Cloudflare integrationCloudflare logo

Cloudflare integration for AI agents.

Cloudflare integration for AI agents with secure authentication and server-side credential injection. Open Connector runs the OAuth, seals the token in an encrypted vault, and serves Cloudflare tools to your agent over MCP or a typed API — credentials injected server-side, every call audited, nothing leaving your infrastructure. Open source (AGPL-3.0) and self-hostable.

View source on GitHubAll integrations →
What your agents can do

Real Cloudflare actions, managed and audited.

Your user connects Cloudflare once; your agent can then secure AI-agent actions — scoped to the OAuth permissions you grant and the tool allowlist you configure. Every action is least-privilege and written to a tamper-evident audit trail.

  1. 1

    Your user grants Cloudflare access once (OAuth) — the token lands in the vault.

  2. 2

    Your agent calls a tool over MCP or the typed API; Open Connector injects the credential server-side.

  3. 3

    Every routed call appends a hash-chained audit record — nothing leaves your infra.

Tools & triggers

Supported Cloudflare tools.

3,239 tools are generated from the published Cloudflare catalog. Descriptions are plain text; each action remains subject to its configured authentication and tool allowlist.

Showing 3,239 tools. All published catalog entries are included in this page's server-rendered HTML.

Add an Access application
Adds a new application to Access.
Access applications
Delete an Access application
Deletes an application from Access.
Access applications
Get an Access application
Fetches information about an Access application.
Access applications
List Access applications
Lists all Access applications in an account.
Access applications
Update Access application settings
Updates Access application settings.
Access applications
Update Access application settings
Updates Access application settings.
Access applications
Revoke application tokens
Revokes all tokens issued for an application.
Access applications
Test Access policies
Tests if a specific user has permission to access an application.
Access applications
Update an Access application
Updates an Access application.
Access applications
Get Access authentication logs
Gets a list of Access authentication audit logs for an account.
Access authentication logs
List authenticator device AAGUIDs
Returns a list of Authenticator Device AAGUIDs for MFA configuration.
Access Authenticator Device AAGUIDs
Create a Bookmark application
Create a new Bookmark application.
Access Bookmark applications (Deprecated)
Delete a Bookmark application
Deletes a Bookmark application.
Access Bookmark applications (Deprecated)
Get a Bookmark application
Fetches a single Bookmark application.
Access Bookmark applications (Deprecated)
List Bookmark applications
Lists Bookmark applications.
Access Bookmark applications (Deprecated)
Update a Bookmark application
Updates a configured Bookmark application.
Access Bookmark applications (Deprecated)
Create a custom page
Create a custom page
Access custom pages
Delete a custom page
Delete a custom page
Access custom pages
Get a custom page
Fetches a custom page and also returns its HTML.
Access custom pages
List custom pages
List custom pages
Access custom pages
Update a custom page
Update a custom page
Access custom pages
Add a new SSH Certificate Authority (CA)
Adds a new SSH Certificate Authority (CA).
Gateway CA
Delete an SSH Certificate Authority (CA)
Deletes an SSH Certificate Authority.
Gateway CA
List SSH Certificate Authorities (CA)
Lists SSH Certificate Authorities (CA).
Gateway CA
Create an Access group
Creates a new Access group.
Access groups
Delete an Access group
Deletes an Access group.
Access groups
Get an Access group
Fetches a single Access group.
Access groups
List Access groups
Lists all Access groups.
Access groups
Update an Access group
Updates a configured Access group.
Access groups
Add an Access identity provider
Adds a new identity provider to Access.
Access identity providers
Create SAML encryption certificate for Identity Provider
Creates a new SAML encryption certificate set and assigns it to the specified SAML Identity Provider. This endpoint is idempotent - if the IdP already has a certificate set assigned, the existing certificate set is returned with a 200 status. **Workflow for enabling SAML encryption:** 1. Call this endpoint to create and assign a certificate set to the IdP 2. Update the IdP configuration (PUT `/identity_providers/{id}`) with: - `config.enable_encryption: true` - `saml_certificate_set_id: <uid from step 1>` 3. Configure the certificate's public key in your external SAML Identity Provider
Access identity providers
Delete an Access identity provider
Deletes an identity provider from Access.
Access identity providers
Get an Access identity provider
Fetches a configured identity provider.
Access identity providers
List Access identity providers
Lists all configured identity providers.
Access identity providers
List SCIM Group resources
Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).
Access identity providers
List SCIM User resources
Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).
Access identity providers
Update an Access identity provider
Updates a configured identity provider.
Access identity providers
Create an IdP federation grant
Creates an IdP federation grant for the specified identity provider, making it available for federation to other accounts in the same Cloudflare organization. The account must belong to a Cloudflare organization. One-time pin and Cloudflare-managed identity providers cannot be federated. An account can federate at most five identity providers at a time.
Access IdP federation grants
Delete an IdP federation grant
Deletes an IdP federation grant. The identity provider remains in the account, but it is no longer available for federation to other accounts.
Access IdP federation grants
Get an IdP federation grant
Retrieves a single IdP federation grant by its UID.
Access IdP federation grants
List IdP federation grants
Lists the IdP federation grants owned by the account.
Access IdP federation grants
Get an Access JIT request log
Gets an account-scoped Access JIT request summary and its lifecycle events in chronological order.
Access JIT request logs
List Access JIT request logs
Lists account-wide Access JIT request logs reconstructed from request lifecycle events.
Access JIT request logs
Get the Access key configuration
Gets the Access key rotation settings for an account.
Access key configuration
Rotate Access keys
Perfoms a key rotation for an account.
Access key configuration
Update the Access key configuration
Updates the Access key rotation settings for an account.
Access key configuration
Add an mTLS certificate
Adds a new mTLS root certificate to Access.
Access mTLS authentication
Delete an mTLS certificate
Deletes an mTLS certificate.
Access mTLS authentication
Get an mTLS certificate
Fetches a single mTLS certificate.
Access mTLS authentication
List mTLS certificates
Lists all mTLS root certificates.
Access mTLS authentication
List all mTLS hostname settings
List all mTLS hostname settings for this account.
Access mTLS authentication
Update an mTLS certificate
Updates a configured mTLS certificate.
Access mTLS authentication
Update an mTLS certificate's hostname settings
Updates an mTLS certificate's hostname settings.
Access mTLS authentication
Convert an Access application policy to a reusable policy
Converts an application-scoped policy to a reusable policy. The policy will no longer be exclusively scoped to the application. Further updates to the policy should go through the /accounts/{account_id}/policies/{uid} endpoint.
Access application-scoped policies
Create an Access application policy
Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array.
Access application-scoped policies
Create an Access reusable policy
Creates a new Access reusable policy.
Access reusable policies
Delete an Access application policy
Deletes an Access policy specific to an application. To delete a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.
Access application-scoped policies
Delete an Access reusable policy
Deletes an Access reusable policy.
Access reusable policies
Get an Access application policy
Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.
Access application-scoped policies
Get an Access reusable policy
Fetches a single Access reusable policy.
Access reusable policies
List Access application policies
Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.
Access application-scoped policies
List Access reusable policies
Lists Access reusable policies.
Access reusable policies
Update an Access application policy
Updates an Access policy specific to an application. To update a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.
Access application-scoped policies
Update an Access reusable policy
Updates a Access reusable policy.
Access reusable policies
Start Access policy test
Starts an Access policy test.
Access policy tester
Get an Access policy test users page
Fetches a single page of user results from an Access policy test.
Access policy tester
Get the current status of a given Access policy test
Fetches the current status of a given Access policy test.
Access policy tester
Get SAML certificate set
Retrieves a specific SAML encryption certificate set by its UID, including both current and previous certificates if available.
Access SAML encryption certificates
Download current certificate in PEM format
Downloads the current SAML encryption certificate's public key in PEM format for the specified certificate set. This endpoint is useful for providing the certificate to Identity Providers for SAML assertion encryption configuration.
Access SAML encryption certificates
List SAML certificate sets
Returns a paginated list of the organization's SAML encryption certificate sets. Each certificate set includes the current and (if present) previous certificates.
Access SAML encryption certificates
Rotate SAML certificate
Rotates the SAML encryption certificates within the specified certificate set. This generates a new certificate and moves the current certificate to the previous slot. If a previous certificate exists, it will be deactivated and removed. This endpoint ensures zero-downtime rotation by maintaining both current and previous certificates during the transition period, allowing IdPs time to update their configurations. Automated rotation happens 30 days before a current certificate's expiration.
Access SAML encryption certificates
List Access SCIM update logs
Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).
Access SCIM update logs
Create a service token
Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token.
Access service tokens
Delete a service token
Deletes a service token.
Access service tokens
Get a service token
Fetches a single service token.
Access service tokens
List service tokens
Lists all service tokens.
Access service tokens
Refresh a service token
Refreshes the expiration of a service token.
Access service tokens
Rotate a service token
Generates a new Client Secret for a service token and revokes the old one.
Access service tokens
Update a service token
Updates a configured service token.
Access service tokens
Create a short-lived certificate CA
Generates a new short-lived certificate CA and public key.
Access short-lived certificate CAs
Delete a short-lived certificate CA
Deletes a short-lived certificate CA.
Access short-lived certificate CAs
Get a short-lived certificate CA
Fetches a short-lived certificate CA and its public key.
Access short-lived certificate CAs
List short-lived certificate CAs
Lists short-lived certificate CAs and their public keys.
Access short-lived certificate CAs
Create a tag
Create a tag
Access tags
Delete a tag
Delete a tag
Access tags
Get a tag
Get a tag
Access tags
List tags
List tags
Access tags
Update a tag
Update a tag
Access tags
Create Token
Create a new Account Owned API token.
Account Owned API Tokens
Delete Token
Destroy an Account Owned API token.
Account Owned API Tokens
List Permission Groups
Find all available permission groups for Account Owned API Tokens
Account Owned API Tokens
List Tokens
List all Account Owned API tokens created for this account. Results include active, disabled, and recently-expired tokens when include_expired is set to true.
Account Owned API Tokens
Roll Token
Roll the Account Owned API token secret.
Account Owned API Tokens
Token Details
Get information about a specific Account Owned API token.
Account Owned API Tokens
Update Token
Update an existing token.
Account Owned API Tokens
Verify Token
Test whether a token works.
Account Owned API Tokens
Billing Profile Details
Gets the current billing profile for the account.
Account Billing Profile
Create an account
Create an account (only available for tenant admins at this time)
Accounts
Delete a specific account
Delete a specific account (only available for tenant admins at this time). This is a permanent operation that will delete any zones or other resources under the account
Accounts
Add Account Custom Nameserver
Adds a custom nameserver to the account for use as a vanity nameserver on zones.
Account-Level Custom Nameservers
Delete Account Custom Nameserver
Removes a custom nameserver from the account.
Account-Level Custom Nameservers
List Account Custom Nameservers
List an account's custom nameservers.
Account-Level Custom Nameservers
Get Account Custom Nameserver Related Zone Metadata
Get metadata for account-level custom nameservers on a zone. Deprecated in favor of [Show DNS Settings](https://developers.cloudflare.com/api/operations/dns-settings-for-a-zone-list-dns-settings).
Account-Level Custom Nameservers Usage for a Zone
Set Account Custom Nameserver Related Zone Metadata
Set metadata for account-level custom nameservers on a zone. If you would like new zones in the account to use account custom nameservers by default, use PUT /accounts/:identifier to set the account setting use_account_custom_ns_by_default to true. Deprecated in favor of [Update DNS Settings](https://developers.cloudflare.com/api/operations/dns-settings-for-a-zone-update-dns-settings).
Account-Level Custom Nameservers Usage for a Zone
Create Monitor Group
Create a new monitor group.
Account Load Balancer Monitor Groups
Delete Monitor Group
Delete a configured monitor group.
Account Load Balancer Monitor Groups
List Monitor Group References
Get the list of resources that reference the provided monitor group.
Account Load Balancer Monitor Groups
List Monitor Groups
List configured monitor groups.
Account Load Balancer Monitor Groups
Monitor Group Details
Fetch a single configured monitor group.
Account Load Balancer Monitor Groups
Patch Monitor Group
Apply changes to an existing monitor group, overwriting the supplied properties.
Account Load Balancer Monitor Groups
Update Monitor Group
Modify a configured monitor group.
Account Load Balancer Monitor Groups
Create Monitor
Create a configured monitor.
Account Load Balancer Monitors
Delete Monitor
Delete a configured monitor.
Account Load Balancer Monitors
List Monitor References
Get the list of resources that reference the provided monitor.
Account Load Balancer Monitors
List Monitors
List configured monitors for an account.
Account Load Balancer Monitors
Monitor Details
List a single configured monitor for an account.
Account Load Balancer Monitors
Patch Monitor
Apply changes to an existing monitor, overwriting the supplied properties.
Account Load Balancer Monitors
Preview Monitor
Preview pools using the specified monitor with provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results.
Account Load Balancer Monitors
Preview Result
Get the result of a previous preview operation using the provided preview_id.
Account Load Balancer Monitors
Update Monitor
Modify a configured monitor.
Account Load Balancer Monitors
Create Pool
Create a new pool.
Account Load Balancer Pools
Delete Pool
Delete a configured pool.
Account Load Balancer Pools
List Pool References
Get the list of resources that reference the provided pool.
Account Load Balancer Pools
List Pools
List configured pools.
Account Load Balancer Pools
Patch Pool
Apply changes to an existing pool, overwriting the supplied properties.
Account Load Balancer Pools
Patch Pools
Apply changes to a number of existing pools, overwriting the supplied properties. Pools are ordered by ascending `name`. Returns the list of affected pools. Supports the standard pagination query parameters, either `limit`/`offset` or `per_page`/`page`.
Account Load Balancer Pools
Pool Details
Fetch a single configured pool.
Account Load Balancer Pools
Pool Health Details
Fetch the latest pool health status for a single pool.
Account Load Balancer Pools
Preview Pool
Preview pool health using provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results.
Account Load Balancer Pools
Update Pool
Modify a configured pool.
Account Load Balancer Pools
Search Resources
Search for Load Balancing resources.
Account Load Balancer Search
Account Load Balancer Details
Fetch a single configured account-scoped load balancer.
Account Load Balancers
Create Account Load Balancer
Create a new account-scoped load balancer.
Account Load Balancers
Delete Account Load Balancer
Delete a configured account-scoped load balancer.
Account Load Balancers
List Account Load Balancers
List configured account-scoped load balancers.
Account Load Balancers
List Load Balancer Usage
Get current load balancer resource usage counts for an account.
Account Load Balancers
Patch Account Load Balancer
Apply changes to an existing account-scoped load balancer, overwriting the supplied properties.
Account Load Balancers
Update Account Load Balancer
Update a configured account-scoped load balancer.
Account Load Balancers
Add Member
Add a user to the list of members for this account.
Account Members
List Members
List all members of an account.
Account Members
Member Details
Get information about a specific member of an account.
Account Members
Remove Member
Remove a member from an account.
Account Members
Update Member
Modify an account member.
Account Members
Permission Group Details
Get information about a specific permission group in an account.
Account Permission Groups
List Account Permission Groups
List all the permissions groups for an account.
Account Permission Groups
Request Trace
Traces a simulated HTTP request through Cloudflare's edge to analyze how rules, settings, and configurations would process the request. Useful for debugging firewall rules, page rules, and other request transformations without sending actual traffic. Supports custom headers, cookies, body content, and geolocation context.
Account Request Tracer
Create Resource Group
Create a new Resource Group under the specified account.
Account Resource Groups
Remove Resource Group
Remove a resource group from an account.
Account Resource Groups
Resource Group Details
Get information about a specific resource group in an account.
Account Resource Groups
List Resource Groups
List all the resource groups for an account.
Account Resource Groups
Update Resource Group
Modify an existing resource group.
Account Resource Groups
List Roles
Get all available roles for an account.
Account Roles
Role Details
Get information about a specific role for an account.
Account Roles
Append Subscription Action
Smartly applies the incoming subscription into the lifecycle of the subscription.
Account Subscriptions
Create Subscriptions
Creates multiple subscriptions for an account in a single request.
Account Subscriptions
Create Subscription
Creates an account subscription.
Account Subscriptions
Delete Subscription
Deletes an account's subscription.
Account Subscriptions
List Subscriptions
Lists all of an account's subscriptions.
Account Subscriptions
Update Subscription
Updates an account subscription.
Account Subscriptions
Create User Group
Create a new user group under the specified account.
Account User Groups
Remove User Group
Remove a user group from an account.
Account User Groups
User Group Details
Get information about a specific user group in an account.
Account User Groups
List User Groups
List all the user groups for an account.
Account User Groups
Add User Group Members
Add members to a User Group.
Account User Group Members
Remove User Group Member
Remove a member from User Group
Account User Group Members
Get User Group Member
Get details of a specific member in a user group.
Account User Group Members
List User Group Members
List all the members attached to a user group.
Account User Group Members
Update User Group Members
Replace the set of members attached to a User Group.
Account User Group Members
Update User Group
Modify an existing user group.
Account User Groups
Account Details
Get information about a specific account that you are a member of.
Accounts
Batch move accounts
Batch move a collection of accounts to a specific organization. ⚠️ Not implemented.
Accounts
Get browser extension configuration
Returns the browser extension configuration for an account. This endpoint is currently backed by the scaffolded service response while the runtime configuration surface is being implemented.
Browser Extension Config
Get account profile
Retrieves the profile information for a specific Cloudflare account, including organization details, settings, and metadata. This endpoint is commonly used to verify account access and retrieve account-level configuration.
Accounts
List account organizations
Retrieve a list of the organizations that "contain" this account or are managing it. The returned list will be in order from "root" to "leaf", where the "leaf" will be the organization that _immediately_ contains the specified account.
Accounts
List Accounts
List all accounts you have ownership or verified access to.
Accounts
List available account datasets
Returns all dataset types that this account can create. Each entry includes the dataset schema and timestamp field. The schema shows all possible fields for a dataset. However, not all fields may be available for your account. When creating or updating a dataset, only fields available to your account can be enabled. If you request a field that is not available, you will receive an error.
Log Explorer Datasets
Create an account dataset
Create a new Log Explorer dataset for the account. List available account datasets to see the dataset types and fields you can use. The `fields` property is optional. If not specified, all available fields will be enabled. For dataset field definitions, see: https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/
Log Explorer Datasets
Get an account dataset
Retrieve a single Log Explorer dataset by ID for the account.
Log Explorer Datasets
List account datasets
Returns all Log Explorer datasets configured for the account. Pass `include_zones=true` to also include zone-level datasets that belong to this account. List responses omit the `fields` property; use the single-dataset endpoint to retrieve field configuration.
Log Explorer Datasets
Update an account dataset
Updates the enabled state and/or field configuration of an account dataset.
Log Explorer Datasets
Run a log query
Run a SQL query against account-level datasets. The SQL query is passed as the `query` query parameter. Because the query appears in the URL, it is subject to gateway and proxy URL-length limits and may be recorded in access logs. This endpoint is deprecated in favour of the POST variant which sends the query in the request body.
Log Explorer Queries
Run a log query
Run a SQL query against account-level datasets. Timestamp fields are RFC3339 strings. Filter with: WHERE {timestamp_field} >= now() - INTERVAL '30' DAY WHERE {timestamp_field} >= '2026-04-01T00:00:00Z' WHERE {timestamp_field} BETWEEN '2026-04-01T00:00:00Z' AND '2026-04-30T23:59:59Z' List configured account datasets to see enabled account-level datasets. Zone-level datasets will not appear here. List available account datasets to inspect their schemas and timestamp fields. For more information about the datasets, and the meaning of each field, check out https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/
Log Explorer Queries
Modify account profile
Updates the profile information for a Cloudflare account. Allows modification of account-level settings and organizational details. Requires Account Settings Write permission.
Accounts
Move account
Move an account within an organization hierarchy or an account outside an organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)
Accounts
Create a Turnstile Widget
Lists challenge widgets.
Turnstile
Delete a Turnstile Widget
Destroy a Turnstile Widget.
Turnstile
Turnstile Widget Details
Show a single challenge widget configuration.
Turnstile
Rotate Secret for a Turnstile Widget
Generate a new secret key for this widget. If `invalidate_immediately` is set to `false`, the previous secret remains valid for 2 hours. Note that secrets cannot be rotated again during the grace period.
Turnstile
Update a Turnstile Widget
Update the configuration of a widget.
Turnstile
List Turnstile Widgets
Lists all turnstile widgets of an account.
Turnstile
Update Account
Update an existing account.
Accounts
Add audio tracks to a video
Adds an additional audio track to a video using the provided audio track URL.
Stream Audio Tracks
Add a participant
Adds a participant to the given meeting ID.
Meetings
Add a webhook
Adds a new webhook to an App.
Webhooks
Ingest messages
Processes a conversation and extracts structured memories from it. Agent Memory identifies facts, events, instructions, and tasks automatically.
Memory
Delete a memory
Deletes a memory by ID. Removes the memory and any source messages linked to it. Returns the deleted memory.
Memory
Get a memory
Retrieves a memory by ID.
Memory
List memories
List memories stored in a profile.
Memory
Create a namespace
Creates a new memory namespace owned by the account.
Namespaces
Delete a namespace
Deletes a namespace.
Namespaces
Get a namespace
Gets a namespace by name.
Namespaces
List namespaces
Lists all namespaces for the given account. Results are paginated.
Namespaces
Delete a profile
Marks a profile for deletion.
Memory
Recall memories
Retrieves memories relevant to the query and returns a synthesized answer.
Memory
Remember a memory
Stores a single memory explicitly.
Memory
Delete a session
Marks all memories and messages in a profile that are tagged with the given session ID for deletion.
Memory
Get a profile summary
Generates a structured Markdown summary of everything stored in a memory profile.
Memory
Bulk get robots.txt rules
Fetches and parses robots.txt files for multiple domains within a zone in a single request. Each domain must belong to the specified zone. Results are keyed by hostname.
AI Audit
Get robots.txt rules
Fetches and parses the robots.txt file for a zone or a specific subdomain within the zone. Returns parsed user-agent rules, content signals, and sitemaps.
AI Audit
Create an AI Search instance.
Create a new AI Search instance with the given configuration.
AI Search Instances
Create a namespace
Create a namespace for organizing AI Search instances.
AI Search Namespaces
Create a token
Create a stored Cloudflare credential for an AI Search instance to access its data source.
AI Search Tokens
Delete an AI Search instance.
Permanently delete an AI Search instance and all its indexed data.
AI Search Instances
Delete a namespace
Permanently delete a namespace. The namespace must be empty (no instances), and the default namespace cannot be deleted.
AI Search Namespaces
Delete a token
Permanently delete a stored AI Search credential. Credentials in use by an instance cannot be deleted.
AI Search Tokens
Get an AI Search instance.
Retrieve the configuration and status of an AI Search instance.
AI Search Instances
Get a namespace
Retrieve a namespace and its description.
AI Search Namespaces
Get a token
Retrieve a stored AI Search credential without exposing its secret.
AI Search Tokens
Cancel an indexing job.
Cancel an in-progress indexing job for an AI Search instance.
AI Search Instances Jobs
Chat Completions
Performs a chat completion request against an AI Search instance, using indexed content as context for generating responses.
AI Search Instances
Create new job
Creates a new indexing job for an AI Search instance.
AI Search Instances Jobs
Get a Job Details
Retrieves details for a specific AI Search indexing job.
AI Search Instances Jobs
List Job Logs
Lists log entries for an AI Search indexing job.
AI Search Instances Jobs
List Jobs
Lists indexing jobs for an AI Search instance.
AI Search Instances Jobs
Search
Executes a semantic search query against an AI Search instance to find relevant indexed content.
AI Search Instances
List AI Search instances.
List all AI Search instances in the account.
AI Search Instances
List namespaces
List namespaces in the account, including their descriptions and creation times.
AI Search Namespaces
List tokens
List stored AI Search credentials in the account without exposing their secrets.
AI Search Tokens
Move an instance to a different namespace.
Moves an instance from its current namespace to the specified target namespace. Use 'default' with --destination-namespace to move the instance back to the default namespace. Fails with 400 if the target namespace already has an instance with the same id (ids must be unique within a namespace — the same id can exist in different namespaces).
AI Search Namespaces
Create an AI Search instance.
Create a new AI Search instance with the given configuration.
AI Search Instances
Delete an AI Search instance.
Permanently delete an AI Search instance and all its indexed data.
AI Search Instances
Get an AI Search instance.
Retrieve the configuration and status of an AI Search instance.
AI Search Instances
Cancel an indexing job.
Cancel an in-progress indexing job for an AI Search instance.
AI Search Instances Jobs
Chat Completions
Performs a chat completion request against an AI Search instance, using indexed content as context for generating responses.
AI Search Instances
Create new job
Creates a new indexing job for an AI Search instance.
AI Search Instances Jobs
Create or Update Item.
Creates or updates an indexed item in an AI Search instance.
AI Search Instances Items
Delete Item.
Deletes a file from a managed AI Search instance and triggers a reindex.
AI Search Instances Items
Get Item.
Retrieves a specific indexed item from an AI Search instance.
AI Search Instances Items
Download Item Content.
Downloads the raw file content for a specific item from the managed AI Search instance storage.
AI Search Instances Items
Get a Job Details
Retrieves details for a specific AI Search indexing job.
AI Search Instances Jobs
List Item Chunks.
Lists chunks for a specific item in an AI Search instance, including their text content.
AI Search Instances Items
Items List.
Lists indexed items in an AI Search instance.
AI Search Instances Items
List Job Logs
Lists log entries for an AI Search indexing job.
AI Search Instances Jobs
List Jobs
Lists indexing jobs for an AI Search instance.
AI Search Instances Jobs
Item Logs.
Lists processing logs for a specific item in an AI Search instance.
AI Search Instances Items
Search
Executes a semantic search query against an AI Search instance to find relevant indexed content.
AI Search Instances
Sync Item.
Syncs an item to an AI Search instance index.
AI Search Instances Items
Upload AI Search item from URL
Downloads a file from a public HTTPS URL with redirect, timeout, and size guards, then uploads it to a Cloudflare AI Search instance as multipart/form-data.
AI Search Instances Itemsuploadurl
List AI Search instances.
List all AI Search instances in the account.
AI Search Instances
Multi-Instance Chat Completions
Performs a chat completion request against multiple AI Search instances in parallel, merging retrieved content as context for generating a response.
AI Search Account Search
Multi-Instance Search
Performs a semantic search query against multiple AI Search instances in parallel, merging the retrieved results into a single ranked response.
AI Search Account Search
Purge search cache.
Purges all cached search results for an AI Search instance. A new internal cache key is generated, immediately orphaning all prior cached entries.
AI Search Instances
Get instance statistics.
Retrieve usage and indexing statistics for an AI Search instance.
AI Search Instances
Update an AI Search instance.
Update the configuration of an AI Search instance.
AI Search Instances
Get instance statistics.
Retrieve usage and indexing statistics for an AI Search instance.
AI Search Instances
Update an AI Search instance.
Update the configuration of an AI Search instance.
AI Search Instances
Update a namespace
Update the description of an existing namespace. The default namespace cannot be modified.
AI Search Namespaces
Update a token
Replace a stored AI Search credential and invalidate cached credentials for instances that use it.
AI Search Tokens
Get AI Security for Apps Custom Topics
Get the AI Security for Apps custom topic categories for a zone.
AI Security for Apps
Set AI Security for Apps Custom Topics
Set the AI Security for Apps custom topic categories for a zone. A maximum of 20 custom topics can be configured per zone. Each topic label must be 2–20 characters using only lowercase letters (a–z), digits (0–9), and hyphens. Each topic description must be 2–50 printable ASCII characters. Changes can take up to a minute to propagate to the zone.
AI Security for Apps
Get AI Security for Apps Status
Get whether AI Security for Apps is enabled or disabled for a zone.
AI Security for Apps
Set AI Security for Apps Status
Enable or disable AI Security for Apps for a zone. Changes can take up to a minute to propagate to the zone.
AI Security for Apps
Check top-up status
Get the payment processing status of a top-up by its invoice ID.
AI Gateway
Create a top-up
Create a credit top-up via Stripe PaymentIntent for the given account.
AI Gateway
Delete spending limit
Remove the spending limit for the account.
AI Gateway
Delete auto top-up configuration
Remove the auto top-up configuration for the account.
AI Gateway
Get credit balance
Retrieve the current credit balance, payment method info, and top-up configuration.
AI Gateway
Get invoice history
Retrieve a list of past invoices with pagination, optionally filtered by type.
AI Gateway
Get invoice preview
Retrieve a preview of the upcoming invoice including line items and tax.
AI Gateway
Get spending limit
Retrieve the current spending limit configuration for the account.
AI Gateway
Get auto top-up configuration
Retrieve the current auto top-up threshold, amount, and any error state.
AI Gateway
Get account top-up limits
Retrieve the minimum and maximum allowed top-up amounts (in cents) for this account.
AI Gateway
Get usage history
Retrieve aggregated usage meter event summaries for the given time range.
AI Gateway
Set spending limit (deprecated)
Deprecated: spending limits can no longer be created, enabled, or modified and this endpoint always responds 403. Use the new AI Gateway spend limits instead: https://developers.cloudflare.com/ai-gateway/features/spend-limits/. Existing limits can be removed via DELETE /spending-limit.
AI Gateway
Set auto top-up configuration
Configure auto top-up with a balance threshold and top-up amount.
AI Gateway
Create a new Account Provider
Creates a new AI Gateway.
AI Gateway Account Providers
Create a new Account Provider Cost
Creates a new AI Gateway.
AI Gateway Account Provider Costs
Create a new Dataset
Creates a new AI Gateway.
AI Gateway Datasets
Create a new Evaluation
Creates a new AI Gateway.
AI Gateway Evaluations
Create a new Gateway
Creates a new AI Gateway.
AI Gateway Gateways
Create a new Provider Configs
Creates a new AI Gateway.
AI Gateway Provider Configs
Delete a Account Provider
Deletes an AI Gateway dataset.
AI Gateway Account Providers
Delete a Account Provider Cost
Deletes an AI Gateway dataset.
AI Gateway Account Provider Costs
Delete a Dataset
Deletes an AI Gateway dataset.
AI Gateway Datasets
Delete a Evaluation
Deletes an AI Gateway dataset.
AI Gateway Evaluations
Delete a Gateway
Deletes an AI Gateway dataset.
AI Gateway Gateways
Delete an AI Gateway Dynamic Route.
Delete an AI Gateway Dynamic Route.
AI Gateway Dynamic Routes
Delete Gateway Logs
Deletes gateway log entries matching the specified criteria.
AI Gateway Logs
Delete a Provider Configs
Deletes an AI Gateway dataset.
AI Gateway Provider Configs
Fetch a Account Provider
Retrieves details for a specific AI Gateway dataset.
AI Gateway Account Providers
Fetch a Account Provider Cost
Retrieves details for a specific AI Gateway dataset.
AI Gateway Account Provider Costs
Fetch a Dataset
Retrieves details for a specific AI Gateway dataset.
AI Gateway Datasets
Fetch a Evaluation
Retrieves details for a specific AI Gateway dataset.
AI Gateway Evaluations
Fetch a Gateway
Retrieves details for a specific AI Gateway dataset.
AI Gateway Gateways
Get an AI Gateway Dynamic Route.
Get an AI Gateway Dynamic Route.
AI Gateway Dynamic Routes
Get an AI Gateway Dynamic Route Version.
Get an AI Gateway Dynamic Route Version.
AI Gateway Dynamic Routes
Get Gateway Log Detail
Retrieves detailed information for a specific AI Gateway log entry.
AI Gateway Logs
Get Gateway Log Request
Retrieves the original request payload for an AI Gateway log entry.
AI Gateway Logs
Get Gateway Log Response
Retrieves the response payload for an AI Gateway log entry.
AI Gateway Logs
Get Gateway URL
Retrieves the endpoint URL for an AI Gateway.
AI Gateway Gateways
List Account Providers
Lists all AI Gateway evaluator types configured for the account.
AI Gateway Account Providers
List Account Provider Costs
Lists all AI Gateway evaluator types configured for the account.
AI Gateway Account Provider Costs
List Datasets
Lists all AI Gateway evaluator types configured for the account.
AI Gateway Datasets
List Evaluations
Lists all AI Gateway evaluator types configured for the account.
AI Gateway Evaluations
List Evaluators
Lists all available evaluator types for scoring AI gateway responses.
AI Gateway Evaluations
List Gateways
Lists all AI Gateway evaluator types configured for the account.
AI Gateway Gateways
List all AI Gateway Dynamic Route Deployments.
List all AI Gateway Dynamic Route Deployments.
AI Gateway Dynamic Routes
List all AI Gateway Dynamic Route Versions.
List all AI Gateway Dynamic Route Versions.
AI Gateway Dynamic Routes
List all AI Gateway Dynamic Routes.
List all AI Gateway Dynamic Routes.
AI Gateway Dynamic Routes
List Gateway Logs
Lists request/response log entries for the AI gateway with filtering and pagination.
AI Gateway Logs
List Provider Configs
Lists all AI Gateway evaluator types configured for the account.
AI Gateway Provider Configs
Patch Gateway Log
Updates metadata for an AI Gateway log entry.
AI Gateway Logs
Create a new AI Gateway Dynamic Route.
Create a new AI Gateway Dynamic Route.
AI Gateway Dynamic Routes
Create a new AI Gateway Dynamic Route Deployment.
Create a new AI Gateway Dynamic Route Deployment.
AI Gateway Dynamic Routes
Create a new AI Gateway Dynamic Route Version.
Create a new AI Gateway Dynamic Route Version.
AI Gateway Dynamic Routes
Update a Account Provider
Updates an existing AI Gateway dataset.
AI Gateway Account Providers
Update a Account Provider Cost
Updates an existing AI Gateway dataset.
AI Gateway Account Provider Costs
Update a Dataset
Updates an existing AI Gateway dataset.
AI Gateway Datasets
Update a Gateway
Updates an existing AI Gateway dataset.
AI Gateway Gateways
Update an AI Gateway Dynamic Route.
Update an AI Gateway Dynamic Route.
AI Gateway Dynamic Routes
Update a Provider Configs
Updates an existing AI Gateway dataset.
AI Gateway Provider Configs
Execute an Analytics Engine SQL query via query parameter
Executes a SQL query against Workers Analytics Engine data. Pass the SQL query as a query parameter. The response uses newline-delimited JSON (NDJSON) by default, or a single JSON object when the query includes a FORMAT JSON clause. Use the POST method for longer queries that may exceed URL length limits.
Analytics Engine
Execute an Analytics Engine SQL query via request body
Executes a SQL query against Workers Analytics Engine data. Pass the SQL query in the request body as plain text. The response uses newline-delimited JSON (NDJSON) by default, or a single JSON object when the query includes a FORMAT JSON clause. Prefer this method for longer queries that may exceed URL length limits.
Analytics Engine
Analyze Certificate
Returns the set of hostnames, the signature algorithm, and the expiration date of the certificate.
Analyze Certificate
Retrieve a discovered operation
Retrieve a single discovered operation by ID
API Shield API Discovery
Retrieve discovered operations on a zone
Retrieve the most up to date view of discovered operations
API Shield API Discovery
Retrieve discovered operations on a zone rendered as OpenAPI schemas
Retrieve the most up to date view of discovered operations, rendered as OpenAPI schemas
API Shield API Discovery
Patch discovered operation
Update the `state` on a discovered operation
API Shield API Discovery
Patch discovered operations
Update the `state` on one or more discovered operations
API Shield API Discovery
Delete user label
Delete user label
API Shield Labels
Add one operation to a zone
Add one operation to a zone. Endpoints can contain path variables. Host, method, endpoint will be normalized to a canoncial form when creating an operation and must be unique on the zone. Inserting an operation that matches an existing one will return the record of the already existing operation and update its last_updated date.
API Shield Endpoint Management
Add operations to a zone
Add one or more operations to a zone. Endpoints can contain path variables. Host, method, endpoint will be normalized to a canoncial form when creating an operation and must be unique on the zone. Inserting an operation that matches an existing one will return the record of the already existing operation and update its last_updated date.
API Shield Endpoint Management
Delete an operation
Removes a single API operation from API Shield endpoint management. The operation will no longer be tracked or protected by API Shield rules.
API Shield Endpoint Management
Delete multiple operations
Bulk removes multiple API operations from API Shield endpoint management in a single request. Efficient for cleaning up unused endpoints.
API Shield Endpoint Management
Retrieve information about all operations on a zone
Lists all API operations tracked by API Shield for a zone with pagination. Returns operation details including method, path, and feature configurations.
API Shield Endpoint Management
Retrieve information about an operation
Gets detailed information about a specific API operation in API Shield, including its schema validation settings and traffic statistics.
API Shield Endpoint Management
Retrieve operations and features as OpenAPI schemas
Retrieves API operations and their features exported as OpenAPI schemas.
API Shield Endpoint Management
Generate fallthrough WAF expression template from a set of API hosts
Creates an expression template fallthrough rule for API Shield. Used for configuring default behavior when no other expression templates match.
API Shield WAF Expression Templates
Create user labels
Create user labels
API Shield Labels
Delete user labels
Delete user labels
API Shield Labels
Retrieve all labels
Retrieve all labels
API Shield Labels
Retrieve managed label
Retrieve managed label
API Shield Labels
Retrieve user label
Retrieve user label
API Shield Labels
Replace operation(s) attached to a managed label
Replace all operations(s) attached to a managed label
API Shield Labels
Replace operation(s) attached to a user label
Replace all operations(s) attached to a user label
API Shield Labels
Bulk remove label(s) on operation(s) in endpoint management
Bulk remove label(s) on operation(s) in endpoint management
API Shield Labels
Bulk attach label(s) on operation(s) in endpoint management
Bulk attach label(s) on operation(s) in endpoint management
API Shield Labels
Bulk replace label(s) on operation(s) in endpoint management
Bulk replace label(s) on operation(s) in endpoint management
API Shield Labels
Remove label(s) on an operation in endpoint management
Remove label(s) on an operation in endpoint management
API Shield Labels
Attach label(s) on an operation in endpoint management
Attach label(s) on an operation in endpoint management
API Shield Labels
Replace label(s) on an operation in endpoint management
Replace label(s) on an operation in endpoint management
API Shield Labels
Patch user label
Update certain fields on a label
API Shield Labels
Update user label
Update all fields on a label
API Shield Labels
Delete a schema
Permanently removes an uploaded OpenAPI schema from API Shield schema validation. Operations using this schema will lose their validation rules.
API Shield Schema Validation 2.0
Enable validation for a schema
Activates schema validation for an uploaded OpenAPI schema. Requests to matching endpoints will be validated against the schema definitions.
API Shield Schema Validation 2.0
Retrieve all operations from a schema.
Retrieves all operations from the schema. Operations that already exist in API Shield Endpoint Management will be returned as full operations.
API Shield Schema Validation 2.0
Update zone level schema validation settings
Updates zone level schema validation settings on the zone
API Shield Schema Validation 2.0
Upload a schema to a zone
Uploads a new OpenAPI schema for API Shield schema validation. The schema defines expected request/response formats for API endpoints.
API Shield Schema Validation 2.0
Retrieve information about all schemas on a zone
Lists all OpenAPI schemas uploaded to API Shield for the zone, including their validation status and associated operations.
API Shield Schema Validation 2.0
Retrieve information about a specific schema on a zone
Gets detailed information about a specific uploaded OpenAPI schema, including its contents and validation configuration.
API Shield Schema Validation 2.0
Retrieve operation-level schema validation settings
Retrieves operation-level schema validation settings on the zone
API Shield Schema Validation 2.0
Retrieve schema hosts in a zone
Lists all unique hosts found in uploaded OpenAPI schemas for the zone. Useful for understanding which domains have schema coverage.
API Shield Schema Validation 2.0
Retrieve zone level schema validation settings
Retrieves zone level schema validation settings currently set on the zone
API Shield Schema Validation 2.0
Update multiple operation-level schema validation settings
Updates multiple operation-level schema validation settings on the zone
API Shield Schema Validation 2.0
Update operation-level schema validation settings
Updates operation-level schema validation settings on the zone
API Shield Schema Validation 2.0
Update zone level schema validation settings
Updates zone level schema validation settings on the zone
API Shield Schema Validation 2.0
Retrieve information about specific configuration properties
Gets the current API Shield configuration settings for a zone, including validation behavior and enforcement mode.
API Shield Settings
Update configuration properties
Updates API Shield configuration settings for a zone. Can modify validation strictness, enforcement mode, and other global settings.
API Shield Settings
Archive a finding
Archive one or more finding instances.
findings
Archives Security Center Insight
Archives a Security Center insight for an account, removing it from the active insights list while preserving historical data.
Security Center Insights
Archives Security Center Insight
Deprecated endpoint for archiving Security Center insights. Use the newer archive-security-center-insight endpoint instead.
Security Center Insights
Archives Zone Security Center Insight
Archives a zone-specific Security Center insight, removing it from the active zone insights while preserving historical data.
Security Center Insights
Argo Analytics for a zone at different PoPs
Retrieves Argo Smart Routing analytics broken down by geographic points of presence (PoPs). Shows latency improvements and routing efficiency per location.
Argo Analytics for Geolocation
Argo Analytics for a zone
Retrieves aggregate Argo Smart Routing analytics for a zone, including latency improvements, bandwidth savings, and routing statistics.
Argo Analytics for Zone
Get Argo Smart Routing setting
Retrieves the value of Argo Smart Routing enablement setting.
Argo Smart Routing
Patch Argo Smart Routing setting
Configures the value of the Argo Smart Routing enablement setting.
Argo Smart Routing
Query analytics summary
Returns aggregate summary stats for a dataset. Includes current-period and previous-period totals for trend comparison.
ART Analytics
Query analytics timeseries
Returns time-bucketed analytics data for a dataset. Includes time slots, each containing the requested stats, group-by dimensions, and resolution-controlled bucket size (e.g. `hour`, `day`).
ART Analytics
Query analytics top-N
Returns the top N results for a dataset by a specified stat. Includes an array of result rows, each containing the requested stats and group-by dimensions.
ART Analytics
Get a namespace
Returns an Artifacts namespace summary.
Artifacts
List namespaces
Lists Artifacts namespaces for an account.
Artifacts
List repository tokens
Lists tokens for a repository.
Artifacts
Read a Git blob
Returns raw bytes for an immutable Git blob object. Blob responses are cacheable forever by hash.
Artifacts
Read a Git commit
Returns decoded metadata for an immutable Git commit object. Commit responses are cacheable forever by hash.
Artifacts
Create a repository
Creates a Git-compatible Artifacts repository in a namespace.
Artifacts
Delete a repository
Deletes a repository and schedules cleanup of its backing data.
Artifacts
Read a file
Returns raw bytes for a file resolved by ref and path.
Artifacts
Fork a repository
Forks a source repository into a new repository.
Artifacts
Get a repository
Returns repository metadata.
Artifacts
Import a repository
Imports an HTTPS Git repository into an Artifacts repository.
Artifacts
List repositories
Lists repositories in a namespace.
Artifacts
Read commit history
Returns commit metadata walking backwards from a ref, branch, tag, or HEAD.
Artifacts
Read a raw file with content type
Returns file bytes resolved by ref and path, with a sniffed content type and browser-safe response headers.
Artifacts
Read a Git tree
Returns decoded entries for an immutable Git tree object. Tree responses are cacheable forever by hash.
Artifacts
Create a repository token
Creates a scoped Git token for a repository.
Artifacts
Revoke a token
Revokes an Artifacts repository token.
Artifacts
Get ASN Overview.
Gets an overview of the Autonomous System Number (ASN) and a list of subnets for it.
ASN Intelligence
Get ASN Subnets
Get ASN Subnets.
ASN Intelligence
Get account audit logs
Gets a list of audit logs for an account. Can be filtered by who made the change, on which zone, and the timeframe of the change.
Audit Logs
Get user audit logs
Gets a list of audit logs for a user account. Can be filtered by who made the change, on which zone, and the timeframe of the change.
Audit Logs
Get resource change history from an account audit log entry (Version 2)
Returns the chronological change history for the resource identified by the given audit log entry. The endpoint first locates the source audit log entry by `id` (using `action_time` to narrow the lookup window), derives identifying filters from that entry, and then returns matching audit logs within the `since`/`before` window. The `result_info.history_status` field indicates the quality of the resource identification used: - `exact`: Resource was identified by the resource URI. - `approximate`: Resource was identified without the resource URI. - `unavailable`: The source audit log entry did not contain enough information to identify the resource; an empty result is returned.
Audit Logs
Get account audit logs (Version 2)
Gets a list of audit logs for an account.
Audit Logs
Get resource change history from an organization audit log entry (Version 2)
Returns the chronological change history for the resource identified by the given organization-scoped audit log entry. The endpoint first locates the source audit log entry by `id` (using `action_time` to narrow the lookup window), derives identifying filters from that entry, and then returns matching audit logs within the `since`/`before` window. The `result_info.history_status` field indicates the quality of the resource identification used: - `exact`: Resource was identified by the resource URI. - `approximate`: Resource was identified without the resource URI. - `unavailable`: The source audit log entry did not contain enough information to identify the resource; an empty result is returned.
Audit Logs
Get organization audit logs (Version 2)
Gets a list of audit logs for an organization.
Audit Logs
List account audit log product categories (Version 2)
Lists the available audit log product categories and the resource products each one expands to. Use these values with the product_category filter on the account audit logs endpoint.
Audit Logs
AI Search
Runs an AI Search query against an AutoRAG.
AutoRAG RAG Search
Files
Lists files indexed by an AutoRAG.
AutoRAG RAG
Get a Job Details
Returns details for an AutoRAG job.
AutoRAG Jobs
List Job Logs
Lists logs for an AutoRAG job.
AutoRAG Jobs
List Jobs
Lists jobs for an AutoRAG.
AutoRAG Jobs
Search
Searches an AutoRAG.
AutoRAG RAG Search
Sync
Starts synchronization for an AutoRAG.
AutoRAG RAG
List available Page Rules settings
Returns a list of settings (and their details) that Page Rules can apply to matching requests.
Available Page Rules settings
Begin SSO connector verification
Validates the user has added the DNS TXT record required for validating ownership of the domain they are trying to set up a connector for.
SSO
Get PayGo Account Billable Usage (Version 1, Alpha)
Returns billable usage data for PayGo (self-serve) accounts. When no query parameters are provided, returns usage for the current billing period.
Billable Usage
Get PayGo Account Billable Usage Info (Version 1, Alpha)
Returns high-level usage information for the account, including coverage, and subscription metadata.
Billable Usage
Get Account Usage (Version 2, Alpha, Restricted)
Returns cost and usage data for a single Cloudflare account, aligned with the [FinOps FOCUS v1.3](https://focus.finops.org/focus-specification/v1-3/) Cost and Usage dataset specification. Each record represents one billable metric for one account on one day. This includes all metered usage, including usage that falls within free-tier allowances and may result in zero cost. **Note:** Cost and pricing fields are not yet populated and will be absent from responses until billing integration is complete. When `from` and `to` are omitted, defaults to the start of the current month through today. The maximum date range is 31 days.
Billable Usage V2
Get Organization Usage (Version 2, Alpha, Restricted)
Returns cost and usage data for all accounts within an organization, aligned with the [FinOps FOCUS v1.3](https://focus.finops.org/focus-specification/v1-3/) Cost and Usage dataset specification. Each record represents one billable metric for one account on one day. This includes all metered usage, including usage that falls within free-tier allowances and may result in zero cost. The response includes usage for every account belonging to the specified organization. **Note:** Cost and pricing fields are not yet populated and will be absent from responses until billing integration is complete. When `from` and `to` are omitted, defaults to the start of the current month through today. The maximum date range is 31 days.
Billable Usage V2
Get Zone Bot Management Config
Retrieve a zone's Bot Management Config
Bot Settings
Update Zone Bot Management Config
