound) |
↳ placement_mode | string | Smart placement mode (smart or targeted) |
↳ logpush | boolean | Whether Workers Logpush is enabled |
↳ has_assets | boolean | Whether the script ships static assets |
↳ has_modules | boolean | Whether the script uses ES modules |
↳ compatibility_date | string | Workers runtime compatibility date |
↳ compatibility_flags | array | Workers runtime compatibility flags |
↳ routes | json | Routes the script is bound to |
↳ tail_consumers | json | Workers that consume this script's tail events |
total_count | number | Number of scripts returned |
Reads the deployment settings of a single Workers script — bindings, compatibility date and flags, limits, observability, placement, and tail consumers. The plain "get script" endpoint in the Cloudflare API returns raw JavaScript source rather than JSON, so this settings endpoint is the structured way to inspect one script. Requires an API token with Account Workers Scripts Read.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Workers scripts are account-scoped |
scriptName | string | Yes | The name of the Workers script to read settings for |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
bindings | json | Resource bindings available to the script (KV, R2, D1, secrets, and more) |
compatibility_date | string | Workers runtime compatibility date |
compatibility_flags | array | Workers runtime compatibility flags |
limits | json | CPU and other execution limits |
logpush | boolean | Whether Workers Logpush is enabled |
migrations | json | Durable Object migrations |
observability | json | Observability and log-sampling configuration |
placement | json | Smart placement configuration |
tags | array | Tags attached to the script |
tail_consumers | json | Workers that consume this script's tail events |
usage_model | string | Billing usage model |
Lists the Workers routes on a zone, showing which URL patterns are handled by which Worker script. Unlike the Workers script endpoints, routes are zone-scoped. Requires an API token with Zone Workers Routes Read.
| Parameter | Type | Required | Description |
|---|
zoneId | string | Yes | The zone ID to list Workers routes for. Routes are zone-scoped, not account-scoped |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
routes | array | Workers routes on the zone |
↳ id | string | Route identifier |
↳ pattern | string | URL pattern the route matches, e.g. example.com/* |
↳ script | string | Name of the Workers script handling the route |
total_count | number | Number of routes returned |
Lists the Cloudflare Tunnels (cloudflared) in an account, with their health status and active connections. Requires an API token with Account Cloudflare Tunnel Read.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Tunnels are account-scoped |
name | string | No | Filter by exact tunnel name |
status | string | No | Filter by tunnel health: inactive, degraded, healthy, or down |
uuid | string | No | Filter by tunnel UUID |
is_deleted | boolean | No | Whether to return deleted tunnels instead of active ones |
include_prefix | string | No | Only include tunnels whose name starts with this prefix |
exclude_prefix | string | No | Exclude tunnels whose name starts with this prefix |
existed_at | string | No | Return tunnels that existed at this RFC 3339 timestamp |
was_active_at | string | No | Return tunnels that were active at this RFC 3339 timestamp |
was_inactive_at | string | No | Return tunnels that were inactive at this RFC 3339 timestamp |
page | number | No | Page number for pagination |
per_page | number | No | Number of tunnels per page |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
tunnels | array | Cloudflare Tunnels in the account |
↳ id | string | Tunnel identifier |
↳ name | string | Tunnel name |
↳ account_tag | string | Account the tunnel belongs to |
↳ config_src | string | Where the tunnel configuration lives: local or cloudflare |
↳ status | string | Tunnel health: inactive, degraded, healthy, or down |
↳ tun_type | string | Tunnel type, e.g. cfd_tunnel, warp_connector, or warp |
↳ remote_config | boolean | Whether the tunnel is remotely managed |
↳ metadata | json | Metadata associated with the tunnel |
↳ created_at | string | Creation timestamp |
↳ deleted_at | string | Deletion timestamp |
↳ conns_active_at | string | When the tunnel last had active connections |
↳ conns_inactive_at | string | When the tunnel last lost all connections |
↳ connections | json | Active connector connections for the tunnel |
total_count | number | Total number of tunnels |
Reads a single Cloudflare Tunnel (cloudflared), including its health status and active connector connections. Requires an API token with Account Cloudflare Tunnel Read.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Tunnels are account-scoped |
tunnelId | string | Yes | The tunnel ID to read |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
id | string | Tunnel identifier |
name | string | Tunnel name |
account_tag | string | Account the tunnel belongs to |
config_src | string | Where the tunnel configuration lives: local or cloudflare |
status | string | Tunnel health: inactive, degraded, healthy, or down |
tun_type | string | Tunnel type, e.g. cfd_tunnel, warp_connector, or warp |
remote_config | boolean | Whether the tunnel is remotely managed |
metadata | json | Metadata associated with the tunnel |
created_at | string | Creation timestamp |
deleted_at | string | Deletion timestamp |
conns_active_at | string | When the tunnel last had active connections |
conns_inactive_at | string | When the tunnel last lost all connections |
connections | json | Active connector connections for the tunnel |
Reads the configuration of a remotely-managed Cloudflare Tunnel — its ingress rules, origin request settings, and WARP routing. Only tunnels whose configuration source is "cloudflare" have a remote configuration; locally-managed tunnels keep it in their own config file. Requires an API token with Account Cloudflare Tunnel Read.
| Parameter | Type | Required | Description |
|---|
accountId | string | Yes | The Cloudflare account ID. Tunnels are account-scoped |
tunnelId | string | Yes | The tunnel ID to read the configuration for |
apiKey | string | Yes | Cloudflare API Token |
| Parameter | Type | Description |
|---|
tunnel_id | string | Tunnel the configuration belongs to |
account_id | string | Account the tunnel belongs to |
version | number | Configuration version, incremented on every change |
source | string | Where the configuration is managed: local or cloudflare |
created_at | string | Creation timestamp |
config | json | Tunnel configuration with ingress rules, originRequest defaults, and warp-routing settings |