Updates the Bot Management configuration for a zone. This API is used to update: - **Bot Fight Mode** - **Super Bot Fight Mode** - **Bot Management for Enterprise** See [Bot Plans](https://developers.cloudflare.com/bots/plans/) for more information on the different plans \ If you recently upgraded or downgraded your plan, refer to the following examples to clean up old configurations. Copy and paste the example body to remove old zone configurations based on your current plan. #### Clean up configuration for Bot Fight Mode plan ```json { "sbfm_likely_automated": "allow", "sbfm_definitely_automated": "allow", "sbfm_verified_bots": "allow", "sbfm_static_resource_protection": false, "optimize_wordpress": false, "suppress_session_score": false } ``` #### Clean up configuration for SBFM Pro plan ```json { "sbfm_likely_automated": "allow", "fight_mode": false } ``` #### Clean up configuration for SBFM Biz plan ```json { "fight_mode": false } ``` #### Clean up configuration for BM Enterprise Subscription plan It is strongly recommended that you ensure you have [custom rules](https://developers.cloudflare.com/waf/custom-rules/) in place to protect your zone before disabling the SBFM rules. Without these protections, your zone is vulnerable to attacks. ```json { "sbfm_likely_automated": "allow", "sbfm_definitely_automated": "allow", "sbfm_verified_bots": "allow", "sbfm_static_resource_protection": false, "optimize_wordpress": false, "fight_mode": false } ```
Bot Settings
Submit a feedback report
Submit a feedback report for the specified zone. Use `type` to indicate whether the report is a false positive (good traffic flagged as bot) or a false negative (bot traffic missed). Furthermore, you can also use `expression` as a wirefilter to identify the affected traffic sample. See more accepted API fields and expression types at https://developers.cloudflare.com/bots/concepts/feedback-loop/#api-fields and https://developers.cloudflare.com/bots/concepts/feedback-loop/#expression-fields, respectively.
Feedback
List zone feedback reports
Returns all feedback reports previously submitted for the specified zone. Feedback reports help improve detection by sharing samples of traffic that were misclassified as bots or humans.
Feedback
Delete an ASN
Delete an ASN from botnet threat feed for a given user.
Botnet Threat Feed
Get daily report
Gets all the data the botnet tracking database has for a given ASN registered to user account for given date. If no date is given, it will return results for the previous day.
Botnet Threat Feed
Get full report
Gets all the data the botnet threat feed tracking database has for a given ASN registered to user account.
Botnet Threat Feed
Get list of ASNs
Gets a list of all ASNs registered for a user for the DDoS Botnet Feed API.
Botnet Threat Feed
Cancel a crawl job.
Cancels an ongoing crawl job by setting its status to cancelled and stopping all queued URLs.
brapi
Close browser session.
Closes an existing browser session.
brapi
Get crawl result.
Returns the result of a crawl job.
brapi
Connect to browser session.
Establishes a WebSocket connection to an existing browser session.
brapi
Acquire and connect to browser session.
Acquires and establishes a WebSocket connection to a browser session.
brapi
List targets.
Returns a list of all debuggable targets including tabs, pages, service workers, and other browser contexts.
brapi
Activate a browser target.
Activates (brings to front) a specific browser target by its ID.
brapi
Close a browser target.
Closes a specific browser target (tab, page, etc.) by its ID. Returns 'Target is closing' on success or an error if the target is not found.
brapi
List targets.
Returns a list of all debuggable targets including tabs, pages, service workers, and other browser contexts.
brapi
Get Chrome DevTools Protocol schema.
Returns the complete Chrome DevTools Protocol schema including all domains, commands, events, and types. This schema describes the entire CDP API surface.
brapi
Get a target by ID.
Returns the debuggable target with the given ID.
brapi
Get browser version metadata.
Get browser version metadata.
brapi
Connect to a specific Chrome DevTools page.
Establishes a WebSocket connection to a specific Chrome DevTools target or page.
brapi
Get session details.
Get details for a specific browser session.
brapi
List sessions.
List active browser sessions.
brapi
Get accessibility tree page
Returns the page's accessibility tree. Use `interestingOnly` to only return semantically meaningful nodes; use `root` to scope the tree to a CSS-selector-anchored subtree. Control page loading with `gotoOptions` and `waitFor*` options.
brapi
Get HTML content.
Fetches rendered HTML content from provided URL or HTML. Check available options like `gotoOptions` and `waitFor*` to control page load behaviour.
brapi
Crawl websites.
Starts a crawl job for the provided URL and its children. Check available options like `gotoOptions` and `waitFor*` to control page load behaviour.
brapi
Get a browser session ID.
Acquires a browser and returns its session ID and websocket URL.
brapi
Get json.
Gets json from a webpage from a provided URL or HTML. Pass `prompt` or `schema` in the body. Control page loading with `gotoOptions` and `waitFor*` options.
brapi
Get Links.
Get links from a web page.
brapi
Get markdown.
Gets markdown of a webpage from provided URL or HTML. Control page loading with `gotoOptions` and `waitFor*` options.
brapi
Get PDF.
Fetches rendered PDF from provided URL or HTML. Check available options like `gotoOptions` and `waitFor*` to control page load behaviour.
brapi
Scrape elements.
Get meta attributes like height, width, text and others of selected elements.
brapi
Get screenshot.
Takes a screenshot of a webpage from provided URL or HTML. Control page loading with `gotoOptions` and `waitFor*` options. Customize screenshots with `viewport`, `fullPage`, `clip` and others.
brapi
Get HTML content and screenshot.
Returns the page's HTML content and screenshot. Control page loading with `gotoOptions` and `waitFor*` options. Customize screenshots with `viewport`, `fullPage`, `clip` and others.
brapi
Open a new browser tab.
Opens a new tab in the browser. Optionally specify a URL to navigate to.
brapi
Create multiple prefixes.
Create multiple prefixes for an account.
dos-flowtrackd-api_other
Create a new app
Creates a new Cloudflare calls app. An app is an unique enviroment where each Session can access all Tracks within the app.
Calls Apps
Delete app
Deletes an app from Cloudflare Calls
Calls Apps
List apps
Lists all apps in the Cloudflare account
Calls Apps
Retrieve app details
Fetches details for a single Calls app.
Calls Apps
Edit app details
Edit details for a single app.
Calls Apps
Delete TURN key
Deletes a TURN key from Cloudflare Calls
Calls TURN Keys
Retrieve TURN key details
Fetches details for a single TURN key.
Calls TURN Keys
Create a new TURN key
Creates a new Cloudflare Calls TURN key.
Calls TURN Keys
List TURN Keys
Lists all TURN keys in the Cloudflare account
Calls TURN Keys
Edit TURN key details
Edit details for a single TURN key.
Calls TURN Keys
Cancel build
Cancel a running or queued build
Builds
Create Catalog Sync
Create a new Catalog Sync (Closed Beta).
Catalog Sync
Delete Catalog Sync
Delete a Catalog Sync (Closed Beta).
Catalog Sync
List Catalog Syncs
List Catalog Syncs (Closed Beta).
Catalog Sync
Patch Catalog Sync
Update a Catalog Sync (Closed Beta).
Catalog Sync
List Prebuilt Policies
List prebuilt catalog sync policies (Closed Beta).
Catalog Sync
Read Catalog Sync
Read a Catalog Sync (Closed Beta).
Catalog Sync
Run Catalog Sync
Refresh a Catalog Sync's destination by running the sync policy against latest resource catalog (Closed Beta).
Catalog Sync
Update Catalog Sync
Update a Catalog Sync (Closed Beta).
Catalog Sync
Delete Advanced Certificate Manager Certificate Pack
For a given zone, delete an advanced certificate pack.
Certificate Packs
Get Certificate Pack
For a given zone, get a certificate pack.
Certificate Packs
Get Certificate Pack Quotas
For a given zone, list certificate pack quotas.
Certificate Packs
List Certificate Packs
For a given zone, list all active certificate packs.
Certificate Packs
Order Advanced Certificate Manager Certificate Pack
For a given zone, order an advanced certificate pack.
Certificate Packs
Restart Validation or Update Advanced Certificate Manager Certificate Pack
For a given zone, restart validation or add cloudflare branding for an advanced certificate pack. The former is only a validation operation for a Certificate Pack in a validation_timed_out status.
Certificate Packs
Update the severity for a finding
Update the severity of a Finding. This will update the `severity_override` field on the Finding payload with the new severity value.
findings
Check whether a report can be appealed
Returns whether the report is currently appealable, along with the signals behind that decision: whether it already has an open appeal, how many appeals have been submitted against it, and whether it has at least one mitigation that an appeal could reverse.
tseng-abuse-complaint-processor_other
Client Certificate Details
Get Details for a single mTLS API Shield Client Certificate.
API Shield Client Certificates for a Zone
Create Client Certificate
Create a new API Shield mTLS Client Certificate.
API Shield Client Certificates for a Zone
Revoke Client Certificate
Set a API Shield mTLS Client Certificate to pending_revocation status for processing to revoked status.
API Shield Client Certificates for a Zone
Reactivate Client Certificate
If a API Shield mTLS Client Certificate is in a pending_revocation state, you may reactivate it with this endpoint.
API Shield Client Certificates for a Zone
List Client Certificates
List all of your Zone's API Shield mTLS Client Certificates by Status and/or using Pagination.
API Shield Client Certificates for a Zone
List Hostname Associations
List Hostname Associations.
API Shield Client Certificates for a Zone
Replace Hostname Associations
Replace Hostname Associations.
API Shield Client Certificates for a Zone
Add patterns to exemption rules
Add regex patterns to per-account exemption rules (union semantics). Missing keys leave that type untouched; duplicates are silently deduped.
Rules
Create a rule
Create a new detection rule.
Rules
Delete all rules
Delete all rules in an account.
Rules
Delete a rule
Delete an existing rule.
Rules
Get exemption rules for an account
Get all exemption rule patterns for the account, grouped by type.
Rules
Get managed rules
Get DFP managed rule metadata (name and description) from YARA rules.
Rules
Get a rule
Get a single rule by ID.
Rules
Get dashboard stats
Get statistics about rules for the dashboard.
Rules
Get folder tree structure
Get the folder tree structure for rules navigation.
Rules
List rules
List all rules for an account with optional filtering.
Rules
Delete a Priority Intelligence Requirement
Deletes a priority intelligence request from Cloudforce One.
Priority Intelligence Requirements (PIR)
Get a Priority Intelligence Requirement
Retrieves a specific priority intelligence request from Cloudforce One.
Priority Intelligence Requirements (PIR)
List Priority Intelligence Requirements
Lists priority intelligence requests in Cloudforce One.
Priority Intelligence Requirements (PIR)
Create a New Priority Intelligence Requirement
Creates a new priority intelligence request in Cloudforce One.
Priority Intelligence Requirements (PIR)
Get Priority Intelligence Requirement Quota
Retrieves quota usage for Cloudforce One priority requests.
Priority Intelligence Requirements (PIR)
Update a Priority Intelligence Requirement
Updates a priority intelligence request in Cloudforce One.
Priority Intelligence Requirements (PIR)
Remove patterns from exemption rules
Remove regex patterns from per-account exemption rules. Missing keys leave that type untouched; non-existent patterns are silently skipped.
Rules
Delete a Request Asset
Removes an asset from a Cloudforce One intelligence request.
Request for Information (RFI)
Get a Request Asset
Retrieves an asset attached to a Cloudforce One intelligence request.
Request for Information (RFI)
List Request Assets
Lists assets attached to a Cloudforce One intelligence request.
Request for Information (RFI)
Create a New Request Asset
Uploads a new asset to a Cloudforce One intelligence request.
Request for Information (RFI)
Update a Request Asset
Updates an asset in a Cloudforce One intelligence request.
Request for Information (RFI)
Get Request Priority, Status, and TLP constants
Retrieves constant values used in Cloudforce One requests, including valid statuses and types.
Request for Information (RFI)
Delete a Request
Deletes a Cloudforce One intelligence request and all associated data.
Request for Information (RFI)
Get a Request
Retrieves details for a specific Cloudforce One intelligence request.
Request for Information (RFI)
List Requests
Lists Cloudforce One intelligence requests with filtering and pagination.
Request for Information (RFI)
Delete a Request Message
Removes a message from a Cloudforce One intelligence request thread.
Request for Information (RFI)
List Request Messages
Lists messages in a Cloudforce One intelligence request conversation.
Request for Information (RFI)
Create a New Request Message
Adds a message to a Cloudforce One intelligence request conversation.
Request for Information (RFI)
Update a Request Message
Updates a message in a Cloudforce One intelligence request thread.
Request for Information (RFI)
Create a New Request.
Creating a request adds the request into the Cloudforce One queue for analysis. In addition to the content, a short title, type, priority, and releasability should be provided. If one is not provided, a default will be assigned.
Request for Information (RFI)
Get Request Quota
Retrieves quota usage for Cloudforce One standard requests.
Request for Information (RFI)
Get Request Types
Lists available request types for Cloudforce One intelligence requests.
Request for Information (RFI)
Update a Request
Updating a request alters the request in the Cloudforce One queue. This API may be used to update any attributes of the request after the initial submission. Only fields that you choose to update need to be add to the request body.
Request for Information (RFI)
Search rules
Search rules using hybrid, vector, keyword, or exact retrieval, backed by AI Search with a SQL fallback.
Rules
Update exemption rule patterns
Replace existing exemption patterns with new values. Each key maps to an array of {old_pattern, new_pattern} entries. Missing keys leave that type untouched. Fails if any old pattern is not found or any new pattern already exists.
Rules
Update a rule
Update an existing rule.
Rules
Validate rule with context
Validate rule syntax, name uniqueness, namespace, and meta checks.
Rules
Configure DMARC Reports
Updates the DMARC report configuration for a zone. At least one of `enabled` or `skip_wizard` must be provided. When enabling, the handler will ensure the DMARC RUA record exists in DNS.
Email Auth
Delete Workers VPC connectivity service
Delete Workers VPC connectivity service
Connectivity Services
Get Workers VPC connectivity service
Get Workers VPC connectivity service
Connectivity Services
List Workers VPC connectivity services
List Workers VPC connectivity services
Connectivity Services
Create Workers VPC connectivity service
Create Workers VPC connectivity service
Connectivity Services
Update Workers VPC connectivity service
Update Workers VPC connectivity service
Connectivity Services
Execute a command in a container instance
Executes a command in a running container instance and returns its buffered standard output, standard error, and exit code.
ApplicationsContainer Instances
Proxy a request to a container instance
Forwards an HTTP request to a running container instance by invoking fetch on the backing Durable Object. The container must be running. The container response status, headers, and text body are returned in the API response body.
ApplicationsContainer Instances
Get credentials to SSH into a Container
Get a JWT to hit the SSH port on a given container.
Deployments
Create an account ruleset
Creates a ruleset at the account level.
Account Rulesets
Create an account ruleset rule
Adds a new rule to an account ruleset. The rule will be added to the end of the existing list of rules in the ruleset by default.
Account Rulesets
Create allowlist prefix.
Create an allowlist prefix for an account.
dos-flowtrackd-api_other
Create App
Create new app for your account
Apps
Create a new application
Create a new application. An Application represents an intent to run one or more containers, with the same image, dynamically scheduled based on constraints
Applications
Create a new rollout for an application
A rollout can be used to update the application's configuration across instances with minimal downtime.
ApplicationsRollouts
Create build token
Create a new build authentication token
Build Tokens
Create a new CNI object
Create a new CNI object
CNIs
Create a container instance
Creates a new container instance within an application. The instance's container is started immediately by invoking startAndWaitForPorts on the backing Durable Object.
ApplicationsContainer Instances
Create a content export
Creates a CSV export for content and accepts optional filters in the payload.
exports
Create Credential
Creates a new credential within a credential set.
Credentials
Create Credential Set
Creates a new credential set.
Credential Sets
Create deploy hook
Create a new deploy hook for a worker script.
Deploy Hooks
Create deployment group
Creates a new deployment group. Policy IDs must be unique across all deployment groups. This endpoint is in Beta.
Deployment Groups
Create a DEX Rule
Create a DEX Rule.
DEX Rules
Create DNS Protection rule.
Create a DNS Protection rule for an account.
dos-flowtrackd-api_other
Create new findings export request
Creates a CSV export for findings and accepts optional filters in the payload.
exports
Create a finding instances export
Creates a CSV export for Finding instances and accepts optional filters in the payload. The `storage_namespace_id` path parameter is derived from the finding ID by base64-decoding it (which yields `integration_id:finding_type_id`) and replacing the colon with a hyphen.
exports
Create Hyperdrive
Creates and returns a new Hyperdrive configuration.
Hyperdrive
Add a new image registry configuration
Add a new image registry into your account, so then Cloudflare can pull docker images with public key JWT authentication
Image Registries
Create integration
Creates a new integration for the specified application. Integration creation with OAuth is not supported by API at the moment. For other auth methods, use `GET /v2/applications/{application_id}/credential-guide` to see the required credential structure and example payloads for each vendor.
Integrations
Create a new interconnect
Create a new interconnect
Interconnects
Create IP profile
Creates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.
IP Profiles
Create an independent livestream
Creates a livestream for the given App ID and returns ingest server, stream key, and playback URL. You can pass custom input to the ingest server and stream key, and freely distribute the content using the playback URL on any player that supports HLS/LHLS.
Live streams
Create manual build
Trigger a manual build for a specific trigger
Triggers
Create a meeting
Create a meeting for the given App ID.
Meetings
Create a poll
Creates a new poll in an active session for the given meeting ID.
Active session
Create prefix.
Create a prefix for an account.
dos-flowtrackd-api_other
Creates remediation jobs
Create one or more remediation jobs tied to a specific Cloudflare Account.
remediations
Create a remediation jobs export
Creates a CSV export for remediation jobs and accepts optional filters in the payload.
exports
Create Scan
Creates and starts a new vulnerability scan. The response may include non-fatal warnings in the `messages` array.
Scans
Create a SYN Protection filter.
Create a SYN Protection filter for an account.
dos-flowtrackd-api_other
Create SYN Protection rule.
Create a SYN Protection rule for an account.
dos-flowtrackd-api_other
Create Target Environment
Creates a new target environment for the account.
Target Environments
Create a TCP Flow Protection filter.
Create a TCP Flow Protection filter for an account.
dos-flowtrackd-api_other
Create TCP Flow Protection rule.
Create a TCP Flow Protection rule for an account.
dos-flowtrackd-api_other
Create trigger
Create a new CI/CD trigger
Triggers
Create a new webhook configuration
Creates a new webhook configuration for sending finding notifications to external endpoints.
webhooks
Create webhook jobs
Creates webhook jobs to send a finding instance to one or more configured webhooks.
webhooks
Create Worker
Create a new Worker.
Workers
Create worker build configuration
Create a new build configuration for a Worker script, linking it to a git repository with CI/CD triggers.
Workers
Create Version
Create a new version.
Versions
Create a zone ruleset
Creates a ruleset at the zone level.
Zone Rulesets
Create a zone ruleset rule
Adds a new rule to a zone ruleset. The rule will be added to the end of the existing list of rules in the ruleset by default.
Zone Rulesets
Get CSAM Scanner setting
Retrieve the current CSAM Scanner configuration for a zone. The notification email is masked by default in responses.
CSAM Scanner Settings
Update CSAM Scanner setting
Update the CSAM Scanner configuration for a zone. Allows enabling or disabling CSAM scanning, updating the notification email, and configuring scanning sources. When a new email is provided, email verification is triggered automatically. The `enabled` field is a toggle; the server may adjust it based on whether the notification email is verified. Returns 403 if the zone or account is locked by Trust & Safety.
CSAM Scanner Settings
Get CT Alerting Subscription
Retrieve the Certificate Transparency alerting subscription settings for a zone. Returns whether CT monitoring is enabled and, for Business and Enterprise zones, the list of email addresses that receive alerts.
CT Alerting
Update CT Alerting Subscription
Create or update the Certificate Transparency alerting subscription for a zone. Enables or disables email notifications when certificates are issued for the zone's domains. For Free and Pro zones, the subscription is toggled on or off using the enabled field. Notification emails are sent to all users with SSL permissions on the zone. For Business and Enterprise zones, the emails field is required and controls which addresses receive alerts. Setting emails to an empty list disables the subscription regardless of the enabled field. A maximum of 10 email addresses may be configured.
CT Alerting
Create a custom asset
Creates a new custom asset at the zone level.
Custom assets for a zone
Delete a custom asset
Deletes an existing custom asset.
Custom assets for a zone
Get a custom asset
Fetches the details of a custom asset.
Custom assets for a zone
List custom assets
Fetches all the custom assets at the zone level.
Custom assets for a zone
Update a custom asset
Updates the configuration of an existing custom asset.
Custom assets for a zone
Create a custom asset
Creates a new custom asset at the account level.
Custom assets for an account
Delete a custom asset
Deletes an existing custom asset.
Custom assets for an account
Get a custom asset
Fetches the details of a custom asset.
Custom assets for an account
List custom assets
Fetches all the custom assets at the account level.
Custom assets for an account
Update a custom asset
Updates the configuration of an existing custom asset.
Custom assets for an account
Create Custom CSR
Generate a new custom Certificate Signing Request (CSR) for a zone. Cloudflare generates and securely stores the private key associated with the CSR. The CSR can then be provided to a Certificate Authority for signing. Once signed, the certificate is uploaded via the Custom SSL endpoint using the CSR ID.
Custom CSRs for a Zone
Custom CSR Details
Retrieve details for a specific custom Certificate Signing Request (CSR).
Custom CSRs for a Zone
Delete Custom CSR
Delete a custom Certificate Signing Request (CSR) and its associated private key. A CSR cannot be deleted if any custom certificates still reference it.
Custom CSRs for a Zone
List Custom CSRs
List all custom Certificate Signing Requests (CSRs) for a zone.
Custom CSRs for a Zone
Create Custom CSR
Generate a new custom Certificate Signing Request (CSR) for an account. Cloudflare generates and securely stores the private key associated with the CSR.
Custom CSRs for an Account
Custom CSR Details
Retrieve details for a specific custom Certificate Signing Request (CSR).
Custom CSRs for an Account
Delete Custom CSR
Delete a custom Certificate Signing Request (CSR) and its associated private key.
Custom CSRs for an Account
List Custom CSRs
List all custom Certificate Signing Requests (CSRs) for an account.
Custom CSRs for an Account
Delete Fallback Origin for Custom Hostnames
Removes the fallback origin configuration for custom hostnames on a zone. Custom hostnames without specific origins will no longer have a fallback.
Custom Hostname Fallback Origin for a Zone
Get Fallback Origin for Custom Hostnames
Retrieves the current fallback origin configuration for custom hostnames on a zone. The fallback origin handles traffic when specific custom hostname origins are unavailable.
Custom Hostname Fallback Origin for a Zone
Update Fallback Origin for Custom Hostnames
Updates the fallback origin configuration for custom hostnames on a zone. Sets the default origin server for custom hostname traffic.
Custom Hostname Fallback Origin for a Zone
Create Custom Hostname
Add a new custom hostname and request that an SSL certificate be issued for it. One of three validation methods—http, txt, email—should be used, with 'http' recommended if the CNAME is already in place (or will be soon). Specifying 'email' will send an email to the WHOIS contacts on file for the base domain plus hostmaster, postmaster, webmaster, admin, administrator. If http is used and the domain is not already pointing to the Managed CNAME host, the PATCH method must be used once it is (to complete validation). Enable bundling of certificates using the custom_cert_bundle field. The bundling process requires the following condition One certificate in the bundle must use an RSA, and the other must use an ECDSA.
Custom Hostname for a Zone
Custom Hostname Details
Retrieves detailed information about a specific custom hostname, including SSL certificate status, ownership verification, and origin configuration.
Custom Hostname for a Zone
Delete Custom Hostname (and any issued SSL certificates)
Permanently deletes a custom hostname and revokes any SSL certificates that were issued for it. This action cannot be undone.
Custom Hostname for a Zone
Delete Single Certificate And Key For Custom Hostname
Delete a single custom certificate from a certificate pack that contains two bundled certificates. Deletion is subject to the following constraints. You cannot delete a certificate if it is the only remaining certificate in the pack. At least one certificate must remain in the pack.
Custom Hostname for a Zone
Replace Custom Certificate and Custom Key In Custom Hostname
Replace a single custom certificate within a certificate pack that contains two bundled certificates. The replacement must adhere to the following constraints. You can only replace an RSA certificate with another RSA certificate or an ECDSA certificate with another ECDSA certificate.
Custom Hostname for a Zone
Edit Custom Hostname
Modify SSL configuration for a custom hostname. When sent with SSL config that matches existing config, used to indicate that hostname should pass domain control validation (DCV). Can also be used to change validation type, e.g., from 'http' to 'email'. Bundle an existing certificate with another certificate by using the "custom_cert_bundle" field. The bundling process supports combining certificates as long as the following condition is met. One certificate must use the RSA algorithm, and the other must use the ECDSA algorithm.
Custom Hostname for a Zone
Get Custom Hostname Quota
Returns custom hostname quota usage for a zone. The allocated quota is a soft limit; creating custom hostnames after usage exceeds this limit can still succeed until the hard cap is reached. Use the exceeded and hard_cap fields to track when usage is above the soft limit and when new custom hostname creation will be rejected.
Custom Hostname for a Zone
List Custom Hostnames
List, search, sort, and filter all of your custom hostnames.
Custom Hostname for a Zone
Grant permission to indicator feed
Grants access permissions for a custom threat indicator feed to other accounts.
Custom Indicator Feeds
Create new indicator feed
Creates a new custom threat indicator feed for sharing threat intelligence data.
Custom Indicator Feeds
Create indicator feed provider
Creates a new indicator feed provider for an account. Only available to Intel accounts.
Custom Indicator Feeds
Download indicator feed data
Downloads the content of a custom threat indicator feed.
Custom Indicator Feeds
Get indicator feed data
Retrieves the raw data entries in a custom threat indicator feed.
Custom Indicator Feeds
Get indicator feed metadata
Retrieves details for a specific custom threat indicator feed.
Custom Indicator Feeds
Get indicator feeds owned by this account
Retrieves details for all accessible custom threat indicator feeds.
Custom Indicator Feeds
Revoke permission to indicator feed
Revokes access permissions for a custom threat indicator feed.
Custom Indicator Feeds
Update indicator feed data
Revises the raw data entries in a custom threat indicator feed. Accepts both plain and gzipped STIX2/CRDF bodies. Gzip is detected by RFC 1952 magic bytes (`0x1f 0x8b`) and/or a `.gz` filename suffix (case-insensitive) — either signal alone is sufficient to trigger the gzip path; if the body is not valid gzip, the upload fails fast. Customers are encouraged to gzip larger uploads — the api-gateway 500 MB body cap applies to the on-the-wire (compressed) size, so gzip lets a single upload carry several GiB of decompressed STIX.
Custom Indicator Feeds
Update indicator feed metadata
Revises details for a specific custom threat indicator feed.
Custom Indicator Feeds
List indicator feed permissions
Lists current access permissions for custom threat indicator feeds.
Custom Indicator Feeds
Upload Custom Origin Trust Store
Upload a root CA certificate to the Custom Origin Trust Store for a Zone. Only root CA certificates are accepted.
Custom Origin Trust Store
Delete Custom Origin Trust Store
Removes a root CA certificate from the custom origin trust store. Origins using certificates signed by this CA will no longer be trusted.
Custom Origin Trust Store
Custom Origin Trust Store Details
Retrieves details about a specific root CA certificate in the custom origin trust store, including expiration and subject information.
Custom Origin Trust Store
List Custom Origin Trust Store Details
Get Custom Origin Trust Store for a Zone.
Custom Origin Trust Store
Create a preview token
Creates a signed JWT token used to preview custom pages before they are published. The API gateway rewrites zone-scoped requests to the account-level service endpoint.
Custom pages for a zone
Get a custom page
Fetches the details of a custom page.
Custom pages for a zone
List custom pages
Fetches all the custom pages at the zone level.
Custom pages for a zone
Update a custom page
Updates the configuration of an existing custom page.
Custom pages for a zone
Create a preview token
Creates a signed JWT token used to preview custom pages before they are published.
Custom pages for an account
Get a custom page
Fetches the details of a custom page.
Custom pages for an account
List custom pages
Fetches all the custom pages at the account level.
Custom pages for an account
Update a custom page
Updates the configuration of an existing custom page.
Custom pages for an account
Create SSL Configuration
Upload a new SSL certificate for a zone.
Custom SSL for a Zone
Delete SSL Configuration
Remove a SSL certificate from a zone.
Custom SSL for a Zone
Edit SSL Configuration
Upload a new private key and/or PEM/CRT for the SSL certificate. Note: PATCHing a configuration for sni_custom certificates will result in a new resource id being returned, and the previous one being deleted.
Custom SSL for a Zone
List SSL Configurations
List, search, and filter all of your custom SSL certificates. The higher priority will break ties across overlapping 'legacy_custom' certificates, but 'legacy_custom' certificates will always supercede 'sni_custom' certificates.
Custom SSL for a Zone
Re-prioritize SSL Certificates
If a zone has multiple SSL certificates, you can set the order in which they should be used during a request. The higher priority will break ties across overlapping 'legacy_custom' certificates.
Custom SSL for a Zone
SSL Configuration Details
Retrieves details for a specific custom SSL certificate, including certificate metadata, bundle method, geographic restrictions, and associated keyless server configuration.
Custom SSL for a Zone
Create D1 Database
Returns the created D1 database.
D1
Delete D1 Database
Deletes the specified D1 database.
D1
Export D1 Database as SQL
Returns a URL where the SQL contents of your D1 can be downloaded. Note: this process may take some time for larger DBs, during which your D1 will be unavailable to serve queries. To avoid blocking your DB unnecessarily, an in-progress export must be continually polled or will automatically cancel.
D1
Get D1 Database
Returns the specified D1 database.
D1
Import SQL into your D1 Database
Generates a temporary URL for uploading an SQL file to, then instructing the D1 to import it and polling it for status updates. Imports block the D1 for their duration.
D1
List D1 Databases
Returns a list of D1 databases.
D1
Query D1 Database
Returns the query result as an object.
D1
Raw D1 Database query
Returns the query result rows as arrays rather than objects. This is a performance-optimized version of the /query endpoint.
D1
Get D1 database bookmark
Retrieves the current bookmark, or the nearest bookmark at or before a provided timestamp. Bookmarks can be used with the restore endpoint to revert the database to a previous point in time.
D1
Restore D1 Database to a bookmark or point in time
Restores a D1 database to a previous point in time either via a bookmark or a timestamp.
D1
Update D1 Database
Updates the specified D1 database.
D1
Update D1 Database partially
Updates partially the specified D1 database.
D1
Top integrations by content findings
Returns the top N integrations ranked by total content findings.
Data Security
Data security findings summary
Returns aggregate current-period and previous-period totals for CASB findings.
Data Security
Data security findings timeseries
Returns merged time-bucketed CASB findings.
Data Security
Retrieve the DCV Delegation unique identifier.
Retrieve the account and zone specific unique identifier used as part of the CNAME target for DCV Delegation.
DCV Delegation
Delete an account ruleset
Deletes all versions of an existing account ruleset.
Account Rulesets
Delete an account ruleset rule
Deletes an existing rule from an account ruleset.
Account Rulesets
Delete an account ruleset version
Deletes an existing version of an account ruleset.
Account Rulesets
Delete brands by ID
Return a success message after deleting brands by ID
brand_protection
Delete patterns for brands by ID
Return a success message after deleting patterns for brands by ID
brand_protection
Delete saved logo queries by ID
Return a success message after deleting saved logo queries by ID
logo_match
Delete saved string queries by ID
Return a success message after deleting saved string queries by ID
domain_search
Delete Logpush job
Deletes a Logpush job.
Logpush jobs for an account
Validate destination
Validates destination.
Logpush jobs for an account
Check destination exists
Checks if there is an existing job with a destination.
Logpush jobs for an account
Delete CMB config
Deletes CMB config.
Logcontrol CMB config for an account
Delete allowlist prefix.
Delete the allowlist prefix for an account given a UUID.
dos-flowtrackd-api_other
Delete all allowlist prefixes.
Delete all allowlist prefixes for an account.
dos-flowtrackd-api_other
Delete a single application by id
Deletes a single application by id
Applications
Delete additional audio tracks on a video
Deletes additional audio tracks on a video. Deleting a default audio track is not allowed. You must assign another audio track as default prior to deletion.
Stream Audio Tracks
Delete build token
Remove a build authentication token
Build Tokens
Deletes a category
Delete a category by its identifier.
Category
Delete a specified CNI object
Delete a specified CNI object
CNIs
Delete collection
Deletes a collection and all its items. This action cannot be undone. The Durable Object storage is deleted asynchronously.
Collections
Delete column
Delete a column from the collection schema. Data is preserved as orphaned UUID keys (forensic safety) and filtered from API responses.
Collections
Delete a container instance
Stops the backing Durable Object container by sending SIGKILL. The instance remains visible until normal runtime lifecycle processing marks it asleep and eventually prunes it.
ApplicationsContainer Instances
Delete Credential
Deletes a credential.
Credentials
Delete Credential Set
Deletes a credential set and all of its credentials.
Credential Sets
Delete a dataset
Soft-deletes a dataset given a datasetId.
Dataset
Delete domain query
Delete a saved brand protection domain query from the account_queries table. This operation will remove the query from the durable object database. Returns 404 if the query ID doesn't exist.
Brand Protection
Delete logo query
Delete a saved brand protection logo query. Returns 404 if the query ID doesn't exist.
Brand Protection
Delete a Scan Config
Delete a Scan Config
Scans
Delete deploy hook
Delete a deploy hook.
Deploy Hooks
Delete deployment group
Deletes a deployment group. Associated policies no longer apply and devices stop receiving version targets. This endpoint is in Beta.
Deployment Groups
Delete device
Deletes a WARP device.
Physical Devices
Delete a DEX Rule
Delete a DEX Rule.
DEX Rules
Delete DNS Protection rule.
Delete a DNS Protection rule specified by the given UUID.
dos-flowtrackd-api_other
Delete all DNS Protection rules.
Delete all DNS Protection rules for an account.
dos-flowtrackd-api_other
Delete environment variable
Remove a specific environment variable from a trigger
Environment Variables
Deletes one or more events
Delete one or more events from a dataset.
Event
Delete a saved event query
Delete a saved event query by its ID
Event
Removes an event reference
Remove one or more references from an event.
Event
Removes a tag from an event
Remove one or more tags from an event.
Event
Delete a group for an account
Delete a group for an account
Groups
Delete a group member
Delete a group member
Groups
Delete Hyperdrive
Deletes the specified Hyperdrive.
Hyperdrive
Delete a registry from the account
Delete a registry from the account, this will make Cloudchamber unable to pull images from the registry
Image Registries
Deletes an indicator
Deletes a specific indicator by its UUID.
Indicator
Delete integration
Delete an integration by soft-deleting it.
Integrations
Delete an interconnect object
Delete an interconnect object
Interconnects
Delete IP profile
Delete a WARP Device IP profile.
IP Profiles
Delete collection item
Delete an item from a collection by its identifier.
Collections
Delete letter template
Delete a user-defined takedown letter template. System templates cannot be deleted.
Brand Protection
Delete Managed Transforms
Disables all Managed Transforms.
Managed Transforms
Delete a participant
Deletes a participant for the given meeting and participant ID.
Meetings
Delete a permission for dataset
Delete a permission
Permissions
Delete prefix.
Delete the prefix for an account given a UUID.
dos-flowtrackd-api_other
Delete all prefixes.
Delete all prefixes for an account.
dos-flowtrackd-api_other
Delete a preset
Deletes a preset using the provided preset ID
Presets
Delete account Email Sending suppression
Delete account Email Sending suppression
Email Sending suppressions
Delete account email suppression
Deletes an email suppression for the specified account.
Email Routing suppressions
Delete account email suppression
Deletes an email suppression for the specified account.
Email Sending suppressions
Delete zone email suppression
Deletes an email suppression for the specified zone.
Email Routing suppressions
Delete zone email suppression
Deletes an email suppression for the specified zone.
Email Sending suppressions
Delete registration
Deletes a WARP registration.
Registrations
Delete registrations
Deletes a list of WARP registrations.
Physical Devices
Delete repository connection
Remove a repository connection
Repository Connections
Delete Scan
Deletes a scan and all associated data. Only scans in a terminal state (`finished`, `failed`) may be deleted. Attempting to delete a scan that is still being created or executed (`created`, `scheduled`, `planning`, `running`) returns `400`.
Scans
Deletes security.txt
Removes the security.txt file configuration for a zone. The /.well-known/security.txt endpoint will no longer be served.
security.txt
Delete SSO connector
Deletes an SSO connector from the account.
SSO
Delete SYN Protection filter.
Delete a SYN Protection filter specified by the given UUID.
dos-flowtrackd-api_other
Delete all SYN Protection filters.
Delete all SYN Protection filters for an account.
dos-flowtrackd-api_other
Delete SYN Protection rule.
Delete a SYN Protection rule specified by the given UUID.
dos-flowtrackd-api_other
Delete all SYN Protection rules.
Delete all SYN Protection rules for an account.
dos-flowtrackd-api_other
Deletes a tag category (SoT)
Deletes a Source-of-Truth tag category by UUID.
TagCategory
Deletes a tag (SoT)
Deletes a Source-of-Truth tag by UUID.
Tag
Delete takedown letter
Delete a specific takedown letter and its associated PDF from storage.
Brand Protection
Delete takedown notice
Delete a takedown notice and all associated letters. PDFs are also removed from storage.
Brand Protection
Delete Target Environment
Removes a target environment.
Target Environments
Delete TCP Flow Protection filter.
Delete a TCP Flow Protection filter specified by the given UUID.
dos-flowtrackd-api_other
Delete all TCP Flow Protection filters.
Delete all TCP Flow Protection filters for an account.
dos-flowtrackd-api_other
Delete TCP Flow Protection rule.
Delete a TCP Flow Protection rule specified by the given UUID.
dos-flowtrackd-api_other
Delete all TCP Flow Protection rules.
Delete all TCP Flow Protection rules for an account.
dos-flowtrackd-api_other
Delete trigger
Remove a CI/CD trigger
Triggers
Delete URL Normalization settings
Deletes the URL Normalization settings.
URL Normalization
[DEPRECATED] Delete Pipeline
[DEPRECATED] Delete a pipeline. Use the new /pipelines/v1/pipelines endpoint instead.
workers_pipelines_other
Delete Pipelines
Delete Pipeline in Account.
workers_pipelines_other
Delete Sink
Delete Pipeline in Account.
workers_pipelines_other
Delete Stream
Delete Stream in Account.
workers_pipelines_other
Delete a webhook configuration
Soft deletes a webhook configuration by its unique identifier. The webhook will be marked as deleted and will no longer be available for use.
webhooks
Delete a webhook
Removes a webhook for the given webhook ID.
Webhooks
Delete Worker
Delete a Worker and all its associated resources (versions, deployments, etc.).
Workers
Delete worker build configuration
Delete the build configuration for a Worker script.
Workers
Delete Version
Delete a version.
Versions
Delete a zone ruleset
Deletes all versions of an existing zone ruleset.
Zone Rulesets
Delete a zone ruleset rule
Deletes an existing rule from a zone ruleset.
Zone Rulesets
Delete a zone ruleset version
Deletes an existing version of a zone ruleset.
Zone Rulesets
Delete a zone snippet
Deletes a snippet belonging to the zone.
Zone Snippets
Delete zone snippet rules
Deletes all snippet rules belonging to the zone.
Zone Snippets
Delete Logpush job
Deletes a Logpush job.
Logpush jobs for a zone
Create Destination
Create a new Workers Observability Telemetry Destination.
Destinations
Get Destinations
List your Workers Observability Telemetry Destinations.
Destinations
Update Destination
Update an existing Workers Observability Telemetry Destination.
Destinations
Delete Destination
Delete a Workers Observability Telemetry Destination.
Destinations
Create Device DEX test
Create a DEX test.
DEX Synthetic Application Monitoring
Delete Device DEX test
Delete a Device DEX test. Returns the remaining device dex tests for the account.
DEX Synthetic Application Monitoring
List Device DEX tests
Fetch all DEX tests.
DEX Synthetic Application Monitoring
Get Device DEX test
Fetch a single DEX test.
DEX Synthetic Application Monitoring
Update Device DEX test
Update a DEX test.
DEX Synthetic Application Monitoring
Create a device managed network
Creates a new device managed network.
Device Managed Networks
Delete a device managed network
Deletes a device managed network and fetches a list of the remaining device managed networks for an account.
Device Managed Networks
Get device managed network details
Fetches details for a single managed network.
Device Managed Networks
List your device managed networks
Fetches a list of managed networks for an account.
Device Managed Networks
Update a device managed network
Updates a configured device managed network.
Device Managed Networks
Create a device posture integration
Create a new device posture integration.
Device Posture Integrations
Delete a device posture integration
Delete a configured device posture integration.
Device Posture Integrations
Get device posture integration details
Fetches details for a single device posture integration.
Device Posture Integrations
List your device posture integrations
Fetches the list of device posture integrations for an account.
Device Posture Integrations
Update a device posture integration
Updates a configured device posture integration.
Device Posture Integrations
Create a device posture rule
Creates a new device posture rule.
Device posture rules
Delete a device posture rule
Deletes a device posture rule.
Device posture rules
Get device posture rule details
Fetches a single device posture rule.
Device posture rules
List device posture rules
Fetches device posture rules for a Zero Trust account.
Device posture rules
Update a device posture rule
Updates a device posture rule.
Device posture rules
Create a device settings profile
Creates a device settings profile to be applied to certain devices matching the criteria.
Devices
Delete a device settings profile
Deletes a device settings profile and fetches a list of the remaining profiles for an account.
Devices
Get device (deprecated)
Fetches a single WARP device. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices/{device_id} - GET /accounts/{account_id}/devices/registrations/{registration_id}
Devices
Get the default device settings profile
Fetches the default device settings profile for an account.
Devices
Get device settings profile by ID
Fetches a device settings profile by ID.
Devices
Get your Local Domain Fallback list
Fetches a list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.
Devices
Get the Local Domain Fallback list for a device settings profile
Fetches the list of domains to bypass Gateway DNS resolution from a specified device settings profile. These domains will use the specified local DNS resolver instead.
Devices
Get device certificate provisioning status
Fetches device certificate provisioning.
Devices
Get the Split Tunnel exclude list
Fetches the list of routes excluded from the WARP client's tunnel.
Devices
Get the Split Tunnel exclude list for a device settings profile
Fetches the list of routes excluded from the WARP client's tunnel for a specific device settings profile.
Devices
Get the Split Tunnel include list
Fetches the list of routes included in the WARP client's tunnel.
Devices
Get the Split Tunnel include list for a device settings profile
Fetches the list of routes included in the WARP client's tunnel for a specific device settings profile.
Devices
Get override codes (deprecated)
Fetches a one-time use admin override code for a device. This relies on the **Admin Override** setting being enabled in your device configuration. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated:** please use GET /accounts/{account_id}/devices/registrations/{registration_id}/override_codes instead.
Devices
List device settings profiles
Fetches a list of the device settings profiles for an account.
Devices
List devices (deprecated)
List WARP devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices - GET /accounts/{account_id}/devices/registrations
Devices
Get the latest status of a device.
Get the latest status of a device given device_id from the device_state table.
DEX Synthetic Application Monitoring
Retrieve Global WARP override state
Fetch the Global WARP override state.
Devices Resilience
Set Global WARP override state
Sets the Global WARP override state.
Devices Resilience
Revoke devices (deprecated)
Revokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/revoke instead.
Devices
Set your Local Domain Fallback list
Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.
Devices
Set the Local Domain Fallback list for a device settings profile
Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. This will only apply to the specified device settings profile.
Devices
Set the Split Tunnel exclude list
Sets the list of routes excluded from the WARP client's tunnel.
Devices
Set the Split Tunnel exclude list for a device settings profile
Sets the list of routes excluded from the WARP client's tunnel for a specific device settings profile.
Devices
Set the Split Tunnel include list
Sets the list of routes included in the WARP client's tunnel.
Devices
Set the Split Tunnel include list for a device settings profile
Sets the list of routes included in the WARP client's tunnel for a specific device settings profile.
Devices
Unrevoke devices (deprecated)
Unrevokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/unrevoke instead.
Devices
Update the default device settings profile
Updates the default device settings profile for an account.
Devices
Update a device settings profile
Updates a configured device settings profile.
Devices
Update device certificate provisioning status
Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session.
Devices
Get the status over time for a device
Get time-bucketed status metrics for a specific device.
DEX Synthetic Application Monitoring
Get details and aggregate metrics for an http test
Get test details and aggregate performance metrics for an http test for a given time period between 1 hour and 7 days.
DEX Synthetic Application Monitoring
Get percentiles for an http test
Get percentiles for an http test for a given time period between 1 hour and 7 days.
DEX Synthetic Application Monitoring
List Cloudflare colos
List Cloudflare colos that account's devices were connected to during a time period, sorted by usage starting from the most used colo. Colos without traffic are also returned and sorted alphabetically.
DEX Synthetic Application Monitoring
List device ISPs
List ISP information observed for a specific device during traceroute tests.
DEX Synthetic Application Monitoring
List DEX test analytics
List DEX tests with overview metrics.
DEX Synthetic Application Monitoring
Get count of devices targeted
Returns unique count of devices that have run synthetic application monitoring tests in the past 7 days.
DEX Synthetic Application Monitoring
Get details and aggregate metrics for a traceroute test
Get test details and aggregate performance metrics for a traceroute test for a given time period between 1 hour and 7 days.
DEX Synthetic Application Monitoring
Get network path breakdown for a traceroute test
Get a breakdown of metrics by hop for individual traceroute test runs.
DEX Synthetic Application Monitoring
Get percentiles for a traceroute test
Get percentiles for a traceroute test for a given time period between 1 hour and 7 days.
DEX Synthetic Application Monitoring
Get details for a specific traceroute test run
Get a breakdown of hops and performance metrics for a specific traceroute test run
DEX Synthetic Application Monitoring
List details of devices using WARP.
List details of devices using WARP.
DEX Synthetic Application Monitoring
Get live aggregate device details by dimension
Get details for live (up to 60 minutes) devices using WARP.
DEX Synthetic Application Monitoring
Get over time aggregate details for devices by dimension
Get aggregate details for devices using WARP, up to 7 days.
DEX Synthetic Application Monitoring
Endpoint Health Check
Create Endpoint Health Check.
Endpoint Health Checks
Delete Endpoint Health Check
Delete Endpoint Health Check.
Endpoint Health Checks
Get Endpoint Health Check
Get a single Endpoint Health Check.
Endpoint Health Checks
List Endpoint Health Checks
List Endpoint Health Checks.
Endpoint Health Checks
Update Endpoint Health Check
Update a Endpoint Health Check.
Endpoint Health Checks
Traceroute
Run traceroutes from Cloudflare colos.
Diagnostics
Disable R2 catalog
Disable an R2 bucket as a catalog. This operation deactivates the catalog but preserves existing metadata and data files. The catalog can be re-enabled later.
R2 Catalog Management
Create custom prompt topic
Creates a DLP custom prompt topic entry.
DLP Custom Prompt Topics
Delete custom prompt topic
Deletes a DLP custom prompt topic entry.
DLP Custom Prompt Topics
Get custom prompt topic
Fetches a DLP custom prompt topic entry by ID.
DLP Custom Prompt Topics
List custom prompt topics
Lists all DLP custom prompt topic entries in an account.
DLP Custom Prompt Topics
Update custom prompt topic
Updates a DLP custom prompt topic entry.
DLP Custom Prompt Topics
Creates a new data class
Creates a data class for use in DLP profiles.
DLP Data Classes
Delete a single data class
Deletes a data class from the account.
DLP Data Classes
Retrieve all data classes in an account
Lists data classes configured for the account.
DLP Data Classes
Retrieve a specific data class
Gets the configuration for a data class.
DLP Data Classes
Update the attributes of a single data class
Updates the configuration for a data class.
DLP Data Classes
Creates a new data tag category.
Creates a data tag category, optionally from a template.
DLP Data Tag Categories
Delete a single data tag category.
Deletes a data tag category and its tags.
DLP Data Tag Categories
Retrieve all data tag categories in an account
Lists data tag categories configured for the account.
DLP Data Tag Categories
Retrieve a specific data tag category.
Gets a data tag category and its tags.
DLP Data Tag Categories
Update the attributes of a single data tag category.
Updates a data tag category and its tags.
DLP Data Tag Categories
Retrieve a specific data tag category template.
Gets an available data tag category template.
DLP Data Tag Category Templates
Retrieve all data tag category templates in an account
Lists available data tag category templates.
DLP Data Tag Category Templates
Creates a new data tag.
Creates a data tag in a category.
DLP Data Tags
Delete a single data tag.
Deletes a data tag from a category.
DLP Data Tags
Retrieve all data tags in a data tag category
Lists data tags in a category.
DLP Data Tags
Retrieve a specific data tag.
Gets a data tag from a category.
DLP Data Tags
Update the attributes of a single data tag.
Updates a data tag in a category.
DLP Data Tags
Create a new dataset
Creates a new DLP (Data Loss Prevention) dataset for storing custom detection patterns. Datasets can contain exact match data, word lists, or EDM (Exact Data Match) configurations.
DLP Datasets
Prepare to upload a new version of a dataset
Creates a new version of a DLP dataset, allowing you to stage changes before activation. Used for single-column EDM and custom word lists.
DLP Datasets
Sets the column information for a multi-column upload
This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. The columns in the response appear in the same order as in the request.
DLP Datasets
Delete a dataset
This deletes all versions of the dataset.
DLP Datasets
Fetch a specific dataset
Gets a dataset and its latest upload status.
DLP Datasets
Fetch all datasets
Lists all DLP datasets configured for the account, including custom word lists and EDM datasets.
DLP Datasets
Update details about a dataset
Updates the configuration of an existing DLP dataset, such as its name, description, or detection settings.
DLP Datasets
Upload a new version of a multi-column dataset
This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard.
DLP Datasets
Upload a new version of a dataset
This is used for single-column EDMv1 and Custom Word Lists. The EDM format can only be created in the Cloudflare dashboard. For other clients, this operation can only be used for non-secret Custom Word Lists. The body must be a UTF-8 encoded, newline (NL or CRNL) separated list of words to be matched.
DLP Datasets
Creates a new document fingerprint.
Creates a new document fingerprint for DLP scanning. Document fingerprints detect documents that are structurally similar to the uploaded sample.
DLP Document Fingerprints
Delete a single document fingerprint.
Removes a document fingerprint from DLP configuration. Documents matching this fingerprint will no longer be detected.
DLP Document Fingerprints
Retrieve data about a specific document fingerprint.
Gets a document fingerprint and its latest upload status.
DLP Document Fingerprints
Retrieve data about all document fingerprints.
Lists all document fingerprints configured for DLP scanning in the account.
DLP Document Fingerprints
Update the attributes of a single document fingerprint.
Updates metadata for an existing document fingerprint, such as its name or description.
DLP Document Fingerprints
Uploads a new version for a document fingerprint.
Uploads a new document to create or update a fingerprint. The document structure is analyzed to enable detection of similar documents.
DLP Document Fingerprints
Create mapping
Creates a mapping between a Cloudflare account and an email provider for DLP email scanning integration.
DLP Email
Create email scanner rule
Creates a new DLP email scanning rule that defines what content patterns to detect in email messages and what actions to take.
DLP Email
Delete email scanner rule
Removes a DLP email scanning rule. The rule will no longer be applied to email messages.
DLP Email
Get mapping
Retrieves the email provider mapping configuration for DLP email scanning.
DLP Email
Get an email scanner rule
Gets detailed configuration for a specific DLP email scanning rule, including detection patterns and actions.
DLP Email
List all email scanner rules
Lists all email scanner rules for an account.
DLP Email
Update email scanner rule
Updates a DLP email scanning rule.
DLP Email
Update email scanner rule priorities
Reorders DLP email scanning rules by updating their priority values. Higher priority rules are evaluated first.
DLP Email
Create custom entry
Creates a DLP custom entry.
DLP Entries
Create integration entry
Integration entries can't be created, this will update an existing integration entry. This is needed for our generated terraform API.
DLP Integration Entries
Create predefined entry
Predefined entries can't be created, this will update an existing predefined entry. This is needed for our generated terraform API.
DLP Predefined Entries
Delete custom entry
Deletes a DLP custom entry.
DLP Entries
Delete integration entry
This is a no-op as integration entires can't be deleted but is needed for our generated terraform API.
DLP Integration Entries
Delete predefined entry
This is a no-op as predefined entires can't be deleted but is needed for our generated terraform API.
DLP Predefined Entries
Get DLP Entry
Fetches a DLP entry by ID.
DLP Entries
List all entries
Lists all DLP entries in an account.
DLP Entries
Update custom entry
Updates a DLP custom entry.
DLP Entries
Update entry
Updates a DLP entry.
DLP Entries
Update integration entry
Updates a DLP entry.
DLP Integration Entries
Update predefined entry
Updates a DLP entry.
DLP Entries
Fetch limits associated with DLP for account
Retrieves current DLP usage limits and quotas for the account, including maximum allowed counts and current usage for custom entries, dataset cells, and document fingerprints.
DLP Settings
Validate a DLP regex pattern
Validates whether this pattern is a valid regular expression. Rejects it if the regular expression is too complex or can match an unbounded-length string. The regex will be rejected if it uses `*` or `+`. Bound the maximum number of characters that can be matched using a range, e.g. `{1,100}`.
DLP Settings
Get payload log settings
Gets the current payload logging configuration for DLP, showing whether matched content is being logged.
DLP Settings
Set payload log settings
Enables or disables payload logging for DLP matches. When enabled, matched content is stored for review.
DLP Settings
Create custom profile
Creates a DLP custom profile.
DLP Profiles
Create predefined profile
Creates a DLP predefined profile. Only supports enabling/disabling entries.
DLP Profiles
Create predefined profile
This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Creates a DLP predefined profile. Only supports enabling/disabling entries.
DLP Profiles
Delete custom profile
Deletes a DLP custom profile.
DLP Profiles
Delete predefined profile
This is a no-op as predefined profiles can't be deleted but is needed for our generated terraform API.
DLP Profiles
Get custom profile
Fetches a custom DLP profile by id.
DLP Profiles
Get DLP Profile
Fetches a DLP profile by ID.
DLP Profiles
Get predefined profile
Fetches a predefined DLP profile by id.
DLP Profiles
Get predefined profile config
This is similar to `get_predefined` but only returns entries that are enabled. This is needed for our terraform API Fetches a predefined DLP profile by id.
DLP Profiles
List all custom profiles
Lists all DLP custom profiles in an account.
DLP Profiles
List all profiles
Lists all DLP profiles in an account.
DLP Profiles
Update custom profile
Updates a DLP custom profile.
DLP Profiles
Update predefined profile
Updates a DLP predefined profile. Only supports enabling/disabling entries.
DLP Profiles
Update predefined profile config
This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Updates a DLP predefined profile. Only supports enabling/disabling entries.
DLP Profiles
Get all behaviors and associated configuration
Retrieves configured risk score behaviors that define how user actions affect their overall risk score.
Zero Trust Risk Scoring
Update configuration for risk behaviors
Updates risk score behavior configurations, defining weights and thresholds for risk calculation.
Zero Trust Risk Scoring
Clear the risk score for a particular user
Resets risk scores for specified users, clearing their accumulated risk history.
Zero Trust Risk Scoring
Get risk score info for all users in the account
Gets an aggregate summary of risk scores across the account, including distribution and trends.
Zero Trust Risk Scoring
Get risk event/score information for a specific user
Retrieves the detailed risk score breakdown for a specific user, including contributing factors.
Zero Trust Risk Scoring
Retrieve a specific sensitivity group template.
Gets an available sensitivity group template.
DLP Sensitivity Group Templates
Retrieve all sensitivity group templates in an account
Lists available sensitivity group templates.
DLP Sensitivity Group Templates
Creates a new sensitivity group.
Creates a sensitivity group, optionally from a template.
DLP Sensitivity Groups
Delete a single sensitivity group.
Deletes a sensitivity group and its levels.
DLP Sensitivity Groups
Retrieve the ordered list of level IDs for a sensitivity group.
Gets the current order of sensitivity levels in a group.
DLP Sensitivity Groups
Retrieve all sensitivity groups in an account
Lists sensitivity groups configured for the account.
DLP Sensitivity Groups
Set the ordering of levels within a sensitivity group.
Updates the order of sensitivity levels in a group.
DLP Sensitivity Groups
Retrieve a specific sensitivity group.
Gets a sensitivity group and its levels.
DLP Sensitivity Groups
Update the attributes of a single sensitivity group.
Updates a sensitivity group and its levels.
DLP Sensitivity Groups
Creates a new sensitivity level.
Creates a sensitivity level in a group.
DLP Sensitivity Levels
Delete a single sensitivity level.
Deletes a sensitivity level from a group.
DLP Sensitivity Levels
Retrieve all sensitivity levels in a sensitivity group
Lists sensitivity levels in a sensitivity group.
DLP Sensitivity Levels
Retrieve a specific sensitivity level.
Gets a sensitivity level from a group.
DLP Sensitivity Levels
Update the attributes of a single sensitivity level.
Updates a sensitivity level in a group.
DLP Sensitivity Levels
Delete (reset) DLP account-level settings to initial values.
Deletes account-level DLP settings and returns the initial values.
DLP Settings
Partially update DLP account-level settings.
Missing fields keep their existing values.
DLP Settings
Get DLP account-level settings.
Gets the account-level DLP settings.
DLP Settings
Update DLP account-level settings (full replacement).
Missing fields are reset to initial (unconfigured) values.
DLP Settings
Create new risk score integration.
Creates a new Zero Trust risk score integration, connecting external risk signals to Cloudflare's risk scoring system.
Zero Trust Risk Scoring Integrations
Delete a risk score integration.
Removes a Zero Trust risk score integration, disconnecting the external risk signal source.
Zero Trust Risk Scoring Integrations
Get risk score integration by id.
Gets a Zero Trust risk score integration by ID.
Zero Trust Risk Scoring Integrations
Get risk score integration by reference id.
Retrieves a Zero Trust risk score integration using its external reference ID.
Zero Trust Risk Scoring Integrations
List all risk score integrations for the account.
Lists all configured Zero Trust risk score integrations for the account.
Zero Trust Risk Scoring Integrations
Update a risk score integration.
Overwrite the reference_id, tenant_url, and active values with the ones provided.
Zero Trust Risk Scoring Integrations
List Regions
List all Regional Services regions available for use by this account.
DLS Regional Services
Create Regional Hostname
Create a new Regional Hostname entry. Cloudflare will only use data centers that are physically located within the chosen region to decrypt and service HTTPS traffic. Learn more about [Regional Services](https://developers.cloudflare.com/data-localization/regional-services/get-started/).
DLS Regional Services
Delete Regional Hostname
Delete the region configuration for a specific Regional Hostname.
DLS Regional Services
Fetch Regional Hostname
Fetch the configuration for a specific Regional Hostname, within a zone.
DLS Regional Services
List Regional Hostnames
List all Regional Hostnames within a zone.
DLS Regional Services
Update Regional Hostname
Update the configuration for a specific Regional Hostname. Only the region_key of a hostname is mutable.
DLS Regional Services
By Time
Retrieves a list of aggregate metrics grouped by time interval. See [Analytics API properties](https://developers.cloudflare.com/dns/reference/analytics-api-properties/) for detailed information about the available query parameters.
DNS Analytics
Table
Retrieves a list of summarised aggregate metrics over a given time period. See [Analytics API properties](https://developers.cloudflare.com/dns/reference/analytics-api-properties/) for detailed information about the available query parameters.
DNS Analytics
By Time
Retrieves a list of aggregate metrics grouped by time interval. See [Analytics API properties](https://developers.cloudflare.com/dns/reference/analytics-api-properties/) for detailed information about the available query parameters.
DNS Firewall Analytics
Table
Retrieves a list of summarised aggregate metrics over a given time period. See [Analytics API properties](https://developers.cloudflare.com/dns/reference/analytics-api-properties/) for detailed information about the available query parameters.
DNS Firewall Analytics
Create DNS Firewall Cluster
Create a DNS Firewall cluster
DNS Firewall
Delete DNS Firewall Cluster
Delete a DNS Firewall cluster
DNS Firewall
DNS Firewall Cluster Details
Show a single DNS Firewall cluster for an account
DNS Firewall
List DNS Firewall Clusters
List DNS Firewall clusters for an account
DNS Firewall
Show DNS Firewall Cluster Reverse DNS
Show reverse DNS configuration (PTR records) for a DNS Firewall cluster
DNS Firewall
Update DNS Firewall Cluster
Modify the configuration of a DNS Firewall cluster
DNS Firewall
Update DNS Firewall Cluster Reverse DNS
Update reverse DNS configuration (PTR records) for a DNS Firewall cluster
DNS Firewall
Review Scanned DNS Records
Accept or reject DNS records found by the DNS records scan. Accepted records will be permanently added to the zone, while rejected records will be permanently deleted.
DNS Records for a Zone
Batch DNS Records
Send a Batch of DNS Record API calls to be executed together. Notes: - Although Cloudflare will execute the batched operations in a single database transaction, Cloudflare's distributed KV store must treat each record change as a single key-value pair. This means that the propagation of changes is not atomic. See [the documentation](https://developers.cloudflare.com/dns/manage-dns-records/how-to/batch-record-changes/ "Batch DNS records") for more information. - The operations you specify within the /batch request body are always executed in the following order: - Deletes - Patches - Puts - Posts
DNS Records for a Zone
Create DNS Record
Create a new DNS record for a zone. Notes: - A/AAAA records cannot exist on the same name as CNAME records. - NS records cannot exist on the same name as any other record type. - Domain names are always represented in Punycode, even if Unicode characters were used when creating the record.
DNS Records for a Zone
Delete DNS Record
Permanently removes a DNS record from the zone.
DNS Records for a Zone
DNS Record Details
Retrieves details for a specific DNS record in the zone.
DNS Records for a Zone
Export DNS Records
You can export your [BIND config](https://en.wikipedia.org/wiki/Zone_file "Zone file") through this endpoint. See [the documentation](https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/ "Import and export records") for more information.
DNS Records for a Zone
Get DNS Record Usage
Get the current DNS record usage for a zone, including the number of records and the quota limit.
DNS Records for a Zone
Import DNS Records
You can upload your [BIND config](https://en.wikipedia.org/wiki/Zone_file "Zone file") through this endpoint. It assumes that cURL is called from a location with bind_config.txt (valid BIND config) present. See [the documentation](https://developers.cloudflare.com/dns/manage-dns-records/how-to/import-and-export/ "Import and export records") for more information.
DNS Records for a Zone
List DNS Records
List, search, sort, and filter a zones' DNS records.
DNS Records for a Zone
Update DNS Record
Update an existing DNS record. Notes: - A/AAAA records cannot exist on the same name as CNAME records. - NS records cannot exist on the same name as any other record type. - Domain names are always represented in Punycode, even if Unicode characters were used when creating the record.
DNS Records for a Zone
List Scanned DNS Records
Retrieves the list of DNS records discovered up to this point by the asynchronous scan. These records are temporary until explicitly accepted or rejected via `POST /scan/review`. Additional records may be discovered by the scan later.
DNS Records for a Zone
Scan DNS Records
Scan for common DNS records on your domain and automatically add them to your zone. Useful if you haven't updated your nameservers yet.
DNS Records for a Zone
Trigger DNS Record Scan
Initiates an asynchronous scan for common DNS records on your domain. Note that this **does not** automatically add records to your zone. The scan runs in the background, and results can be reviewed later using the `/scan/review` endpoints. Useful if you haven't updated your nameservers yet.
DNS Records for a Zone
Overwrite DNS Record
Overwrite an existing DNS record. Notes: - A/AAAA records cannot exist on the same name as CNAME records. - NS records cannot exist on the same name as any other record type. - Domain names are always represented in Punycode, even if Unicode characters were used when creating the record.
DNS Records for a Zone
Get DNS Record Usage for Account
Get the current DNS record usage and quota for an account. May include internal DNS usage and quota.
DNS Records for an Account
Show DNS Settings
Show DNS settings for a zone
DNS Settings for a Zone
Update DNS Settings
Update DNS settings for a zone
DNS Settings for a Zone
Show DNS Settings
Show DNS settings for an account
DNS Settings for an Account
Update DNS Settings
Update DNS settings for an account
DNS Settings for an Account
Create Internal DNS View
Create Internal DNS View for an account
DNS Internal Views for an Account
Delete Internal DNS View
Delete an existing Internal DNS View
DNS Internal Views for an Account
DNS Internal View Details
Get DNS Internal View
DNS Internal Views for an Account
List Internal DNS Views
List DNS Internal Views for an Account
DNS Internal Views for an Account
Update Internal DNS View
Update an existing Internal DNS View
DNS Internal Views for an Account
Delete DNSSEC records
Delete DNSSEC.
DNSSEC
DNSSEC Details
Details about DNSSEC status and configuration.
DNSSEC
Edit DNSSEC Status
Enable or disable DNSSEC.
DNSSEC
List DNSSEC ZSKs
List the Zone Signing Keys (ZSKs) that DNSSEC uses for the zone.
DNSSEC
Get Domain History
Gets historical security threat and content categories currently and previously assigned to a domain.
Domain History
Get Domain Details
Gets security details and statistics about a domain.
Domain Intelligence
Get Multiple Domain Details
Returns security details and statistics about multiple domains in a single request. **Behavior change — domain ranking is becoming opt-in.** This endpoint previously included domain ranking data in every response and accepted a `skip_ranking=true` query parameter to opt out. That parameter is being deprecated and ranking will no longer be returned by default. Callers that want ranking data must pass `include_ranking=true`. The `skip_ranking` parameter will be silently ignored once the change ships.
Domain Intelligence
List Namespaces
Returns the Durable Object namespaces owned by an account.
Durable Objects Namespace
List Objects
Returns the Durable Objects in a given namespace.
Durable Objects Namespace
Edit additional audio tracks on a video
Edits additional audio tracks on a video. Editing the default status of an audio track to `true` will mark all other audio tracks on the video default status to `false`.
Stream Audio Tracks
Edit Credential
Updates a credential with only the provided fields; omitted fields remain unchanged.
Credentials
Edit Credential Set
Updates a credential set with only the provided fields; omitted fields remain unchanged.
Credential Sets
Edit a participant's detail
Updates a participant's details for the given meeting and participant ID.
Meetings
Edit Target Environment
Updates a target environment with only the provided fields; omitted fields remain unchanged.
Target Environments
Edit a webhook
Edits the webhook details for the given webhook ID.
Webhooks
Edit Worker
Perform a partial update on a Worker, where omitted properties are left unchanged from their current values.
Workers
Create a destination address
Create a destination address to forward your emails to. Destination addresses need to be verified before they can be used.
Email Routing destination addresses
Delete destination address
Deletes a specific destination address.
Email Routing destination addresses
Get a destination address
Gets information for a specific destination email already created.
Email Routing destination addresses
List destination addresses
Lists existing destination addresses.
Email Routing destination addresses
Update destination address
Updates the status of a specific destination address.
Email Routing destination addresses
Create routing rule
Rules consist of a set of criteria for matching emails (such as an email being sent to a specific custom email address) plus a set of actions to take on the email (like forwarding it to a specific destination address). Forward actions require exactly one verified destination address.
Email Routing routing rules
Delete routing rule
Delete a specific routing rule.
Email Routing routing rules
Get catch-all rule
Get information on the default catch-all routing rule.
Email Routing routing rules
Get routing rule
Get information for a specific routing rule already created.
Email Routing routing rules
List account routing rules
Lists existing routing rules across all zones in the account.
Email Routing routing rules
List routing rules
Lists existing routing rules.
Email Routing routing rules
Plan account routing rule changes
Computes the Email Routing rule changes that would be needed to reconcile a Wrangler-managed desired ruleset. This endpoint is read-only and does not create, update, or delete rules.
Email Routing routing rules
Update catch-all rule
Enable or disable catch-all routing rule, or change action to forward to a specific destination address. Forward actions require exactly one verified destination address.
Email Routing routing rules
Update routing rule
Update actions and matches, or enable/disable specific routing rules. Forward actions require exactly one verified destination address.
Email Routing routing rules
Disable Email Routing
Disable your Email Routing zone. Also removes additional MX records previously required for Email Routing to work.
Email Routing settings
Disable Email Routing
Disable your Email Routing zone. Also removes additional MX records previously required for Email Routing to work.
Email Routing settings
Email Routing - DNS settings
Show the DNS records needed to configure your Email Routing zone.
Email Routing settings
Enable Email Routing
Enable you Email Routing zone. Add and lock the necessary MX and SPF records.
Email Routing settings
Enable Email Routing
Enable you Email Routing zone. Add and lock the necessary MX and SPF records.
Email Routing settings
Get Email Routing settings
Get information about the settings for your Email Routing zone.
Email Routing settings
Update Email Routing settings
Update the settings for your Email Routing zone.
Email Routing settings
Unlock Email Routing
Unlock MX records previously locked by Email Routing. Deprecated - use PATCH /zones/{zone_id}/email/routing/dns instead.
Email Routing settings
Unlock Email Routing
Unlock MX Records previously locked by Email Routing.
Email Routing settings
Update Email Routing settings
Update the settings for your Email Routing zone.
Email Routing settings
Batch allow policies operations
Executes multiple operations atomically. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations.
Email Security Settings
Batch blocked senders operations
Executes multiple operations atomically. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations.
Email Security Settings
Batch domain operations
Executes multiple domain operations in a single request. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations.
Email Security Settings
Batch sending domain restrictions operations
Executes multiple delete operations on sending domain restrictions atomically. All operations succeed or fail together as a transaction. Currently only supports batch deletion. Removes TLS enforcement requirements for the specified domains.
Email Security Settings
Batch trusted domains operations
Executes multiple operations atomically. All four operation arrays (deletes, patches, puts, posts) are required and executed in order. Send empty arrays for unused operations.
Email Security Settings
Batch URL ignore patterns
Sends a batch of URL ignore patterns API calls to execute together.
Email Security Settings
Cancel a bulk action job
Cancels the job, marking it as cancelled and stopping any pending message processing. The job record remains visible in list and detail endpoints.
Email Security
Create email allow policy
Creates a new allow policy that exempts matching emails from security detections. Use with caution as this bypasses email security scanning. Policies can match on sender patterns and apply to specific detections or all detections.
Email Security Settings
Create blocked email sender
Creates a new blocked sender pattern. Emails matching this pattern will be blocked from delivery. Patterns can be email addresses, domains, or IP addresses, and support regular expressions.
Email Security Settings
Create a bulk action job
Creates a new bulk action job to move or release messages that match the provided search parameters.
Email Security
Add a new email domain
Protects a new email domain by adding it to Email Security. Accepts a flat configuration object covering all delivery modes. Returns the newly created domain configuration.
Email Security Settings
Create impersonation registry entry
Creates a new entry in the impersonation registry to protect against impersonation. Emails attempting to impersonate this identity will be flagged. Supports regex patterns for flexible email matching.
Email Security Settings
Create a sending domain restriction
Creates a new sending domain restriction to enforce TLS requirements for a domain. Emails without TLS from this domain will be dropped unless the subdomain is in the exclude list.
Email Security Settings
Create trusted email domain
Creates a new trusted domain pattern. Use for partner domains or approved senders that should bypass recent domain registration and similarity checks. Configure whether it prevents recent domain or spoof dispositions.
Email Security Settings
Create a URL ignore pattern
Creates a new URL rewrite ignore pattern. URLs matching this pattern will not be rewritten.
Email Security Settings
Delete an email allow policy
Removes an allow policy. After deletion, emails matching this pattern will be subject to normal security scanning and disposition actions.
Email Security Settings
Delete a blocked email sender
Removes a blocked sender pattern. After deletion, emails from this sender will no longer be automatically blocked based on this rule.
Email Security Settings
Delete a bulk action job
Deletes the job, removing it from all list and detail endpoints. Only jobs in a terminal state (`COMPLETED`, `CANCELLED`, `FAILED`, or `SKIPPED`) can be deleted. To stop an in-progress job without removing it, use the cancel endpoint instead.
Email Security
Unprotect an email domain
Removes email security protection from a domain. After deletion, emails for this domain will no longer be processed by Email Security. This action cannot be undone.
Email Security Settings
Unprotect multiple email domains
Removes protection from multiple email domains. Deprecated; use the batch endpoint instead.
Email Security Settings
Delete an impersonation registry entry
Removes an entry from the impersonation registry. After deletion, this identity will no longer be protected from impersonation.
Email Security Settings
Delete a sending domain restriction
Removes a sending domain restriction. After deletion, TLS will no longer be enforced for emails from this domain.
Email Security Settings
Delete a trusted email domain
Removes a trusted domain pattern. After deletion, emails from this domain will be subject to normal recent domain and similarity checks.
Email Security Settings
Delete a URL ignore pattern
Removes a URL rewrite ignore pattern. After deletion, URLs matching this pattern will be rewritten again.
Email Security Settings
Get an email allow policy
Retrieves details for a specific allow policy including its pattern, dispositions that are exempted, and whether it applies to all detections.
Email Security Settings
Get a blocked email sender
Retrieves details for a specific blocked sender pattern including its pattern type, value, and metadata.
Email Security Settings
Get bulk action job details
Returns the status and details of a specific bulk action job.
Email Security
List messages for a bulk action job
Returns the individual messages associated with a bulk action job, including their processing status.
Email Security
List bulk action jobs
Returns a paginated list of bulk action jobs for the account.
Email Security
Get an email domain
Retrieves detailed information for a specific protected email domain including its delivery configuration, SPF/DMARC status, and authorization state.
Email Security Settings
Get domain verification details
Returns DNS TXT verification details for a domain created through the Terraform API. Returns `200 OK` with the TXT record name and value when the domain uses `dns_txt` verification. Returns `204 No Content` for pre-existing domains or domains verified by other means (Cloudflare zone ownership, CASB integration).
Email Security Settings
Get an impersonation registry entry
Retrieves details for a specific impersonation registry entry including the protected identity, email pattern, and synchronization source if directory-synced.
Email Security Settings
Get message details
Retrieves comprehensive details for a specific email message including headers, recipients, sender information, and current quarantine status. Use the investigate_id from search results to fetch detailed information.
Email Security
Get action log for a message
Returns the list of post-delivery actions (moves, quarantine releases, previews, etc.) that have been applied to a specific email message.
Email Security
Get message detection details
Returns detection details such as threat categories and sender information for non-benign messages.
Email Security
Get email preview
Returns a preview of the message body as a base64 encoded PNG image for non-benign messages.
Email Security
Get raw email content
Returns the raw eml of any non-benign message.
Email Security
Get email trace
Retrieves delivery and processing trace information for an email message. Shows the delivery path, retraction history, and move operations performed on the message. Useful for debugging delivery issues.
Email Security
Get PhishGuard reports
Retrieves PhishGuard security alert reports for a specified date range. Reports include detected threats, dispositions, and contextual information. Use for security monitoring and threat analysis.
Email Security
Get a sending domain restriction
Retrieves details for a specific sending domain restriction including the domain requiring TLS and any excluded subdomains exempt from the TLS requirement.
Email Security Settings
Get a trusted email domain
Retrieves details for a specific trusted domain pattern including its pattern value, whether it uses regex matching, and which detection types it affects.
Email Security Settings
Get a URL ignore pattern
Returns a single URL rewrite ignore pattern by its identifier.
Email Security Settings
Search email messages
Returns information for each email that matches the search parameter(s).
Email Security
List email allow policies
Returns a paginated list of email allow policies. These policies exempt matching emails from security detection, allowing them to bypass disposition actions. Supports filtering by pattern type and policy attributes.
Email Security Settings
List blocked email senders
Returns a paginated list of blocked email sender patterns. These patterns prevent emails from matching senders from being delivered. Supports filtering by pattern type and searching across patterns.
Email Security Settings
List protected email domains
Returns a paginated list of email domains protected by Email Security. Includes domain configuration, delivery modes, and authorization status. Supports filtering by delivery mode and integration ID.
Email Security Settings
List entries in impersonation registry
Returns a paginated list of protected identities in the impersonation registry. These entries define identities and email addresses to protect from impersonation attacks. Can be manually added or automatically synced from directory integrations.
Email Security Settings
List sending domain restrictions
Returns a paginated list of sending domain restrictions. These restrictions enforce TLS requirements for emails from specific domains. Mail without TLS from restricted domains will be dropped unless the subdomain is in the exclude list. Supports sorting and searching.
Email Security Settings
List trusted email domains
Returns a paginated list of trusted domain patterns. Trusted domains prevent false positives for recently registered domains and lookalike domain detections. Patterns can use regular expressions for flexible matching.
Email Security Settings
List URL ignore patterns
Returns a paginated list of URL rewrite ignore patterns for the account. URLs matching these patterns will not be rewritten.
Email Security Settings
Move multiple messages
Moves multiple messages to a specified mailbox folder (Inbox, JunkEmail, DeletedItems, RecoverableItemsDeletions, or RecoverableItemsPurges). Requires active integration.
Email Security
Move a message
Moves a single message to a specified mailbox folder (Inbox, JunkEmail, DeletedItems, RecoverableItemsDeletions, or RecoverableItemsPurges). Requires active integration.
Email Security
Preview for non-detection messages
Generates a preview image for a message that was not flagged as a detection. Useful for investigating benign messages. Returns a base64-encoded PNG screenshot of the email body.
Email Security
Change email classification
Submits a request to reclassify an email's disposition. Use for reporting false positives or false negatives. Optionally provide the raw EML content for reanalysis. The reclassification is processed asynchronously.
Email Security
Release messages from quarantine
Delivers one or more quarantined messages to their intended recipients, for cases where a message was incorrectly quarantined. The response includes delivery status for each recipient.
Email Security
Replace an email domain
Replaces all mutable fields of a protected email domain in a single atomic operation. Unlike PATCH, all non-computed fields are required.
Email Security Settings
Get reclassify submissions
Returns information for submissions made to reclassify emails. Shows the status, outcome, and disposition changes for reclassification requests made by users or the security team. Useful for tracking false positive/negative reports.
Email Security
Update an email allow policy
Updates an existing allow policy. Only provided fields will be modified. Changes take effect for new emails matching the pattern.
Email Security Settings
Update a blocked email sender
Updates an existing blocked sender pattern. Only provided fields will be modified. The pattern will continue blocking emails until deleted.
Email Security Settings
Update an email domain
Updates configuration for a protected email domain. Only provided fields will be modified. Changes affect delivery mode, security settings, and regional processing.
Email Security Settings
Update an impersonation registry entry
Updates an existing impersonation registry entry. Only provided fields will be modified. Directory-synced entries can't be updated.
Email Security Settings
Update a sending domain restriction
Updates an existing sending domain restriction. Only provided fields will be modified. Changes affect which domains require TLS and which subdomains are excluded.
Email Security Settings
Update a trusted email domain
Updates an existing trusted domain pattern. Only provided fields will be modified. Changes take effect for new emails matching the pattern.
Email Security Settings
Update a URL ignore pattern
Updates an existing URL rewrite ignore pattern. Only provided fields will be modified.
Email Security Settings
Send an email
Send an email for the specified account using the structured builder. Provide the sender, recipients, subject, and at least one of text or html; attachments are optional.
Email Sending
Send a raw MIME email
Send a raw RFC 5322 (MIME) email for the specified account. Provide the full MIME message plus the SMTP envelope (from and recipients).
Email Sending
Fetch an email message
Returns the raw RFC 5322 MIME message for the given account and message id.
Email Sending
Get sending limits
Returns the current daily sending quota for the account and, when a quota is resolved, the account's current usage against it. Quota is null when not yet available; usage is null when there is no resolved quota or usage is temporarily unavailable.
Email Sending
Create a sending subdomain
Creates a new sending subdomain or re-enables sending on an existing subdomain that had it disabled. If zone-level Email Sending has not been enabled yet, the zone flag is automatically set when the entitlement is present.
Email Sending subdomains
Delete a sending subdomain
Disables sending on a subdomain and removes its DNS records. If routing is still active on the subdomain, only sending is disabled.
Email Sending subdomains
Fix sending subdomain DNS records
Idempotently re-applies the sending DNS records (creates missing records, re-applies the email_routing lock on records whose lock has been cleared). Refuses with a 409 if foreign MX, multiple SPF, multiple DMARC, or multiple DKIM records exist at the relevant DNS names — those require manual cleanup.
Email Sending subdomains
Get a sending subdomain
Gets information for a specific sending subdomain.
Email Sending subdomains
Get sending subdomain DNS records
Returns the expected DNS records for a sending subdomain.
Email Sending subdomains
Get sending subdomain DNS status
Returns the desired DNS records for a sending subdomain along with a live diff against actual DNS state. Use this to detect missing, unlocked, foreign, or multi-record conflicts before deciding whether to call the fix endpoint.
Email Sending subdomains
List sending subdomains
Lists all sending-enabled subdomains for the zone.
Email Sending subdomains
Preview sending subdomain DNS
Returns the DNS records that would be created for a sending subdomain, flags which records are missing, and reports any conflicts with existing DNS records. This is a read-only dry-run — no records are created or modified. Use before or after creating a subdomain to check DNS status.
Email Sending subdomains
Update a sending subdomain
Updates the activity-log preview preference for a sending subdomain.
Email Sending subdomains
Enable R2 bucket as a catalog
Enable an R2 bucket as an Apache Iceberg catalog. This operation creates the necessary catalog infrastructure and activates the bucket for storing Iceberg metadata and data files.
R2 Catalog Management
Test an existing webhook configuration
Sends a test webhook event using an existing webhook configuration. This allows customers to verify their webhook endpoint is still reachable and properly configured after creating the webhook resource. The test payload includes: - event_type: "webhook.test" - timestamp: Current UTC timestamp - message: Test message indicating this is from Cloudflare CASB - data: Object with test: true
webhooks
Test a webhook configuration before creating it
Sends a test webhook event to the specified destination URL to verify the webhook endpoint is reachable and properly configured. This allows customers to validate their webhook configuration before creating the actual webhook resource. The test payload includes: - event_type: "webhook.test" - timestamp: Current UTC timestamp - message: Test message indicating this is from Cloudflare CASB - data: Object with test: true
webhooks
Fetch all livestreams
Returns details of livestreams associated with the given App ID. It includes livestreams created by your App and RealtimeKit meetings that are livestreamed by your App. If you only want details of livestreams created by your App and not RealtimeKit meetings, you can use the `exclude_meetings` query parameter.
Live streams
Create filters
Creates one or more filters.
Filters
Delete a filter
Deletes an existing filter.
Filters
Delete filters
Deletes one or more existing filters.
Filters
Get a filter
Fetches the details of a filter.
Filters
List filters
Fetches filters in a zone. You can filter the results using several optional parameters.
Filters
Update a filter
Updates an existing filter.
Filters
Update filters
Updates one or more existing filters.
Filters
Create firewall rules
Create one or more firewall rules.
Firewall rules
Delete a firewall rule
Deletes an existing firewall rule.
Firewall rules
Delete firewall rules
Deletes existing firewall rules.
Firewall rules
Get a firewall rule
Fetches the details of a firewall rule.
Firewall rules
List firewall rules
Fetches firewall rules in a zone. You can filter the results using several optional parameters.
Firewall rules
Update a firewall rule
Updates an existing firewall rule.
Firewall rules
Update firewall rules
Updates one or more existing firewall rules.
Firewall rules
Update priority of a firewall rule
Updates the priority of an existing firewall rule.
Firewall rules
Update priority of firewall rules
Updates the priority of existing firewall rules.
Firewall rules
Create app
Creates an app. The returned `id` is used in all subsequent flag, changelog, and evaluation requests.
Apps
Create flag
Creates a flag. Returns 409 if the key already exists. `type` is inferred from variation values and may be omitted.
Flags
Delete app
Deletes an app and all its flags and changelog history. Returns 409 if any Worker still references this app via a Flagship binding.
Apps
Delete flag
Deletes a flag permanently. Subsequent evaluations fall back to the caller-supplied default. Cannot be undone.
Flags
Evaluate flag
Evaluates a flag against the provided context. Pass context attributes as query parameters; values are forwarded as strings. For low-latency in-Worker evaluation, prefer the Flagship binding over this endpoint.
Evaluation
Evaluate flag (POST)
Evaluates a flag against the provided context, passed as a JSON request body (OFREP-shaped) rather than query parameters. Returns the same response shape as the GET variant.
Evaluation
Get app
Returns an app's name and audit fields. Flag definitions are not included.
Apps
Get flag
Returns the full flag definition including rules, variations, and audit fields.
Flags
Get flag changelog
Returns the audit history for a flag, newest first. Each entry includes the event type and full flag state after the change; `update` entries include a field-level diff. Capped at 200 entries per flag.
Changelog
List apps
Lists all apps in the account. Returns identity and audit fields only — flag definitions are not included.
Apps
List flags
Lists an app's flags ordered by key. Pass `cursor` from `result_info` to page forward; a null cursor indicates the last page.
Flags
Update app
Updates an app. Only `name` is mutable.
Apps
Update flag
Replaces the entire flag definition. Omitted fields are dropped, not preserved — read before writing. Each update appends a changelog entry.
Flags
Get Fraud Detection Settings
Retrieve Fraud Detection settings for a zone.
Fraud Detection
Update Fraud Detection Settings
Update Fraud Detection settings for a zone. Notes on `username_expressions` behavior: - If omitted or set to null, expressions are not modified. - If provided as an empty array `[]`, all expressions will be cleared.
Fraud Detection
Generate a JWT to interact with the specified image registry.
Generates temporary credentials for accessing Cloudflare's container image registry. Used for pulling and pushing container images.
Image Registries
Abuse Report Details
Retrieve the details of an abuse report.
tseng-abuse-complaint-processor_other
Get an account entry point ruleset
Fetches the latest version of the account entry point ruleset for a given phase.
Account Rulesets
Get an account entry point ruleset version
Fetches a specific version of an account entry point ruleset.
Account Rulesets
Get account limits
Retrieve account limits and usage information
Account
Get an account ruleset
Fetches the latest version of an account ruleset.
Account Rulesets
Get an account ruleset version
Fetches a specific version of an account ruleset.
Account Rulesets
Read all alerts on submitted domains
Return all alerts on submitted domains
brand_protection
Read all brands
Return all brands
brand_protection
Read patterns for brands by ID
Return patterns for brands based on ID
brand_protection
Read submitted domains by ID
Return submitted domains based on ID
brand_protection
Read matches for logo queries by ID
Return matches for logo queries based on ID
logo_match
Download matches for logo queries by ID
Return matches as CSV for logo queries based on ID
logo_match
Read all saved logo queries
Return all saved logo queries
logo_match
Read saved logo queries by ID
Return saved logo queries based on ID
logo_match
Read matches for string queries by ID
Return matches for string queries based on ID
domain_search
Download matches for string queries by ID
Return matches as CSV for string queries based on ID
domain_search
Read string queries by ID
Return string queries based on ID
domain_search
Read recent URL submissions
Return recent URL submissions
brand_protection
Read URL submissions by ID
Return URL submissions based on ID
brand_protection
Read the total number of saved string queries
Return the total number of saved string queries
domain_search
Read submitted domains by pattern
Return submitted domains based on pattern
brand_protection
Read submitted URLs by ID
Return submitted URLs based on ID
brand_protection
List fields
Lists all fields available for a dataset. The response result is. an object with key-value pairs, where keys are field names, and values are descriptions.
Logpush jobs for an account
List Logpush jobs for a dataset
Lists Logpush jobs for an account for a dataset.
Logpush jobs for an account
List Logpush jobs
Lists Logpush jobs for an account.
Logpush jobs for an account
Get Logpush job details
Gets the details of a Logpush job.
Logpush jobs for an account
Get CMB config
Gets CMB config.
Logcontrol CMB config for an account
Fetch active recording
Returns the active recording details for the given meeting ID.
Recordings
Fetch details of an active session
Returns details of an ongoing active session for the given meeting ID.
Active session
Fetch all meetings for an App
Returns all meetings for the given App ID.
Meetings
Fetch all recordings for an App
Returns all recordings for an App. If the `meeting_id` parameter is passed, returns all recordings for the given meeting ID.
Recordings
Get all SSO connectors
Lists all SSO connectors configured for the account.
SSO
Fetch all supported webhook events
Returns the list of webhook event names supported by RealtimeKit.
Webhooks
Fetch all webhooks details
Returns details of all webhooks for an App.
Webhooks
Get allowlist prefix.
Get an allowlist prefix specified by the given UUID.
dos-flowtrackd-api_other
Fetch app details
Fetch details for an app in your account.
Apps
Get a single application by id
Returns a single application by id
Applications
Get auth methods
Returns available auth methods for the specified vendor, including credential schema, instructions, and example payloads. Use this to understand what credentials are required before calling POST /v2/integrations.
Applications
Get application
Get application by ID.
Applications
Get application setup flows
Returns all available setup flows for the application, one per auth method.
Applications
Get application details
Returns full application details including auth methods, use cases, and permissions.
Applications
List applications
List applications with different filters.
Applications
Fetch all apps
Fetch all apps for your account
Apps
Lists attackers across multiple datasets
List attacker names referenced in events across one or more datasets.
Attacker
Retrieves a file from Binary Storage
Retrieves a binary file from the Cloudforce One binary storage for analysis.
BinDB
Get build by UUID
Retrieve detailed information about a specific build
Builds
Get build logs
Retrieve logs for a specific build with cursor-based pagination
Builds
Get builds by version IDs
Retrieve builds for specific version IDs
Builds
Get R2 catalog details
Retrieve detailed information about a specific R2 catalog by bucket name. Returns catalog status, maintenance configuration, and credential status.
R2 Catalog Management
List application categories
List application categories.
Category
Get application category
Get application category by ID.
Category
Lists categories across multiple datasets
List categories across one or more datasets for the account.
Category
Lists categories
List all categories stored in the account catalog.
Category
Reads a category
Retrieve a single category by its identifier.
Category
Get information about a CNI object
Get information about a CNI object
CNIs
Export collection to CSV, JSONL, or Markdown
Streams collection data in the requested format. Supports CSV (default), JSONL, or Markdown via Accept header. Queries items in batches of 1000 to avoid memory/timeout limits.
Collections
Get collection
Retrieves a single collection by ID with its schema and metadata
Collections
List collections
Retrieves all collections for an account with pagination
Collections
List account commands
Retrieves a paginated list of commands issued to devices under the specified account, optionally filtered by time range, device, or other parameters
DEX Remote Commands
Download command output file
Downloads artifacts for an executed command. Bulk downloads are not supported
DEX Remote Commands
List devices eligible for remote captures
List devices with WARP client support for remote captures which have been connected in the last 1 hour.
DEX Remote Commands
Returns account commands usage, quota, and reset time
Retrieves the current quota usage and limits for device commands within a specific account, including the time when the quota will reset
DEX Remote Commands
List Scan Configs
List Scan Configs
Scans
Get a container instance
Returns control-plane details for a single container instance and any associated deployment/placement information.
ApplicationsContainer Instances
Retrieves countries information for all countries
Retrieve country code information for all supported countries.
Country
Get Credential
Returns a single credential by ID.
Credentials
Get Credential Set
Returns a single credential set by ID.
Credential Sets
Lists all datasets in an account
List all datasets accessible to the account.
Dataset
Reads a dataset
Retrieve metadata for a specific dataset.
Dataset
List indicators related to a tag within a dataset (deprecated)
This endpoint is deprecated. Use GET /:account_id/events/tags/:tag_uuid/indicators with the optional datasetIds query parameter instead. Returns indicators associated with the provided tag UUID within a single dataset's indicator shards, with pagination.
Tag
Get deploy hook
Get details of a specific deploy hook.
Deploy Hooks
Get deployment group
Fetches a single deployment group by its ID. This endpoint is in Beta.
Deployment Groups
Get device
Fetches a single WARP device.
Physical Devices
Get DEX Rule
Get details for a DEX Rule.
DEX Rules
Get DMARC Report Status
Retrieves the current DMARC report configuration and status for a zone. Returns the RUA prefix, enabled status, approved sources, and DNS records.
Email Auth
Get DNS Protection rule.
Get a DNS Protection rule specified by the given UUID.
dos-flowtrackd-api_other
List saved query matches
Get paginated list of domain matches for one or more brand protection queries. When multiple query_ids are provided (comma-separated), matches are deduplicated across queries and each match includes a match_details array with per-match query metadata and individual dismissed state.
Brand Protection
Aggregate events by single or multiple columns with optional date filtering
Aggregate threat events by one or more columns (e.g., attacker, targetIndustry) with optional date filtering and daily grouping. Supports multi-dimensional aggregation for cross-analysis.
Event
Query graph neighborhood from R2 Data Catalog
Expands the single-level relationship neighborhood of one or more seed nodes (event, indicator, or tag) from R2 Data Catalog. Seeds use compact id format (type:uuid), e.g. "event:550e8400-...". Multi-seed requests merge and deduplicate results server-side. Hydrates neighbor entities with summary data from Durable Objects. Supports filtering by relationship type and dataset scope.
EventsR2 Catalog
Filter and list events
Use `datasetId=all` or `datasetId=*` to query all event datasets for the account (limited to 50). When `datasetId` is unspecified, events are listed from the default Cloudforce One Threat Events dataset. To list existing datasets, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint.
Event
List all saved event queries
Retrieve all saved event queries for the account
Event
Read a saved event query
Retrieve a saved event query by its ID
Event
Reads data for a raw event
Retrieve raw data for a specific event.
Event
Reads raw data for an event by UUID
Retrieves the raw data associated with an event. Searches across all shards in the dataset.
Event
Reads an event
Retrieves a specific event by its UUID.
Event
Reads an event
This Method is deprecated. Please use /events/dataset/:dataset_id/events/:event_id instead.
Event
Filter and list events related to specific event
The `event_id` must be defined (to list existing events (and their IDs), use the [`Filter and List Events`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/list/) endpoint). Also, must provide query parameters.
Event
Get a single export job
Retrieves a single export job by its unique identifier
exports
Get a finding type
Gets a security Finding that has been identified as being problematic.
findings
Get a finding instance using an instance ID
Gets a security Finding instance by id.
findings
Get finding by ID
Retrieve a specific finding type by its unique identifier.
finding_types
Get queries
Get all saved brand protection queries for an account
Brand Protection
Get logo queries
Get all saved brand protection logo queries for an account. Optionally specify id to get a single query. Set download=true to include base64-encoded image data.
Brand Protection
Get the Latest Scan Result
Get the Latest Scan Result
Scans
List groups for an account
List groups for an account
Groups
List group members
List group members
Groups
Read a group for an account
Read a group for an account
Groups
Get Hyperdrive
Returns the specified Hyperdrive configuration.
Hyperdrive
Aggregate indicators by column(s)
Aggregate threat indicators by one or more columns (e.g., indicatorType, value) across datasets. Returns top-N groups ordered by count.
Indicator
Lists indicators across multiple datasets
Retrieves a paginated list of indicators across specified datasets. Use datasetIds=all or datasetIds=* to query all datasets for the account. If no datasetIds provided, uses the default dataset.
Indicator
Lists indicators
This method is deprecated. Please use /events/indicators to retrieve a paginated list of indicators.
Indicator
Reads an indicator
Retrieves a specific indicator by its UUID.
Indicator
List mirrored tags for an indicator dataset
Returns all mirrored tags from the indicator dataset (DO mirror table). No pagination.
Indicator
Lists indicator types across multiple datasets
List indicator types across one or more datasets for the account.
Indicator Types
Get integration details
Returns full integration details including use cases and permissions.
Integrations
Get information about an interconnect object
Get information about an interconnect object
Interconnects
Generate the Letter of Authorization (LOA) for a given interconnect
Generate the Letter of Authorization (LOA) for a given interconnect
Interconnects
Get the current status of an interconnect object
Get the current status of an interconnect object
Interconnects
Get IP profile
Fetches a single WARP Device IP profile.
IP Profiles
Get collection item
Retrieve a single item from a collection by its identifier.
Collections
Query collection items
Retrieves items from a collection with keyset pagination and optional column-based filters
Collections
Get latest builds by script IDs
Retrieve the most recent builds for multiple worker scripts
Builds
Lists all indicator types
This Method is deprecated. Please use /events/dataset/:dataset_id/indicatorTypes instead.
Indicator Types
List example letter templates
List system-provided example templates that can be used as starting points when creating custom templates. These templates cannot be used directly for letter generation.
Brand Protection
Get letter template
Get a specific user-defined takedown letter template by ID. System example templates are available via the /templates/examples endpoint.
Brand Protection
List letter templates
List user-defined takedown letter templates. System example templates are available via the /templates/examples endpoint.
Brand Protection
Run liveness checks
Return a success message after running liveness checks
brand_protection
Fetch complete analytics data for your livestreams
Returns livestream analytics for the specified time range.
Live streamsLivestreamAnalytics
Fetch day-wise analytics data for your livestreams
Returns day-wise livestream analytics for the specified time range.
Live streamsLivestreamAnalytics
List logo matches
Get paginated list of logo matches for a specific brand protection logo query
Brand Protection
Get catalog maintenance configuration
Retrieve the maintenance configuration for a specific catalog, including compaction settings and credential status.
Maintenance Configuration
Fetch a meeting for an App
Returns a meeting details in an App for the given meeting ID.
Meetings
Fetch a participant's detail
Returns a participant details for the given meeting and participant ID.
Meetings
Fetch all participants of a meeting
Returns all participants detail for the given meeting ID.
Meetings
Fetch details of a recording
Returns details of a recording for the given recording ID.
Recordings
Fetch day-wise session and recording analytics data for an App
Returns day-wise session and recording analytics data of an App for the specified time range start_date to end_date. If start_date and end_date are not provided, the default time range is set from 30 days ago to the current date.
AnalyticsOrganizations
Fetch details of peer
Returns participant details for the given peer ID along with call statistics.
Sessions
Fetch details of a participant
Returns details of the given participant ID along with call statistics for the given session ID.
Sessions
List permissions for dataset
List permissions
Permissions
Get prefix.
Get a prefix specified by the given UUID.
dos-flowtrackd-api_other
Fetch all presets
Fetches all the presets belonging to an App.
Presets
Fetch details of a preset
Fetches details of a preset using the provided preset ID
Presets
Get protection status.
Get the protection status of the account.
dos-flowtrackd-api_other
Get feedback emails statistics
Returns the count of feedback emails received for the specified account and date range.
Email Sending feedback
Get account Email Sending suppression
Get account Email Sending suppression
Email Sending suppressions
Get account email suppression
Retrieves a single email suppression for the specified account.
Email Routing suppressions
Get account email suppression
Retrieves a single email suppression for the specified account.
Email Sending suppressions
Get zone email suppression
Retrieves a single email suppression for the specified zone.
Email Routing suppressions
Get zone email suppression
Retrieves a single email suppression for the specified zone.
Email Sending suppressions
List account Email Sending suppressions
List account Email Sending suppressions
Email Sending suppressions
List account email suppressions
Lists email suppressions for the specified account.
Email Routing suppressions
List account email suppressions
Lists email suppressions for the specified account.
Email Sending suppressions
List zone email suppressions
Lists email suppressions for the specified zone.
Email Routing suppressions
List zone email suppressions
Lists email suppressions for the specified zone.
Email Sending suppressions
Run readiness checks
Return a success message after running readiness checks
brand_protection
Get registration
Fetches a single WARP registration.
Registrations
Get override codes
Fetches one-time use admin override codes for a registration. This relies on the **Admin Override** setting being enabled in your device configuration.
warp-teams-device-api_other
List remediation types for a finding type
List all remediation types for a given finding type. This endpoint supports both cursor and offset pagination. Note that `cursor` and `page` are mutually exclusive.
finding_types
Get Scan
Returns a single scan by ID.
Scans
Retrieves Account Audit Log
Lists audit log entries for all Security Center insights in the account, showing changes to insight status and classification.
Security Center Audit Log
Get Recent Account Scans
Returns the most recent on-demand scans for the account, up to a maximum of 5. Each scan includes its ID, start time, and current status. This includes both account-wide and zone-scoped scans. Also returns quota information showing how many scans have been used and how many remain in the current 24-hour window.
Security Center Scans
Retrieves Security Center Insight Context
Returns the full context payload for an insight. This endpoint is used for insights with large payloads that are not included inline in the list response.
Security Center Insights
Retrieves Security Center Insight Counts by Class
Retrieves Security Center insight counts aggregated by classification class.
Security Center Insights
Retrieves Security Center Insight Counts by Severity
Retrieves Security Center insight counts aggregated by severity level (critical, high, medium, low).
Security Center Insights
Retrieves Security Center Insight Counts by Type
Retrieves Security Center insight counts aggregated by insight type.
Security Center Insights
Retrieves Security Center Insights
Lists all Security Center insights for the account, showing security findings and recommendations.
Security Center Insights
Retrieves Issue Audit Log
Lists audit log entries for a specific Security Center insight, showing changes to its status and classification over time.
Security Center Audit Log
Retrieves Security Center Issue Counts by Class
Retrieves Security Center issue counts aggregated by classification class.
Security Center Insights
Retrieves Security Center Issue Counts by Severity
Retrieves Security Center issue counts aggregated by severity level.
Security Center Insights
Retrieves Security Center Issue Counts by Type
Retrieves Security Center issue counts aggregated by issue type.
Security Center Insights
Retrieves Security Center Issues Types
Lists all available issue types in Security Center, describing categories of security issues.
Security Center Insights
Retrieves Security Center Issues
Lists all Security Center issues for the account, showing active security problems requiring attention.
Security Center Insights
Get Recent Zone Scans
Returns the most recent on-demand scans for a specific zone, up to a maximum of 5. Each scan includes its ID, start time, and current status. Results include both zone-specific scans and account-wide scans (which cover all zones). Also returns quota information showing how many scans have been used and how many remain in the current 24-hour window.
Security Center Scans
Retrieves security.txt
Retrieves the current security.txt file configuration for a zone, used for security vulnerability reporting.
security.txt
Fetch all chat messages of a session
Returns a URL to download all chat messages of the session ID in CSV format.
Sessions
Fetch details of a session
Returns data of the given session ID including recording details.
Sessions
Fetch participants list of a session
Returns a list of participants for the given session ID.
Sessions
Fetch summary of transcripts for a session
Returns a Summary URL to download the Summary of Transcripts for the session ID as plain text.
Sessions
Fetch the complete transcript for a session
Returns a URL to download the transcript for the session ID in CSV format.
Sessions
Fetch all sessions of an App
Returns details of all sessions of an App.
Sessions
Get the current settings for the active account
Get the current settings for the active account
Settings
Internal route for testing signed URLs
Internal route for testing signed URLs.
logo_match
Get information about the specified slot
Get information about the specified slot
Slots
Get single SSO connector
Retrieves details for a specific SSO connector.
SSO
Get SYN Protection filter.
Get a SYN Protection filter specified by the given UUID.
dos-flowtrackd-api_other
Get SYN Protection rule.
Get a SYN Protection rule specified by the given UUID.
dos-flowtrackd-api_other
Get table details
Returns full Apache Iceberg metadata for a single table: schema, partition specs, sort orders, properties, and recent snapshot history. Designed for catalog introspection UIs that need per-table details without holding R2 credentials. The `metadata.snapshots`, `metadata.snapshot-log`, and `metadata.metadata-log` arrays are pruned to the most recent 10 entries by `timestamp-ms`. Use `total_snapshots` and `returned_snapshots` to surface the truncation to end users.
Table Management
Get table maintenance configuration
Retrieve the maintenance configuration for a specific table, including compaction settings.
Table Maintenance Configuration
Lists all tag categories (SoT)
Returns all Source-of-Truth tag categories for an account.
TagCategory
List indicators related to a tag
Returns indicators associated with the provided tag UUID, with pagination. By default fans out across every indicator dataset the account can read; pass datasetIds to scope to specific datasets.
Tag
Lists all tags (SoT)
Returns all Source-of-Truth tags for an account. Supports legacy free-text `search` on tag value and `categoryUuid` exact match, plus a structured `filters` JSON array for filtering by metadata fields (originCountryISO, actorCategory, motive, priority, etc.). Country values may be passed as alpha-2, alpha-3, name, or common alias.
Tag
Get takedown letter
Get a specific takedown letter by ID, including the rendered text.
Brand Protection
List takedown letters
List all letters for a specific takedown notice.
Brand Protection
Download takedown letter PDF
Download the PDF for a stored takedown letter. If no PDF exists yet, it is generated from the stored letter text and cached for future downloads.
Brand Protection
Get takedown notice
Get a specific takedown notice by ID.
Brand Protection
List takedown notices
List all takedown notices for the account.
Brand Protection
Get Target Environment
Returns a single target environment by ID.
Target Environments
Lists target industries across multiple datasets
List target industries referenced in events across one or more datasets.
Target Industry
Lists all target industries for a specific dataset
List all target industries referenced in events for a specific dataset.
Target Industry
Lists all target industries from industry map catalog
List all predefined target industries from the industry map catalog.
Target Industry
Get TCP Flow Protection filter.
Get a TCP Flow Protection filter specified by the given UUID.
dos-flowtrackd-api_other
Get TCP Flow Protection rule.
Get a TCP Flow Protection rule specified by the given UUID.
dos-flowtrackd-api_other
Get total queries
Get the total number of saved brand protection queries (domain + logo) for an account
Brand Protection
Get URL Normalization settings
Fetches the current URL Normalization settings.
URL Normalization
Fetch active livestream session details
Returns details of all active livestreams for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API.
Live streams
Fetch livestream details using livestream ID
Returns details of a livestream with sessions for the given livestream ID. Retreive the livestream ID using the `Start livestreaming a meeting` API.
Live streams
Fetch livestream session details using livestream session ID
Returns livestream session details for the given livestream session ID. Retrieve the `livestream_session_id`using the `Fetch livestream session details using a session ID` API.
Live streams
Fetch livestream session details using a session ID
Returns livestream session details for the given session ID. Retreive the session ID using the `Fetch all sessions of an App` API.
Live streams
Fetch active livestreams for a meeting
Returns details of all active livestreams for the given meeting ID.
Live streams
[DEPRECATED] Get Pipeline
[DEPRECATED] Get configuration of a pipeline. Use the new /pipelines/v1/pipelines endpoint instead.
workers_pipelines_other
[DEPRECATED] List Pipelines
[DEPRECATED] List, filter, and paginate pipelines in an account. Use the new /pipelines/v1/pipelines endpoint instead.
workers_pipelines_other
List Pipelines
List/Filter Pipelines in Account.
workers_pipelines_other
Get Pipeline Details
Get Pipelines Details.
workers_pipelines_other
List Sinks
List/Filter Sinks in Account.
workers_pipelines_other
Get Sink Details
Get Sink Details.
workers_pipelines_other
List Streams
List/Filter Streams in Account.
workers_pipelines_other
Get Stream Details
Get Stream Details.
workers_pipelines_other
Fetch details of a webhook
Returns webhook details for the given webhook ID.
Webhooks
Get webhook configuration by ID
Retrieves a specific webhook configuration by its unique identifier.
webhooks
Get Worker
Get details about a specific Worker.
Workers
Get worker build configuration
Retrieve the build configuration for a specific Worker script, including git repository details and production settings.
Workers
Get repository configuration autofill
Analyze repository for automatic configuration detection
GitHub Integration
Get Version
Get details about a specific version.
Versions
Get a zone entry point ruleset
Fetches the latest version of the zone entry point ruleset for a given phase.
Zone Rulesets
Get a zone entry point ruleset version
Fetches a specific version of a zone entry point ruleset.
Zone Rulesets
Get a zone ruleset
Fetches the latest version of a zone ruleset.
Zone Rulesets
Get a zone ruleset version
Fetches a specific version of a zone ruleset.
Zone Rulesets
Retrieves Zone Audit Log
Lists audit log entries for all Security Center insights in a specific zone, showing changes to insight status and classification.
Security Center Audit Log
Retrieves Zone Security Center Insight Counts by Class
Retrieves zone-specific Security Center insight counts aggregated by classification class.
Security Center Insights
Retrieves Zone Security Center Insight Counts by Severity
Retrieves zone-specific Security Center insight counts aggregated by severity level.
Security Center Insights
Retrieves Zone Security Center Insight Counts by Type
Retrieves zone-specific Security Center insight counts aggregated by insight type.
Security Center Insights
Retrieves Zone Security Center Insights
Lists Security Center insights for a specific zone, showing zone-level security findings.
Security Center Insights
Retrieves Zone Issue Audit Log
Lists audit log entries for a specific Security Center insight within a zone, showing changes to its status and classification over time.
Security Center Audit Log
Get a zone snippet
Fetches a snippet belonging to the zone.
Zone Snippets
Get a zone snippet content
Fetches the content of a snippet belonging to the zone.
Zone Snippets
List fields
Lists all fields available for a dataset. The response result is. an object with key-value pairs, where keys are field names, and values are descriptions.
Logpush jobs for a zone
List Logpush jobs for a dataset
Lists Logpush jobs for a zone for a dataset.
Logpush jobs for a zone
List Instant Logs jobs
Lists Instant Logs jobs for a zone.
Instant Logs jobs for a zone
List Logpush jobs
Lists Logpush jobs for a zone.
Logpush jobs for a zone
Get Logpush job details
Gets the details of a Logpush job.
Logpush jobs for a zone
Get log retention flag
Gets log retention flag for Logpull API.
Logs Received
Get logs RayIDs
The `/rayids` api route allows lookups by specific rayid. The rayids route will return zero, one, or more records (ray ids are not unique).
Logs Received
Get logs received
The `/received` api route allows customers to retrieve their edge HTTP logs. The basic access pattern is "give me all the logs for zone Z for minute M", where the minute M refers to the time records were received at Cloudflare's central data center. `start` is inclusive, and `end` is exclusive. Because of that, to get all data, at minutely cadence, starting at 10AM, the proper values are: `start=2018-05-20T10:00:00Z&end=2018-05-20T10:01:00Z`, then `start=2018-05-20T10:01:00Z&end=2018-05-20T10:02:00Z` and so on; the overlap will be handled properly.
Logs Received
List fields
Lists all fields available. The response is json object with key-value pairs, where keys are field names, and values are descriptions.
Logs Received
Get Zaraz configuration
Gets latest Zaraz configuration for a zone. It can be preview or published configuration, whichever was the last updated. Secret variables values will not be included.
Zaraz
Get Zaraz historical configurations by ID(s)
Gets a history of published Zaraz configurations by ID(s) for a zone.
Zaraz
Get default Zaraz configuration
Gets default Zaraz configuration for a zone.
Zaraz
Export Zaraz configuration
Exports full current published Zaraz configuration for a zone, secret variables included.
Zaraz
List Zaraz historical configuration records
Lists a history of published Zaraz configuration records for a zone.
Zaraz
Get Zaraz workflow
Gets Zaraz workflow for a zone.
Zaraz
Create Health Check
Create a new health check.
Health Checks
Create Preview Health Check
Create a new preview health check.
Health Checks
Delete Health Check
Delete a health check.
Health Checks
Delete Preview Health Check
Delete a health check.
Health Checks
Health Check Details
Fetch a single configured health check.
Health Checks
Health Check Preview Details
Fetch a single configured health check preview.
Health Checks
List Health Checks
List configured health checks.
Health Checks
Patch Health Check
Patch a configured health check.
Health Checks
Update Health Check
Update a configured health check.
Health Checks
Mark a finding as ignored
Given a list of findings, mark as ignored. Does nothing if Finding is already ignored.
findings
Download image
Download an image from CF Images. For most images this will be the originally uploaded file. For larger images it can be a near-lossless version of the original.
Cloudflare Images
Create authenticated direct upload URL V1
Direct uploads allow users to upload images without API keys. A common use case are web apps, client-side applications, or mobile devices where users upload content directly to Cloudflare Images. This method creates a one-time upload URL. Use the V2 endpoint for additional features such as custom IDs and metadata.
Cloudflare Images
Create authenticated direct upload URL V2
Direct uploads allow users to upload images without API keys. A common use case are web apps, client-side applications, or mobile devices where users upload content directly to Cloudflare Images. This method creates a draft record for a future image. It returns an upload URL and an image identifier. To verify if the image itself has been uploaded, send an image details request (accounts/:account_identifier/images/v1/:identifier), and check that the `draft: true` property is not present.
Cloudflare Images
Delete image
Delete an image on Cloudflare Images. On success, all copies of the image are deleted and purged from cache.
Cloudflare Images
Image details
Fetch details for a CF Images image.
Cloudflare Images
Images usage statistics
Fetch image statistics details for Cloudflare Images. The returned statistics detail storage usage, including the current image count vs this account's allowance.
Cloudflare Images
Create a new Signing Key
Create a new CF Images signing key with specified name. Returns all keys available.
Cloudflare Images Keys
Delete Signing Key
Delete a CF Images signing key with specified name. Returns all keys available. When the last key is removed, a new default signing key will be generated.
Cloudflare Images Keys
List Signing Keys
List your CF Images signing keys.
Cloudflare Images Keys
List images
List up to 100 images with one request. Use the optional parameters below to get a specific range of images.
Cloudflare Images
List images V2
List up to 10000 images from CF Images, with up to 1000 results per page. Use the optional parameters below to get a specific range of images. Pagination is supported via continuation_token. **Metadata Filtering (Optional):** You can optionally filter images by custom metadata fields using the `meta.<field>[<operator>]=<value>` syntax. **Supported Operators:** - `eq` / `eq:string` / `eq:number` / `eq:boolean` - Exact match - `gt` / `gt:number` - Greater than (number only) - `gte` / `gte:number` - Greater than or equal (number only) - `lt` / `lt:number` - Less than (number only) - `lte` / `lte:number` - Less than or equal (number only) - `in` / `in:string` / `in:number` - Match any value in list (pipe-separated) **Metadata Filter Constraints:** - Maximum 5 metadata filters per request - Maximum 5 levels of nesting (e.g., `meta.first.second.third.fourth.fifth`) - Maximum 10 elements for list operators (`in`) - Supports string, number, and boolean value types - Range operators (`gt`, `gte`, `lt`, `lte`) only accept numeric values **Filter Consistency:** Filters are combined with AND logic. The system does not validate whether filter combinations are logically consistent. For example, `meta.priority[eq:number]=5&meta.priority[lte:number]=3` will return zero results because no value can satisfy both conditions simultaneously. It is the caller's responsibility to ensure filter combinations make sense. **Examples:** ``` # List all images /images/v2 # Filter by metadata [eq] /images/v2?meta.status[eq:string]=active # Filter by metadata [in] /images/v2?meta.status[in]=pending|deleted|flagged # Filter by metadata [in:number] /images/v2?meta.ratings[in:number]=4|5 # Filter by metadata range [gte:number] /images/v2?meta.priority[gte:number]=1 # Filter by bounded range /images/v2?meta.priority[gte:number]=1&meta.priority[lte:number]=5 # Filter by nested metadata /images/v2?meta.region.name[eq]=eu-west # Combine metadata filters with creator /images/v2?meta.status[eq]=active&creator=user123 # Multiple metadata filters (AND logic) /images/v2?meta.status[eq]=active&meta.priority[eq:number]=5 ```
Cloudflare Images
Abort a migration
Abort a running migration. Objects already imported will not be removed.
Cloudflare Images Sourcing Kit
Create a sourcing kit migration
Create a new migration from an existing source. The migration will import objects from the source bucket into Cloudflare Images.
Cloudflare Images Sourcing Kit
Create a sourcing kit source
Create a new migration source by providing storage credentials. The service will verify connectivity to the bucket before accepting the source.
Cloudflare Images Sourcing Kit
Delete a sourcing kit migration
Delete an existing migration. Only completed, errored, or aborted migrations can be deleted.
Cloudflare Images Sourcing Kit
Delete a sourcing kit source
Delete an existing migration source. Sources with active migrations cannot be deleted.
Cloudflare Images Sourcing Kit
Get sourcing kit migration
Fetch details for a single migration.
Cloudflare Images Sourcing Kit
Get migration progress
Get the current progress of a migration including counts of scanned, imported, skipped, and errored objects.
Cloudflare Images Sourcing Kit
Get sourcing kit source
Fetch details for a single migration source.
Cloudflare Images Sourcing Kit
Get source connectivity status
Check the current connectivity status of an existing migration source.
Cloudflare Images Sourcing Kit
List migration logs
List log entries for a specific migration.
Cloudflare Images Sourcing Kit
List sourcing kit migrations
List all migrations for the account.
Cloudflare Images Sourcing Kit
List sourcing kit sources
List all configured migration sources for the account.
Cloudflare Images Sourcing Kit
Precheck source connectivity
Verify connectivity to a storage bucket before creating a source. Returns connectivity status without persisting any state.
Cloudflare Images Sourcing Kit
Start a migration
Start a pending migration. The migration will begin importing objects from the configured source.
Cloudflare Images Sourcing Kit
Update a sourcing kit source
Update the name of an existing migration source.
Cloudflare Images Sourcing Kit
Update image
Update a CF Images image's metadata, creator, or access control. On access control change, all copies of the image are purged from cache.
Cloudflare Images
Upload an image
Upload an image to CF Images. Images up to 10 Megabytes can be uploaded using a single HTTP POST (multipart/form-data) request by sending an image file or passing a URL accessible to the API.
Cloudflare Images
Create a variant
Create a CF Images variant that allows you to resize images for different use cases.
Cloudflare Images Variants
Delete a variant
Delete a CF Images variant. This will purge the cache for all images associated with the variant.
Cloudflare Images Variants
List variants
List existing CF Images variants.
Cloudflare Images Variants
Update a variant
Update a CF Images variant. This will purge the cache for all images associated with the variant.
Cloudflare Images Variants
Variant details
Fetch details for a CF Images variant.
Cloudflare Images Variants
Variant details (flat)
Fetch details for a single variant with properties at the top level of the result.
Cloudflare Images Variants
Delete target
Delete target
Infrastructure Access Targets
Delete targets (Deprecated)
Removes one or more targets.
Infrastructure Access Targets
Delete targets
Removes one or more targets.
Infrastructure Access Targets
Get target
Get target
Infrastructure Access Targets
List all targets
Lists and sorts an account’s targets. Filters are optional and are ANDed together.
Infrastructure Access Targets
Create new target
Create new target
Infrastructure Access Targets
Update target
Update target
Infrastructure Access Targets
Create new targets
Adds one or more targets.
Infrastructure Access Targets
Initialize new SSO connector
Creates a new SSO connector for logging into Cloudflare through an identity provider.
SSO
Inspect SPF Record
Inspects a specific SPF TXT record and returns a parsed tree structure in the spflimit-worker format. The record ID must be provided via the `id` query parameter. Returns a recursive tree showing: - Parsed components with their qualifiers and types - Nested includes recursively resolved within components - Per-component and total lookup counts - Detailed error information with context
Email Auth
Create an IP Access rule
Creates a new IP Access rule for all zones owned by the current user. Note: To create an IP Access rule that applies to a specific zone, refer to the [IP Access rules for a zone](#ip-access-rules-for-a-zone) endpoints.
IP Access rules for a user
Delete an IP Access rule
Deletes an IP Access rule at the user level. Note: Deleting a user-level rule will affect all zones owned by the user.
IP Access rules for a user
Get an IP Access rule
Fetches the details of an IP Access rule defined at the user level.
IP Access rules for a user
List IP Access rules
Fetches IP Access rules of the user. You can filter the results using several optional parameters.
IP Access rules for a user
Update an IP Access rule
Updates an IP Access rule defined at the user level. You can only update the rule action (`mode` parameter) and notes.
IP Access rules for a user
Create an IP Access rule
Creates a new IP Access rule for a zone. Note: To create an IP Access rule that applies to multiple zones, refer to [IP Access rules for a user](#ip-access-rules-for-a-user) or [IP Access rules for an account](#ip-access-rules-for-an-account) as appropriate.
IP Access rules for a zone
Delete an IP Access rule
Deletes an IP Access rule defined at the zone level. Optionally, you can use the `cascade` property to specify that you wish to delete similar rules in other zones managed by the same zone owner.
IP Access rules for a zone
List IP Access rules
Fetches IP Access rules of a zone. You can filter the results using several optional parameters.
IP Access rules for a zone
Update an IP Access rule
Updates an IP Access rule defined at the zone level. You can only update the rule action (`mode` parameter) and notes.
IP Access rules for a zone
Create an IP Access rule
Creates a new IP Access rule for an account. The rule will apply to all zones in the account. Note: To create an IP Access rule that applies to a single zone, refer to the [IP Access rules for a zone](#ip-access-rules-for-a-zone) endpoints.
IP Access rules for an account
Delete an IP Access rule
Deletes an existing IP Access rule defined at the account level. Note: This operation will affect all zones in the account.
IP Access rules for an account
Get an IP Access rule
Fetches the details of an IP Access rule defined at the account level.
IP Access rules for an account
List IP Access rules
Fetches IP Access rules of an account. These rules apply to all the zones in the account. You can filter the results using several optional parameters.
IP Access rules for an account
Update an IP Access rule
Updates an IP Access rule defined at the account level. Note: This operation will affect all zones in the account.
IP Access rules for an account
Add a zone membership to an Address Map
Add a zone as a member of a particular address map.
IP Address Management Address Maps
Add an account membership to an Address Map
Add an account as a member of a particular address map.
IP Address Management Address Maps
Add an IP to an Address Map
Add an IP from a prefix owned by the account to a particular address map.
IP Address Management Address Maps
Address Map Details
Show a particular address map owned by the account.
IP Address Management Address Maps
Create Address Map
Create a new address map under the account.
IP Address Management Address Maps
Delete Address Map
Delete a particular address map owned by the account. An Address Map must be disabled before it can be deleted.
IP Address Management Address Maps
List Address Maps
List all address maps owned by the account.
IP Address Management Address Maps
Remove a zone membership from an Address Map
Remove a zone as a member of a particular address map.
IP Address Management Address Maps
Remove an account membership from an Address Map
Remove an account as a member of a particular address map.
IP Address Management Address Maps
Remove an IP from an Address Map
Remove an IP from a particular address map.
IP Address Management Address Maps
Update Address Map
Modify properties of an address map owned by the account.
IP Address Management Address Maps
Get Advertisement Status
View the current advertisement state for a prefix. **Deprecated:** Prefer the BGP Prefixes endpoints, which additionally allow for advertising and withdrawing subnets of an IP prefix.
IP Address Management Dynamic Advertisement
Update Prefix Dynamic Advertisement Status
Advertise or withdraw the BGP route for a prefix. **Deprecated:** Prefer the BGP Prefixes endpoints, which additionally allow for advertising and withdrawing subnets of an IP prefix.
IP Address Management Dynamic Advertisement
List Leases
List all leases owned by the account.
IP Address Management Leases
Create Prefix Delegation
Create a new account delegation for a given IP prefix.
IP Address Management Prefix Delegation
Delete Prefix Delegation
Delete an account delegation for a given IP prefix.
IP Address Management Prefix Delegation
List Prefix Delegations
List all delegations for a given account IP prefix.
IP Address Management Prefix Delegation
Add Prefix
Add a new prefix under the account.
IP Address Management Prefixes
Create BGP Prefix
Create a BGP prefix, controlling the BGP advertisement status of a specific subnet. When created, BGP prefixes are initially withdrawn, and can be advertised with the Update BGP Prefix API.
IP Address Management BGP Prefixes
Delete BGP Prefix
Delete a BGP Prefix associated with the specified IP Prefix. A BGP Prefix must be withdrawn before it can be deleted.
IP Address Management BGP Prefixes
Delete Prefix
Delete an unapproved prefix owned by the account.
IP Address Management Prefixes
Download LOA Document
Download specified LOA document under the account.
IP Address Management Prefixes
Fetch BGP Prefix
Retrieve a single BGP Prefix according to its identifier
IP Address Management BGP Prefixes
List BGP Prefixes
List all BGP Prefixes within the specified IP Prefix. BGP Prefixes are used to control which specific subnets are advertised to the Internet. It is possible to advertise subnets more specific than an IP Prefix by creating more specific BGP Prefixes.
IP Address Management BGP Prefixes
List Prefixes
List all prefixes owned by the account.
IP Address Management Prefixes
Prefix Details
List a particular prefix owned by the account.
IP Address Management Prefixes
Update BGP Prefix
Update the properties of a BGP Prefix, such as the on demand advertisement status (advertised or withdrawn).
IP Address Management BGP Prefixes
Update Prefix Description
Modify the description for a prefix owned by the account.
IP Address Management Prefixes
Upload LOA Document
Submit LOA document (pdf format) under the account.
IP Address Management Prefixes
Validate Prefix
Triggers a new prefix validation. The checks are run asynchronously and include IRR, RPKI, and prefix ownership.
IP Address Management Prefixes
Create Service Binding
Creates a new Service Binding, routing traffic to IPs within the given CIDR to a service running on Cloudflare's network. **NOTE:** The first Service Binding created for an IP Prefix must exactly match the IP Prefix's CIDR. Subsequent Service Bindings may be created with a more-specific CIDR. Refer to the [Service Bindings Documentation](https://developers.cloudflare.com/byoip/service-bindings/) for compatibility details.
IP Address Management Service Bindings
Delete Service Binding
Delete a Service Binding
IP Address Management Service Bindings
Get Service Binding
Fetch a single Service Binding
IP Address Management Service Bindings
List Service Bindings
List the Cloudflare services this prefix is currently bound to. Traffic sent to an address within an IP prefix will be routed to the Cloudflare service of the most-specific Service Binding matching the address. **Example:** binding `192.0.2.0/24` to Cloudflare Magic Transit and `192.0.2.1/32` to the Cloudflare CDN would route traffic for `192.0.2.1` to the CDN, and traffic for all other IPs in the prefix to Cloudflare Magic Transit.
IP Address Management Service Bindings
List Services
Bring-Your-Own IP (BYOIP) prefixes onboarded to Cloudflare must be bound to a service running on the Cloudflare network to enable a Cloudflare product on the IP addresses. This endpoint can be used as a reference of available services on the Cloudflare network, and their service IDs.
IP Address Management Service Bindings
Get IP Overview
Gets the geolocation, ASN, infrastructure type of the ASN, and any security threat categories of an IP address. **Must provide ip query parameters.** For example, `/intel/ip?ipv4=1.1.1.1` or `/intel/ip?ipv6=2001:db8::1`.
IP Intelligence
Get Available IP Lists
Returns a list of available IP list categories (e.g., anonymizer, botnetcc, malware, tor, vpn, open_proxies). This endpoint provides metadata about which IP lists are available in the system.
IP List
Cloudflare/JD Cloud IP Details
Get IPs used on the Cloudflare/JD Cloud network, see https://www.cloudflare.com/ips for Cloudflare IPs or https://developers.cloudflare.com/china-network/reference/infrastructure/ for JD Cloud IPs.
Cloudflare IPs
Create Keyless SSL Configuration
Creates a Keyless SSL configuration that allows SSL/TLS termination without exposing private keys to Cloudflare. Keys remain on your infrastructure.
Keyless SSL for a Zone
Delete Keyless SSL Configuration
Removes a Keyless SSL configuration. SSL connections will no longer use the keyless server for cryptographic operations.
Keyless SSL for a Zone
Edit Keyless SSL Configuration
This will update attributes of a Keyless SSL. Consists of one or more of the following: host,name,port.
Keyless SSL for a Zone
Get Keyless SSL Configuration
Get details for one Keyless SSL configuration.
Keyless SSL for a Zone
List Keyless SSL Configurations
List all Keyless SSL configurations for a given zone.
Keyless SSL for a Zone
Kick all participants
Kicks all participants from an active session for the given meeting ID.
Active session
Kick participants from an active session
Kicks one or more participants from an active session using user ID or custom participant ID.
Active session
List abuse reports
List the abuse reports for a given account
tseng-abuse-complaint-processor_other
List an account entry point ruleset's versions
Fetches the versions of an account entry point ruleset.
Account Rulesets
List an account ruleset version's rules by tag
Fetches the rules of a managed account ruleset version for a given tag.
Account Rulesets
List an account ruleset's versions
Fetches the versions of an account ruleset.
Account Rulesets
List account rulesets
Fetches all rulesets at the account level.
Account Rulesets
List all allowlist prefixes.
List all allowlist prefixes for an account.
dos-flowtrackd-api_other
List all application versions
Returns all versions for this application
Applications
List Applications associated with your account
Lists all the applications that are associated with your account
Applications
List applications
Returns a list of available applications with use cases and permissions.
Applications
List additional audio tracks on a video
Lists additional audio tracks on a video. Note this API will not return information for audio attached to the video upload.
Stream Audio Tracks
List build tokens
Get all build tokens with pagination
Build Tokens
List builds by script
Get all builds for a specific worker script with pagination
Workers
List R2 catalogs
Returns a list of R2 buckets that have been enabled as Apache Iceberg catalogs for the specified account. Each catalog represents an R2 bucket configured to store Iceberg metadata and data files.
R2 Catalog Management
List available target environments
Retrieves a list of all available target environments with their display names. This endpoint is in Beta.
Client Versions
List client versions
Lists available WARP client versions for a specific target environment and release track. This endpoint is in Beta.
Client Versions
List existing CNI objects
List existing CNI objects
CNIs
List container instances
Lists container instances for an application, including control-plane details and any associated deployment/placement information.
ApplicationsContainer Instances
List DLP content findings
List DLP content findings
content
List Credential Sets
Returns all credential sets for the account.
Credential Sets
List Credentials
Returns all credentials within a credential set.
Credentials
List deploy hooks
Get all deploy hooks for a specific worker script.
Deploy Hooks
List deployment groups
Lists all deployment groups for an account. Use deployment groups to assign target WARP client versions to specific devices. This endpoint is in Beta.
Deployment Groups
List devices
Lists WARP devices.
Physical Devices
List DEX Rules
List DEX Rules.
DEX Rules
List all DNS Protection rules.
List all DNS Protection rules for an account.
dos-flowtrackd-api_other
List abuse report emails
List emails sent to the customer for an abuse report. Returns all successful customer emails sent for the specified abuse report. Does not include emails sent to hosts or submitters.
tseng-abuse-complaint-processor_other
List environment variables
Get all environment variables for a trigger
Environment Variables
List all export jobs
List all export jobs for a given requestor's organization
exports
List instances of a finding
Lists all security finding instances for a given security finding.
findings
List all finding types
List all available finding types with pagination support.
finding_types
List posture findings
List all security findings that have been identified as being problematic. This will return a list of findings regardless if they have been ignored or not.
findings
List Hyperdrives
Returns a list of Hyperdrives.
Hyperdrive
Get the list of configured registries in the account
Get the list of configured registries in the account
Image Registries
List integrations
Returns a paginated list of integrations for the account.
Integrations
List existing interconnects
List existing interconnects
Interconnects
List IP profiles
Lists WARP Device IP profiles.
IP Profiles
List Managed Transforms
Fetches a list of all Managed Transforms.
Managed Transforms
List abuse report mitigations
List mitigations done to remediate the abuse report.
tseng-abuse-complaint-processor_other
List namespaces in catalog
Returns a list of namespaces in the specified R2 catalog. Supports hierarchical filtering and pagination for efficient traversal of large namespace hierarchies.
Namespace Management
List all prefixes.
List all prefixes for an account.
dos-flowtrackd-api_other
List registrations
Lists WARP registrations.
Registrations
List remediation jobs
List all remediation jobs tied to a specific Cloudflare Account. Note that `cursor` and `page` are mutually exclusive.
remediations
List Scans
Returns all scans for the account.
Scans
Retrieve a list of all slots matching the specified parameters
Retrieve a list of all slots matching the specified parameters
Slots
List all SYN Protection filters.
List all SYN Protection filters for an account.
dos-flowtrackd-api_other
List all SYN Protection rules.
List all SYN Protection rules for an account.
dos-flowtrackd-api_other
List tables in namespace
Returns a list of tables in the specified namespace within an R2 catalog. Supports pagination for efficient traversal of large table collections.
Table Management
List Target Environments
Returns all target environments for the account.
Target Environments
List all TCP Flow Protection filters.
List all TCP Flow Protection filters for an account.
dos-flowtrackd-api_other
List all TCP Flow Protection rules.
List all TCP Flow Protection rules for an account.
dos-flowtrackd-api_other
List triggers by script
Get all triggers for a specific worker script
Workers
List WARP change events.
List WARP configuration and enablement toggle change events by device.
WARP Change Events
List webhook configurations
Retrieves all webhook configurations for the authenticated account. Returns an array of webhook configurations that can be used to send finding notifications.
webhooks
List Versions
List all versions for a Worker.
Versions
List Workers
List all Workers for an account.
Workers
List a zone entry point ruleset's versions
Fetches the versions of a zone entry point ruleset.
Zone Rulesets
List a zone ruleset version's rules by tag
Fetches the rules of a managed zone ruleset version for a given tag.
Zone Rulesets
List a zone ruleset's versions
Fetches the versions of a zone ruleset.
Zone Rulesets
List zone rulesets
Fetches all rulesets at the zone level.
Zone Rulesets
List zone snippet rules
Fetches all snippet rules belonging to the zone.
Zone Snippets
List zone snippets
Fetches all snippets belonging to the zone.
Zone Snippets
Create a list
Creates a new list of the specified kind.
Lists
Create list items
Appends new items to the list. This operation is asynchronous. To get current the operation status, invoke the `Get bulk operation status` endpoint with the returned `operation_id`. There is a limit of 1 pending bulk operation per account. If an outstanding bulk operation is in progress, the request will be rejected.
Lists
Delete a list
Deletes a specific list and all its items.
Lists
Delete list items
Removes one or more items from a list. This operation is asynchronous. To get current the operation status, invoke the `Get bulk operation status` endpoint with the returned `operation_id`. There is a limit of 1 pending bulk operation per account. If an outstanding bulk operation is in progress, the request will be rejected.
Lists
Get a list
Fetches the details of a list.
Lists
Get a list item
Fetches a list item in the list.
Lists
Get bulk operation status
Gets the current status of an asynchronous operation on a list. The `status` property can have one of the following values: `pending`, `running`, `completed`, or `failed`. If the status is `failed`, the `error` property will contain a message describing the error.
Lists
Get list items
Fetches all the items in the list.
Lists
Get lists
Fetches all lists in the account.
Lists
Update a list
Updates the description of a list.
Lists
Update all list items
Removes all existing items from the list and adds the provided items to the list. This operation is asynchronous. To get current the operation status, invoke the `Get bulk operation status` endpoint with the returned `operation_id`. There is a limit of 1 pending bulk operation per account. If an outstanding bulk operation is in progress, the request will be rejected.
Lists
Fetch livestream session details for a meeting
Returns livestream session details for the given meeting ID. Retreive the meeting ID using the `Create a meeting` API.
Live streams
List Healthcheck Events
List origin health changes.
Load Balancer Healthcheck Events
Create Monitor
Create a configured monitor.
Load Balancer Monitors
Delete Monitor
Delete a configured monitor.
Load Balancer Monitors
List Monitor References
Get the list of resources that reference the provided monitor.
Load Balancer Monitors
List Monitors
List configured monitors for a user.
Load Balancer Monitors
Monitor Details
List a single configured monitor for a user.
Load Balancer Monitors
Patch Monitor
Apply changes to an existing monitor, overwriting the supplied properties.
Load Balancer Monitors
Preview Monitor
Preview pools using the specified monitor with provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results.
Load Balancer Monitors
Preview Result
Get the result of a previous preview operation using the provided preview_id.
Load Balancer Monitors
Update Monitor
Modify a configured monitor.
Load Balancer Monitors
Create Pool
Create a new pool.
Load Balancer Pools
Delete Pool
Delete a configured pool.
Load Balancer Pools
List Pool References
Get the list of resources that reference the provided pool.
Load Balancer Pools
List Pools
List configured pools.
Load Balancer Pools
Patch Pool
Apply changes to an existing pool, overwriting the supplied properties.
Load Balancer Pools
Patch Pools
Apply changes to a number of existing pools, overwriting the supplied properties. Pools are ordered by ascending `name`. Returns the list of affected pools. Supports the standard pagination query parameters, either `limit`/`offset` or `per_page`/`page`.
Load Balancer Pools
Pool Details
Fetch a single configured pool.
Load Balancer Pools
Pool Health Details
Fetch the latest pool health status for a single pool.
Load Balancer Pools
Preview Pool
Preview pool health using provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results.
Load Balancer Pools
Update Pool
Modify a configured pool.
Load Balancer Pools
Get Region
Get a single region mapping.
Load Balancer Regions
List Regions
List all region mappings.
Load Balancer Regions
Create Load Balancer
Create a new load balancer.
Load Balancers
Delete Load Balancer
Delete a configured load balancer.
Load Balancers
List Load Balancers
List configured load balancers.
Load Balancers
Load Balancer Details
Fetch a single configured load balancer.
Load Balancers
Patch Load Balancer
Apply changes to an existing load balancer, overwriting the supplied properties.
Load Balancers
Update Load Balancer
Update a configured load balancer.
Load Balancers
List log files
Lists R2 objects containing logs matching the provided query parameters.
Logpull
Retrieve logs
Returns logs stored in R2 that match the provided query parameters.
Logpull
Delete mTLS certificate
Deletes the mTLS certificate unless the certificate is in use by one or more Cloudflare services.
mTLS Certificate Management
Get mTLS certificate
Fetches a single mTLS certificate uploaded to your account. To get a certificate issued by the Cloudflare managed CA, use the [Client Certificate Details endpoint](/api/resources/client_certificates/methods/get/).
mTLS Certificate Management
List mTLS certificate associations
Lists all active associations between the certificate and Cloudflare services.
mTLS Certificate Management
List mTLS certificates
Lists all mTLS certificates uploaded to your account, such as Bring Your Own CA (BYO-CA) for mTLS. To list certificates issued by the Cloudflare managed CA, use the [List Client Certificates endpoint](/api/resources/client_certificates/methods/list/).
mTLS Certificate Management
Upload mTLS certificate
Upload a certificate that you want to use with mTLS-enabled Cloudflare services, such as Bring Your Own CA (BYO-CA) for mTLS. To create certificates issued by the Cloudflare managed CA, use the [Create Client Certificate endpoint](/api/resources/client_certificates/methods/create/).
mTLS Certificate Management
Create a new App
Creates a new App for an account
Magic Account Apps
Delete Account App
Deletes specific Account App.
Magic Account Apps
List Apps
Lists Apps associated with an account.
Magic Account Apps
Update an App
Updates an Account App
Magic Account Apps
Update an App
Updates an Account App
Magic Account Apps
Create BGP Filter Profile
Creates a new BGP filter profile for an account.
Magic BGP Filter Profiles
Delete BGP Filter Profile
Deletes a BGP filter profile.
Magic BGP Filter Profiles
Get BGP Filter Profile
Gets a specific BGP filter profile for an account.
Magic BGP Filter Profiles
Get BGP Settings
Gets the BGP settings for an account, including the default ASN and redistribution configuration.
Magic BGP Settings
List BGP Filter Profiles
Lists all BGP filter profiles for an account.
Magic BGP Filter Profiles
Update BGP Filter Profile
Updates a BGP filter profile. Omitted properties are left unchanged. To clear an existing description send `description: ""`.
Magic BGP Filter Profiles
Update BGP Settings
Modifies the BGP settings for an account, including the default ASN and redistribution configuration.
Magic BGP Settings
Create CF1 Site Ramps
Creates ramps (network connections) for a CF1 Site.
Magic CF1 Site Ramps
Create CF1 Sites
Creates new CF1 Sites for an account. Each site must have a unique name within the account.
Magic CF1 Sites
Delete CF1 Site
Deletes a specific CF1 Site for an account.
Magic CF1 Sites
Delete CF1 Site Ramp
Deletes a specific ramp from a CF1 Site.
Magic CF1 Site Ramps
Get CF1 Site
Gets a specific CF1 Site for an account.
Magic CF1 Sites
Get CF1 Site Ramp
Gets a specific ramp for a CF1 Site.
Magic CF1 Site Ramps
List CF1 Site Ramps
Lists ramps (network connections) associated with a CF1 Site. Ramps represent GRE tunnels, IPsec tunnels, interconnects, or MCONN links.
Magic CF1 Site Ramps
List CF1 Sites
Lists CF1 Sites associated with an account. A CF1 Site represents a physical customer network location with optional geographic coordinates.
Magic CF1 Sites
Update CF1 Site
Partially updates a specific CF1 Site for an account. Only the fields included in the request body are modified; omitted fields retain their existing values.
Magic CF1 Sites
Create a GRE tunnel
Creates a new GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.
Magic GRE tunnels
Delete GRE Tunnel
Disables and removes a specific static GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.
Magic GRE tunnels
List GRE Tunnel Details
Lists informtion for a specific GRE tunnel.
Magic GRE tunnels
List GRE tunnels
Lists GRE tunnels associated with an account.
Magic GRE tunnels
Update GRE Tunnel
Updates a specific GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.
Magic GRE tunnels
Update multiple GRE tunnels
Updates multiple GRE tunnels. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.
Magic GRE tunnels
List interconnect Details
Lists details for a specific interconnect.
Magic Interconnects
List interconnects
Lists interconnects associated with an account.
Magic Interconnects
Update interconnect
Updates a specific interconnect associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.
Magic Interconnects
Update multiple interconnects
Updates multiple interconnects associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.
Magic Interconnects
Create an IPsec tunnel
Creates a new IPsec tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.
Magic IPsec tunnels
Delete IPsec Tunnel
Disables and removes a specific static IPsec Tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.
Magic IPsec tunnels
Generate Pre-Shared Key (PSK) for IPsec tunnels
Generates a Pre-Shared Key for a specific IPsec tunnel used in the IKE session. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. After a PSK is generated, the PSK is immediately persisted to Cloudflare's edge and cannot be retrieved later. Store the PSK in a safe place.
Magic IPsec tunnels
List IPsec tunnel details
Lists details for a specific IPsec tunnel.
Magic IPsec tunnels
List IPsec tunnels
Lists IPsec tunnels associated with an account.
Magic IPsec tunnels
Set Pre-Shared Keys (PSK) for IPsec tunnels
Sets Pre-Shared Keys for multiple IPsec tunnels associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. After PSKs are applied, they are immediately persisted to Cloudflare's edge and cannot be retrieved later. Store the PSKs in a safe place.
Magic IPsec tunnels
Update IPsec Tunnel
Updates a specific IPsec tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.
Magic IPsec tunnels
Update multiple IPsec tunnels
Update multiple IPsec tunnels associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.
Magic IPsec tunnels
Create account configuration
Create a new network monitoring configuration.
Magic Network Monitoring Configuration
Delete account configuration
Delete an existing network monitoring configuration.
Magic Network Monitoring Configuration
List account configuration
Lists default sampling, router IPs and warp devices for account.
Magic Network Monitoring Configuration
List rules and account configuration
Lists default sampling, router IPs, warp devices, and rules for account.
Magic Network Monitoring Configuration
Update account configuration fields
Update fields in an existing network monitoring configuration.
Magic Network Monitoring Configuration
Update an entire account configuration
Update an existing network monitoring configuration, requires the entire configuration to be updated at once.
Magic Network Monitoring Configuration
Create rules
Create network monitoring rules for account. Currently only supports creating a single rule per API request.
Magic Network Monitoring Rules
Create rules in bulk
Create multiple network monitoring rules for account in a single request. Supports up to 100 rules per request. All rules in a single request must be of the same type.
Magic Network Monitoring Rules
Delete rule
Delete a network monitoring rule for account.
Magic Network Monitoring Rules
Get rule
List a single network monitoring rule for account.
Magic Network Monitoring Rules
List rules
Lists network monitoring rules for account.
Magic Network Monitoring Rules
Update advertisement for rule
Update advertisement for rule.
Magic Network Monitoring Rules
Update rule
Update a network monitoring rule for account.
Magic Network Monitoring Rules
Update rules
Update network monitoring rules for account.
Magic Network Monitoring Rules
Update rules in bulk
Update multiple network monitoring rules for account in a single request. Supports up to 100 rules per request. All rules in a single request must be of the same type.
Magic Network Monitoring Rules
Generate authentication token for VPC flow logs export.
Generate authentication token for VPC flow logs export.
Magic Network Monitoring VPC Flow logs
Add buckets for full packet captures
Adds an AWS or GCP bucket to use with full packet captures.
Magic PCAP collection
Create PCAP request
Create new PCAP request for account.
Magic PCAP collection
Delete buckets for full packet captures
Deletes buckets added to the packet captures API.
Magic PCAP collection
Download Simple PCAP
Download PCAP information into a file. Response is a binary PCAP file.
Magic PCAP collection
Get PCAP request
Get information for a PCAP request by id.
Magic PCAP collection
List packet capture requests
Lists all packet capture requests for an account.
Magic PCAP collection
List PCAPs Bucket Ownership
List all buckets configured for use with PCAPs API.
Magic PCAP collection
Stop full PCAP
Stop full PCAP.
Magic PCAP collection
Validate buckets for full packet captures
Validates buckets added to the packet captures API.
Magic PCAP collection
Create a Redundancy Group
Creates a new redundancy group, optionally with tunnel members.
Magic Redundancy Groups
Delete a Redundancy Group
Deletes a redundancy group. Member tunnels are not deleted — their redundancy_group_id is cleared.
Magic Redundancy Groups
Get Redundancy Group Details
Gets details for a specific redundancy group, including full member tunnel data.
Magic Redundancy Groups
List Redundancy Groups
Lists redundancy groups associated with an account, including full member tunnel data.
Magic Redundancy Groups
Update a Redundancy Group
Replaces the name, description, and full set of members for an existing redundancy group.
Magic Redundancy Groups
Site ACL Details
Get a specific Site ACL.
Magic Site ACLs
Create a new Site ACL
Creates a new Site ACL.
Magic Site ACLs
Delete Site ACL
Remove a specific Site ACL.
Magic Site ACLs
List Site ACLs
Lists Site ACLs associated with an account.
Magic Site ACLs
Patch Site ACL
Patch a specific Site ACL.
Magic Site ACLs
Update Site ACL
Update a specific Site ACL.
Magic Site ACLs
Create a new App Config
Creates a new App Config for a site
Magic Site App Configs
Delete App Config
Deletes specific App Config associated with a site.
Magic Site App Configs
List App Configs
Lists App Configs associated with a site.
Magic Site App Configs
Update an App Config
Updates an App Config for a site
Magic Site App Configs
Update an App Config
Updates an App Config for a site
Magic Site App Configs
Create a new Site LAN
Creates a new Site LAN. If the site is in high availability mode, static_addressing is required along with secondary and virtual address.
Magic Site LANs
Delete Site LAN
Remove a specific Site LAN.
Magic Site LANs
Site LAN Details
Get a specific Site LAN.
Magic Site LANs
List Site LANs
Lists Site LANs associated with an account.
Magic Site LANs
Patch Site LAN
Patch a specific Site LAN.
Magic Site LANs
Update Site LAN
Update a specific Site LAN.
Magic Site LANs
Create NetFlow Configuration
Creates a NetFlow configuration for a site.
Magic Site NetFlow Config
Delete NetFlow Configuration
Remove NetFlow configuration for a site.
Magic Site NetFlow Config
NetFlow Configuration Details
Get NetFlow configuration for a site.
Magic Site NetFlow Config
Update NetFlow Configuration
Updates NetFlow configuration for a site.
Magic Site NetFlow Config
Update NetFlow Configuration
Updates NetFlow configuration for a site (partial update).
Magic Site NetFlow Config
Create a new Site WAN
Creates a new Site WAN.
Magic Site WANs
Delete Site WAN
Remove a specific Site WAN.
Magic Site WANs
List Site WANs
Lists Site WANs associated with an account.
Magic Site WANs
Patch Site WAN
Patch a specific Site WAN.
Magic Site WANs
Update Site WAN
Update a specific Site WAN.
Magic Site WANs
Site WAN Details
Get a specific Site WAN.
Magic Site WANs
Create a new Site
Creates a new Site
Magic Sites
Delete Site
Remove a specific Site.
Magic Sites
List Sites
Lists Sites associated with an account. Use connectorid query param to return sites where connectorid matches either site.ConnectorID or site.SecondaryConnectorID.
Magic Sites
Patch Site
Patch a specific Site.
Magic Sites
Site Details
Get a specific Site.
Magic Sites
Update Site
Update a specific Site.
Magic Sites
Create a Route
Creates a new Magic static route. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes.
Magic Static Routes
Delete Many Routes
Delete multiple Magic static routes.
Magic Static Routes
Delete Route
Disable and remove a specific Magic static route.
Magic Static Routes
List Routes
List all Magic static routes.
Magic Static Routes
Route Details
Get a specific Magic static route.
Magic Static Routes
Update Many Routes
Update multiple Magic static routes. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes. Only fields for a route that need to be changed need be provided.
Magic Static Routes
Update Route
Update a specific Magic static route. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes.
Magic Static Routes
Create Interrupt
Creates an interrupt for a Magic WAN Connector.
Magic Connectors
List Interrupts
Lists interrupts for a Magic WAN Connector.
Magic Connectors
Get Event
Gets Magic WAN Connector Telemetry Event
Magic Connectors
Get latest Events
Gets latest Magic WAN Connector Telemetry Events
Magic Connectors
List Events
Lists Magic WAN Connector Telemetry Events
Magic Connectors
Get Snapshot
Gets Magic WAN Connector Telemetry Snapshot
Magic Connectors
Get latest Snapshots
Gets latest Magic WAN Connector Telemetry Snapshots
Magic Connectors
List Snapshots
Lists Magic WAN Connector Telemetry Snapshots
Magic Connectors
Create Connector
Creates a Magic WAN Connector.
Magic Connectors
Delete Connector
Deletes a Magic WAN Connector.
Magic Connectors
Edit Connector
Edits properties of a Magic WAN Connector. May be used to re-provision a license key.
Magic Connectors
Get Connector
Gets a Magic WAN Connector.
Magic Connectors
List Connectors
Lists Magic WAN Connectors.
Magic Connectors
Update Connector
Updates properties of a Magic WAN Connector. May be used to re-provision a license key.
Magic Connectors
Create a new MCP Portal
Creates a new MCP portal for managing AI tool access through Cloudflare Access.
MCP Portal
Create a new MCP Server
Creates a new MCP portal for managing AI tool access through Cloudflare Access.
MCP Portal Servers
Delete a MCP Portal
Deletes an MCP portal from the account.
MCP Portal
Delete a MCP Server
Deletes an MCP portal from the account.
MCP Portal Servers
Resolve the OAuth redirect_uri the admin must register at the upstream
Returns the redirect URI the gateway will actually send to the upstream OAuth provider for this (portal, server) pair. Stable for the lifetime of the configuration unless MCP-22 rollout state changes. Use this value verbatim when registering the OAuth app at the upstream.
MCP Portal
Read details of an MCP Portal
Read the details of a single MCP Portal, including its configured servers.
MCP Portal
Read the details of a MCP Server
Retrieves gateway configuration for MCP portals.
MCP Portal Servers
List MCP Portals
Lists all MCP portals configured for the account.
MCP Portal
List MCP Servers
Lists all MCP portals configured for the account.
MCP Portal Servers
Sync MCP Server Capabilities
Syncs an MCP server's capabilities and returns the updated server state, including any connection errors.
MCP Portal Servers
Update a MCP Portal
Updates an MCP portal configuration.
MCP Portal
Update a MCP Server
Updates an MCP portal configuration.
MCP Portal Servers
Batch create organization members
Batch create multiple memberships that grant access to a specific Organization.
OrganizationMembers
Create organization member
Create a membership that grants access to a specific Organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)
OrganizationMembers
Delete organization member
Delete a membership to a particular Organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)
OrganizationMembers
List organization members
List memberships for an Organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)
OrganizationMembers
Get organization member
Retrieve a single membership from an Organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)
OrganizationMembers
Delete Metrics Export
Delete one resource configured for Workers Observability metrics export.
Metrics Export
List Metrics Exports
List resources configured for Workers Observability metrics export.
Metrics Export
Upsert Metrics Exports
Create or replace resources configured for Workers Observability metrics export.
Metrics Export
Create Miscategorization
Allows you to submit requests to change a domain’s category. Requests that include category `169` (New Domains) or category `177` (Newly Seen) in any of `content_adds`, `content_removes`, `security_adds`, or `security_removes` will be rejected with a `400 Bad Request`. These categories are automatically managed and fall off 30 days after they are applied.
Miscategorization
Modify an application
Modifies a single application by id.
Applications
Create a relay
Provisions a new MoQ relay instance. Auto-creates a publish+subscribe token and a subscribe-only token. Token values are included in the response (shown once). Config is always set to defaults (upstreams off) and cannot be supplied here — sending a non-empty `config` is rejected (21014); `null` or `{}` is accepted as absent. Use PUT to configure the relay after it exists.
MoQ Relays
Delete a relay
Soft-deletes a MoQ relay. The relay ID goes in the URL path — `DELETE /accounts/{account_id}/moq/relays/{relay_id}` — not the request body; there is no collection-level delete endpoint.
MoQ Relays
Get a relay
Retrieves a single MoQ relay including config and status. Tokens are NOT included.
MoQ Relays
List relays
Lists all MoQ relays for the account. Returns only metadata. Config, status, and tokens are omitted. Results are cursor-paginated (keyset on the `created` timestamp). Use `created_before` / `created_after` with the `created` value of the first/last item in a page to fetch the adjacent page. `result_info` reports the page `count` and the `total` matching the cursor filters.
MoQ Relays
Create a token
Mints a new relay-scoped token and adds it to the relay's accepted-auth registry. The token value (secret) is shown once in the response. A relay may hold up to 10 tokens; creating an 11th is rejected.
MoQ Relays
Revoke a token
Revokes a token by removing it from the relay's registry. crique rejects the token within the cache TTL. Idempotent — revoking an unknown token succeeds.
MoQ Relays
List tokens
Returns metadata for every token in the relay's registry. Secrets are never returned. The dashboard derives an `expired` flag by comparing each token's `expires` to the current time.
MoQ Relays
Update a relay
Updates a relay's name and/or configuration. The relay ID goes in the URL path — `PUT /accounts/{account_id}/moq/relays/{relay_id}` — not the request body; there is no collection-level update endpoint. This is also the only way to set a relay's config (config cannot be set at create time). Partial updates: omitted fields are preserved; config sub-objects replace as whole objects when present.
MoQ Relays
Mute all participants
Mutes all participants of an active session for the given meeting ID.
Active session
Mute participants of an active session
Mutes one or more participants from an active session using user ID or custom participant ID.
Active session
Create dispatch namespace
Create a new Workers for Platforms namespace.
Workers for Platforms
Delete dispatch namespace
Delete a Workers for Platforms namespace.
Workers for Platforms
Delete script secret
Remove a secret from a script uploaded to a Workers for Platforms namespace.
Workers for Platforms
Delete Script Tag
Delete script tag for a script uploaded to a Workers for Platforms namespace.
Workers for Platforms
Delete Scripts in Namespace
Delete multiple scripts from a Workers for Platforms namespace based on optional tag filters.
Workers for Platforms
Get dispatch namespace
Get a Workers for Platforms namespace.
Workers for Platforms
Get Script Bindings
Fetch script bindings from a script uploaded to a Workers for Platforms namespace.
Workers for Platforms
Get Script Content
Fetch script content from a script uploaded to a Workers for Platforms namespace.
Workers for Platforms
Get secret binding
Get a given secret binding (value omitted) on a script uploaded to a Workers for Platforms namespace.
Workers for Platforms
Get Script Settings
Get script settings from a script uploaded to a Workers for Platforms namespace.
Workers for Platforms
Get Script Tags
Fetch tags from a script uploaded to a Workers for Platforms namespace.
Workers for Platforms
List dispatch namespaces
Fetch a list of Workers for Platforms namespaces.
Workers for Platforms
List Script Secrets
List secrets bound to a script uploaded to a Workers for Platforms namespace.
Workers for Platforms
List Scripts in Namespace
Fetch a list of scripts uploaded to a Workers for Platforms namespace.
Workers for Platforms
Patch dispatch namespace
Patch a Workers for Platforms namespace. Omitted fields are left unchanged.
Workers for Platforms
Patch multiple script secrets
Create, update, or delete multiple secrets on a script in a single operation using JSON Merge Patch (RFC 7396). Usage: - To create or update a secret, set its value to a secret object. - To delete a secret, set its value to `null`. - Secrets not included in the request are left unchanged.
Workers for Platforms
Patch Script Settings
Patch script metadata, such as bindings.
Workers for Platforms
Update dispatch namespace
Update a Workers for Platforms namespace.
Workers for Platforms
Put Script Content
Put script content for a script uploaded to a Workers for Platforms namespace.
Workers for Platforms
Add script secret
Add a secret to a script uploaded to a Workers for Platforms namespace.
Workers for Platforms
Put Script Tag
Put a single tag on a script uploaded to a Workers for Platforms namespace.
Workers for Platforms
Put Script Tags
Put script tags for a script uploaded to a Workers for Platforms namespace.
Workers for Platforms
Delete Worker
Delete a worker from a Workers for Platforms namespace. This call has no response body on a successful delete.
Workers for Platforms
Create Assets Upload Session
Start uploading a collection of assets for use in a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/.
Workers for Platforms
Upload Worker Module
Upload a worker module to a Workers for Platforms namespace. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/.
Workers for Platforms
Worker Details
Fetch information about a script uploaded to a Workers for Platforms namespace.
Workers for Platforms
Get Alert Types
Gets a list of all alert types for which an account is eligible.
Notification Alert Types
Create PagerDuty integration token
Creates a new token for integrating with PagerDuty.
Notification destinations with PagerDuty
Connect PagerDuty
Links PagerDuty with the account using the integration token.
Notification destinations with PagerDuty
Delete PagerDuty Services
Deletes all the PagerDuty Services connected to the account.
Notification destinations with PagerDuty
List PagerDuty services
Get a list of all configured PagerDuty services.
Notification destinations with PagerDuty
List History
Gets a list of history records for notifications sent to an account. The records are displayed for last `x` number of days based on the zone plan (free = 30, pro = 30, biz = 30, ent = 90).
Notification History
Get delivery mechanism eligibility
Get a list of all delivery mechanism types for which an account is eligible.
Notification Mechanism Eligibility
Create a Notification policy
Creates a new Notification policy.
Notification policies
Delete a Notification policy
Delete a Notification policy.
Notification policies
Get a Notification policy
Get details for a single policy.
Notification policies
List Notification policies
Get a list of all Notification policies.
Notification policies
Show email unsubscribe details
Shows details for unsubscribing an email address from a notification policy.
Notification policies
Test a Notification policy
Send a test notification for a policy to verify delivery mechanisms are working as expected.
Notification policies
Unsubscribe email from a Notification policy
Unsubscribes an email address from a notification policy.
Notification policies
Update a Notification policy
Update a Notification policy.
Notification policies
Create Silences
Creates a new silence for an account.
Notification Silences
Delete Silence
Deletes an existing silence for an account.
Notification Silences
Get Silence
Gets a specific silence for an account.
Notification Silences
List Silences
Gets a list of silences for an account.
Notification Silences
Update Silences
Updates existing silences for an account.
Notification Silences
Create a webhook
Creates a new webhook destination.
Notification webhooks
Delete a webhook
Delete a configured webhook destination.
Notification webhooks
Get a webhook
Get details for a single webhooks destination.
Notification webhooks
List webhooks
Gets a list of all configured webhook destinations.
Notification webhooks
Update a webhook
Update a webhook destination.
Notification webhooks
Create OAuth Client
Create a new OAuth client for an account.
OAuth Clients
Delete OAuth Client
Delete an OAuth client.
OAuth Clients
Delete Rotated OAuth Client Secret
Removes the old client secret after a rotation, keeping only the new one. Use this after you have updated your client configuration to use the new secret. The `has_rotated_secret` field on the client indicates whether there is an old secret to delete.
OAuth Clients
OAuth Client Details
Get details of a specific OAuth client.
OAuth Clients
List OAuth Clients
List all OAuth clients for an account.
OAuth Clients
Rotate OAuth Client Secret
Creates a second client secret so you can update your client configuration before deleting the old one. The `has_rotated_secret` field on the client will be set to `true`.
OAuth Clients
Update OAuth Client
Update an existing OAuth client. Only include fields you want to update.
OAuth Clients
List OAuth Scopes
List all available OAuth scopes. This endpoint requires authentication but has no authorization role requirements.
OAuth Clients
Apply On-ramp
Apply an On-ramp (Closed Beta).
On-ramps
Create On-ramp
Create a new On-ramp (Closed Beta).
On-ramps
Delete On-ramp
Delete an On-ramp (Closed Beta).
On-ramps
Export as Terraform
Export an On-ramp to terraform ready file(s) (Closed Beta).
On-ramps
List On-ramps
List On-ramps (Closed Beta).
On-ramps
Patch Magic WAN Address Space
Update the Magic WAN Address Space (Closed Beta).
On-ramps
Read Magic WAN Address Space
Read the Magic WAN Address Space (Closed Beta).
On-ramps
Update Magic WAN Address Space
Update the Magic WAN Address Space (Closed Beta).
On-ramps
Patch On-ramp
Update an On-ramp (Closed Beta).
On-ramps
Plan On-ramp
Plan an On-ramp (Closed Beta).
On-ramps
Read On-ramp
Read an On-ramp (Closed Beta).
On-ramps
Update On-ramp
Update an On-ramp (Closed Beta).
On-ramps
List organizations the user has access to
Retrieve a list of organizations a particular user has access to. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)
Organizations
List organization shares
Lists all organization shares.
Resource Sharing
Create organization
Create a new organization for a user. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)
Organizations
Delete organization.
Delete an organization. The organization MUST be empty before deleting. It must not contain any sub-organizations, accounts, members or users. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) **Access Control:** Restricted to enterprise organizations.
Organizations
Get organization accounts
Retrieve a list of accounts that belong to a specific organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)
Organizations
Get organization profile
Get an organizations profile if it exists. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)
Organizations
Modify organization.
Modify organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)
Organizations
Modify organization profile.
Modify organization profile. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)
Organizations
Get organization
Retrieve the details of a certain organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)
Organizations
Create Certificate
Create an Origin CA certificate. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)).
Origin CA
Get Certificate
Get an existing Origin CA certificate by its serial number. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)).
Origin CA
List Certificates
List all existing Origin CA certificates for a given zone. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)).
Origin CA
Revoke Certificate
Revoke an existing Origin CA certificate by its serial number. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)).
Origin CA
Batch delete origin cloud region mappings
Removes up to 100 IP-to-cloud-region mappings in a single request. Each IP is validated independently — successfully deleted items are returned in the `succeeded` array and IPs that could not be found or are invalid are returned in the `failed` array.
Origin Cloud Regions
Batch create or update origin cloud region mappings
Adds or updates up to 100 IP-to-cloud-region mappings in a single request. Each item is validated independently — valid items are applied and invalid items are returned in the `failed` array. The vendor and region for every item are validated against the list from `GET /zones/{zone_id}/cache/origin_cloud_regions/supported_regions`.
Origin Cloud Regions
Create an origin cloud region mapping
Adds a single IP-to-cloud-region mapping for the zone. The IP must be a valid IPv4 or IPv6 address and is normalized to canonical form before storage (RFC 5952 for IPv6). Returns 400 (code 1145) if a mapping for that IP already exists — use PATCH to update an existing entry. The vendor and region are validated against the list from `GET /zones/{zone_id}/cache/origin_cloud_regions/supported_regions`.
Origin Cloud Regions
Delete an origin cloud region mapping
Removes the cloud region mapping for a single origin IP address. The IP path parameter is normalized before lookup. Returns the deleted entry on success. Returns 404 (code 1163) if no mapping exists for the specified IP. When the last mapping for the zone is removed the underlying rule record is also deleted.
Origin Cloud Regions
Get an origin cloud region mapping
Returns the cloud region mapping for a single origin IP address. The IP path parameter is normalized before lookup (RFC 5952 for IPv6). Returns 404 (code 1142) if the zone has no mappings or if the specified IP has no mapping.
Origin Cloud Regions
List origin cloud region mappings
Returns all IP-to-cloud-region mappings configured for the zone. Each mapping tells Cloudflare which cloud vendor and region hosts the origin at that IP, enabling the edge to route via the nearest Tiered Cache upper-tier co-located with that cloud provider. Returns an empty array when no mappings exist.
Origin Cloud Regions
List supported cloud vendors and regions
Returns the cloud vendors and regions that are valid values for origin cloud region mappings. Each region includes the Tiered Cache upper-tier colocation codes that will be used for cache routing when a mapping targeting that region is active. Requires the zone to have Tiered Cache enabled.
Origin Cloud Regions
Create or update an origin cloud region mapping
Adds or updates a single IP-to-cloud-region mapping for the zone. Unlike POST, this operation is idempotent — if a mapping for the IP already exists it is overwritten. Returns the complete updated list of all mappings for the zone. Returns 403 (code 1164) when the zone has reached the limit of 3,500 IP mappings.
Origin Cloud Regions
Batch delete origin cloud region mappings
Removes up to 100 IP-to-cloud-region mappings in a single request. Each IP is validated independently — successfully deleted items are returned in the `succeeded` array and IPs that could not be found or are invalid are returned in the `failed` array.
Origin Cloud Regions
Batch create or replace origin cloud region mappings
Upserts up to 100 IP-to-cloud-region mappings in a single request. Items in the request body are created or replaced; mappings not included in the request body are preserved unchanged (this is a merge operation, not a full collection replacement). Each item is validated independently — valid items are applied and invalid items are returned in the `failed` array. The vendor and region for every item are validated against the list from `GET /zones/{zone_id}/origin/cloud_regions/supported_regions`.
Origin Cloud Regions
Delete an origin cloud region mapping
Removes the cloud region mapping for a single origin IP address. The IP path parameter is normalized before lookup. Returns the deleted IP on success. Returns 404 if no mapping exists for the specified IP. When the last mapping for the zone is removed the underlying rule record is also deleted.
Origin Cloud Regions
Get an origin cloud region mapping
Returns the cloud region mapping for a single origin IP address. The IP path parameter is normalized before lookup (RFC 5952 for IPv6). Returns 404 if the zone has no mappings or if the specified IP has no mapping.
Origin Cloud Regions
List origin cloud region mappings
Returns all IP-to-cloud-region mappings configured for the zone with pagination support. Each mapping tells Cloudflare which cloud vendor and region hosts the origin at that IP, enabling the edge to route via the nearest Tiered Cache upper-tier co-located with that cloud provider. Returns an empty array when no mappings exist.
Origin Cloud Regions
List supported cloud vendors and regions
Returns the cloud vendors and regions that are valid values for origin cloud region mappings. Each region includes the Tiered Cache upper-tier colocation codes that will be used for cache routing when a mapping targeting that region is active. Requires the zone to have Tiered Cache enabled.
Origin Cloud Regions
Create or replace an origin cloud region mapping
Creates a new IP-to-cloud-region mapping or replaces the existing mapping for the specified IP. PUT is idempotent — calling it repeatedly with the same body produces the same result. The IP path parameter is normalized to canonical form (RFC 5952 for IPv6) before storage. The vendor and region are validated against the list from `GET /zones/{zone_id}/origin/cloud_regions/supported_regions`. Returns 400 if the `origin_ip` in the body does not match the URL path parameter. Returns 403 (code 1164) when the zone has reached the limit of 3,500 IP mappings.
Origin Cloud Regions
Create a Page Rule
Creates a new Page Rule.
Page Rules
Delete a Page Rule
Deletes an existing Page Rule.
Page Rules
Edit a Page Rule
Updates one or more fields of an existing Page Rule.
Page Rules
Get a Page Rule
Fetches the details of a Page Rule.
Page Rules
List Page Rules
Fetches Page Rules in a zone.
Page Rules
Update a Page Rule
Replaces the configuration of an existing Page Rule. The configuration of the updated Page Rule will exactly match the data passed in the API request.
Page Rules
Create a Page Shield policy
Create a Page Shield policy.
Page Shield
Delete a Page Shield policy
Delete a Page Shield policy by ID.
Page Shield
Get a Page Shield connection
Fetches a connection detected by Page Shield by connection ID.
Page Shield
Get a Page Shield cookie
Fetches a cookie collected by Page Shield by cookie ID.
Page Shield
Get a Page Shield policy
Fetches a Page Shield policy by ID.
Page Shield
Get a Page Shield script
Fetches a script detected by Page Shield by script ID.
Page Shield
Get Page Shield settings
Fetches the Page Shield settings.
Page Shield
List Page Shield connections
Lists all connections detected by Page Shield.
Page Shield
List Page Shield Cookies
Lists all cookies collected by Page Shield.
Page Shield
List Page Shield policies
Lists all Page Shield policies.
Page Shield
List Page Shield scripts
Lists all scripts detected by Page Shield.
Page Shield
Update a Page Shield policy
Update a Page Shield policy by ID.
Page Shield
Update Page Shield settings
Updates Page Shield settings.
Page Shield
Check missing assets
Check which of the provided file hashes are missing from the Pages asset store. Returns a list of missing hashes that need to be uploaded. Used as part of the Pages Direct Upload workflow. Authenticate with the JWT obtained from the upload-token endpoint: GET /accounts/{account_id}/pages/projects/{project_name}/upload-token
Pages Assets
Upload asset
Upload one or more files to the Pages asset store. Each file is identified by its content hash and is uploaded using the same JSON shape as the Cloudflare KV bulk write API. Used as part of the Pages Direct Upload workflow. Authenticate with the JWT obtained from the upload-token endpoint: GET /accounts/{account_id}/pages/projects/{project_name}/upload-token
Pages Assets
Upsert asset hashes
Register the provided file hashes as recently uploaded to the Pages asset store. Used as part of the Pages Direct Upload workflow so future deployments can avoid re-uploading files that are already present. Authenticate with the JWT obtained from the upload-token endpoint: GET /accounts/{account_id}/pages/projects/{project_name}/upload-token
Pages Assets
Create deployment
Start a new deployment from production. The repository and account must have already been authorized on the Cloudflare Pages dashboard.
Pages Deployment
Create deployment tail
Start a tail that receives logs and exception data.
Pages Deployment
Delete deployment
Delete a deployment.
Pages Deployment
Delete deployment tail
Deletes a tail from a Pages deployment.
Pages Deployment
Get deployment info
Fetch information about a deployment.
Pages Deployment
Get deployment logs
Fetch deployment logs for a project.
Pages Deployment
Get deployments
Fetch a list of project deployments.
Pages Deployment
Retry deployment
Retry a previous deployment.
Pages Deployment
Rollback deployment
Rollback the production deployment to a previous deployment. You can only rollback to succesful builds on production.
Pages Deployment
Add domain
Add a new domain for the Pages project.
Pages Domains
Delete domain
Delete a Pages project's domain.
Pages Domains
Get domain
Fetch a single domain.
Pages Domains
Get domains
Fetch a list of all domains associated with a Pages project.
Pages Domains
Patch domain
Retry the validation status of a single domain.
Pages Domains
Connect project source
Connect a Git repository source to an existing Pages project.
Pages Project
Create project
Create a new project.
Pages Project
Delete project
Delete a project by name.
Pages Project
Disconnect project source
Disconnect the Git repository source from an existing Pages project.
Pages Project
Get project
Fetch a project by name.
Pages Project
Get projects
Fetch a list of all user projects.
Pages Project
Get upload token
Get a short-lived JWT for Pages Direct Upload asset operations.
Pages Project
Update project
Set new attributes for an existing project. Modify environment variables. To delete an environment variable, set the key to null.
Pages Project
Purge build cache
Purge all cached build artifacts for a Pages project
Pages Build Cache
Get Passive DNS by IP
Gets a list of all the domains that have resolved to a specific IP address.
Passive DNS by IP
Update alerts on submitted domains by ID
Return a success message after updating alerts on submitted domains by ID
brand_protection
Update verification statuses of tracked URLs to awaiting by ID
Return a success message after updating verification statuses of tracked URLs to awaiting by ID
brand_protection
Update verification statuses of tracked URLs to disproven by ID
Return a success message after updating verification statuses of tracked URLs to disproven by ID
brand_protection
Update verification statuses of tracked URLs to confirmed by ID
Return a success message after updating verification statuses of tracked URLs to confirmed by ID
brand_protection
Update verification statuses of submitted URLs to awaiting by ID
Return a success message after updating verification statuses of submitted URLs to awaiting by ID
brand_protection
Update saved string queries by ID
Update a saved query's tag, scan setting, or string_matches (pattern). When string_matches is provided, the query parameters and hash are updated. At least one of tag, scan, or string_matches is required.
domain_search
Update verification statuses of submitted URLs to disproven by ID
Return a success message after updating verification statuses of submitted URLs to disproven by ID
brand_protection
Update verification statuses of submitted URLs to confirmed by ID
Return a success message after updating verification statuses of submitted URLs to confirmed by ID
brand_protection
Updates a category
Update an existing category by its identifier.
Category
Update collection
Updates collection name and/or metadata. Schema (columns) cannot be modified.
Collections
Update column
Update name, type, required, or position of a column.
Collections
Updates an existing dataset
Update an existing dataset by its identifier.
Dataset
Update a saved event query
Update an existing saved event query by its ID
Event
Updates a raw event
Update raw data for a specific event.
Event
Updates an event
Update an existing event by its identifier.
Event
Bulk update events
Updates multiple events with the same field values. Maximum 100 events per request.
Event
Patch Hyperdrive
Patches and returns the specified Hyperdrive configuration. Custom caching settings are not kept if caching is disabled.
Hyperdrive
Updates an indicator
Updates an existing indicator's properties.
Indicator
Update collection item
Update an item in a collection with partial data.
Collections
Patch Latest Version
Only `/versions/latest` is supported. Creates a new version by applying a JSON Merge Patch (RFC 7396) to the latest version. Patching a specific version ID is not supported. Omitted fields are inherited from the latest version.
Versions
Update a preset
Update a preset by the provided preset ID
Presets
Updates a tag category (SoT)
Updates a Source-of-Truth tag category by UUID.
TagCategory
Updates a tag (SoT)
Updates a Source-of-Truth tag by UUID.
Tag
Update domain query
Update a saved brand protection domain query with string match patterns
Brand Protection
Update Stream
Update a Stream.
workers_pipelines_other
Pause integration
Pauses an integration, stopping all crawlers.
Integrations
Pause/Resume/Stop recording
Pause/Resume/Stop a given recording ID.
Recordings
Creates the stripe config for a crawler
Creates the stripe config for a crawler.
ppc_stripe
Deletes the stripe config for a crawler
Deletes the stripe config for a crawler.
ppc_stripe
Gets the stripe config for a crawler
Gets the stripe config for a crawler.
ppc_stripe
Creates pay-per-crawl config for a zone
Creates the pay-per-crawl config for a zone.
ppc_config
Get the pay-per-crawl config
Gets the pay-per-crawl config for a zone including the bot configuration.
ppc_config
Changes pay-per-crawl config for a zone
Changes the pay-per-crawl config for a zone.
ppc_config
Creates the stripe config for a publisher
Creates the stripe config for a publisher.
ppc_stripe
Deletes the stripe config for a publisher
Deletes the stripe config for a publisher.
ppc_stripe
Gets the stripe config for a publisher
Gets the stripe config for a publisher.
ppc_stripe
Gets the can_be_enabled zone setting
Provided a list of pay-per-crawl configured zones this method will return whether they can enable PPC or not.
ppc_config
Set can_be_enabled setting on zones
Allows an account admin to set the can_be_enabled setting on a list of zones.
ppc_config
Delete Hostname Client Certificate
Removes a client certificate used for authenticated origin pulls on a specific hostname. Note: Before deleting the certificate, you must first invalidate the hostname for client authentication by sending a PUT request with `enabled` set to null. After invalidating the association, the certificate can be safely deleted.
Per-hostname Authenticated Origin Pull
Enable or Disable a Hostname for Client Authentication
Associate a hostname to a certificate and enable, disable or invalidate the association. If disabled, client certificate will not be sent to the hostname even if activated at the zone level. 100 maximum associations on a single certificate are allowed. Note: Use a null value for parameter *enabled* to invalidate the association.
Per-hostname Authenticated Origin Pull
Get the Hostname Client Certificate
Get the certificate by ID to be used for client authentication on a hostname.
Per-hostname Authenticated Origin Pull
Get the Hostname Status for Client Authentication
Retrieves the client certificate authentication status for a specific hostname, showing whether authenticated origin pulls are enabled.
Per-hostname Authenticated Origin Pull
List Certificates
Lists all client certificates configured for per-hostname authenticated origin pulls on the zone.
Per-hostname Authenticated Origin Pull
List Hostname Associations
List certificate ID - hostname associations for the given zone. Shows which hostnames are associated to which certificates for authenticated origin pulls.
Per-hostname Authenticated Origin Pull
Upload a Hostname Client Certificate
Upload a certificate to be used for client authentication on a hostname. 10 hostname certificates per zone are allowed.
Per-hostname Authenticated Origin Pull
Delete TLS setting for hostname
Delete the tls setting value for the hostname.
Per-Hostname TLS Settings
Get TLS setting for hostname
Get the requested TLS setting for the hostname.
Per-Hostname TLS Settings
List TLS setting for hostnames
List the requested TLS setting for the hostnames under this zone.
Per-Hostname TLS Settings
Edit TLS setting for hostname
Update the tls setting value for the hostname.
Per-Hostname TLS Settings
List Token Permission Groups
Find all available permission groups for API Tokens.
User API Tokens
Create new brands
Return new brands
brand_protection
Create new patterns for brands by ID
Return a success message after creating new patterns for brands by ID
brand_protection
Create new saved logo queries from image files
Return new saved logo queries created from image files
logo_match
Create new saved string queries
Return a success message after creating new saved string queries
domain_search
Create new saved string queries in bulk
Return a success message after creating new saved string queries in bulk
domain_search
Create new logo queries from image files
Return new logo queries created from image files
logo_match
Create new logo queries from URLs
Return new logo queries created from URLs
logo_match
Create new string queries
Return new string queries
domain_search
Create new URL submissions
Return new URL submissions
brand_protection
Create Logpush job
Creates a new Logpush job for an account.
Logpush jobs for an account
Get ownership challenge
Gets a new ownership challenge sent to your destination.
Logpush jobs for an account
Validate ownership challenge
Validates ownership challenge of the destination.
Logpush jobs for an account
Validate origin
Validates logpull origin with logpull_options.
Logpush jobs for an account
Update CMB config
Updates CMB config.
Logcontrol CMB config for an account
Posts a file to Binary Storage
Uploads a binary file to Cloudforce One's binary database for malware analysis and threat intelligence correlation.
BinDB
Creates a new category
Create a new event category for the account.
Category
Updates a category
Update an existing category by its identifier.
Category
Create a new collection
Creates a collection with four patterns: schema-only (empty collection), rows-only (inferred schema), schema+rows (validated data), or file upload (CSV/JSON/JSONL)
Collections
Add column to collection
Adds a new column to an existing collection schema. Existing items will have NULL for the new column unless a default value is provided.
Collections
Create account commands
Initiate commands for up to 10 devices per account.
DEX Remote Commands
Create a new Scan Config
Create a new Scan Config
Scans
Update an existing Scan Config
Update an existing Scan Config
Scans
Create a relationship between two events
Creates a directed relationship between two events. The relationship is from parent to child with a specified type.
Event
Creates a dataset
Create a new dataset in the account.
Dataset
Populate dataset-specific lookup tables from existing Events data with batch processing
Populate dataset-specific lookup tables by scanning existing event data with batch processing.
Datasets
Updates an existing dataset
Update an existing dataset by its identifier.
Dataset
Creates bulk DOS event with relationships and indicators
This method is deprecated. Please use `event_create_bulk` instead
Event
Copies specified events from one dataset to another dataset
Copy one or more events from a source dataset to a destination dataset.
Event
Creates a new event
To create a dataset, see the [`Create Dataset`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create/) endpoint. When `datasetId` parameter is unspecified, it will be created in a default dataset named `Cloudforce One Threat Events`.
Event
Creates bulk events
The `datasetId` parameter must be defined. To list existing datasets (and their IDs) in your account, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint.
Event
GraphQL endpoint for event aggregation
Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation.
Event
GraphQL endpoint for event aggregation
Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation.
Event
Moves specified events from one dataset to another dataset
Move one or more events from a source dataset to a destination dataset.
Event
Create a saved event query
Create a new saved event query for the account
Event
Update a saved event query
Update an existing saved event query by its ID
Event
Updates a raw event
Update raw data for a specific event.
Event
Creates event references for a event
Create one or more references between events.
Event
Adds a tag to an event
Add one or more tags to an event.
Event
Updates an event
Update an existing event by its identifier.
Event
Create a group
Create a group
Groups
Create a group member
Create a group member
Groups
Creates a new indicator
Creates a new indicator with the specified type and related datasets.
Indicator
Creates multiple indicators in bulk
Creates multiple indicators at once with their respective types and related datasets.
Indicator
Create a new indicator type
Creates a new indicator type and initializes its dedicated Durable Object
Indicators
Insert query
Create a new saved brand protection query with string match patterns
Brand Protection
Insert logo query
Create a new saved brand protection logo query for visual similarity matching
Brand Protection
Internal route for testing URL submissions
Internal route for testing URL submissions.
brand_protection
Create item(s)
Create one or more items in a collection. Supports single item (data field) or bulk creation (data array). Item data is validated against the collection schema.
Collections - Items
Search items (advanced filtering)
Search collection items with advanced filtering. Supports operators (eq, neq, gt, lt, gte, lte, contains, is_empty, is_not_empty) and AND/OR logic for complex queries.
Collections - Items
Generate takedown letter
Generate a takedown letter from a template. Returns V4 JSON for text format or a PDF binary for pdf format.
Brand Protection
Create letter template
Create a new user-defined takedown letter template
Brand Protection
Create a permission for dataset
Create a permission
Permissions
Create a preset
Creates a preset belonging to the current App
Presets
Bulk import account Email Sending suppressions
Bulk import account Email Sending suppressions
Email Sending suppressions
Create account Email Sending suppression
Create account Email Sending suppression
Email Sending suppressions
Create account email suppression
Creates a new email suppression for the specified account.
Email Routing suppressions
Create account email suppression
Creates a new email suppression for the specified account.
Email Sending suppressions
Create zone email suppression
Creates a new email suppression for the specified zone.
Email Routing suppressions
Create zone email suppression
Creates a new email suppression for the specified zone.
Email Sending suppressions
Search scanned images
Submit an image and find the n closest matches from the scanned images index without creating any match records. Returns similarity scores and metadata for each match.
Brand Protection
Generate summary of Transcripts for the session
Trigger Summary generation of Transcripts for the session ID.
Sessions
Creates a new tag category (SoT)
Creates a new Source-of-Truth tag category for an account.
TagCategory
Creates a new tag
Creates a new tag to be used accross threat events.
Tag
Create takedown letter
Generate a takedown letter for a notice and persist the rendered text. The PDF is generated lazily on download.
Brand Protection
Create takedown notice
Create a new takedown notice for a domain suspected of trademark infringement.
Brand Protection
Lookup takedown notices by domains
Bulk lookup of takedown notices by domain names. Returns an array of { domain, queryId, notice } entries (notice is null when no match exists). Supports optional queryId or queryIds to scope lookups per query. Uses POST to avoid URL length limits when looking up many domains. This endpoint is read-only. Domains are normalized (trimmed, lowercased) and deduplicated.
Brand Protection
[DEPRECATED] Create Pipeline
[DEPRECATED] Create a new pipeline. Use the new /pipelines/v1/pipelines endpoint instead.
workers_pipelines_other
Create Pipeline
Create a new Pipeline.
workers_pipelines_other
Create Sink
Create a new Sink.
workers_pipelines_other
Create Stream
Create a new Stream.
workers_pipelines_other
Validate SQL
Validate Arroyo SQL.
workers_pipelines_other
Create Instant Logs job
Creates a new Instant Logs job for a zone.
Instant Logs jobs for a zone
Create Logpush job
Creates a new Logpush job for a zone.
Logpush jobs for a zone
Get ownership challenge
Gets a new ownership challenge sent to your destination.
Logpush jobs for a zone
Validate ownership challenge
Validates ownership challenge of the destination.
Logpush jobs for a zone
Validate destination
Validates destination.
Logpush jobs for a zone
Check destination exists
Checks if there is an existing job with a destination.
Logpush jobs for a zone
Validate origin
Validates logpull origin with logpull_options.
Logpush jobs for a zone
Update log retention flag
Updates log retention flag for Logpull API.
Logs Received
Publish Zaraz preview configuration
Publish current Zaraz preview configuration for a zone.
Zaraz
Get Zone Precursor Config
Retrieve a zone's Precursor configuration: the zone-level `default_mode` and the ordered list of `enforcement_rules`.
Precursor
Update Zone Precursor Config
Updates the Precursor configuration for a zone. `default_mode` sets the zone-level enforcement mode. `enforcement_rules` is the ordered list of rules that override enforcement for matching requests. This is a partial update: only the fields present in the request body are changed. - Sending an empty array (`[]`) clears all enforcement rules. - At least one of `default_mode` or `enforcement_rules` must be present; an empty body (`{}`) is rejected with `400`. - Rule `id` is read-only (assigned by Cloudflare) and ignored on input. - Rule `mode` must be `min-friction` or `max-security` (`off` is not a valid rule mode; use `default_mode` to disable enforcement).
Precursor
Create Cloud Integration
Create a new Cloud Integration (Closed Beta).
Cloud Integrations
Delete Cloud Integration
Delete a Cloud Integration (Closed Beta).
Cloud Integrations
Run Discovery
Run discovery for a Cloud Integration (Closed Beta).
Cloud Integrations
Run Discovery for All Integrations
Run discovery for all Cloud Integrations in an account (Closed Beta).
Cloud Integrations
Get Cloud Integration Setup Config
Get initial configuration to complete Cloud Integration setup (Closed Beta).
Cloud Integrations
List Cloud Integrations
List Cloud Integrations (Closed Beta).
Cloud Integrations
Patch Cloud Integration
Update a Cloud Integration (Closed Beta).
Cloud Integrations
Read Cloud Integration
Read a Cloud Integration (Closed Beta).
Cloud Integrations
Update Cloud Integration
Update a Cloud Integration (Closed Beta).
Cloud Integrations
Create a DLS prefix binding
Bind a CIDR from a BYOIP prefix to a region. This requires the **IP Prefixes Write** permission in addition to **DLS Write**, because the binding is created against a BYOIP prefix in Addressing.
Prefix Bindings
Delete a DLS prefix binding
Delete a BYOIP prefix binding. Like creating a binding, this requires **IP Prefixes Write** in addition to **DLS Write**.
Prefix Bindings
Get a DLS prefix binding
Retrieve a single BYOIP prefix binding by ID.
Prefix Bindings
Get a DLS region
Retrieve a single DLS region (managed or custom) by ID or region key.
Regions
List DLS prefix bindings for an account
List the BYOIP prefix bindings configured for an account.
Prefix Bindings
List DLS regions for an account
List the DLS regions (managed and custom) available to an account.
Regions
Update a DLS prefix binding
Update the region of an existing BYOIP prefix binding. Like creating a binding, this requires **IP Prefixes Write** in addition to **DLS Write**.
Prefix Bindings
Purge build cache
Clear the build cache for a specific trigger
Triggers
Update Logpush job
Updates a Logpush job.
Logpush jobs for an account
Update a group
Update a group
Groups
Update letter template
Update a user-defined takedown letter template. System templates cannot be modified.
Brand Protection
Update a permission for dataset
Update a permission
Permissions
Replace a preset
Replace all details for the preset using the provided preset ID.
Presets
Update takedown notice
Update a takedown notice (e.g. change status to sent, resolved, etc.).
Brand Protection
[DEPRECATED] Update Pipeline
[DEPRECATED] Update an existing pipeline. Use the new /pipelines/v1/pipelines endpoint instead.
workers_pipelines_other
Rerun the Activation Check
Triggeres a new activation check for a PENDING Zone. This can be triggered every 5 min for paygo/ent customers, every hour for FREE Zones.
Zone
Update Logpush job
Updates a Logpush job.
Logpush jobs for a zone
Update Zaraz configuration
Updates Zaraz configuration for a zone.
Zaraz
Restore Zaraz historical configuration by ID
Restores a historical published Zaraz configuration by ID for a zone.
Zaraz
Update Zaraz workflow
Updates Zaraz workflow for a zone.
Zaraz
Delete query
Delete a saved query.
Saved Queries
Get query
Retrieve a saved query.
Saved Queries
List queries
List saved queries.
Saved Queries
Update query
Update saved query.
Saved Queries
Save query
Persist query for later use.
Saved Queries
Acknowledge + Retry Queue Messages
Acknowledge + Retry messages from a Queue
Queue
Delete Previewed Queue Messages
Delete previewed messages from a Queue. Note that messages acknowledged this way aren't considered delivered, they are instantly deleted from this queue and do not affect metrics.
Queue
Create Queue
Create a new queue
Queue
Create a Queue Consumer
Creates a new consumer for a Queue
Queue
Delete Queue
Deletes a queue
Queue
Delete Queue Consumer
Deletes the consumer for a queue.
Queue
Get Queue
Get details about a specific queue.
Queue
Get Queue Consumer
Fetches the consumer for a queue by consumer id
Queue
Get Queue Metrics
Return best-effort metrics for a queue. Values may be approximate due to the distributed nature of queues.
Queue
List Queues
Returns the queues owned by an account.
Queue
List Queue Consumers
Returns the consumers for a Queue
Queue
Preview Queue Messages
Preview messages from a Queue without leasing them. Messages remain available for subsequent preview or pull operations.
Queue
Pull Queue Messages
Pull a batch of messages from a Queue
Queue
Purge Queue
Deletes all messages from the Queue.
Queue
Get Queue Purge Status
Get details about a Queue's purge status.
Queue
Push Message
Push a message to a Queue
Queue
Push Message Batch
Push a batch of message to a Queue
Queue
Update Queue
Updates a Queue. Note that this endpoint does not support partial updates. If successful, the Queue's configuration is overwritten with the supplied configuration.
Queue
Update Queue Consumer
Updates the consumer for a queue, or creates one if it does not exist.
Queue
Update Queue
Updates a Queue.
Queue
Attach Custom Domain To Bucket
Register a new custom domain for an existing R2 bucket.
R2 Bucket
Create Bucket
Creates a new R2 bucket.
R2 Bucket
Create Temporary Access Credentials
Creates temporary access credentials on a bucket that can be optionally scoped to prefixes or objects.
R2 Bucket
Delete Bucket
Deletes an existing R2 bucket.
R2 Bucket
Delete Bucket CORS Policy
Delete the CORS policy for a bucket.
R2 Bucket
Disable Sippy
Disables Sippy on this bucket.
R2 Bucket
Remove Custom Domain From Bucket
Remove custom domain registration from an existing R2 bucket.
R2 Bucket
Delete Object
Deletes an object from an R2 bucket. For most workloads, we recommend using R2's [S3-compatible API](https://developers.cloudflare.com/r2/api/s3/api/) or a [Worker with an R2 binding](https://developers.cloudflare.com/r2/api/workers/workers-api-reference/) instead.
R2 Object
Delete Objects
Deletes multiple objects from an R2 bucket. Two modes are supported: 1. **Delete by list** (default): Provide a JSON array of object keys in the request body. All listed objects are deleted; per-key errors are reported in the response. 2. **Delete by prefix**: Provide the `prefix` query parameter (and an empty/no body) to schedule deletion of every object whose key begins with the given prefix. This kicks off an asynchronous prefix-delete job and returns the job descriptor. For most workloads, we recommend using R2's [S3-compatible API](https://developers.cloudflare.com/r2/api/s3/api/) or a [Worker with an R2 binding](https://developers.cloudflare.com/r2/api/workers/workers-api-reference/) instead.
R2 Object
Configure Custom Domain Settings
Edit the configuration for a custom domain on an existing R2 bucket.
R2 Bucket
Delete Event Notification Rules
Delete an event notification rule. **If no body is provided, all rules for specified queue will be deleted**.
R2 Bucket
Get Account-Level Metrics
Get Storage/Object Count Metrics across all buckets in your account. Note that Account-Level Metrics may not immediately reflect the latest data.
R2 Account
Get Bucket
Gets properties of an existing R2 bucket.
R2 Bucket
Get Bucket CORS Policy
Get the CORS policy for a bucket.
R2 Bucket
Get Object Lifecycle Rules
Get object lifecycle rules for a bucket.
R2 Bucket
Get Local Uploads Configuration
Get the local uploads configuration for a bucket. When enabled, object's data is written to the nearest region first, then asynchronously replicated to the bucket's primary region.
R2 Bucket
Get Bucket Lock Rules
Get lock rules for a bucket.
R2 Bucket
Get r2.dev Domain of Bucket
Gets state of public access over the bucket's R2-managed (r2.dev) domain.
R2 Bucket
Get Sippy Configuration
Gets configuration for Sippy for an existing R2 bucket.
R2 Bucket
Get Custom Domain Settings
Get the configuration for a custom domain on an existing R2 bucket.
R2 Bucket
Get Event Notification Rule
Get a single event notification rule.
R2 Bucket
List Event Notification Rules
List all event notification rules for a bucket.
R2 Bucket
Get Object
Retrieves an object from an R2 bucket. Returns the object body along with metadata headers. For most workloads, we recommend using R2's [S3-compatible API](https://developers.cloudflare.com/r2/api/s3/api/) or a [Worker with an R2 binding](https://developers.cloudflare.com/r2/api/workers/workers-api-reference/) instead.
R2 Object
List Buckets
Lists all R2 buckets on your account.
R2 Bucket
List Custom Domains of Bucket
Gets a list of all custom domains registered with an existing R2 bucket.
R2 Bucket
List Objects
Lists objects in an R2 bucket. Returns object metadata including key, size, etag, last modified date, HTTP metadata, and custom metadata. For most workloads, we recommend using R2's [S3-compatible API](https://developers.cloudflare.com/r2/api/s3/api/) or a [Worker with an R2 binding](https://developers.cloudflare.com/r2/api/workers/workers-api-reference/) instead.
R2 Object
Patch Bucket
Updates properties of an existing R2 bucket.
R2 Bucket
Put Bucket CORS Policy
Set the CORS policy for a bucket.
R2 Bucket
Put Object Lifecycle Rules
Set the object lifecycle rules for a bucket.
R2 Bucket
Put Local Uploads Configuration
Set the local uploads configuration for a bucket. When enabled, object's data is written to the nearest region first, then asynchronously replicated to the bucket's primary region.
R2 Bucket
Put Bucket Lock Rules
Set lock rules for a bucket.
R2 Bucket
Update r2.dev Domain of Bucket
Updates state of public access over the bucket's R2-managed (r2.dev) domain.
R2 Bucket
Enable Sippy
Sets configuration for Sippy for an existing R2 bucket.
R2 Bucket
Create Event Notification Rule
Create event notification rule.
R2 Bucket
Upload Object
Uploads an object to an R2 bucket. The object body is provided as the request body. Returns metadata about the uploaded object. The maximum upload size for this endpoint is 300 MB. For most workloads, we recommend using R2's [S3-compatible API](https://developers.cloudflare.com/r2/api/s3/api/) or a [Worker with an R2 binding](https://developers.cloudflare.com/r2/api/workers/workers-api-reference/) instead.
R2 Object
Get agent readiness summary
Returns a summary of AI agent readiness scores across scanned domains, grouped by the specified dimension. Data is sourced from weekly bulk scans. All values are raw domain counts.
Radar Agent Readiness
Get AI bots HTTP requests distribution by dimension
Retrieves an aggregated summary of AI bots HTTP requests grouped by the specified dimension.
Radar AI Bots
Get AI user agents summary
Retrieves the distribution of traffic by AI user agent.
Radar AI Bots
Get AI bots HTTP requests time series
Retrieves AI bots HTTP request volume over time.
Radar AI Bots
Get time series distribution of AI bots HTTP requests by dimension.
Retrieves the distribution of HTTP requests from AI bots, grouped by the specified dimension over time.
Radar AI Bots
Get AI user agents time series
Retrieves the distribution of traffic by AI user agent over time.
Radar AI Bots
Get Workers AI inference distribution by dimension
Retrieves an aggregated summary of the number of inferences run on Workers AI, grouped by the specified dimension.
Radar AI Inference
Get Workers AI models summary
Retrieves the distribution of the number of inferences by model.
Radar AI Inference
Get Workers AI tasks summary
Retrieves the distribution of the number of inferences by task.
Radar AI Inference
Get time series distribution of Workers AI inference by dimension.
Retrieves the distribution of the number of inferences run on Workers AI, grouped by the specified dimension over time.
Radar AI Inference
Get Workers AI models time series
Retrieves the distribution of the number of inferences by model over time.
Radar AI Inference
Get Workers AI tasks time series
Retrieves the distribution of the number of inferences by task over time.
Radar AI Inference
Get AI markdown for agents reduction ratio summary
Retrieves the overall median HTML-to-markdown reduction ratio for AI agent requests over the given date range.
Radar Markdown for Agents
Get AI markdown for agents reduction ratio time series
Retrieves the median HTML-to-markdown reduction ratio over time for AI agent requests.
Radar Markdown for Agents
Get latest annotations
Retrieves the latest annotations.
Radar Annotations
Get latest Internet outages and anomalies
Retrieves the latest Internet outages and anomalies.
Radar Annotations
Get the number of outages by location
Retrieves the number of outages by location.
Radar Annotations
Get AS rankings by botnet threat feed activity
Retrieves a ranked list of Autonomous Systems based on their presence in the Cloudflare Botnet Threat Feed. Rankings can be sorted by offense count or number of bad IPs. Optionally compare to a previous date to see rank changes.
Radar Autonomous Systems
Get IRR AS-SETs that an AS is a member of
Retrieves Internet Routing Registry AS-SETs that an AS is a member of.
Radar Autonomous Systems
Get AS-level relationships by ASN
Retrieves AS-level relationship for given networks.
Radar Autonomous Systems
Get layer 3 attacks summary by dimension
Retrieves the distribution of layer 3 attacks by the specified dimension.
Radar Layer 3 Attacks
Get layer 3 attacks by bitrate summary
Retrieves the distribution of layer 3 attacks by bitrate.
Radar Layer 3 Attacks
Get layer 3 attacks by duration summary
Retrieves the distribution of layer 3 attacks by duration.
Radar Layer 3 Attacks
Get layer 3 attacks by targeted industry summary
Retrieves the distribution of layer 3 attacks by targeted industry.
Radar Layer 3 Attacks
Get layer 3 attacks by IP version summary
Retrieves the distribution of layer 3 attacks by IP version.
Radar Layer 3 Attacks
Get layer 3 attacks by protocol summary
Retrieves the distribution of layer 3 attacks by protocol.
Radar Layer 3 Attacks
Get layer 3 attacks by vector summary
Retrieves the distribution of layer 3 attacks by vector.
Radar Layer 3 Attacks
Get layer 3 attacks by targeted vertical summary
Retrieves the distribution of layer 3 attacks by targeted vertical.
Radar Layer 3 Attacks
Get layer 3 attacks by bytes time series
Retrieves layer 3 attacks over time.
Radar Layer 3 Attacks
Get layer 3 attacks time series grouped by dimension
Retrieves the distribution of layer 3 attacks grouped by dimension over time.
Radar Layer 3 Attacks
Get layer 3 attacks by bitrate time series
Retrieves the distribution of layer 3 attacks by bitrate over time.
Radar Layer 3 Attacks
Get layer 3 attacks by duration time series
Retrieves the distribution of layer 3 attacks by duration over time.
Radar Layer 3 Attacks
Get layer 3 attacks by target industries time series
Retrieves the distribution of layer 3 attacks by targeted industry over time.
Radar Layer 3 Attacks
Get layer 3 attacks by IP version time series
Retrieves the distribution of layer 3 attacks by IP version over time.
Radar Layer 3 Attacks
Get layer 3 attacks by protocol time series
Retrieves the distribution of layer 3 attacks by protocol over time.
Radar Layer 3 Attacks
Get layer 3 attacks by vector time series
Retrieves the distribution of layer 3 attacks by vector over time.
Radar Layer 3 Attacks
Get layer 3 attacks by vertical time series
Retrieves the distribution of layer 3 attacks by targeted vertical over time.
Radar Layer 3 Attacks
Get top layer 3 attack pairs (origin and target locations)
Retrieves the top layer 3 attacks from origin to target location. Values are a percentage out of the total layer 3 attacks (with billing country). You can optionally limit the number of attacks by origin/target location (useful if all the top attacks are from or to the same location).
Radar Layer 3 Attacks
Get top industries targeted by layer 3 attacks
This endpoint is deprecated. To continue getting this data, switch to the summary by industry endpoint.
Radar Layer 3 Attacks
Get top origin locations of layer 3 attacks
Retrieves the origin locations of layer 3 attacks.
Radar Layer 3 Attacks
Get top target locations of layer 3 attacks
Retrieves the target locations of layer 3 attacks.
Radar Layer 3 Attacks
Get top verticals targeted by layer 3 attacks
This endpoint is deprecated. To continue getting this data, switch to the summary by vertical endpoint.
Radar Layer 3 Attacks
Get layer 7 attacks summary by dimension
Retrieves the distribution of layer 7 attacks by the specified dimension.
Radar Layer 7 Attacks
Get layer 7 attacks by HTTP method summary
Retrieves the distribution of layer 7 attacks by HTTP method.
Radar Layer 7 Attacks
Get layer 7 attacks by HTTP version summary
Retrieves the distribution of layer 7 attacks by HTTP version.
Radar Layer 7 Attacks
Get layer 7 attacks by targeted industry summary
Retrieves the distribution of layer 7 attacks by targeted industry.
Radar Layer 7 Attacks
Get layer 7 attacks by IP version summary
Retrieves the distribution of layer 7 attacks by IP version.
Radar Layer 7 Attacks
Get layer 7 attacks by managed rules summary
Retrieves the distribution of layer 7 attacks by managed rules.
Radar Layer 7 Attacks
Get layer 7 attacks by mitigation product summary
Retrieves the distribution of layer 7 attacks by mitigation product.
Radar Layer 7 Attacks
Get layer 7 attacks by targeted vertical summary
Retrieves the distribution of layer 7 attacks by targeted vertical.
Radar Layer 7 Attacks
Get layer 7 attacks time series
Retrieves layer 7 attacks over time.
Radar Layer 7 Attacks
Get layer 7 attacks time series grouped by dimension
Retrieves the distribution of layer 7 attacks grouped by dimension over time.
Radar Layer 7 Attacks
Get layer 7 attacks by HTTP method time series
Retrieves the distribution of layer 7 attacks by HTTP method over time.
Radar Layer 7 Attacks
Get layer 7 attacks by HTTP version time series
Retrieves the distribution of layer 7 attacks by HTTP version over time.
Radar Layer 7 Attacks
Get layer 7 attacks by target industries time series
Retrieves the distribution of layer 7 attacks by targeted industry over time.
Radar Layer 7 Attacks
Get layer 7 attacks by IP version time series
Retrieves the distribution of layer 7 attacks by IP version used over time.
Radar Layer 7 Attacks
Get layer 7 attacks by managed rules time series
Retrieves the distribution of layer 7 attacks by managed rules over time.
Radar Layer 7 Attacks
Get layer 7 attacks by mitigation product time series
Retrieves the distribution of layer 7 attacks by mitigation product over time.
Radar Layer 7 Attacks
Get layer 7 attacks by vertical time series
Retrieves the distribution of layer 7 attacks by targeted vertical over time.
Radar Layer 7 Attacks
Get top layer 7 attack pairs (origin and target locations)
Retrieves the top attacks from origin to target location. Values are percentages of the total layer 7 attacks (with billing country). The attack magnitude can be defined by the number of mitigated requests or by the number of zones affected. You can optionally limit the number of attacks by origin/target location (useful if all the top attacks are from or to the same location).
Radar Layer 7 Attacks
Get top industries targeted by layer 7 attacks
This endpoint is deprecated. To continue getting this data, switch to the summary by industry endpoint.
Radar Layer 7 Attacks
Get top origin ASes of layer 7 attacks
Retrieves the top origin autonomous systems of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin autonomous systems determined by the client IP address.
Radar Layer 7 Attacks
Get top origin locations of layer 7 attacks
Retrieves the top origin locations of layer 7 attacks. Values are percentages of the total layer 7 attacks, with the origin location determined by the client IP address.
Radar Layer 7 Attacks
Get top target locations of layer 7 attacks
Retrieves the top target locations of and by layer 7 attacks. Values are a percentage out of the total layer 7 attacks. The target location is determined by the attacked zone's billing country, when available.
Radar Layer 7 Attacks
Get top verticals targeted by layer 7 attacks
This endpoint is deprecated. To continue getting this data, switch to the summary by vertical endpoint.
Radar Layer 7 Attacks
Get BGP hijack events
Retrieves the BGP hijack events.
Radar BGP
Get announced IP address space time series
Retrieves time series data for the announced IP space count, represented as the number of IPv4 /24s and IPv6 /48s, for a given ASN.
Radar BGP
Get top ASes by announced IP space
Returns the top-N autonomous systems by announced IP space at the nearest 8-hour RIB boundary at or before the requested date. The snapped boundary is returned as `anchor_ts`.
Radar BGP
Get prefix-to-ASN mapping
Retrieves the prefix-to-ASN mapping from global routing tables.
Radar BGP
Get Multi-Origin AS (MOAS) prefixes
Retrieves all Multi-Origin AS (MOAS) prefixes in the global routing tables.
Radar BGP
Get BGP route leak events
Retrieves the BGP route leak events.
Radar BGP
List ASes from global routing tables
Retrieves all ASes in the current global routing tables with routing statistics.
Radar BGP
Get tier-1 path segments for an AS
Retrieves the paths an AS uses to reach the tier-1 clique, derived from RouteViews RIB snapshots. Each entry is an ordered AS-path segment (from the queried AS toward a tier-1) with the number of observed paths and peers, and the collectors that observed it. By default segments are merged across all active collectors; pass "collector" to scope to one. The response also includes an "asnInfo" map (keyed by ASN) with the name and country for every ASN in the returned segments plus the queried ASN (best-effort; null when unavailable).
Radar BGP
Get real-time BGP routes for a prefix
Retrieves real-time BGP routes for a prefix, using public real-time data collectors (RouteViews and RIPE RIS).
Radar BGP
Get BGP routing table stats
Retrieves the BGP routing table stats.
Radar BGP
Get upstream composition time series for an AS
Retrieves the share of an AS’s observed paths carried by each direct upstream over time, derived from RouteViews RIB snapshots across all collectors (the combined product). Each upstream ASN is returned as its own series of shares (0–1); the least-significant upstreams beyond the requested limit are grouped into an "OTHER" series. Series share a common set of timestamps.
Radar BGP
Get ASPA changes over time
Retrieves ASPA (Autonomous System Provider Authorization) changes over time. Returns daily aggregated changes including additions, removals, and modifications of ASPA objects.
Radar BGP
Get ASPA objects snapshot
Retrieves current or historical ASPA (Autonomous System Provider Authorization) objects. ASPA objects define which ASNs are authorized upstream providers for a customer ASN.
Radar BGP
Get ASPA count time series
Retrieves ASPA (Autonomous System Provider Authorization) object count over time. Supports filtering by RIR or location (country code) to generate multiple named series. If no RIR or location filter is specified, returns total count.
Radar BGP
Get RPKI ROA deployment time series
Retrieves RPKI ROA (Route Origin Authorization) validation ratios over time. Returns the selected metric as a time series. Supports filtering by ASN or location (country code) — multiple values of the same filter type produce one series per value. If no ASN or location is specified, returns the global aggregate.
Radar BGP
Get BGP time series
Retrieves BGP updates over time. When requesting updates for an autonomous system, only BGP updates of type announcement are returned.
Radar BGP
Get top ASes by BGP updates
Retrieves the top autonomous systems by BGP updates (announcements only).
Radar BGP
Get top ASes by prefix count
Retrieves the full list of autonomous systems on the global routing table ordered by announced prefixes count. The data comes from public BGP MRT data archives and updates every 2 hours.
Radar BGP
Get top prefixes by BGP updates
Retrieves the top network prefixes by BGP updates.
Radar BGP
Get bot details
Retrieves the requested bot information.
Radar Bots
List bots
Retrieves a list of bots.
Radar Bots
Get bots HTTP requests distribution by dimension
Retrieves an aggregated summary of bots HTTP requests grouped by the specified dimension.
Radar Bots
Get bots HTTP requests time series
Retrieves bots HTTP request volume over time.
Radar Bots
Get time series distribution of bots HTTP requests by dimension.
Retrieves the distribution of HTTP requests from bots, grouped by the specified dimension over time.
Radar Bots
List certificate authorities
Retrieves a list of certificate authorities.
Radar Certificate Transparency
Get certificate authority details
Retrieves the requested CA information.
Radar Certificate Transparency
Get certificate log details
Retrieves the requested certificate log information.
Radar Certificate Transparency
List certificate logs
Retrieves a list of certificate logs.
Radar Certificate Transparency
Get crawler HTTP request distribution by dimension
Retrieves an aggregated summary of HTTP requests from crawlers, grouped by the specified dimension.
Radar Web Crawlers
Get time series of crawler HTTP request distribution by dimension
Retrieves the distribution of HTTP requests from crawlers, grouped by the specified dimension over time.
Radar Web Crawlers
Get certificate distribution by dimension
Retrieves an aggregated summary of certificates grouped by the specified dimension.
Radar Certificate Transparency
Get certificates time series
Retrieves certificate volume over time.
Radar Certificate Transparency
Get time series of certificate distribution by dimension
Retrieves the distribution of certificates grouped by the specified dimension over time.
Radar Certificate Transparency
Get AS112 summary by dimension
Retrieves the distribution of AS112 queries by the specified dimension.
Radar AS112
Get AS112 DNS queries time series
Retrieves the AS112 DNS queries over time.
Radar AS112
Get AS112 DNS queries by DNSSEC summary
Retrieves the distribution of DNS queries to AS112 by DNSSEC (DNS Security Extensions) support.
Radar AS112
Get AS112 DNS queries by EDNS summary
Retrieves the distribution of DNS queries to AS112 by EDNS (Extension Mechanisms for DNS) support.
Radar AS112
Get AS112 DNS queries by IP version summary
Retrieves the distribution of DNS queries to AS112 by IP version.
Radar AS112
Get AS112 DNS queries by DNS protocol summary
Retrieves the distribution of DNS queries to AS112 by protocol.
Radar AS112
Get AS112 DNS queries by type summary
Retrieves the distribution of DNS queries to AS112 by type.
Radar AS112
Get AS112 DNS queries by response code summary
Retrieves the distribution of AS112 DNS requests classified by response code.
Radar AS112
Get AS112 time series grouped by dimension
Retrieves the distribution of AS112 queries grouped by dimension over time.
Radar AS112
Get AS112 DNS queries by DNSSEC support time series
Retrieves the distribution of AS112 DNS queries by DNSSEC (DNS Security Extensions) support over time.
Radar AS112
Get AS112 DNS queries by EDNS support summary
Retrieves the distribution of AS112 DNS queries by EDNS (Extension Mechanisms for DNS) support over time.
Radar AS112
Get AS112 DNS queries by IP version time series
Retrieves the distribution of AS112 DNS queries by IP version over time.
Radar AS112
Get AS112 DNS queries by DNS protocol time series
Retrieves the distribution of AS112 DNS requests classified by protocol over time.
Radar AS112
Get AS112 DNS queries by type time series
Retrieves the distribution of AS112 DNS queries by type over time.
Radar AS112
Get AS112 DNS queries by response code time series
Retrieves the distribution of AS112 DNS requests classified by response code over time.
Radar AS112
Get top locations by AS112 DNS queries
Retrieves the top locations by AS112 DNS queries.
Radar AS112
Get top locations by AS112 DNS queries with DNSSEC support
Retrieves the top locations of DNS queries to AS112 with DNSSEC (DNS Security Extensions) support.
Radar AS112
Get top locations by AS112 DNS queries with EDNS support
Retrieves the top locations of DNS queries to AS112 with EDNS (Extension Mechanisms for DNS) support.
Radar AS112
Get top locations by AS112 DNS queries for an IP version
Retrieves the top locations of DNS queries to AS112 for an IP version.
Radar AS112
Get DNS summary by dimension
Retrieves the distribution of DNS queries by the specified dimension.
Radar DNS
Get DNS queries by cache status summary
Retrieves the distribution of DNS queries by cache status.
Radar DNS
Get DNS queries by DNSSEC support summary
Retrieves the distribution of DNS responses by DNSSEC (DNS Security Extensions) support.
Radar DNS
Get DNS queries by DNSSEC awareness summary
Retrieves the distribution of DNS queries by DNSSEC (DNS Security Extensions) client awareness.
Radar DNS
Get DNS queries by DNSSEC end-to-end summary
Retrieves the distribution of DNSSEC-validated answers by end-to-end security status.
Radar DNS
Get DNS queries by IP version summary
Retrieves the distribution of DNS queries by IP version.
Radar DNS
Get DNS queries by matching answer summary
Retrieves the distribution of DNS queries by matching answers.
Radar DNS
Get DNS queries by protocol summary
Retrieves the distribution of DNS queries by DNS transport protocol.
Radar DNS
Get DNS queries by type summary
Retrieves the distribution of DNS queries by type.
Radar DNS
Get DNS queries by response code summary
Retrieves the distribution of DNS queries by response code.
Radar DNS
Get DNS queries by response TTL summary
Retrieves the distribution of DNS queries by minimum response TTL.
Radar DNS
Get DNS queries time series
Retrieves normalized query volume to the 1.1.1.1 DNS resolver over time.
Radar DNS
Get DNS time series grouped by dimension
Retrieves the distribution of DNS queries grouped by dimension over time.
Radar DNS
Get DNS queries by cache status time series
Retrieves the distribution of DNS queries by cache status over time.
Radar DNS
Get DNS queries by DNSSEC support time series
Retrieves the distribution of DNS responses by DNSSEC (DNS Security Extensions) support over time.
Radar DNS
Get DNS queries by DNSSEC awareness time series
Retrieves the distribution of DNS queries by DNSSEC (DNS Security Extensions) client awareness over time.
Radar DNS
Get DNS queries by DNSSEC end-to-end time series
Retrieves the distribution of DNSSEC-validated answers by end-to-end security status over time.
Radar DNS
Get DNS queries by IP version time series
Retrieves the distribution of DNS queries by IP version over time.
Radar DNS
Get DNS queries by matching answer time series
Retrieves the distribution of DNS queries by matching answers over time.
Radar DNS
Get DNS queries by protocol time series
Retrieves the distribution of DNS queries by DNS transport protocol over time.
Radar DNS
Get DNS queries by type time series
Retrieves the distribution of DNS queries by type over time.
Radar DNS
Get DNS queries by response code time series
Retrieves the distribution of DNS queries by response code over time.
Radar DNS
Get DNS queries by response TTL time series
Retrieves the distribution of DNS queries by minimum answer TTL over time.
Radar DNS
Get top ASes by DNS queries
Retrieves the top autonomous systems by DNS queries made to 1.1.1.1 DNS resolver.
Radar DNS
Get top locations by DNS queries
Retrieves the top locations by DNS queries made to 1.1.1.1 DNS resolver.
Radar DNS
Get email routing summary by dimension
Retrieves the distribution of email routing metrics by the specified dimension.
Radar Email Routing
Get email ARC validation summary
Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation.
Radar Email Routing
Get email DKIM validation summary
Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation.
Radar Email Routing
Get email DMARC validation summary
Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation.
Radar Email Routing
Get email encryption status summary
Retrieves the distribution of emails by encryption status (encrypted vs. not-encrypted).
Radar Email Routing
Get email IP version summary
Retrieves the distribution of emails by IP version.
Radar Email Routing
Get email SPF validation summary
Retrieves the distribution of emails by SPF (Sender Policy Framework) validation.
Radar Email Routing
Get email routing time series grouped by dimension
Retrieves the distribution of email routing metrics grouped by dimension over time.
Radar Email Routing
Get email ARC validation time series
Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation over time.
Radar Email Routing
Get email DKIM validation time series
Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation over time.
Radar Email Routing
Get email DMARC validation time series
Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation over time.
Radar Email Routing
Get email encryption status time series
Retrieves the distribution of emails by encryption status (encrypted vs. not-encrypted) over time.
Radar Email Routing
Get email IP version time series
Retrieves the distribution of emails by IP version over time.
Radar Email Routing
Get email SPF validation time series
Retrieves the distribution of emails by SPF (Sender Policy Framework) validation over time.
Radar Email Routing
Get email security summary by dimension
Retrieves the distribution of email security metrics by the specified dimension.
Radar Email Security
Get email ARC validation summary
Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation.
Radar Email Security
Get email DKIM validation summary
Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation.
Radar Email Security
Get email DMARC validation summary
Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation.
Radar Email Security
Get email malicious classification summary
Retrieves the distribution of emails by malicious classification.
Radar Email Security
Get email spam classification summary
Retrieves the proportion of emails by spam classification (spam vs. non-spam).
Radar Email Security
Get email SPF validation summary
Retrieves the distribution of emails by SPF (Sender Policy Framework) validation.
Radar Email Security
Get email spoof classification summary
Retrieves the proportion of emails by spoof classification (spoof vs. non-spoof).
Radar Email Security
Get email threat category summary
Retrieves the distribution of emails by threat categories.
Radar Email Security
Get email TLS version summary
Retrieves the distribution of emails by TLS version.
Radar Email Security
Get email security time series grouped by dimension
Retrieves the distribution of email security metrics grouped by dimension over time.
Radar Email Security
Get email ARC validation time series
Retrieves the distribution of emails by ARC (Authenticated Received Chain) validation over time.
Radar Email Security
Get email DKIM validation time series
Retrieves the distribution of emails by DKIM (DomainKeys Identified Mail) validation over time.
Radar Email Security
Get email DMARC validation time series
Retrieves the distribution of emails by DMARC (Domain-based Message Authentication, Reporting and Conformance) validation over time.
Radar Email Security
Get email malicious classification time series
Retrieves the distribution of emails by malicious classification over time.
Radar Email Security
Get email spam classification time series
Retrieves the distribution of emails by spam classification (spam vs. non-spam) over time.
Radar Email Security
Get email SPF validation time series
Retrieves the distribution of emails by SPF (Sender Policy Framework) validation over time.
Radar Email Security
Get email spoof classification time series
Retrieves the distribution of emails by spoof classification (spoof vs. non-spoof) over time.
Radar Email Security
Get email threat category time series
Retrieves the distribution of emails by threat category over time.
Radar Email Security
Get email TLS version time series
Retrieves the distribution of emails by TLS version over time.
Radar Email Security
Get top TLDs by email malicious classification
Retrieves the top TLDs by emails classified as malicious or not.
Radar Email Security
Get top TLDs by email message volume
Retrieves the top TLDs by number of email messages.
Radar Email Security
Get top TLDs by email spam classification
Retrieves the top TLDs by emails classified as spam or not.
Radar Email Security
Get top TLDs by email spoof classification
Retrieves the top TLDs by emails classified as spoof or not.
Radar Email Security
Get AS details by ASN
Retrieves the requested autonomous system information. (A confidence level below `5` indicates a low level of confidence in the traffic data - normally this happens because Cloudflare has a small amount of traffic from/to this AS). Population estimates come from APNIC (refer to https://labs.apnic.net/?p=526).
Radar Autonomous Systems
Get AS details by IP address
Retrieves the requested autonomous system information based on IP address. Population estimates come from APNIC (refer to https://labs.apnic.net/?p=526).
Radar Autonomous Systems
List autonomous systems
Retrieves a list of autonomous systems.
Radar Autonomous Systems
Get IP address details
Retrieves IP address information.
Radar IP
Get location details
Retrieves the requested location information. (A confidence level below `5` indicates a low level of confidence in the traffic data - normally this happens because Cloudflare has a small amount of traffic from/to this location).
Radar Locations
List locations
Retrieves a list of locations.
Radar Locations
Get Geolocation details
Retrieves the requested Geolocation information. Geolocation names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`).
Radar Geolocations
List Geolocations
Retrieves a list of geolocations. Geolocation names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`).
Radar Geolocations
Get HTTP requests summary by dimension
Retrieves the distribution of HTTP requests by the specified dimension.
Radar HTTP
Get HTTP requests by bot class summary
Retrieves the distribution of bot-generated HTTP requests to genuine human traffic, as classified by Cloudflare. Visit https://developers.cloudflare.com/radar/concepts/bot-classes/ for more information.
Radar HTTP
Get HTTP requests by device type summary
Retrieves the distribution of HTTP requests generated by mobile, desktop, and other types of devices.
Radar HTTP
Get HTTP requests by HTTP/HTTPS summary
Retrieves the distribution of HTTP requests by HTTP protocol (HTTP vs. HTTPS).
Radar HTTP
Get HTTP requests by HTTP version summary
Retrieves the distribution of HTTP requests by HTTP version.
Radar HTTP
Get HTTP requests by IP version summary
Retrieves the distribution of HTTP requests by IP version.
Radar HTTP
Get HTTP requests by OS summary
Retrieves the distribution of HTTP requests by operating system (Windows, macOS, Android, iOS, and others).
Radar HTTP
Get HTTP requests by post-quantum support summary
Retrieves the distribution of HTTP requests by post-quantum support.
Radar HTTP
Get HTTP requests by TLS version summary
Retrieves the distribution of HTTP requests by TLS version.
Radar HTTP
Get HTTP requests time series
Retrieves the HTTP requests over time.
Radar HTTP
Get HTTP requests time series grouped by dimension
Retrieves the distribution of HTTP requests grouped by dimension.
Radar HTTP
Get HTTP requests by bot class time series
Retrieves the distribution of HTTP requests classified as automated or human over time. Visit https://developers.cloudflare.com/radar/concepts/bot-classes/ for more information.
Radar HTTP
Get HTTP requests by user agent family time series
Retrieves the distribution of HTTP requests by user agent family over time.
Radar HTTP
Get HTTP requests by user agent time series
Retrieves the distribution of HTTP requests by user agent over time.
Radar HTTP
Get HTTP requests by device type time series
Retrieves the distribution of HTTP requests by device type over time.
Radar HTTP
Get HTTP requests by HTTP/HTTPS time series
Retrieves the distribution of HTTP requests by HTTP protocol (HTTP vs. HTTPS) over time.
Radar HTTP
Get HTTP requests by HTTP version time series
Retrieves the distribution of HTTP requests by HTTP version over time.
Radar HTTP
Get HTTP requests by IP version time series
Retrieves the distribution of HTTP requests by IP version over time.
Radar HTTP
Get HTTP requests by OS time series
Retrieves the distribution of HTTP requests by operating system over time.
Radar HTTP
Get HTTP requests by post-quantum support time series
Retrieves the distribution of HTTP requests by post-quantum support over time.
Radar HTTP
Get HTTP requests by TLS version time series
Retrieves the distribution of HTTP requests by TLS version over time.
Radar HTTP
Get top ASes by HTTP requests for a bot class
Retrieves the top autonomous systems, by HTTP requests, of the requested bot class.
Radar HTTP
Get top ASes by HTTP requests for a browser family
Retrieves the top autonomous systems, by HTTP requests, of the requested browser family.
Radar HTTP
Get top ASes by HTTP requests for a device type
Retrieves the top autonomous systems, by HTTP requests, of the requested device type.
Radar HTTP
Get top ASes by HTTP requests for an HTTP protocol
Retrieves the top autonomous systems, by HTTP requests, of the requested HTTP protocol.
Radar HTTP
Get top ASes by HTTP requests
Retrieves the top autonomous systems by HTTP requests.
Radar HTTP
Get top ASes by HTTP requests for an HTTP version
Retrieves the top autonomous systems, by HTTP requests, of the requested HTTP version.
Radar HTTP
Get top ASes by HTTP requests for an IP version
Retrieves the top autonomous systems, by HTTP requests, of the requested IP version.
Radar HTTP
Get top ASes by HTTP requests for an OS
Retrieves the top autonomous systems, by HTTP requests, of the requested operating system.
Radar HTTP
Get top ASes by HTTP requests for a TLS version
Retrieves the top autonomous systems, by HTTP requests, of the requested TLS protocol version.
Radar HTTP
Get top user agent families by HTTP requests
Retrieves the top user agents, aggregated in families, by HTTP requests.
Radar HTTP
Get top user agents by HTTP requests
Retrieves the top user agents by HTTP requests.
Radar HTTP
Get top locations by HTTP requests for a bot class
Retrieves the top locations, by HTTP requests, of the requested bot class.
Radar HTTP
Get top locations by HTTP requests for a browser family
Retrieves the top locations, by HTTP requests, of the requested browser family.
Radar HTTP
Get top locations by HTTP requests for a device type
Retrieves the top locations, by HTTP requests, of the requested device type.
Radar HTTP
Get top locations by HTTP requests for an HTTP protocol
Retrieves the top locations, by HTTP requests, of the requested HTTP protocol.
Radar HTTP
Get top locations by HTTP requests
Retrieves the top locations by HTTP requests.
Radar HTTP
Get top locations by HTTP requests for an HTTP version
Retrieves the top locations, by HTTP requests, of the requested HTTP version.
Radar HTTP
Get top locations by HTTP requests for an IP version
Retrieves the top locations, by HTTP requests, of the requested IP version.
Radar HTTP
Get top locations by HTTP requests for an OS
Retrieves the top locations, by HTTP requests, of the requested operating system.
Radar HTTP
Get top locations by HTTP requests for a TLS version
Retrieves the top locations, by HTTP requests, of the requested TLS protocol version.
Radar HTTP
Get HTTP authentication requests distribution by dimension
Retrieves an aggregated summary of HTTP authentication requests grouped by the specified dimension.
Radar Leaked Credential Checks
Get HTTP authentication requests by bot class summary
Retrieves the distribution of HTTP authentication requests by bot class.
Radar Leaked Credential Checks
Get HTTP authentication requests by compromised credential status summary
Retrieves the distribution of HTTP authentication requests by compromised credential status.
Radar Leaked Credential Checks
Get time series distribution of HTTP authentication requests by dimension.
Retrieves the distribution of HTTP authentication requests, grouped by the specified dimension over time.
Radar Leaked Credential Checks
Get HTTP authentication requests by bot class time series
Retrieves the distribution of HTTP authentication requests by bot class over time.
Radar Leaked Credential Checks
Get HTTP authentication requests by compromised credential status time series
Retrieves the distribution of HTTP authentication requests by compromised credential status over time.
Radar Leaked Credential Checks
Get network traffic distribution by dimension
Retrieves the distribution of network traffic (NetFlows) by the specified dimension.
Radar NetFlows
Get network traffic summary
Retrieves the distribution of network traffic (NetFlows) by HTTP vs other protocols.
Radar NetFlows
Get network traffic time series
Retrieves network traffic (NetFlows) over time.
Radar NetFlows
Get time series distribution of network traffic by dimension
Retrieves the distribution of NetFlows traffic, grouped by the specified dimension over time.
Radar NetFlows
Get top ASes by network traffic
Retrieves the top autonomous systems by network traffic (NetFlows).
Radar NetFlows
Get top locations by network traffic
Retrieves the top locations by network traffic (NetFlows).
Radar NetFlows
Get Origin details
Retrieves the requested origin information with its regions.
Radar Origins
Get Origin Post-Quantum Data Summary
Returns a summary of origin post-quantum data grouped by the specified dimension.
Radar Post-Quantum
Get Origin Post-Quantum Data Over Time
Returns a timeseries of origin post-quantum data grouped by the specified dimension.
Radar Post-Quantum
List Origins
Retrieves a list of origins with their regions.
Radar Origins
Get origin metrics distribution by dimension
Retrieves an aggregated summary of origin metrics grouped by the specified dimension.
Radar Origins
Get origin metrics time series
Retrieves the time series of origin metrics for the specified origin.
Radar Origins
Get origin metrics time series grouped by dimension
Retrieves the distribution of origin metrics grouped by the specified dimension over time.
Radar Origins
Check Post-Quantum TLS support
Tests whether a hostname or IP address supports Post-Quantum (PQ) TLS key exchange. Returns information about the negotiated key exchange algorithm, whether it uses PQ cryptography, and any detected TLS implementation bugs (Split ClientHello, HRR failure, etc.).
Radar Post-Quantum
Get Internet Quality Index (IQI) summary
Retrieves a summary (percentiles) of bandwidth, latency, or DNS response time from the Radar Internet Quality Index (IQI).
Radar Quality
Get Internet Quality Index (IQI) time series
Retrieves a time series (percentiles) of bandwidth, latency, or DNS response time from the Radar Internet Quality Index (IQI).
Radar Quality
Get speed tests histogram
Retrieves a histogram from the previous 90 days of Cloudflare Speed Test data, split into fixed bandwidth (Mbps), latency (ms), or jitter (ms) buckets.
Radar Quality
Get speed tests summary
Retrieves a summary of bandwidth, latency, jitter, and packet loss, from the previous 90 days of Cloudflare Speed Test data.
Radar Quality
Get top ASes by speed test results
Retrieves the top autonomous systems by bandwidth, latency, jitter, or packet loss, from the previous 90 days of Cloudflare Speed Test data.
Radar Quality
Get top locations by speed test results
Retrieves the top locations by bandwidth, latency, jitter, or packet loss, from the previous 90 days of Cloudflare Speed Test data.
Radar Quality
Get domain rank details
Retrieves domain rank details. Cloudflare provides an ordered rank for the top 100 domains, but for the remainder it only provides ranking buckets like top 200 thousand, top one million, etc.. These are available through Radar datasets endpoints.
Radar Domains Ranking
Get domains rank time series
Retrieves domains rank over time.
Radar Domains Ranking
List Internet services categories
Retrieves the list of Internet services categories.
Radar Internet Services Ranking
Get Internet services rank time series
Retrieves Internet Services rank update changes over time.
Radar Internet Services Ranking
Get top or trending domains
Retrieves the top or trending domains based on their rank. Popular domains are domains of broad appeal based on how people use the Internet. Trending domains are domains that are generating a surge in interest. For more information on top domains, see https://blog.cloudflare.com/radar-domain-rankings/.
Radar Domains Ranking
Get top Internet services
Retrieves top Internet services based on their rank.
Radar Internet Services Ranking
Get dataset CSV stream
Retrieves the CSV content of a given dataset by alias or ID. When getting the content by alias the latest dataset is returned, optionally filtered by the latest available at a given date.
Radar Datasets
List datasets
Retrieves a list of datasets.
Radar Datasets
Get top domain categories by robots.txt files parsed
Retrieves the top domain categories by the number of robots.txt files parsed.
Radar Robots.txt
Get top user agents on robots.txt files
Retrieves the top user agents on robots.txt files.
Radar Robots.txt
Search for locations, ASes, reports, and more
Searches for locations, autonomous systems, reports, bots, certificate logs, certificate authorities, industries and verticals. Location names can be localized by sending an `Accept-Language` HTTP header with a BCP 47 language tag (e.g., `Accept-Language: pt-PT`). The full quality-value chain is supported (e.g., `pt-PT,pt;q=0.9,en;q=0.8`).
Radar Search
Get TCP resets and timeouts summary
Retrieves the distribution of connection stage by TCP connections terminated within the first 10 packets by a reset or timeout.
Radar TCP Resets and Timeouts
Get TCP resets and timeouts time series
Retrieves the distribution of connection stage by TCP connections terminated within the first 10 packets by a reset or timeout over time.
Radar TCP Resets and Timeouts
Get TLD details
Retrieves the requested TLD information.
Radar Top-Level Domains
List TLDs
Retrieves a list of TLDs.
Radar Top-Level Domains
Get TLD Performance Summary
Returns a summary of TLD authoritative nameserver performance grouped by the specified dimension.
Radar Top-Level Domains
Get TLD Performance Over Time
Returns a timeseries of TLD authoritative nameserver performance grouped by the specified dimension.
Radar Top-Level Domains
Get latest Internet traffic anomalies
Retrieves the latest Internet traffic anomalies, which are signals that might indicate an outage. These alerts are automatically detected by Radar and manually verified by our team.
Radar Traffic Anomalies
Get top locations by total traffic anomalies
Retrieves the sum of Internet traffic anomalies, grouped by location. These anomalies are signals that might indicate an outage, automatically detected by Radar and manually verified by our team.
Radar Traffic Anomalies
Get top verified bots by HTTP requests
Retrieves the top verified bots by HTTP requests, with owner and category.
Radar Verified Bots
Get top verified bot categories by HTTP requests
Retrieves the top verified bot categories by HTTP requests, along with their corresponding percentage, over the total verified bot HTTP requests.
Radar Verified Bots
Get dataset download URL
Retrieves an URL to download a single dataset.
Radar Datasets
Get Rate Limiting Analytics
Returns rate limiting analytics for a zone over the specified time period. The time period divides into time segments of a given length. Each segment contains total action counts and action counts broken down by colo.
Rate Limiting Analytics
Create a rate limit
**Deprecated**: This endpoint returns 410 Gone. Please use the Rulesets API instead.
Rate limits for a zone
Delete a rate limit
**Deprecated**: This endpoint returns 410 Gone. Please use the Rulesets API instead.
Rate limits for a zone
Get a rate limit
**Deprecated**: This endpoint returns 410 Gone. Please use the Rulesets API instead.
Rate limits for a zone
List rate limits
**Deprecated**: This endpoint returns 410 Gone. Please use the Rulesets API instead.
Rate limits for a zone
Update a rate limit
**Deprecated**: This endpoint returns 410 Gone. Please use the Rulesets API instead.
Rate limits for a zone
Refresh participant's authentication token
Regenerates participant's authentication token for the given meeting and participant ID.
Meetings
Check domain availability
Performs real-time, authoritative availability checks directly against domain registries. Use this endpoint to verify a domain is available before attempting registration via `POST /registrations`. **Important:** Unlike the Search endpoint, these results are authoritative and reflect current registry status. Always check availability immediately before registration as domain status can change rapidly. **Note:** This endpoint uses POST to accept a list of domains in the request body. It is a read-only operation — it does not create, modify, or reserve any domains. ### Extension support Only domains on extensions supported for programmatic registration by this API can be registered. If you check a domain on an unsupported extension, the response will include `registrable: false` with a `reason` field explaining why: - `extension_not_supported_via_api` — Cloudflare Registrar supports this extension in the dashboard, but it is not yet available for programmatic registration via this API. Register via `https://dash.cloudflare.com/{account_id}/domains/registrations` instead. - `extension_not_supported` — This extension is not supported by Cloudflare Registrar. - `extension_disallows_registration` — The extension's registry has temporarily or permanently frozen new registrations. No registrar can register domains on this extension at this time. - `domain_premium` — The domain is premium priced. Premium registration is not currently supported by this API. - `domain_unavailable` — The domain is already registered, reserved, or otherwise not available for registration on a supported extension. The `reason` field is only present when `registrable` is `false`. ### Behavior - Maximum 20 domains per request - Pricing is only returned for domains where `registrable: true` - Results are not cached; each request queries the registry ### Workflow 1. Call this endpoint with domains the user wants to register. 2. For each domain where `registrable: true`, present pricing to the user. 3. If `tier: premium`, note that premium registration is not currently supported by this API and do not proceed to `POST /registrations`. 4. Proceed to `POST /registrations` only for supported non-premium domains.
Domain Discovery
Search for available domains
Searches for domain name suggestions based on a keyword, phrase, or partial domain name. Returns a list of potentially available domains with pricing information. **Important:** Results are non-authoritative and based on cached data. Always use the `/domain-check` endpoint to verify real-time availability before attempting registration. Suggestions are scoped to extensions supported for programmatic registration via this API (`POST /registrations`). Domains on unsupported extensions will not appear in results, even if they are available at the registry level. ### Use cases - Brand name discovery (e.g., "acme corp" → acmecorp.com, acmecorp.dev) - Keyword-based suggestions (e.g., "coffee shop" → coffeeshop.com, mycoffeeshop.net) - Alternative extension discovery (e.g., "example.com" → example.com, example.app, example.xyz) ### Workflow 1. Call this endpoint with a keyword or domain name. 2. Present suggestions to the user. 3. Call `/domain-check` with the user's chosen domains to confirm real-time availability and pricing. 4. Proceed to `POST /registrations` only for supported non-premium domains where the Check response returns `registrable: true`. **Note:** Searching with just a domain extension (e.g., "com" or ".app") is not supported. Provide a keyword or domain name.
Domain Discovery
Create Registration
Starts a domain registration workflow. This is a billable operation — successful registration charges the account's default payment method. All successful domain registrations are non-refundable — once the workflow completes with `state: succeeded`, the charge cannot be reversed. ### Prerequisites - The account must have a billing profile with a valid default payment method. Set this up at `https://dash.cloudflare.com/{account_id}/billing/payment-info`. - The account must not already be at the maximum supported domain limit. A single account may own up to 100 domains in total across registrations created through either the dashboard or this API. - The domain must be on a supported extension for programmatic registration. - Use `POST /domain-check` immediately before calling this endpoint to confirm real-time availability and pricing. ### Express mode The only required field is `domain_name`. If `contacts` is omitted, the system uses the account's default address book entry as the registrant. If no default exists and no contact is provided, the request fails. Set up a default address book entry and accept the required agreement at `https://dash.cloudflare.com/{account_id}/domains/registrations`. ### Defaults - `years`: defaults to the extension's minimum registration period (1 year for most extensions, but varies — for example, `.ai` (if supported) requires a minimum of 2 years). - `auto_renew`: defaults to `false`. Setting it to `true` is an explicit opt-in authorizing Cloudflare to charge the account's default payment method up to 30 days before domain expiry to renew the registration. Renewal pricing may change over time based on registry pricing. - `privacy_mode`: defaults to `redaction`. ### Premium domains Premium domain registration is not currently supported by this API. If `POST /domain-check` returns `tier: premium`, do not call this endpoint for that domain. ### Response behavior By default, the server holds the connection for a bounded, server-defined amount of time while the registration completes. Most registrations finish within this window and return `201 Created` with a completed workflow status. If the registration is still processing after this synchronous wait window, the server returns `202 Accepted`. Poll the URL in `links.self` to track progress. To skip the wait and receive an immediate `202`, send `Prefer: respond-async`.
Registrar Registration
Get Registration
Returns the current state of a domain registration. This is the canonical read endpoint for a domain you own. It returns the full registration resource including current settings and expiration. When the registration resource is ready, both `created_at` and `expires_at` are present in the response.
Registrar Registration
Get Registration Status
Returns the current status of a domain registration workflow. Use this endpoint to poll for completion when the POST response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. **Terminal states:** `succeeded` and `failed` are terminal and always have `completed: true`. **Non-terminal states:** - `action_required` has `completed: false` and will not resolve on its own. The workflow is paused pending user intervention. - `blocked` has `completed: false` and indicates the workflow is waiting on a third party such as the extension registry or losing registrar. Continue polling while informing the user of the delay. Use increasing backoff between polls. When `state: blocked`, use a longer polling interval and do not poll indefinitely. A naive polling loop that only checks `completed` can run indefinitely when `state: action_required`. Break explicitly on `action_required`: ```js let status; do { await new Promise(r => setTimeout(r, 2000)); status = await cloudflare.request({ method: 'GET', path: reg.result.links.self, }); } while ( !status.result.completed && status.result.state !== 'action_required' ); if (status.result.state === 'action_required') { // Surface context.action and context.confirmation_sent_to to the user. // Do not re-submit the registration request. } ```
Registrar Registration
Get Update Status
Returns the current status of a domain update workflow. Use this endpoint to poll for completion when the PATCH response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. Use increasing backoff between polls. When the workflow remains blocked on a third party, use a longer polling interval and do not poll indefinitely.
Registrar Registration
List Registrations
Returns a paginated list of domain registrations owned by the account. This endpoint uses cursor-based pagination. Results are ordered by registration date by default. To fetch the next page, pass the `cursor` value from the `result_info` object in the response as the `cursor` query parameter in your next request. An empty `cursor` string indicates there are no more pages.
Registrar Registration
Update Registration
Updates an existing domain registration. By default, the server holds the connection for a bounded, server-defined amount of time while the update completes. Most updates finish within this window and return `200 OK` with a completed workflow status. If the update is still processing after this synchronous wait window, the server returns `202 Accepted`. Poll the URL in `links.self` to track progress. To skip the wait and receive an immediate `202`, send `Prefer: respond-async`. This endpoint currently supports updating `auto_renew` only.
Registrar Registration
Get domain
Show individual domain.
Registrar Domains
List domains
List domains handled by Registrar.
Registrar Domains
Update domain
Update individual domain.
Registrar Domains
Get extension
Returns metadata and JSON Schema documents describing the expected input structure for registration operations on a specific extension (TLD). Supports HTTP conditional GET via `ETag`. Include the `ETag` value from a previous response in an `If-None-Match` header to receive a `304 Not Modified` when the data has not changed.
Extension
List extensions
Returns metadata and JSON Schema documents describing the expected input structure for registration operations on each supported extension (TLD). This endpoint uses cursor-based pagination. Results are ordered by extension name by default. To fetch the next page, pass the `cursor` value from the `result_info` object in the response as the `cursor` query parameter in your next request. An empty `cursor` string indicates there are no more pages. Supports HTTP conditional GET via `ETag`. Include the `ETag` value from a previous response in an `If-None-Match` header to receive a `304 Not Modified` when the data has not changed.
Extension
Replace a meeting
Replaces all the details for the given meeting ID.
Meetings
Replace a participant's detail
Replaces a participant's details for the given meeting and participant ID.
Meetings
Replace a webhook
Replace all details for the given webhook ID.
Webhooks
Request review on mitigations
Request a review for mitigations on an account.
tseng-abuse-complaint-processor_other
Reset severity for a finding back to the default
If a Finding's severity has been changed, reset it back to default value. Does nothing if no override exists.
findings
Export Resources
Export resources in the Resource Catalog as a JSON file (Closed Beta).
Resources
List Resources
List resources in the Resource Catalog (Closed Beta).
Resources
Preview Rego Query
Preview Rego query result against the latest resource catalog (Closed Beta).
Resources
Read Resource
Read an resource from the Resource Catalog (Closed Beta).
Resources
Restart Hyperdrive
Restarts the connection pool for the specified Hyperdrive configuration without changing its configuration. Existing connections are drained and a new pool is established at the edge.
Hyperdrive
Resume integration
Resumes a paused integration, restarting crawlers.
Integrations
Revoke device registrations
Revokes all WARP registrations associated with the specified device.
Physical Devices
Revoke registrations
Revokes a list of WARP registrations.
Registrations
Check domain availability
Performs real-time, authoritative availability checks directly against domain registries. Use this endpoint to verify a domain is available before attempting registration via `POST /registrations`. **Important:** Unlike the Search endpoint, these results are authoritative and reflect current registry status. Always check availability immediately before registration as domain status can change rapidly. **Note:** This endpoint uses POST to accept a list of domains in the request body. It is a read-only operation — it does not create, modify, or reserve any domains. ### Extension support Only domains on extensions supported for programmatic registration by this API can be registered. If you check a domain on an unsupported extension, the response will include `registrable: false` with a `reason` field explaining why: - `extension_not_supported_via_api` — Cloudflare Registrar supports this extension in the dashboard, but it is not yet available for programmatic registration via this API. Register via `https://dash.cloudflare.com/{account_id}/domains/registrations` instead. - `extension_not_supported` — This extension is not supported by Cloudflare Registrar. - `extension_disallows_registration` — The extension's registry has temporarily or permanently frozen new registrations. No registrar can register domains on this extension at this time. - `domain_premium` — The domain is premium priced. Premium registration is not currently supported by this API. - `domain_unavailable` — The domain is already registered, reserved, or otherwise not available for registration on a supported extension. The `reason` field is only present when `registrable` is `false`. ### Behavior - Maximum 20 domains per request - Pricing is only returned for domains where `registrable: true` - Results are not cached; each request queries the registry ### Workflow 1. Call this endpoint with domains the user wants to register. 2. For each domain where `registrable: true`, present pricing to the user. 3. If `tier: premium`, note that premium registration is not currently supported by this API and do not proceed to `POST /registrations`. 4. Proceed to `POST /registrations` only for supported non-premium domains.
Domain Discovery
Search for available domains
Searches for domain name suggestions based on a keyword, phrase, or partial domain name. Returns a list of potentially available domains with pricing information. **Important:** Results are non-authoritative and based on cached data. Always use the `/domain-check` endpoint to verify real-time availability before attempting registration. Suggestions are scoped to extensions supported for programmatic registration via this API (`POST /registrations`). Domains on unsupported extensions will not appear in results, even if they are available at the registry level. ### Use cases - Brand name discovery (e.g., "acme corp" → acmecorp.com, acmecorp.dev) - Keyword-based suggestions (e.g., "coffee shop" → coffeeshop.com, mycoffeeshop.net) - Alternative extension discovery (e.g., "example.com" → example.com, example.app, example.xyz) ### Workflow 1. Call this endpoint with a keyword or domain name. 2. Present suggestions to the user. 3. Call `/domain-check` with the user's chosen domains to confirm real-time availability and pricing. 4. Proceed to `POST /registrations` only for supported non-premium domains where the Check response returns `registrable: true`. **Note:** Searching with just a domain extension (e.g., "com" or ".app") is not supported. Provide a keyword or domain name.
Domain Discovery
Create Registration
Starts a domain registration workflow. ### Prerequisites - The account must not already be at the maximum supported domain limit. A single account may own up to 100 domains in total across registrations created through either the dashboard or this API. - The domain must be on a supported extension for programmatic registration. - Use `POST /domain-check` immediately before calling this endpoint to confirm real-time availability and pricing. ### Defaults - `years`: defaults to the extension's minimum registration period (1 year for most extensions, but varies — for example, `.ai` (if supported) requires a minimum of 2 years). - `auto_renew`: defaults to `false`. Setting it to `true` is an explicit opt-in authorizing Cloudflare to charge the account's default payment method up to 30 days before domain expiry to renew the registration. Renewal pricing may change over time based on registry pricing. - `privacy_mode`: defaults to `redaction`. ### Premium domains Premium domain registration is not currently supported by this API. If `POST /domain-check` returns `tier: premium`, do not call this endpoint for that domain. ### Response behavior By default, the server holds the connection for a bounded, server-defined amount of time while the registration completes. Most registrations finish within this window and return `201 Created` with a completed workflow status. If the registration is still processing after this synchronous wait window, the server returns `202 Accepted`. Poll the URL in `links.self` to track progress. To skip the wait and receive an immediate `202`, send `Prefer: respond-async`.
Registrar Registration
Get Registration
Returns the current state of a domain registration. This is the canonical read endpoint for a domain you own. It returns the full registration resource including current settings and expiration. When the registration resource is ready, both `created_at` and `expires_at` are present in the response.
Registrar Registration
Get Registration Status
Returns the current status of a domain registration workflow. Use this endpoint to poll for completion when the POST response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. **Terminal states:** `succeeded` and `failed` are terminal and always have `completed: true`. **Non-terminal states:** - `action_required` has `completed: false` and will not resolve on its own. The workflow is paused pending user intervention. - `blocked` has `completed: false` and indicates the workflow is waiting on a third party such as the extension registry or losing registrar. Continue polling while informing the user of the delay. Use increasing backoff between polls. When `state: blocked`, use a longer polling interval and do not poll indefinitely. A naive polling loop that only checks `completed` can run indefinitely when `state: action_required`. Break explicitly on `action_required`: ```js let status; do { await new Promise(r => setTimeout(r, 2000)); status = await cloudflare.request({ method: 'GET', path: reg.result.links.self, }); } while ( !status.result.completed && status.result.state !== 'action_required' ); if (status.result.state === 'action_required') { // Surface context.action and context.confirmation_sent_to to the user. // Do not re-submit the registration request. } ```
Registrar Registration
Get Update Status
Returns the current status of a domain update workflow. Use this endpoint to poll for completion when the PATCH response returned `202 Accepted`. The URL is provided in the `links.self` field of the workflow status response. Poll this endpoint until the workflow reaches a terminal state or a state that requires user attention. Use increasing backoff between polls. When the workflow remains blocked on a third party, use a longer polling interval and do not poll indefinitely.
Registrar Registration
List Registrations
Returns a paginated list of domain registrations owned by the account. This endpoint uses cursor-based pagination. Results are ordered by registration date by default. To fetch the next page, pass the `cursor` value from the `result_info` object in the response as the `cursor` query parameter in your next request. An empty `cursor` string indicates there are no more pages.
Registrar Registration
Update Registration
Updates an existing domain registration. By default, the server holds the connection for a bounded, server-defined amount of time while the update completes. Most updates finish within this window and return `200 OK` with a completed workflow status. If the update is still processing after this synchronous wait window, the server returns `202 Accepted`. Poll the URL in `links.self` to track progress. To skip the wait and receive an immediate `202`, send `Prefer: respond-async`. This endpoint currently supports updating `auto_renew` only.
Registrar Registration
Get extension
Returns metadata and JSON Schema documents describing the expected input structure for registration operations on a specific extension (TLD). Supports HTTP conditional GET via `ETag`. Include the `ETag` value from a previous response in an `If-None-Match` header to receive a `304 Not Modified` when the data has not changed.
Extension
List extensions
Returns metadata and JSON Schema documents describing the expected input structure for registration operations on each supported extension (TLD). This endpoint uses cursor-based pagination. Results are ordered by extension name by default. To fetch the next page, pass the `cursor` value from the `result_info` object in the response as the `cursor` query parameter in your next request. An empty `cursor` string indicates there are no more pages. Supports HTTP conditional GET via `ETag`. Include the `ETag` value from a previous response in an `If-None-Match` header to receive a `304 Not Modified` when the data has not changed.
Extension
Bulk edit per-operation schema validation settings
Updates schema validation settings for multiple API operations in a single request. Efficient for applying consistent validation rules across endpoints.
Schema Validation Settings
Upload a schema
Uploads a new OpenAPI schema for API Shield schema validation. The schema defines expected request/response formats for API endpoints.
Schema Validation
Delete per-operation schema validation setting
Removes custom schema validation settings for a specific API operation, reverting to zone-level defaults.
Schema Validation Settings
Delete a schema
Permanently removes an uploaded OpenAPI schema from API Shield. Operations using this schema will lose their validation rules.
Schema Validation
Edit details of a schema to enable validation
Modifies an existing OpenAPI schema in API Shield, updating the validation rules for associated API operations.
Schema Validation
Edit global schema validation settings
Partially updates global schema validation settings for a zone using PATCH semantics.
Schema Validation Settings
Retrieve all operations from the schema.
Retrieves all operations from the schema. Operations that already exist in API Shield Endpoint Management will be returned as full operations.
Schema Validation
Get per-operation schema validation setting
Retrieves the schema validation settings configured for a specific API operation.
Schema Validation Settings
Get details of a schema
Gets the contents and metadata of a specific OpenAPI schema uploaded to API Shield.
Schema Validation
Get global schema validation settings
Retrieves the current global schema validation settings for a zone.
Schema Validation Settings
List per-operation schema validation settings
Lists all per-operation schema validation settings configured for the zone.
Schema Validation Settings
List hosts covered by uploaded schemas
Lists all unique hosts found in uploaded OpenAPI schemas for the zone.
Schema Validation
List all uploaded schemas
Lists all OpenAPI schemas uploaded to API Shield with pagination support.
Schema Validation
Update per-operation schema validation setting
Fully updates schema validation settings for a specific API operation.
Schema Validation Settings
Update global schema validation settings
Fully updates global schema validation settings for a zone, replacing existing configuration.
Schema Validation Settings
Create SCIM Group
Creates a new SCIM Group (user group) for the account. The `displayName` must not be empty and must not begin with `CF` (reserved for system groups).
SCIM Groups
Delete SCIM Group
Deletes a SCIM Group (custom user groups only). System groups backed by Cloudflare permission groups cannot be deleted via SCIM. Returns 204 No Content on success.
SCIM Groups
Get SCIM Group
Retrieves a single SCIM Group resource by group ID.
SCIM Groups
List SCIM Groups
Lists SCIM Group resources for the account. Returns both system groups (backed by Cloudflare permission groups, prefixed `cloudflare-v1-`) and custom user groups. Supports filtering by `displayName` using SCIM filter syntax.
SCIM Groups
Patch SCIM Group
Partially updates a SCIM Group via PATCH operations (RFC 7644 Section 3.5.2). Supports add, remove, and replace operations on `members`, `displayName`, and `externalId`. For system groups (prefixed `cloudflare-v1-`), only member management operations are supported.
SCIM Groups
Get SCIM Resource Type
Returns a single SCIM resource type by ID (RFC 7643 Section 6). Valid IDs are `User` and `Group`.
SCIM Discovery
List SCIM Resource Types
Returns the list of SCIM resource types supported by the Cloudflare SCIM service (RFC 7643 Section 6, RFC 7644 Section 4). Clients use this to discover available resource categories (e.g. Users, Groups) and their associated schemas. Query parameters are not supported on this endpoint.
SCIM Discovery
Get SCIM Schema
Returns a single SCIM schema definition by schema URI ID (RFC 7643 Section 7). Valid IDs are `urn:ietf:params:scim:schemas:core:2.0:User` and `urn:ietf:params:scim:schemas:core:2.0:Group`.
SCIM Discovery
List SCIM Schemas
Returns the list of SCIM schemas supported by the Cloudflare SCIM service (RFC 7643 Section 7, RFC 7644 Section 4). Clients use this to introspect the attributes of each resource type. Query parameters are not supported on this endpoint.
SCIM Discovery
Get SCIM Service Provider Config
Returns the SCIM 2.0 Service Provider configuration (RFC 7643 Section 5). IdPs use this endpoint to auto-configure their SCIM integration with Cloudflare, discovering which optional features (patch, bulk, filter, etc.) are supported.
SCIM Discovery
Create SCIM User
Provisions a new account member via SCIM. The `userName` field must be a valid email address and must match the primary email in `emails`. The account must be an Enterprise account with SCIM entitlements enabled.
SCIM Users
Get SCIM User
Retrieves a single account member as a SCIM User resource by user tag.
SCIM Users
List SCIM Users
Lists account members as SCIM User resources. Supports optional filtering by `userName` (email) using the SCIM filter syntax (e.g. `userName eq "user@example.com"`). Pagination is controlled via `startIndex` and `count` query parameters per RFC 7644 Section 3.4.2.4.
SCIM Users
Patch SCIM User
Partially updates a SCIM User via PATCH operations (RFC 7644 Section 3.5.2). Supports updating `userName`, `name.givenName`, `name.familyName`, and `active`. Setting `active: false` deprovisions the user (removes them from the account). For IdP compatibility, `emails[type eq "work"].value` is also accepted as an alias for `userName`.
SCIM Users
Replace SCIM User
Replaces a SCIM User resource (RFC 7644 Section 3.5.1). Fully replaces the mutable attributes of the user. Supports updating `userName`, `name`, `emails`, and `active`.
SCIM Users
ACL Details
Get ACL.
Secondary DNS (ACL)
Create ACL
Create ACL.
Secondary DNS (ACL)
Delete ACL
Delete ACL.
Secondary DNS (ACL)
List ACLs
List ACLs.
Secondary DNS (ACL)
Update ACL
Modify ACL.
Secondary DNS (ACL)
Create Peer
Create Peer.
Secondary DNS (Peer)
Delete Peer
Delete Peer.
Secondary DNS (Peer)
List Peers
List Peers.
Secondary DNS (Peer)
Peer Details
Get Peer.
Secondary DNS (Peer)
Update Peer
Modify Peer.
Secondary DNS (Peer)
Create Primary Zone Configuration
Create primary zone configuration for outgoing zone transfers.
Secondary DNS (Primary Zone)
Delete Primary Zone Configuration
Delete primary zone configuration for outgoing zone transfers.
Secondary DNS (Primary Zone)
Disable Outgoing Zone Transfers
Disable outgoing zone transfers for primary zone and clears IXFR backlog of primary zone.
Secondary DNS (Primary Zone)
Enable Outgoing Zone Transfers
Enable outgoing zone transfers for primary zone.
Secondary DNS (Primary Zone)
Force DNS NOTIFY
Notifies the secondary nameserver(s) and clears IXFR backlog of primary zone.
Secondary DNS (Primary Zone)
Get Outgoing Zone Transfer Status
Get primary zone transfer status.
Secondary DNS (Primary Zone)
Primary Zone Configuration Details
Get primary zone configuration for outgoing zone transfers.
Secondary DNS (Primary Zone)
Update Primary Zone Configuration
Update primary zone configuration for outgoing zone transfers.
Secondary DNS (Primary Zone)
Create Secondary Zone Configuration
Create secondary zone configuration for incoming zone transfers.
Secondary DNS (Secondary Zone)
Delete Secondary Zone Configuration
Delete secondary zone configuration for incoming zone transfers.
Secondary DNS (Secondary Zone)
Force AXFR
Sends AXFR zone transfer request to primary nameserver(s).
Secondary DNS (Secondary Zone)
Secondary Zone Configuration Details
Get secondary zone configuration for incoming zone transfers.
Secondary DNS (Secondary Zone)
Update Secondary Zone Configuration
Update secondary zone configuration for incoming zone transfers.
Secondary DNS (Secondary Zone)
Create TSIG
Create TSIG.
Secondary DNS (TSIG)
Delete TSIG
Delete TSIG.
Secondary DNS (TSIG)
List TSIGs
List TSIGs.
Secondary DNS (TSIG)
TSIG Details
Get TSIG.
Secondary DNS (TSIG)
Update TSIG
Modify TSIG.
Secondary DNS (TSIG)
Create a store
Creates a store in the account.
Secrets Store
Delete secrets
Deletes one or more secrets.
Secrets Store
Delete a store
Deletes a single store. By default, a store that still contains secrets cannot be deleted and returns HTTP 409 (Conflict) with the "store_not_empty" error. Pass `force=true` to cascade-delete all secrets in the store. Empty stores are always deleted regardless of the force parameter.
Secrets Store
Duplicate Secret
Creates a duplicate of the secret, keeping the value.
Secrets Store
Get a secret by ID
Returns details of a single secret.
Secrets Store
Get a store by ID
Returns details of a single store.
Secrets Store
List account stores
Lists all the stores in an account.
Secrets Store
Patch a secret
Updates a single secret.
Secrets Store
View secret usage
Lists the number of secrets used in the account.
Secrets Store
Create a secret
Creates a secret in the account.
Secrets Store
Delete a secret
Deletes a single secret.
Secrets Store
List store secrets
Lists all store secrets.
Secrets Store
Create a new share
Creates a new resource share for sharing Cloudflare resources with other accounts or organizations.
Resource Sharing
Delete a share
Deletion is not immediate, an updated share object with a new status will be returned.
Resource Sharing
Create a new share recipient
Adds a recipient to a resource share, granting them access to the shared resources.
Resource Sharing
Delete a share recipient
Deletion is not immediate, an updated share recipient object with a new status will be returned.
Resource Sharing
Get share recipient by ID
Get share recipient by ID.
Resource Sharing
List share recipients by share ID
List share recipients by share ID.
Resource Sharing
Update a share's recipients
Changes a share's recipients to match the given list. Returns an error if the share targets an organization.
Resource Sharing
Create a new share resource
Adds a resource to an existing share, making it available to share recipients.
Resource Sharing
Delete a share resource
Deletion is not immediate, an updated share resource object with a new status will be returned.
Resource Sharing
Update a share resource
Update is not immediate, an updated share resource object with a new status will be returned.
Resource Sharing
Get share resource by ID
Get share resource by ID.
Resource Sharing
List share resources by share ID
List share resources by share ID.
Resource Sharing
Update a share
Updating is not immediate, an updated share object with a new status will be returned.
Resource Sharing
View a query that has been shared
Shared queries store the results of a previously run query, allowing you to share the results with others.
SharedQuery
Create a sharable link to a query result
Shared queries store the results of a previously run query, allowing you to share the results with others.
SharedQuery
Get account share by ID
Fetches share by ID.
Resource Sharing
List account shares
Lists all account shares.
Resource Sharing
Create an ingress rule
Create a new ingress rule for the specified sinkhole. The CIDR block must be a Cloudflare BYOIP associated with your account. The zone_id must be a zone with the ability to create Spectrum Apps. The sinkhole must belong to the same account as the zone.
Sinkhole Config
Create a new sinkhole for your account
Create a new sinkhole. Logs of large request bodies will be truncated, but the full request body can be recorded in R2. If you wish to record large request bodies in R2, include the R2 key ID, key secret, and bucket name in the request body.
Sinkhole Config
Delete an ingress rule
Delete the specified ingress rule. The sinkhole must belong to the same account as the zone.
Sinkhole Config
Delete a sinkhole
Delete the specified sinkhole. The sinkhole must not have any active ingress rules defined. A 409 response code indicates that this condition is not met.
Sinkhole Config
Get an ingress rule
Get the specified ingress rule associated with a sinkhole. The sinkhole must belong to the same account as the zone.
Sinkhole Config
Get a sinkhole
Get the specified sinkhole by its unique identifier.
Sinkhole Config
List ingresses for a sinkhole
List all ingress rules associated with the specified sinkhole.
Sinkhole Config
List sinkholes owned by this account
Lists sinkholes owned by the account for redirecting malicious traffic.
Sinkhole Config
Update an ingress rule
Update the specified ingress rule. The sinkhole must belong to the same account as the zone.
Sinkhole Config
Update a sinkhole
Update the name or R2 configuration of the specified sinkhole.
Sinkhole Config
Abort all jobs
Cancels all running R2 Super Slurper migration jobs for the account. Any objects in the middle of a transfer will finish, but no new objects will start transferring.
R2 Super Slurper
Abort a job
Cancels a specific R2 Super Slurper migration job. Any objects in the middle of a transfer will finish, but no new objects will start transferring.
R2 Super Slurper
Check source connectivity
Check whether tokens are valid against the source bucket
R2 Super Slurper
Check target connectivity
Check whether tokens are valid against the target bucket
R2 Super Slurper
Create a job
Creates a new R2 Super Slurper migration job to transfer objects from a source bucket (e.g. S3, GCS, R2) to R2.
R2 Super Slurper
Delete a job
Deletes a completed, aborted, or errored R2 Super Slurper migration job. Active jobs cannot be deleted.
R2 Super Slurper
Get job details
Retrieves detailed status and configuration for a specific R2 Super Slurper migration job.
R2 Super Slurper
Get job logs
Gets log entries for an R2 Super Slurper migration job, showing migration status changes, errors, etc.
R2 Super Slurper
Get job progress
Retrieves current progress metrics for an R2 Super Slurper migration job
R2 Super Slurper
List jobs
Lists all R2 Super Slurper migration jobs for the account with their status.
R2 Super Slurper
Pause a job
Pauses a running R2 Super Slurper migration job. The job can be resumed later to continue transferring.
R2 Super Slurper
Resume a job
Resumes a paused R2 Super Slurper migration job, continuing the transfer from where it stopped.
R2 Super Slurper
Create Health Check
Create a new health check.
Health Checks
Delete Health Check
Delete a health check.
Health Checks
Get Smart Shield Settings
Retrieve Smart Shield Settings.
Smart Shield Settings
Health Check Details
Fetch a single configured health check.
Health Checks
List Health Checks
List configured health checks.
Health Checks
Patch Health Check
Patch a configured health check.
Health Checks
Patch Smart Shield Settings
Set Smart Shield Settings.
Smart Shield Settings
Get Cache Reserve Clear
You can use Cache Reserve Clear to clear your Cache Reserve, but you must first disable Cache Reserve. In most cases, this will be accomplished within 24 hours. You cannot re-enable Cache Reserve while this process is ongoing. Keep in mind that you cannot undo or cancel this operation.
Cache Reserve Clear
Start Cache Reserve Clear
You can use Cache Reserve Clear to clear your Cache Reserve, but you must first disable Cache Reserve. In most cases, this will be accomplished within 24 hours. You cannot re-enable Cache Reserve while this process is ongoing. Keep in mind that you cannot undo or cancel this operation.
Cache Reserve Clear
Update Health Check
Update a configured health check.
Health Checks
Create Smart Tiered Cache setting
Smart Tiered Cache dynamically selects the single closest upper tier for each of your website's origins with no configuration required, using our in-house performance and routing data. Cloudflare collects latency data for each request to an origin, and uses the latency data to determine how well any upper-tier data center is connected with an origin. As a result, Cloudflare can select the data center with the lowest latency to be the upper-tier for an origin.
Smart Tiered Cache
Delete Smart Tiered Cache setting
Smart Tiered Cache dynamically selects the single closest upper tier for each of your website’s origins with no configuration required, using our in-house performance and routing data. Cloudflare collects latency data for each request to an origin, and uses the latency data to determine how well any upper-tier data center is connected with an origin. As a result, Cloudflare can select the data center with the lowest latency to be the upper-tier for an origin.
Smart Tiered Cache
Get Smart Tiered Cache setting
Smart Tiered Cache dynamically selects the single closest upper tier for each of your website’s origins with no configuration required, using our in-house performance and routing data. Cloudflare collects latency data for each request to an origin, and uses the latency data to determine how well any upper-tier data center is connected with an origin. As a result, Cloudflare can select the data center with the lowest latency to be the upper-tier for an origin.
Smart Tiered Cache
Patch Smart Tiered Cache setting
Smart Tiered Cache dynamically selects the single closest upper tier for each of your website’s origins with no configuration required, using our in-house performance and routing data. Cloudflare collects latency data for each request to an origin, and uses the latency data to determine how well any upper-tier data center is connected with an origin. As a result, Cloudflare can select the data center with the lowest latency to be the upper-tier for an origin.
Smart Tiered Cache
Get current aggregated analytics
Retrieves analytics aggregated from the last minute of usage on Spectrum applications underneath a given zone.
Spectrum Analytics
Get analytics by time
Retrieves a list of aggregate metrics grouped by time interval.
Spectrum Analytics
Get analytics summary
Retrieves a list of summarised aggregate metrics over a given time period.
Spectrum Analytics
Create Spectrum application using a name for the origin
Creates a new Spectrum application from a configuration using a name for the origin.
Spectrum Applications
Delete Spectrum application
Deletes a previously existing application.
Spectrum Applications
Get Spectrum application configuration
Gets the application configuration of a specific application inside a zone.
Spectrum Applications
List Spectrum applications
Retrieves a list of currently existing Spectrum applications inside a zone.
Spectrum Applications
Update Spectrum application configuration using a name for the origin
Updates a previously existing application's configuration that uses a name for the origin.
Spectrum Applications
Create scheduled page test
Creates a scheduled test for a page.
Observatory
Start page test
Starts a test for a specific webpage, in a specific region.
Observatory
Delete scheduled page test
Deletes a scheduled test for a page.
Observatory
Delete all page tests
Deletes all tests for a specific webpage from a specific region. Deleted tests are still counted as part of the quota.
Observatory
Get quota and availability
Retrieves quota for all plans, as well as the current zone quota.
Observatory
Get a page test schedule
Retrieves the test schedule for a page in a specific region.
Observatory
Get a page test result
Retrieves the result of a specific test.
Observatory
List core web vital metrics trend
Lists the core web vital metrics trend over time for a specific page.
Observatory
List tested webpages
Lists all webpages which have been tested.
Observatory
List page test history
Test history (list of tests) for a specific webpage.
Observatory
Get Auto-Origin TLS KEX enrollment status for the given zone
When enabled, Cloudflare automatically selects the preferred TLS key-exchange algorithm to use when establishing the TLS connection to the zone's origin, picking from the algorithms permitted by the zone's `origin_tls_compliance_modes` setting. When disabled, the default key-exchange ordering is used.
Origin TLS
Patch Auto-Origin TLS KEX enrollment status for the given zone
Enable or disable Auto-Origin TLS KEX selection for the zone by sending `{"enabled": true}` or `{"enabled": false}`. When enabled, Cloudflare runs a periodic scan of the zone's origins to determine the preferred key-exchange algorithm and writes that preference to the edge so it is sent first in the TLS ClientHello to the origin.
Origin TLS
Get Automatic SSL/TLS enrollment status for the given zone
If the system is enabled, the response will include next_scheduled_scan, representing the next time this zone will be scanned and the zone's ssl/tls encryption mode is potentially upgraded by the system. If the system is disabled, next_scheduled_scan will not be present in the response body.
Automatic SSL/TLS
Patch Automatic SSL/TLS Enrollment status for given zone
The automatic system is enabled when this endpoint is hit with value in the request body is set to "auto", and disabled when the request body value is set to "custom".
Automatic SSL/TLS
Edit SSL Certificate Pack Validation Method
Edit SSL validation method for a certificate pack. A PATCH request will request an immediate validation check on any certificate, and return the updated status. If a validation method is provided, the validation will be immediately attempted using that method.
SSL Verification
SSL Verification Details
Get SSL Verification Info for a Zone.
SSL Verification
Start livestreaming a meeting
Starts livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API.
Live streams
Start recording a meeting
Starts recording a meeting. The meeting can be started by an App admin directly, or a participant with permissions to start a recording, based on the type of authorization used.
Recordings
Start On-Demand Account Scan
Initiates an on-demand security scan for the entire account, scanning all zones associated with the account. Rate limited to 5 scans per account per 24-hour window.
Security Center Scans
Start On-Demand Zone Scan
Initiates an on-demand security scan for a specific zone. Rate limited to 5 scans per account per 24-hour window (shared with account-level scans).
Security Center Scans
Start recording participant audio tracks
Starts track recording for a meeting. Track recording currently records separate participant audio tracks as WebM files in the RealtimeKit bucket. Video track recording is in development. For more information, refer to [Track recording](/realtime/realtimekit/recording-guide/track-recording/).
Recordings
Stop livestreaming a meeting
Stops the active livestream of a meeting associated with the given meeting ID. Retreive the meeting ID using the `Create a meeting` API.
Live streams
Store catalog credentials
Store authentication credentials for a catalog. These credentials are used to authenticate with R2 storage when performing catalog operations.
Credential Management
Create download
Creates a download for a video of specified type. For backwards-compatibility, POST requests to /downloads will enable the default download.
Stream MP4 Downloads
Delete download
Delete specific type of download. For backwards-compatibility, DELETE requests to /downloads will delete the default download.
Stream MP4 Downloads
Create a live input
Creates a live input, and returns credentials that you or your users can use to stream live video to Cloudflare Stream.
Stream Live Inputs
Create a new output, connected to a live input
Creates a new output that can be used to simulcast or restream live video to other RTMP or SRT destinations. Outputs are always linked to a specific live input — one live input can have many outputs.
Stream Live Inputs
Delete a live input
Prevents a live input from being streamed to and makes the live input inaccessible to any future API calls.
Stream Live Inputs
Delete an output
Deletes an output and removes it from the associated live input.
Stream Live Inputs
Disable a live input
Prevents a live input from being streamed to and makes the live input inaccessible to any future API calls until enabled.
Stream Live Inputs
Enable a live input
Allows a live input to be streamed to and makes the live input accessible to any future API calls.
Stream Live Inputs
List all outputs associated with a specified live input
Retrieves all outputs associated with a specified live input.
Stream Live Inputs
List live inputs
Lists the live inputs created for an account. To get the credentials needed to stream to a specific live input, request a single live input.
Stream Live Inputs
Retrieve a live input
Retrieves details of an existing live input.
Stream Live Inputs
Rotate keys for a live input
Rotates the credentials for a live input without changing its identifier. Old credentials are revoked, broadcasts using stale credentials are automatically disconnected shortly after rotation, and the response returns refreshed credentials.
Stream Live Inputs
Update a live input
Updates a specified live input.
Stream Live Inputs
Update an output
Updates the state of an output.
Stream Live Inputs
Create downloads
Creates a download for a video when a video is ready to view. Use `/downloads/{download_type}` instead for type-specific downloads. Available types are `default` and `audio`.
Stream MP4 Downloads
Delete downloads
Delete the downloads for a video. Use `/downloads/{download_type}` instead for type-specific downloads. Available types are `default` and `audio`.
Stream MP4 Downloads
List downloads
Lists the downloads created for a video.
Stream MP4 Downloads
Create signing keys
Creates an RSA private key in PEM and JWK formats. Key files are only displayed once after creation. Keys are created, used, and deleted independently of videos, and every key can sign any video.
Stream Signing Keys
Delete signing keys
Deletes signing keys and revokes all signed URLs generated with the key.
Stream Signing Keys
List signing keys
Lists the video ID and creation date and time when a signing key was created.
Stream Signing Keys
Delete captions or subtitles
Removes the captions or subtitles from a video.
Stream Subtitles/Captions
Generate captions or subtitles for a provided language via AI
Generate captions or subtitles for provided language via AI.
Stream Subtitles/Captions
List captions or subtitles for a provided language
Lists the captions or subtitles for provided language.
Stream Subtitles/Captions
Return WebVTT captions for a provided language
Return WebVTT captions for a provided language.
Stream Subtitles/Captions
List captions or subtitles
Lists the available captions or subtitles for a specific video.
Stream Subtitles/Captions
Upload captions or subtitles
Uploads the caption or subtitle file to the endpoint for a specific BCP47 language. One caption or subtitle file per language is allowed.
Stream Subtitles/Captions
Clip videos given a start and end time
Clips a video based on the specified start and end times provided in seconds.
Stream Video Clipping
Create signed URL tokens for videos
Creates a signed URL token for a video. If a body is not provided in the request, a token is created with default values.
Stream Videos
Delete video
Deletes a video and its copies from Cloudflare Stream.
Stream Videos
Initiate video uploads using TUS
Initiates a video upload using the TUS protocol. On success, the server responds with a status code 201 (created) and includes a `location` header to indicate where the content should be uploaded. Refer to https://tus.io for protocol details.
Stream Videos
List videos
Lists up to 1000 videos from a single request. For a specific range, refer to the optional parameters.
Stream Videos
Retrieve embed Code HTML
Fetches an HTML code snippet to embed a video in a web page delivered through Cloudflare. On success, returns an HTML fragment for use on web pages to display a video. On failure, returns a JSON response body.
Stream Videos
Retrieve video details
Fetches details for a single video.
Stream Videos
Storage use
Returns information about an account's storage use.
Stream Videos
Edit video details
Edit details for a single video.
Stream Videos
Upload videos from a URL
Uploads a video to Stream from a provided URL.
Stream Videos
Upload videos via direct upload URLs
Creates a direct upload that allows video uploads without an API key.
Stream Videos
Create watermark profiles via basic upload
Creates watermark profiles using a single `HTTP POST multipart/form-data` request.
Stream Watermark Profile
Delete watermark profiles
Deletes a watermark profile.
Stream Watermark Profile
List watermark profiles
Lists all watermark profiles for an account.
Stream Watermark Profile
Watermark profile details
Retrieves details for a single watermark profile.
Stream Watermark Profile
Create webhooks
Creates a webhook notification.
Stream Webhook
Delete webhooks
Deletes a webhook.
Stream Webhook
View webhooks
Retrieves a list of webhooks.
Stream Webhook
Submit an abuse report
Submit an abuse report of a particular type. Requires the abuse-reports entitlement on the account (Enterprise accounts have it by default; other accounts must request access) and an API token with the `Account > Abuse Reports > Edit` permission. If the account is not entitled, the request is rejected with an HTTP `401` response (see below).
tseng-abuse-complaint-processor_other
Create Event Subscription
Create a new event subscription for a queue
Queue
Delete Event Subscription
Delete an existing event subscription
Queue
Get Event Subscription
Get details about an existing event subscription
Queue
List Event Subscriptions
Get a paginated list of event subscriptions with optional sorting and filtering
Queue
Update Event Subscription
Update an existing event subscription
Queue
Delete tags from an account-level resource
Removes all tags from a specific account-level resource.
Resource Tagging
Get tags for an account-level resource
Retrieves tags for a specific account-level resource.
Resource Tagging
List tagged resources
Lists all tagged resources for an account.
Resource Tagging
List tag key summary
Lists all distinct tag keys and their distinct values across resources in an account.
Resource Tagging
List tag keys
Lists all distinct tag keys used across resources in an account.
Resource Tagging
List tag values
Lists all distinct values for a given tag key, optionally filtered by resource type.
Resource Tagging
Set tags for an account-level resource
Creates or updates tags for a specific account-level resource.
Resource Tagging
Delete tags from a zone-level resource
Removes all tags from a specific zone-level resource.
Resource Tagging
Get tags for a zone-level resource
Retrieves tags for a specific zone-level resource.
Resource Tagging
Set tags for a zone-level resource
Creates or updates tags for a specific zone-level resource. Replaces all existing tags for the resource.
Resource Tagging
List keys
List all the keys in your telemetry events.
Keys
Live tail heartbeat
Notify live tail that user is still eligible to receive live events.
Live Tail
Prepare live tail
Prepare websocket server for live tail.
Live Tail
Run a query
Run a temporary or saved query.
Query run
List values
List unique values found in your events.
Values
Add Tenant Custom Nameserver
Add Tenant Custom Nameserver
Tenant-Level Custom Nameservers
Delete Tenant Custom Nameserver
Delete Tenant Custom Nameserver
Tenant-Level Custom Nameservers
List Tenant Custom Nameservers
List a tenant's custom nameservers.
Tenant-Level Custom Nameservers
List tenant accounts
List of accounts for the Tenant.
Tenants
List tenant entitlements
List of innate entitlements available for the Tenant.
Tenants
List tenant memberships
List of active members (Cloudflare users) for the Tenant.
Tenants
Get tenant
Retrieves a Tenant by Tenant ID.
Tenants
Get tenant account types
List of account types available for the Tenant to provision accounts.
Tenants
Get Tiered Caching setting
Tiered Cache works by dividing Cloudflare's data centers into a hierarchy of lower-tiers and upper-tiers. If content is not cached in lower-tier data centers (generally the ones closest to a visitor), the lower-tier must ask an upper-tier to see if it has the content. If the upper-tier does not have the content, only the upper-tier can ask the origin for content. This practice improves bandwidth efficiency by limiting the number of data centers that can ask the origin for content, which reduces origin load and makes websites more cost-effective to operate. Additionally, Tiered Cache concentrates connections to origin servers so they come from a small number of data centers rather than the full set of network locations. This results in fewer open connections using server resources.
Tiered Caching
Patch Tiered Caching setting
Tiered Cache works by dividing Cloudflare's data centers into a hierarchy of lower-tiers and upper-tiers. If content is not cached in lower-tier data centers (generally the ones closest to a visitor), the lower-tier must ask an upper-tier to see if it has the content. If the upper-tier does not have the content, only the upper-tier can ask the origin for content. This practice improves bandwidth efficiency by limiting the number of data centers that can ask the origin for content, which reduces origin load and makes websites more cost-effective to operate. Additionally, Tiered Cache concentrates connections to origin servers so they come from a small number of data centers rather than the full set of network locations. This results in fewer open connections using server resources.
Tiered Caching
Create a new Token Validation configuration
Create a new Token Validation configuration
Token Validation Token Configuration
Edit Token Configuration credentials
Edit Token Configuration credentials. The provided `keys` array defines the full resulting key set (stored keys omitted from payload are removed). For each provided key identity (`{alg,kid}`), payload fields overwrite the stored key before validation and omitted fields inherit from the stored key. Key identities must be unique within the request. Existing symmetric keys (`kty: "oct"`) preserve stored key material when `k` is omitted; send `k` to rotate. `k: null` is invalid.
Token Validation Token Configuration
Update Token Configuration credentials
Update Token Configuration credentials with full replacement semantics. Key identities (`{alg,kid}`) must be unique within the request. Symmetric keys (`kty: "oct"`) require `k`; `k: null` is invalid.
Token Validation Token Configuration
Delete Token Configuration
Delete Token Configuration
Token Validation Token Configuration
Edit an existing Token Configuration
Edit fields of an existing Token Configuration
Token Validation Token Configuration
Get a single Token Configuration
Get a single Token Configuration
Token Validation Token Configuration
List token validation configurations
Lists all token validation configurations for this zone
Token Validation Token Configuration
Bulk create token validation rules
Create zone token validation rules. A request can create multiple Token Validation Rules.
Token Validation Token Rules
Bulk edit token validation rules
Edit token validation rules. A request can update multiple Token Validation Rules. Rules can be re-ordered using the `position` field. Returns all updated rules.
Token Validation Token Rules
Create a token validation rule
Create a token validation rule.
Token Validation Token Rules
Delete a zone token validation rule
Delete a zone token validation rule.
Token Validation Token Rules
Edit a zone token validation rule
Edit a zone token validation rule.
Token Validation Token Rules
Get a zone token validation rule
Get a zone token validation rule.
Token Validation Token Rules
List token validation rules
List token validation rules
Token Validation Token Rules
Preview operations covered by a Token Validation rule
Preview operations covered by a Token Validation rule. The API will return all operations on a zone annotated with an additional `state` field. Operations with an `included` `state` will be covered by a Token Validation Rule.
Token Validation Token Rules
Enable or Disable Total TLS
Set Total TLS Settings or disable the feature for a Zone.
Total TLS
Total TLS Settings Details
Get Total TLS Settings for a Zone.
Total TLS
Trigger deploy hook
Trigger a build using a deploy hook. This endpoint does not require authentication - the deploy_hook_uuid acts as a secret token.
Deploy Hooks
Clean up Cloudflare Tunnel connections
Removes a connection (aka Cloudflare Tunnel Connector) from a Cloudflare Tunnel independently of its current state. If no connector id (client_id) is provided all connectors will be removed. We recommend running this command after rotating tokens.
Cloudflare Tunnel
Get configuration
Gets the configuration for a remotely-managed tunnel
Cloudflare Tunnel Configuration
Get WARP Connector HA configuration
Gets the high-availability configuration for a WARP Connector tunnel.
Cloudflare Tunnel Configuration
Configure Tunnel Ingress
Configures public hostname routes for a remotely-managed Cloudflare Tunnel and appends the required catch-all fallback rule.
tunnelconfigurationingress
Update WARP Connector HA configuration
Adds or updates the high-availability configuration for a WARP Connector tunnel.
Cloudflare Tunnel Configuration
Create a Cloudflare Tunnel
Creates a new Cloudflare Tunnel in an account.
Cloudflare Tunnel
Create a Warp Connector Tunnel
Creates a new Warp Connector Tunnel in an account.
Cloudflare Tunnel
Delete a Cloudflare Tunnel
Deletes a Cloudflare Tunnel from an account.
Cloudflare Tunnel
Delete a Warp Connector Tunnel
Deletes a Warp Connector Tunnel from an account.
Cloudflare Tunnel
Get a Cloudflare Tunnel
Fetches a single Cloudflare Tunnel.
Cloudflare Tunnel
Get a Cloudflare Tunnel management token
Gets a management token used to access the management resources (i.e. Streaming Logs) of a tunnel.
Cloudflare Tunnel
Get a Cloudflare Tunnel token
Gets the token used to associate cloudflared with a specific tunnel.
Cloudflare Tunnel
Get a Warp Connector Tunnel
Fetches a single Warp Connector Tunnel.
Cloudflare Tunnel
Get a Warp Connector Tunnel token
Gets the token used to associate warp device with a specific Warp Connector tunnel.
Cloudflare Tunnel
Get Cloudflare Tunnel connector
Fetches connector and connection details for a Cloudflare Tunnel.
Cloudflare Tunnel
Get WARP Connector Tunnel connector
Fetches connector and connection details for a WARP Connector Tunnel.
Cloudflare Tunnel
List All Tunnels
Lists and filters all types of Tunnels in an account.
Cloudflare Tunnel
List Cloudflare Tunnel connections
Fetches connection details for a Cloudflare Tunnel.
Cloudflare Tunnel
List Cloudflare Tunnels
Lists and filters Cloudflare Tunnels in an account.
Cloudflare Tunnel
List WARP Connector Tunnel connections
Fetches connection details for a WARP Connector Tunnel.
Cloudflare Tunnel
List Warp Connector Tunnels
Lists and filters Warp Connector Tunnels in an account.
Cloudflare Tunnel
Trigger a manual failover for a WARP Connector Tunnel
Triggers a manual failover for a specific WARP Connector Tunnel, setting the specified client as the active connector. The tunnel must be configured for high availability (HA) and the client must be linked to the tunnel.
Cloudflare Tunnel
Create a tunnel route
Routes a private network through a Cloudflare Tunnel.
Tunnel Routing
Create a tunnel route (CIDR Endpoint)
Routes a private network through a Cloudflare Tunnel. The CIDR in `ip_network_encoded` must be written in URL-encoded format.
Tunnel Routing
Delete a tunnel route
Deletes a private network route from an account.
Tunnel Routing
Delete a tunnel route (CIDR Endpoint)
Deletes a private network route from an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format. If no virtual_network_id is provided it will delete the route from the default vnet. If no tun_type is provided it will fetch the type from the tunnel_id or if that is missing it will assume Cloudflare Tunnel as default. If tunnel_id is provided it will delete the route from that tunnel, otherwise it will delete the route based on the vnet and tun_type.
Tunnel Routing
Get tunnel route
Get a private network route in an account.
Tunnel Routing
Get tunnel route by IP
Fetches routes that contain the given IP address.
Tunnel Routing
List tunnel routes
Lists and filters private network routes in an account.
Tunnel Routing
Update a tunnel route
Updates an existing private network route in an account. The fields that are meant to be updated should be provided in the body of the request.
Tunnel Routing
Update a tunnel route (CIDR Endpoint)
Updates an existing private network route in an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format.
Tunnel Routing
Update a Cloudflare Tunnel
Updates an existing Cloudflare Tunnel.
Cloudflare Tunnel
Update a Warp Connector Tunnel
Updates an existing Warp Connector Tunnel.
Cloudflare Tunnel
Create a virtual network
Adds a new virtual network to an account.
Tunnel Virtual Network
Delete a virtual network
Deletes an existing virtual network.
Tunnel Virtual Network
Get a virtual network
Get a virtual network.
Tunnel Virtual Network
List virtual networks
Lists and filters virtual networks in an account.
Tunnel Virtual Network
Update a virtual network
Updates an existing virtual network.
Tunnel Virtual Network
Remove ignore marker from a finding
Ability to un-ignore a Finding if it's previously been ignored. Does nothing if the Finding is not ignored.
findings
Remove the archive marking from a finding instance
Remove the archive marking from one or more finding instances.
findings
Edit Universal SSL Settings
Patch Universal SSL Settings for a Zone.
Universal SSL Settings for a Zone
Universal SSL Settings Details
Get Universal SSL Settings for a Zone.
Universal SSL Settings for a Zone
Unrevoke registrations
Unrevokes a list of WARP registrations.
Registrations
Update an account entry point ruleset
Updates an account entry point ruleset, creating a new version.
Account Rulesets
Update an account ruleset
Updates an account ruleset, creating a new version.
Account Rulesets
Update an account ruleset rule
Updates an existing rule in an account ruleset.
Account Rulesets
Update allowlist prefix.
Update an allowlist prefix specified by the given UUID.
dos-flowtrackd-api_other
Modify stored information about a CNI object
Modify stored information about a CNI object
CNIs
Update Credential
Replaces a credential. All fields must be provided.
Credentials
Update Credential Set
Replaces a credential set. All fields must be provided.
Credential Sets
Update deploy hook
Update an existing deploy hook.
Deploy Hooks
Update deployment group
Updates a deployment group. Returns 409 if any newly added policy IDs already belong to another deployment group. This endpoint is in Beta.
Deployment Groups
Update a DEX Rule
Update a DEX Rule.
DEX Rules
Update DNS Protection rule.
Update a DNS Protection rule specified by the given UUID.
dos-flowtrackd-api_other
Update Hyperdrive
Updates and returns the specified Hyperdrive configuration.
Hyperdrive
Update integration
Updates an integration's name, permissions, DLP profiles, use cases, or credentials.
Integrations
Update IP profile
Updates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.
IP Profiles
Update catalog maintenance configuration
Update the maintenance configuration for a catalog. This allows you to enable or disable compaction and adjust target file sizes for optimization.
Maintenance Configuration
Update Managed Transforms
Updates the status of one or more Managed Transforms.
Managed Transforms
Update a meeting
Updates a meeting in an App for the given meeting ID.
Meetings
Update prefix.
Update a prefix specified by the given UUID.
dos-flowtrackd-api_other
Update protection status.
Update the protection status of the account.
dos-flowtrackd-api_other
Updates Security Center Insight Classification
Updates the user classification for a Security Center insight. Valid values are 'false_positive' or 'accept_risk'. To reset, set classification to null. Cannot change directly between classification values - must reset to null first.
Security Center Insights
Updates security.txt
Updates the security.txt file configuration for a zone, which provides security researchers with vulnerability reporting information.
security.txt
Update the current settings for the active account
Update the current settings for the active account
Settings
Update SSO connector state
Updates the state or configuration of an SSO connector.
SSO
Update SYN Protection filter.
Update a SYN Protection filter specified by the given UUID.
dos-flowtrackd-api_other
Update SYN Protection rule.
Update a SYN Protection rule specified by the given UUID.
dos-flowtrackd-api_other
Update table maintenance configuration
Update the maintenance configuration for a specific table. This allows you to enable or disable compaction and adjust target file sizes for optimization.
Table Maintenance Configuration
Update Target Environment
Replaces a target environment. All fields must be provided.
Target Environments
Update TCP Flow Protection filter.
Update a TCP Flow Protection filter specified by the given UUID.
dos-flowtrackd-api_other
Update TCP Flow Protection rule.
Update a TCP Flow Protection rule specified by the given UUID.
dos-flowtrackd-api_other
Update trigger
Update an existing CI/CD trigger
Triggers
Update URL Normalization settings
Updates the URL Normalization settings.
URL Normalization
Update an existing webhook configuration
Updates an existing webhook configuration with new settings.
webhooks
Update Worker
Perform a complete replacement of a Worker, where omitted properties are set to their default values. This is the exact same as the Create Worker endpoint, but operates on an existing Worker. To perform a partial update instead, use the Edit Worker endpoint.
Workers
Update worker build configuration
Update the build configuration for a Worker script. Supports partial updates to git repository settings and production build settings.
Workers
Update a zone entry point ruleset
Updates a zone entry point ruleset, creating a new version.
Zone Rulesets
Update a zone ruleset
Updates a zone ruleset, creating a new version.
Zone Rulesets
Update a zone ruleset rule
Updates an existing rule in a zone ruleset.
Zone Rulesets
Updates Zone Security Center Insight Classification
Updates the user classification for a zone-specific Security Center insight. Valid values are 'false_positive' or 'accept_risk'. To reset, set classification to null. Cannot change directly between classification values - must reset to null first.
Security Center Insights
Update a zone snippet
Creates or updates a snippet belonging to the zone.
Zone Snippets
Update zone snippet rules
Updates all snippet rules belonging to the zone.
Zone Snippets
Upsert environment variables
Create or update environment variables for a trigger
Environment Variables
Create or update repository connection
Upsert a repository connection for CI/CD integration
Repository Connections
Get URL Intelligence
Gets security information about a URL, including content categories and risk types. The URL must be provided as a query parameter.
URL Intelligence
Create URL Scan
Submit a URL to scan. You can also set some options, like the visibility level and custom headers. Check limits at https://developers.cloudflare.com/security-center/investigate/scan-limits/.
URL Scanner (Deprecated)
Bulk create URL Scans
Submit URLs to scan. Check limits at https://developers.cloudflare.com/security-center/investigate/scan-limits/ and take into account scans submitted in bulk have lower priority and may take longer to finish.
URL Scanner
Create URL Scan
Submit a URL to scan. Check limits at https://developers.cloudflare.com/security-center/investigate/scan-limits/.
URL Scanner
Get raw response
Returns the plain response of the network request.
URL Scanner (Deprecated)
Get raw response
Returns the raw response of the network request. Find the `response_id` in the `data.requests.response.hash`.
URL Scanner
Get URL scan
Get URL scan by uuid
URL Scanner (Deprecated)
Get URL scan's DOM
Returns a plain text response, with the scan's DOM content as rendered by Chrome.
URL Scanner
Get URL scan's HAR
Get a URL scan's HAR file. See HAR spec at http://www.softwareishard.com/blog/har-12-spec/.
URL Scanner (Deprecated)
Get URL scan's HAR
Get a URL scan's HAR file. See HAR spec at http://www.softwareishard.com/blog/har-12-spec/.
URL Scanner
Get screenshot
Get scan's screenshot by resolution (desktop/mobile/tablet).
URL Scanner (Deprecated)
Get screenshot
Get scan's screenshot by resolution (desktop/mobile/tablet).
URL Scanner
Get URL scan
Get URL scan by uuid
URL Scanner
Search URL scans
Search scans by date and webpages' requests, including full URL (after redirects), hostname, and path. <br/> A successful scan will appear in search results a few minutes after finishing but may take much longer if the system in under load. By default, only successfully completed scans will appear in search results, unless searching by `scanId`. Please take into account that older scans may be removed from the search index at an unspecified time.
URL Scanner (Deprecated)
Search URL scans
Use a subset of ElasticSearch Query syntax to filter scans. Some example queries:<br/> <br/>- 'path:"/bundles/jquery.js"': Searches for scans who requested resources with the given path.<br/>- 'page.asn:AS24940 AND hash:xxx': Websites hosted in AS24940 where a resource with the given hash was downloaded.<br/>- 'page.domain:microsoft* AND verdicts.malicious:true AND NOT page.domain:microsoft.com': malicious scans whose hostname starts with "microsoft".<br/>- 'apikey:me AND date:[2025-01 TO 2025-02]': my scans from 2025 January to 2025 February.
URL Scanner
Get account billing usage
Retrieve billing usage analytics for an account. Returns time-series data for all billable product metrics including Stream, Media (Images), Rate Limiting, Load Balancing, Argo, Workers, Workers KV, Image Resizing, and Spectrum.
Usage Analytics
Get account Media usage
Retrieve Media usage analytics for an account. This endpoint shares the same backend handler as the Stream usage endpoint and returns identical Stream metrics (streamMinutesViewed). The gateway rewrites this path to the shared usage handler.
Usage Analytics
Get account Stream usage
Retrieve Stream usage analytics for an account. Returns time-series data for Stream billable minutes viewed across all zones in the account. The gateway rewrites this path before forwarding to the backend usage handler.
Usage Analytics
Get zone Media usage
Retrieve Media usage analytics for a zone. This endpoint shares the same backend handler as the Stream usage endpoint and returns identical Stream metrics (streamMinutesViewed). The gateway resolves the zone to its owning account and rewrites this path to the shared usage handler.
Usage Analytics
Get zone Stream usage
Retrieve Stream usage analytics for a zone. Returns time-series data for Stream billable minutes viewed. The gateway resolves the zone to its owning account and rewrites this path before forwarding to the backend usage handler.
Usage Analytics
Get event count
Event counts broken down by dataset and service, bucketed by day, for up to 90 days. The top-level events field is the sum of all breakdown counts.
Usage
Create a User Agent Blocking rule
Creates a new User Agent Blocking rule in a zone.
User Agent Blocking rules
Delete a User Agent Blocking rule
Deletes an existing User Agent Blocking rule.
User Agent Blocking rules
Get a User Agent Blocking rule
Fetches the details of a User Agent Blocking rule.
User Agent Blocking rules
List User Agent Blocking rules
Fetches User Agent Blocking rules in a zone. You can filter the results using several optional parameters.
User Agent Blocking rules
Update a User Agent Blocking rule
Updates an existing User Agent Blocking rule.
User Agent Blocking rules
Get user analytics dashboard
The user analytics dashboard provides totals and timeseries data aggregated across all zones owned by the authenticated user for the given time period. Only zones for which the user has the `#analytics:read` permission are included. This endpoint is deprecated. Please use the GraphQL Analytics API instead: https://developers.cloudflare.com/analytics/graphql-api/
User Analytics (Deprecated)
Create Token
Create a new access token.
User API Tokens
Delete Token
Destroy a token.
User API Tokens
List Tokens
List all access tokens you created. Results include active, disabled, and recently-expired tokens when include_expired is set to true.
User API Tokens
Roll Token
Roll the token secret.
User API Tokens
Token Details
Get information about a specific token.
User API Tokens
Update Token
Update an existing token.
User API Tokens
Verify Token
Test whether a token works.
User API Tokens
Billing History Details
Accesses your billing history object.
User Billing History
Billing Profile Details
Accesses your billing profile object.
User Billing Profile
Edit User
Edit part of your user details.
User
List user tenants
Retrieves list of tenants the authenticated user / method has access to.
User
List Regions
List all region mappings in the user context.
Load Balancer Regions
Delete Membership
Remove the associated member from an account.
User's Account Memberships
List Memberships
List memberships of accounts the user can access.
User's Account Memberships
Membership Details
Get a specific membership.
User's Account Memberships
Update Membership
Accept or reject this account invitation.
User's Account Memberships
Invitation Details
Gets the details of an invitation.
User's Invites
List Invitations
Lists all invitations associated with my user.
User's Invites
Respond to Invitation
Responds to an invitation.
User's Invites
Leave Organization
Removes association to an organization.
User's Organizations
List Organizations
Lists organizations the user is associated with.
User's Organizations
Organization Details
Gets a specific organization the user is associated with.
User's Organizations
Create User Subscription
Creates a user subscription.
User Subscription
Delete User Subscription
Deletes a user's subscription.
User Subscription
Get User Subscriptions
Lists all of a user's subscriptions.
User Subscription
Update User Subscription
Updates a user's subscriptions.
User Subscription
User Details
Retrieves detailed information about the currently authenticated user, including email, name, and account memberships.
User
Create Metadata Index
Enable metadata filtering based on metadata property. Limited to 10 properties.
Vectorize
Create Vectorize Index
Creates and returns a new Vectorize Index.
Vectorize
Delete Metadata Index
Allow Vectorize to delete the specified metadata index.
Vectorize
Delete Vectorize Index
Deletes the specified Vectorize Index.
Vectorize
Delete Vectors By Identifier
Delete a set of vectors from an index by their vector identifiers.
Vectorize
Create Vectorize Index (Deprecated)
Creates and returns a new Vectorize Index.
Vectorize Beta (Deprecated)
Delete Vectorize Index (Deprecated)
Deletes the specified Vectorize Index.
Vectorize Beta (Deprecated)
Delete Vectors By Identifier (Deprecated)
Delete a set of vectors from an index by their vector identifiers.
Vectorize Beta (Deprecated)
Get Vectorize Index (Deprecated)
Returns the specified Vectorize Index.
Vectorize Beta (Deprecated)
Get Vectors By Identifier (Deprecated)
Get a set of vectors from an index by their vector identifiers.
Vectorize Beta (Deprecated)
Insert Vectors (Deprecated)
Inserts vectors into the specified index and returns the count of the vectors successfully inserted.
Vectorize Beta (Deprecated)
List Vectorize Indexes (Deprecated)
Returns a list of Vectorize Indexes
Vectorize Beta (Deprecated)
Query Vectors (Deprecated)
Finds vectors closest to a given vector in an index.
Vectorize Beta (Deprecated)
Update Vectorize Index (Deprecated)
Updates and returns the specified Vectorize Index.
Vectorize Beta (Deprecated)
Upsert Vectors (Deprecated)
Upserts vectors into the specified index, creating them if they do not exist and returns the count of values and ids successfully inserted.
Vectorize Beta (Deprecated)
Get Vectorize Index
Returns the specified Vectorize Index.
Vectorize
Get Vectors By Identifier
Get a set of vectors from an index by their vector identifiers.
Vectorize
Get Vectorize Index Info
Get information about a vectorize index.
Vectorize
Insert Vectors
Inserts vectors into the specified index and returns a mutation id corresponding to the vectors enqueued for insertion.
Vectorize
List Metadata Indexes
List Metadata Indexes for the specified Vectorize Index.
Vectorize
List Vectorize Indexes
Returns a list of Vectorize Indexes
Vectorize
List Vectors
Returns a paginated list of vector identifiers from the specified index.
Vectorize
Query Vectors
Finds vectors closest to a given vector in an index.
Vectorize
Upsert Vectors
Upserts vectors into the specified index, creating them if they do not exist and returns a mutation id corresponding to the vectors enqueued for upsertion.
Vectorize
Add Custom Scan Expressions
Add custom scan expressions for Content Scanning.
Content Scanning
Delete a Custom Scan Expression
Delete a Content Scan Custom Expression.
Content Scanning
Disable Content Scanning
Disable Content Scanning.
Content Scanning
Enable Content Scanning
Enable Content Scanning.
Content Scanning
Get Content Scanning Status
Retrieve the current status of Content Scanning.
Content Scanning
List Existing Custom Scan Expressions
Get a list of existing custom scan expressions for Content Scanning.
Content Scanning
Update Content Scanning Status
Update the Content Scanning status.
Content Scanning
Create a WAF override
**This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Previously created a URI-based WAF override for a zone.
WAF overrides
Delete a WAF override
**This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Previously deleted an existing URI-based WAF override.
WAF overrides
Get a WAF override
**This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Previously fetched the details of a URI-based WAF override.
WAF overrides
List WAF overrides
**This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Previously fetched the URI-based WAF overrides in a zone.
WAF overrides
Update WAF override
**This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Previously updated an existing URI-based WAF override.
WAF overrides
Get a WAF package
Fetches the details of a WAF package. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).
WAF packages
List WAF packages
Fetches WAF packages for a zone. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).
WAF packages
Update a WAF package
Updates a WAF package. You can update the sensitivity and the action of an anomaly detection WAF package. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).
WAF packages
Create Leaked Credential Checks Custom Detection
Create user-defined detection pattern for Leaked Credential Checks.
Leaked Credential Checks
Delete Leaked Credential Checks Custom Detection
Remove user-defined detection pattern for Leaked Credential Checks.
Leaked Credential Checks
Get Leaked Credential Checks Custom Detection
Get user-defined detection pattern for Leaked Credential Checks.
Leaked Credential Checks
Get Leaked Credential Checks Status
Retrieves the current status of Leaked Credential Checks.
Leaked Credential Checks
List Leaked Credential Checks Custom Detections
List user-defined detection patterns for Leaked Credential Checks.
Leaked Credential Checks
Set Leaked Credential Checks Status
Updates the current status of Leaked Credential Checks.
Leaked Credential Checks
Update Leaked Credential Checks Custom Detection
Update user-defined detection pattern for Leaked Credential Checks.
Leaked Credential Checks
Get a WAF rule group
Fetches the details of a WAF rule group. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).
WAF rule groups
List WAF rule groups
Fetches the WAF rule groups in a WAF package. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).
WAF rule groups
Update a WAF rule group
Updates a WAF rule group. You can update the state (`mode` parameter) of a rule group. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).
WAF rule groups
Get a WAF rule
Fetches the details of a WAF rule in a WAF package. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).
WAF rules
List WAF rules
Fetches WAF rules in a WAF package. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).
WAF rules
Update a WAF rule
Updates a WAF rule. You can only update the mode/action of the rule. **Note:** Applies only to the [previous version of WAF managed rules](https://developers.cloudflare.com/support/firewall/managed-rules-web-application-firewall-waf/understanding-waf-managed-rules-web-application-firewall/).
WAF rules
Create a custom waiting room page preview
Creates a waiting room page preview. Upload a custom waiting room page for preview. You will receive a preview URL in the form `http://waitingrooms.dev/preview/<uuid>`. You can use the following query parameters to change the state of the preview: 1. `force_queue`: Boolean indicating if all users will be queued in the waiting room and no one will be let into the origin website (also known as queueAll). 2. `queue_is_full`: Boolean indicating if the waiting room's queue is currently full and not accepting new users at the moment. 3. `queueing_method`: The queueing method currently used by the waiting room. - **fifo** indicates a FIFO queue. - **random** indicates a Random queue. - **passthrough** indicates a Passthrough queue. Keep in mind that the waiting room page will only be displayed if `force_queue=true` or `event=prequeueing` — for other cases the request will pass through to the origin. For our preview, this will be a fake origin website returning \"Welcome\". - **reject** indicates a Reject queue. 4. `event`: Used to preview a waiting room event. - **none** indicates no event is occurring. - **prequeueing** indicates that an event is prequeueing (between `prequeue_start_time` and `event_start_time`). - **started** indicates that an event has started (between `event_start_time` and `event_end_time`). 5. `shuffle_at_event_start`: Boolean indicating if the event will shuffle users in the prequeue when it starts. This can only be set to **true** if an event is active (`event` is not **none**). For example, you can make a request to `http://waitingrooms.dev/preview/<uuid>?force_queue=false&queue_is_full=false&queueing_method=random&event=started&shuffle_at_event_start=true` 6. `waitTime`: Non-zero, positive integer indicating the estimated wait time in minutes. The default value is 10 minutes. For example, you can make a request to `http://waitingrooms.dev/preview/<uuid>?waitTime=50` to configure the estimated wait time as 50 minutes.
Waiting Room
Create event
Only available for the Waiting Room Advanced subscription. Creates an event for a waiting room. An event takes place during a specified period of time, temporarily changing the behavior of a waiting room. While the event is active, some of the properties in the event's configuration may either override or inherit from the waiting room's configuration. Note that events cannot overlap with each other, so only one event can be active at a time.
Waiting Room
Create waiting room
Creates a new waiting room.
Waiting Room
Create Waiting Room Rule
Only available for the Waiting Room Advanced subscription. Creates a rule for a waiting room.
Waiting Room
Delete event
Deletes an event for a waiting room.
Waiting Room
Delete waiting room
Deletes a waiting room.
Waiting Room
Delete Waiting Room Rule
Deletes a rule for a waiting room.
Waiting Room
Event details
Fetches a single configured event for a waiting room.
Waiting Room
Get waiting room status
Fetches the status of a configured waiting room. Response fields include: 1. `status`: String indicating the status of the waiting room. The possible status are: - **not_queueing** indicates that the configured thresholds have not been met and all users are going through to the origin. - **queueing** indicates that the thresholds have been met and some users are held in the waiting room. - **event_prequeueing** indicates that an event is active and is currently prequeueing users before it starts. - **suspended** indicates that the room is suspended. 2. `event_id`: String of the current event's `id` if an event is active, otherwise an empty string. 3. `estimated_queued_users`: Integer of the estimated number of users currently waiting in the queue. 4. `estimated_total_active_users`: Integer of the estimated number of users currently active on the origin. 5. `max_estimated_time_minutes`: Integer of the maximum estimated time currently presented to the users.
Waiting Room
Get zone-level Waiting Room settings
Get zone-level Waiting Room settings.
Waiting Room
List events
Lists events for a waiting room.
Waiting Room
List Waiting Room Rules
Lists rules for a waiting room.
Waiting Room
List waiting rooms for zone
Lists waiting rooms for zone.
Waiting Room
List waiting rooms for account
Lists waiting rooms for account.
Waiting Room
Patch event
Patches a configured event for a waiting room.
Waiting Room
Patch waiting room
Patches a configured waiting room.
Waiting Room
Patch Waiting Room Rule
Patches a rule for a waiting room.
Waiting Room
Patch zone-level Waiting Room settings
Patch zone-level Waiting Room settings.
Waiting Room
Preview active event details
Previews an event's configuration as if it was active. Inherited fields from the waiting room will be displayed with their current values.
Waiting Room
Replace Waiting Room Rules
Only available for the Waiting Room Advanced subscription. Replaces all rules for a waiting room.
Waiting Room
Update event
Updates a configured event for a waiting room.
Waiting Room
Update waiting room
Updates a configured waiting room.
Waiting Room
Update zone-level Waiting Room settings
Replace zone-level Waiting Room settings.
Waiting Room
Waiting room details
Fetches a single configured waiting room.
Waiting Room
Create a Web Analytics rule
Creates a new rule in a Web Analytics ruleset.
Web Analytics
Create a Web Analytics site
Creates a new Web Analytics site.
Web Analytics
Delete a Web Analytics rule
Deletes an existing rule from a Web Analytics ruleset.
Web Analytics
Delete a Web Analytics site
Deletes an existing Web Analytics site.
Web Analytics
Get RUM status for a zone
Retrieves RUM status for a zone.
Web Analytics
Get a Web Analytics site
Retrieves a Web Analytics site.
Web Analytics
List rules in Web Analytics ruleset
Lists all the rules in a Web Analytics ruleset.
Web Analytics
List Web Analytics site tags
Returns all site tags for an account as an array of site tag strings. This endpoint returns all results without pagination.
Web Analytics
List Web Analytics sites
Lists all Web Analytics sites of an account.
Web Analytics
List Web Analytics zone tags
Returns all zone tags associated with Web Analytics sites for an account. These can be used to filter or exclude zones in the zone selection input. This endpoint returns all results without pagination.
Web Analytics
Update Web Analytics rules
Modifies one or more rules in a Web Analytics ruleset with a single request.
Web Analytics
Toggle RUM on/off for a zone
Toggles RUM on/off for an existing zone.
Web Analytics
Update a Web Analytics rule
Updates a rule in a Web Analytics ruleset.
Web Analytics
Update a Web Analytics site
Updates an existing Web Analytics site.
Web Analytics
Validate a Web Analytics site hostname
Validates that the provided hostname is well-formed, does not contain wildcards, and has a valid TLD. Returns an empty result on success.
Web Analytics
Create IPFS Universal Path Gateway Content List Entry
Create IPFS Universal Path Gateway Content List Entry
Web3 Hostname
Create Web3 Hostname
Create Web3 Hostname
Web3 Hostname
Delete IPFS Universal Path Gateway Content List Entry
Delete IPFS Universal Path Gateway Content List Entry
Web3 Hostname
Delete Web3 Hostname
Delete Web3 Hostname
Web3 Hostname
Edit IPFS Universal Path Gateway Content List Entry
Edit IPFS Universal Path Gateway Content List Entry
Web3 Hostname
Edit Web3 Hostname
Edit Web3 Hostname
Web3 Hostname
IPFS Universal Path Gateway Content List Details
IPFS Universal Path Gateway Content List Details
Web3 Hostname
IPFS Universal Path Gateway Content List Entry Details
IPFS Universal Path Gateway Content List Entry Details
Web3 Hostname
List IPFS Universal Path Gateway Content List Entries
List IPFS Universal Path Gateway Content List Entries
Web3 Hostname
List Web3 Hostnames
List Web3 Hostnames
Web3 Hostname
Update IPFS Universal Path Gateway Content List
Update IPFS Universal Path Gateway Content List
Web3 Hostname
Web3 Hostname Details
Web3 Hostname Details
Web3 Hostname
Get WHOIS Record
Retrieves WHOIS registration data for a domain, including registrant and nameserver information.
WHOIS Record
Add script triggers
Adds event trigger declarations without removing existing declarations owned by the script.
Workflows
Batch create new Workflow instances
Creates multiple workflow instances in a single batch operation.
Workflows
Batch terminate instances of a workflow
Terminates multiple workflow instances in a single batch operation.
Workflows
Change status of instance
Changes the execution status of a workflow instance (e.g., pause, resume, terminate).
Workflows
Create a new workflow instance
Creates a new instance of a workflow, starting its execution.
Workflows
Create/modify Workflow
Creates a new workflow or updates an existing workflow definition.
Workflows
Delete script triggers
Deletes all event trigger declarations owned by a Worker script.
Workflows
Deletes a Workflow
Deletes a Workflow. This only deletes the Workflow and does not delete or modify any Worker associated to this Workflow or bounded to it.
Workflows
Delete a workflow instance
Deletes a workflow instance and its stored state.
Workflows
Get logs and status from instance
Retrieves logs and execution status for a specific workflow instance.
Workflows
Get Workflow version details
Retrieves details for a specific deployed workflow version.
Workflows
Get Workflow version dag
Retrieves the directed acyclic graph (DAG) representation of a workflow version.
Workflows
Get Workflow version graph
Retrieves the graph visualization of a workflow version.
Workflows
Get script triggers
Returns the event trigger declarations owned by a Worker script.
Workflows
Get Workflow details
Retrieves configuration and metadata for a specific workflow.
Workflows
Get full step output from instance
Retrieves the full, untruncated output for a specific step on a workflow instance. Returns a flat status-shaped JSON body with step `status` ('running' | 'waiting' | 'complete' | 'errored'), `error` (nullable), and `output` (the step value, or null while running/waiting/errored). When the step returned a ReadableStream from step.do, the response is served as 'application/octet-stream' with the raw bytes as the body instead of JSON. A `status='running'` response with non-null `error` indicates the step is currently retrying after a prior attempt failed.
Workflows
Get account settings
Retrieves account-level Workflows settings, such as the default instance retention.
Workflows
List of workflow instances
Lists all instances of a workflow with their execution status.
Workflows
List deployed Workflow versions
Lists all deployed versions of a workflow.
Workflows
List all Workflows
Lists all workflows configured for the account.
Workflows
Replace script triggers
Replaces all event trigger declarations owned by a Worker script.
Workflows
Send event to instance
Sends an event to a running workflow instance to trigger state transitions.
Workflows
Get status of the job responsible for terminate all instances of a workflow
Gets the status of a bulk workflow instance termination job.
Workflows
Update account settings
Partially updates account-level Workflows settings; only the fields present in the body are changed.
Workflows
Create Worker Account Settings
Creates Worker account settings for an account.
Worker Account Settings
Fetch Worker Account Settings
Fetches Worker account settings for an account.
Worker Account Settings
Upload Assets
Upload assets ahead of creating a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/.
Worker Script
Get Cron Triggers
Fetches Cron Triggers for a Worker.
Worker Cron Trigger
Update Cron Triggers
Updates Cron Triggers for a Worker.
Worker Cron Trigger
Delete script secret
Remove a secret from a script.
Worker Script
Create Deployment
Deployments configure how [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions) are deployed to traffic. A deployment can consist of one or two versions of a Worker.
Worker Deployments
Delete Deployment
Delete a Worker Deployment. The latest deployment, which is actively serving traffic, cannot be deleted. All other deployments can be deleted.
Worker Deployments
Get Deployment
Get information about a Worker Deployment.
Worker Deployments
List Deployments
List of Worker Deployments. The first deployment in the list is the latest deployment actively serving traffic.
Worker Deployments
Get script content
Get script content from a worker with an environment.
Worker Environment
Put script content
Put script content from a worker with an environment.
Worker Environment
Get secret binding
Get a given secret binding (value omitted) on a script.
Worker Script
List script secrets
List secrets bound to a script.
Worker Script
Patch multiple script secrets
Create, update, or delete multiple secrets on a script in a single operation using JSON Merge Patch (RFC 7396). Usage: - To create or update a secret, set its value to a secret object. - To delete a secret, set its value to `null`. - Secrets not included in the request are left unchanged.
Worker Script
List Placement Regions
Returns a list of available placement regions organized by cloud provider. These regions can be used to configure Smart Placement for Workers.
Worker Placement
Add script secret
Add a secret to a script.
Worker Script
Create Route
Creates a route that maps a URL pattern to a Worker.
Worker Routes
Delete Route
Deletes a route.
Worker Routes
Get Route
Returns information about a route, including URL pattern and Worker.
Worker Routes
List Routes
Returns routes for a zone.
Worker Routes
Update Route
Updates the URL pattern or Worker associated with a route.
Worker Routes
Delete Worker subdomain
Disable all workers.dev subdomains for a Worker.
Worker Script
Delete Worker
Delete your worker. This call has no response body on a successful delete.
Worker Script
Download Worker
Fetch raw script content for your worker. Note this is the original script content, not JSON encoded.
Worker Script
Get Script Settings
Get script settings from a worker with an environment.
Worker Environment
Patch Script Settings
Patch script metadata, such as bindings.
Worker Environment
Fetch Usage Model
Fetches the Usage Model for a given Worker.
Worker Script
Get script content
Fetch script content only.
Worker Script
Get Settings
Get metadata and config, such as bindings or usage model.
Worker Script
Get Worker subdomain
Get if the Worker is available on the workers.dev subdomain.
Worker Script
List Workers
Fetch a list of uploaded workers.
Worker Script
Patch Settings
Patch metadata or config, such as bindings or usage model.
Worker Script
Post Worker subdomain
Enable or disable the Worker on the workers.dev subdomain.
Worker Script
Put script content
Put script content without touching config or metadata.
Worker Script
Search Workers
Search for Workers in an account.
Worker Script
Get Script Settings
Get script-level settings when using [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions). Includes Logpush and Tail Consumers.
Worker Script
Patch Script Settings
Patch script-level settings when using [Worker Versions](https://developers.cloudflare.com/api/operations/worker-versions-list-versions). Including but not limited to Logpush and Tail Consumers.
Worker Script
Create Assets Upload Session
Start uploading a collection of assets for use in a Worker version. To learn more about the direct uploads of assets, see https://developers.cloudflare.com/workers/static-assets/direct-upload/.
Worker Script
Update Usage Model
Updates the Usage Model for a given Worker. Requires a Workers Paid subscription.
Worker Script
Upload Worker Module
Upload a worker module. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/.
Worker Script
Create Subdomain
Creates a Workers subdomain for an account.
Worker Subdomain
Delete Subdomain
Deletes a Workers subdomain for an account.
Worker Subdomain
Get Subdomain
Returns a Workers subdomain for an account.
Worker Subdomain
Delete Tail
Deletes a tail from a Worker.
Worker Tail Logs
List Tails
Get list of tails currently deployed on a Worker.
Worker Tail Logs
Start Tail
Starts a tail that receives logs and exception from a Worker.
Worker Tail Logs
Get Version Detail
Retrieves detailed information about a specific version of a Workers script.
Worker Versions
List Versions
List of Worker Versions. The first version in the list is the latest version.
Worker Versions
Upload Version
Upload a Worker Version without deploying to Cloudflare's network. You can find more about the multipart metadata on our docs: https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/.
Worker Versions
Create a new Finetune
Creates a new fine-tuning job for a Workers AI model using custom training data.
Workers AI Finetune
Get Model Schema
Retrieves the input and output JSON schema definition for a Workers AI model.
Workers AI
Get all converted formats supported
Lists all file formats supported for conversion to Markdown.
Workers AI
List Finetunes
Lists all fine-tuning jobs created by the account, including status and metrics.
Workers AI Finetune
List Public Finetunes
Lists publicly available fine-tuned models that can be used with Workers AI.
Workers AI Finetune
Execute AI Model (Generic)
Execute an AI model by specifying the model name in the request body. This endpoint provides a generic interface for running AI models where the model name is part of the request payload rather than the URL path. It supports all AI Gateway features including caching, custom headers, and request options. Model-specific inputs available in [Cloudflare Docs](https://developers.cloudflare.com/workers-ai/models/).
Workers AI
Execute AI model
This endpoint provides users with the capability to run specific AI models on-demand. By submitting the required input data, users can receive real-time predictions or results generated by the chosen AI model. The endpoint supports various AI model types, ensuring flexibility and adaptability for diverse use cases. Model specific inputs available in [Cloudflare Docs](https://developers.cloudflare.com/workers-ai/models/).
Workers AI
Convert Files into Markdown
Converts uploaded files into Markdown format using Workers AI.
Workers AI
Author Search
Searches Workers AI models by author or organization name.
Workers AI
Model Search
Searches Workers AI models by name or description.
Workers AI
Task Search
Searches Workers AI models by task type (e.g., text-generation, embeddings).
Workers AI
Upload a Finetune Asset
Uploads training data assets for a Workers AI fine-tuning job.
Workers AI Finetune
Detach Domain
Detaches a domain from a Worker. Both the Worker and all of its previews are no longer routable using this domain.
Domains
Get Domain
Gets information about a domain.
Domains
List Domains
Lists all domains for an account.
Domains
Attach Domain
Attaches a domain that routes traffic to a Worker.
Domains
Create a Namespace
Creates a namespace under the given title. A `400` is returned if the account already owns a namespace with this title. A namespace must be explicitly deleted to be replaced.
Workers KV Namespace
Delete key-value pair
Remove a KV pair from the namespace. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name.
Workers KV Namespace
Delete multiple key-value pairs
Remove multiple KV pairs from the namespace. Body should be an array of up to 10,000 keys to be removed.
Workers KV Namespace
Delete multiple key-value pairs
Remove multiple KV pairs from the namespace. Body should be an array of up to 10,000 keys to be removed.
Workers KV Namespace
Get a Namespace
Get the namespace corresponding to the given ID.
Workers KV Namespace
Get multiple key-value pairs
Retrieve up to 100 KV pairs from the namespace. Keys must contain text-based values. JSON values can optionally be parsed instead of being returned as a string value. Metadata can be included if `withMetadata` is true.
Workers KV Namespace
List a Namespace's Keys
Lists a namespace's keys.
Workers KV Namespace
List Namespaces
Returns the namespaces owned by an account.
Workers KV Namespace
Read key-value pair
Returns the value associated with the given key in the given namespace. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name. If the KV-pair is set to expire at some point, the expiration time as measured in seconds since the UNIX epoch will be returned in the `expiration` response header.
Workers KV Namespace
Read the metadata for a key
Returns the metadata associated with the given key in the given namespace. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name.
Workers KV Namespace
Remove a Namespace
Deletes the namespace corresponding to the given ID.
Workers KV Namespace
Rename a Namespace
Modifies a namespace's title.
Workers KV Namespace
Write key-value pair with optional metadata
Write a value identified by a key. Use URL-encoding to use special characters (for example, `:`, `!`, `%`) in the key name. Body should be the value to be stored. If JSON metadata to be associated with the key/value pair is needed, use `multipart/form-data` content type for your PUT request (see dropdown below in `REQUEST BODY SCHEMA`). Existing values, expirations, and metadata will be overwritten. If neither `expiration` nor `expiration_ttl` is specified, the key-value pair will never expire. If both are set, `expiration_ttl` is used and `expiration` is ignored.
Workers KV Namespace
Write multiple key-value pairs
Write multiple keys and values at once. Body should be an array of up to 10,000 key-value pairs to be stored, along with optional expiration information. Existing values and expirations will be overwritten. If neither `expiration` nor `expiration_ttl` is specified, the key-value pair will never expire. If both are set, `expiration_ttl` is used and `expiration` is ignored. The entire request size must be 100 megabytes or less.
Workers KV Namespace
Create Zero Trust account
Create a Zero Trust account for an existing Cloudflare account.
Zero Trust accounts
Reset device settings for a Zero Trust account with defaults. This turns off all proxying.
Resets the current device settings for a Zero Trust account.
Zero Trust accounts
Get Zero Trust Connectivity Settings
Gets the Zero Trust Connectivity Settings for the given account.
Zero Trust Connectivity Settings
Get device settings for a Zero Trust account
Describes the current device settings for a Zero Trust account.
Zero Trust accounts
Get gateway egress CIDRs pairs assigned to this account
Retrieve the list of egress CIDRs allocated to this Zero Trust account.
Zero Trust accounts
Get logging settings for the Zero Trust account
Retrieve the current logging settings for the Zero Trust account.
Zero Trust accounts
Get Zero Trust account configuration
Retrieve the current Zero Trust account configuration.
Zero Trust accounts
Get Zero Trust account information
Retrieve information about the current Zero Trust account.
Zero Trust accounts
Get Zero Trust certificate configuration
Retrieve the current Zero Trust certificate configuration.
Zero Trust accounts
Updates the Zero Trust Connectivity Settings
Updates the Zero Trust Connectivity Settings for the given account.
Zero Trust Connectivity Settings
Patch device settings for a Zero Trust account
Patches the current device settings for a Zero Trust account.
Zero Trust accounts
Patch Zero Trust account configuration
Update (PATCH) a single subcollection of settings such as `antivirus`, `tls_decrypt`, `activity_log`, `block_page`, `browser_isolation`, `fips`, `body_scanning`, `certificate`, or `max_ttl_secs` without updating the entire configuration object. This endpoint returns an error if any settings collection lacks proper configuration.
Zero Trust accounts
Update device settings for a Zero Trust account
Updates the current device settings for a Zero Trust account.
Zero Trust accounts
Update Zero Trust account logging settings
Update logging settings for the current Zero Trust account.
Zero Trust accounts
Update Zero Trust account configuration
Update the current Zero Trust account configuration.
Zero Trust accounts
List applications review statuses
Retrieve the statuses of your applications.
Zero Trust applications review status
Update applications review statuses
Update the statuses of your applications.
Zero Trust applications review status
Activate a Zero Trust certificate
Bind a single Zero Trust certificate to the edge.
Zero Trust certificates
Create Zero Trust certificate
Create a new Zero Trust certificate.
Zero Trust certificates
Deactivate a Zero Trust certificate
Unbind a single Zero Trust certificate from the edge.
Zero Trust certificates
Delete Zero Trust certificate
Delete a gateway-managed Zero Trust certificate. You must deactivate the certificate from the edge (inactive) before deleting it.
Zero Trust certificates
List Zero Trust certificates
List all Zero Trust certificates for an account.
Zero Trust certificates
Get Zero Trust certificate details
Get a single Zero Trust certificate.
Zero Trust certificates
List Zero Trust Gateway DNS destination IPv4 address pairs
List Zero Trust Gateway IPv4 address pairs for an account.
Zero Trust Gateway DNS destination IPv4 address pairs
List application and application type mappings
List all application and application type mappings.
Zero Trust Gateway application and application type mappings
List categories
List all categories.
Zero Trust Gateway categories
Create a Zero Trust Gateway location
Create a new Zero Trust Gateway location.
Zero Trust Gateway locations
Delete a Zero Trust Gateway location
Delete a configured Zero Trust Gateway location.
Zero Trust Gateway locations
List Zero Trust Gateway locations
List Zero Trust Gateway locations for an account.
Zero Trust Gateway locations
Update a Zero Trust Gateway location
Update a configured Zero Trust Gateway location.
Zero Trust Gateway locations
Get Zero Trust Gateway location details
Get a single Zero Trust Gateway location.
Zero Trust Gateway locations
List Zero Trust Gateway operations
List all Zero Trust Gateway operations for an account.
Zero Trust Gateway operations
Zero Trust Gateway operation details
Fetch a single Zero Trust Gateway operation by its ID.
Zero Trust Gateway operations
Create a PAC file
Create a new Zero Trust Gateway PAC file.
Zero Trust Gateway PAC files
Delete a PAC file
Delete a configured Zero Trust Gateway PAC file.
Zero Trust Gateway PAC files
Get a PAC file
Get a single Zero Trust Gateway PAC file.
Zero Trust Gateway PAC files
List PAC files
List all Zero Trust Gateway PAC files for an account.
Zero Trust Gateway PAC files
Update a Zero Trust Gateway PAC file
Update a configured Zero Trust Gateway PAC file.
Zero Trust Gateway PAC files
Create a proxy endpoint
Create a new Zero Trust Gateway proxy endpoint.
Zero Trust Gateway proxy endpoints
Delete a proxy endpoint
Delete a configured Zero Trust Gateway proxy endpoint.
Zero Trust Gateway proxy endpoints
List proxy endpoints
List all Zero Trust Gateway proxy endpoints for an account.
Zero Trust Gateway proxy endpoints
Get a proxy endpoint
Get a single Zero Trust Gateway proxy endpoint.
Zero Trust Gateway proxy endpoints
Update a proxy endpoint
Update a configured Zero Trust Gateway proxy endpoint.
Zero Trust Gateway proxy endpoints
Create a Zero Trust Gateway rule
Create a new Zero Trust Gateway rule.
Zero Trust Gateway rules
Delete a Zero Trust Gateway rule
Delete a Zero Trust Gateway rule.
Zero Trust Gateway rules
List Zero Trust Gateway rules
List Zero Trust Gateway rules for an account.
Zero Trust Gateway rules
List Zero Trust Gateway rules inherited from the parent account
List Zero Trust Gateway rules for the parent account of an account in the MSP configuration.
Zero Trust Gateway rules
Patch multiple Zero Trust Gateway rules
Update select fields of multiple Zero Trust Gateway rules in a single request. This is commonly used to reorder rules by updating their precedence values. Only the fields provided for each rule are updated.
Zero Trust Gateway rules
Patch a Zero Trust Gateway rule
Update select fields of an existing Zero Trust Gateway rule. Only the fields provided in the request body are updated. This endpoint supports a limited subset of fields (`name`, `description`, `precedence`, `enabled`). To update other fields such as `action`, `traffic`, `identity`, `device_posture`, `rule_settings`, `schedule`, or `expiration`, use the PUT endpoint for a full rule replacement.
Zero Trust Gateway rules
Reset the expiration of a Zero Trust Gateway Rule
Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and it has a default duration. The Zero Trust Gateway Rule must have values for both `expiration.expires_at` and `expiration.duration`.
Zero Trust Gateway rules
Update a Zero Trust Gateway rule
Update a configured Zero Trust Gateway rule.
Zero Trust Gateway rules
Get Zero Trust Gateway rule details.
Get a single Zero Trust Gateway rule.
Zero Trust Gateway rules
Get Zero Trust SSH settings
Retrieve all Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.
Zero Trust SSH Settings
Create Zero Trust list
Creates a new Zero Trust list.
Zero Trust lists
Create Zero Trust list from CSV
Create a new Zero Trust list by uploading a CSV file. The file must be `text/csv` or `text/plain` and cannot exceed 2 MB. The operation is processed asynchronously. Use the returned operation ID to poll for status.
Zero Trust lists
Delete Zero Trust list
Deletes a Zero Trust list.
Zero Trust lists
List Zero Trust lists
Fetch all Zero Trust lists for an account.
Zero Trust lists
Patch Zero Trust list.
Appends or removes an item from a configured Zero Trust list.
Zero Trust lists
Update Zero Trust list
Updates a configured Zero Trust list. Skips updating list items if not included in the payload. A non empty list items will overwrite the existing list.
Zero Trust lists
Get Zero Trust list details
Fetch a single Zero Trust list.
Zero Trust lists
Get Zero Trust list items
Fetch all items in a single Zero Trust list.
Zero Trust lists
Create hostname route
Create a hostname route.
Zero Trust Hostname Route
Delete hostname route
Delete a hostname route.
Zero Trust Hostname Route
Get hostname route
Get a hostname route.
Zero Trust Hostname Route
List hostname routes
Lists and filters hostname routes in an account.
Zero Trust Hostname Route
Update hostname route
Updates a hostname route.
Zero Trust Hostname Route
Create WARP IP subnet
Create a WARP IP assignment subnet. Currently, only IPv4 subnets can be created. **Network constraints:** - The network must be within one of the following private IP ranges: - `10.0.0.0/8` (RFC 1918) - `172.16.0.0/12` (RFC 1918) - `192.168.0.0/16` (RFC 1918) - `100.64.0.0/10` (RFC 6598 - CGNAT) - The subnet must have a prefix length of `/24` or larger (e.g., `/16`, `/20`, `/24` are valid; `/25`, `/28` are not)
Zero Trust Subnets
Delete WARP IP subnet
Delete a WARP IP assignment subnet. This operation is idempotent - deleting an already-deleted or non-existent subnet will return success with a null result.
Zero Trust Subnets
Get Gateway Ephemeral Subnet
Returns the account's default gateway ephemeral subnet for the given address family.
Zero Trust Subnets
Get WARP IP subnet
Get a WARP IP assignment subnet.
Zero Trust Subnets
Update Cloudflare Source Subnet
Updates the Cloudflare Source subnet of the given address family
Zero Trust Subnets
Update Gateway Ephemeral Subnet
Updates the CIDR for the account's default gateway ephemeral subnet of the given address family. The new CIDR must not conflict with existing private routes in the account.
Zero Trust Subnets
Update WARP IP subnet
Updates a WARP IP assignment subnet. **Update constraints:** - The `network` field cannot be modified for WARP subnets. Only `name`, `comment`, and `is_default_network` can be updated. - IPv6 subnets cannot be updated
Zero Trust Subnets
List Subnets
Lists and filters subnets in an account.
Zero Trust Subnets
Create your Zero Trust organization
Sets up a Zero Trust organization for your account.
Zero Trust organization
Get your Zero Trust organization
Returns the configuration for your Zero Trust organization.
Zero Trust organization
Get your Zero Trust organization DoH settings
Returns the DoH settings for your Zero Trust organization.
Zero Trust organization
Revoke all Access tokens for a user
Revokes a user's access across all applications.
Zero Trust organization
Update your Zero Trust organization
Updates the configuration for your Zero Trust organization.
Zero Trust organization
Update your Zero Trust organization DoH settings
Updates the DoH settings for your Zero Trust organization.
Zero Trust organization
Rotate Zero Trust SSH account seed
Rotate the SSH account seed that generates the host key identity when connecting through the Cloudflare SSH Proxy.
Zero Trust SSH Settings
Update a user seat
Removes a user from a Zero Trust seat when both `access_seat` and `gateway_seat` are set to false.
Zero Trust seats
Update Zero Trust SSH settings
Update Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.
Zero Trust SSH Settings
Create a user
Creates a new user.
Zero Trust users
Delete a user's MFA device
Deletes a specific MFA device for a user. This action is only available if MFA is turned on for the organization.
Zero Trust users
Delete a user
Deletes a specific user for an account. This will also revoke any active seats and tokens for the user.
Zero Trust users
Get single active session
Get an active session for a single user.
Zero Trust users
Get active sessions
Get active sessions for a single user.
Zero Trust users
Get failed logins
Get all failed login attempts for a single user.
Zero Trust users
Get last seen identity
Get last seen identity for a single user.
Zero Trust users
Get a user
Gets a specific user for an account.
Zero Trust users
Get users
Gets a list of users for an account.
Zero Trust users
Update a user
Updates a specific user's name for an account. Requires the user's current email as confirmation (email cannot be changed).
Zero Trust users
Get analytics by Co-locations
This view provides a breakdown of analytics data by datacenter. Note: This is available to Enterprise customers only.
Zone Analytics (Deprecated)
Get dashboard
The dashboard view provides both totals and timeseries data for the given zone and time period across the entire Cloudflare network.
Zone Analytics (Deprecated)
Change aegis setting
Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses.
Zone Settings
Change Cache Reserve setting
Increase cache lifetimes by automatically storing all cacheable files into Cloudflare's persistent object storage buckets. Requires Cache Reserve subscription. Note: using Tiered Cache with Cache Reserve is highly recommended to reduce Reserve operations costs. See the [developer docs](https://developers.cloudflare.com/cache/about/cache-reserve) for more information.
Zone Cache Settings
Change Origin H2 Max Streams Setting
Origin H2 Max Streams configures the max number of concurrent requests that Cloudflare will send within the same connection when communicating with the origin server, if the origin supports it. Note that if your origin does not support H2 multiplexing, 5xx errors may be observed, particularly 520s. Also note that the default value is `100` for all plan types except Enterprise where it is `1`. `1` means that H2 multiplexing is disabled.
Zone Settings
Change Origin Max HTTP Version Setting
Origin Max HTTP Setting Version sets the highest HTTP version Cloudflare will attempt to use with your origin. This setting allows Cloudflare to make HTTP/2 requests to your origin. (Refer to [Enable HTTP/2 to Origin](https://developers.cloudflare.com/cache/how-to/enable-http2-to-origin/), for more information.). The default value is "2" for all plan types except Enterprise where it is "1".
Zone Settings
Change Origin Post-Quantum Encryption setting
Instructs Cloudflare to use Post-Quantum (PQ) key agreement algorithms when connecting to your origin. Preferred instructs Cloudflare to opportunistically send a Post-Quantum keyshare in the first message to the origin (for fastest connections when the origin supports and prefers PQ), supported means that PQ algorithms are advertised but only used when requested by the origin, and off means that PQ algorithms are not advertised.
Origin Post-Quantum
Change Origin TLS Compliance Modes setting
Update the set of TLS compliance modes for the zone. PATCH performs a full replace of the modes list, not a merge — the request body is treated as the complete new list, and any modes not present in it are removed. (To remove a single mode from an existing configuration, send the updated list without it.) The request body must be of the form `{"value": ["fips", "pqh"]}`. Currently supported modes are `fips` and `pqh`; an empty list clears the constraint. Future modes (e.g. `cnsa2`) may be added; clients should treat unknown values as opaque strings. Invalid mode values are rejected with a 4xx response.
Origin TLS
Change Regional Tiered Cache setting
Instructs Cloudflare to check a regional hub data center on the way to your upper tier. This can help improve performance for smart and custom tiered cache topologies.
Zone Cache Settings
Change variants setting
Variant support enables caching variants of images with certain file extensions in addition to the original. This only applies when the origin server sends the 'Vary: Accept' response header. If the origin server sends 'Vary: Accept' but does not serve the variant requested, the response will not be cached. This will be indicated with BYPASS cache status in the response headers.
Zone Cache Settings
Delete Origin TLS Compliance Modes setting
Delete the Origin TLS Compliance Modes setting for the zone, removing any configured compliance constraint. After deletion, Cloudflare's default behavior applies (no compliance filtering of the key-exchange algorithm list sent to the origin).
Origin TLS
Delete variants setting
Variant support enables caching variants of images with certain file extensions in addition to the original. This only applies when the origin server sends the 'Vary: Accept' response header. If the origin server sends 'Vary: Accept' but does not serve the variant requested, the response will not be cached. This will be indicated with BYPASS cache status in the response headers.
Zone Cache Settings
Get aegis setting
Aegis provides dedicated egress IPs (from Cloudflare to your origin) for your layer 7 WAF and CDN services. The egress IPs are reserved exclusively for your account so that you can increase your origin security by only allowing traffic from a small list of IP addresses.
Zone Settings
Get Cache Reserve Clear
You can use Cache Reserve Clear to clear your Cache Reserve, but you must first disable Cache Reserve. In most cases, this will be accomplished within 24 hours. You cannot re-enable Cache Reserve while this process is ongoing. Keep in mind that you cannot undo or cancel this operation.
Zone Cache Settings
Get Cache Reserve setting
Increase cache lifetimes by automatically storing all cacheable files into Cloudflare's persistent object storage buckets. Requires Cache Reserve subscription. Note: using Tiered Cache with Cache Reserve is highly recommended to reduce Reserve operations costs. See the [developer docs](https://developers.cloudflare.com/cache/about/cache-reserve) for more information.
Zone Cache Settings
Get Origin H2 Max Streams Setting
Origin H2 Max Streams configures the max number of concurrent requests that Cloudflare will send within the same connection when communicating with the origin server, if the origin supports it. Note that if your origin does not support H2 multiplexing, 5xx errors may be observed, particularly 520s. Also note that the default value is `100` for all plan types except Enterprise where it is `1`. `1` means that H2 multiplexing is disabled.
Zone Settings
Get Origin Max HTTP Version Setting
Origin Max HTTP Setting Version sets the highest HTTP version Cloudflare will attempt to use with your origin. This setting allows Cloudflare to make HTTP/2 requests to your origin. (Refer to [Enable HTTP/2 to Origin](https://developers.cloudflare.com/cache/how-to/enable-http2-to-origin/), for more information.). The default value is "2" for all plan types except Enterprise where it is "1".
Zone Settings
Get Origin Post-Quantum Encryption setting
Instructs Cloudflare to use Post-Quantum (PQ) key agreement algorithms when connecting to your origin. Preferred instructs Cloudflare to opportunistically send a Post-Quantum keyshare in the first message to the origin (for fastest connections when the origin supports and prefers PQ), supported means that PQ algorithms are advertised but only used when requested by the origin, and off means that PQ algorithms are not advertised.
Origin Post-Quantum
Get Origin TLS Compliance Modes setting
Origin TLS Compliance Modes constrains the set of TLS key-exchange algorithms Cloudflare may use when establishing the TLS connection to the zone's origin. The value is a list of named compliance modes (currently `fips` and `pqh`). Multiple modes are combined as the intersection of their permitted algorithm lists. An empty list (or no rule configured) means no compliance constraint is applied.
Origin TLS
Get Regional Tiered Cache setting
Instructs Cloudflare to check a regional hub data center on the way to your upper tier. This can help improve performance for smart and custom tiered cache topologies.
Zone Cache Settings
Get variants setting
Variant support enables caching variants of images with certain file extensions in addition to the original. This only applies when the origin server sends the 'Vary: Accept' response header. If the origin server sends 'Vary: Accept' but does not serve the variant requested, the response will not be cached. This will be indicated with BYPASS cache status in the response headers.
Zone Cache Settings
Replace Origin TLS Compliance Modes setting
Replace the entire set of TLS compliance modes for the zone with the list provided in the request body. PUT performs a full replace, not a merge — any modes not present in the request body are removed. The request body must be of the form `{"value": ["fips", "pqh"]}`. Currently supported modes are `fips` and `pqh`; an empty list clears the constraint. Future modes (e.g. `cnsa2`) may be added; clients should treat unknown values as opaque strings. Invalid mode values are rejected with a 4xx response.
Origin TLS
Start Cache Reserve Clear
You can use Cache Reserve Clear to clear your Cache Reserve, but you must first disable Cache Reserve. In most cases, this will be accomplished within 24 hours. You cannot re-enable Cache Reserve while this process is ongoing. Keep in mind that you cannot undo or cancel this operation.
Zone Cache Settings
Put Rules
Updates Cloud Connector rules for a zone, replacing the existing rule configuration.
Zone Cloud Connector Rules PUT
Rules
Retrieves the Cloud Connector rules configured for a zone. Rules define how traffic is routed to cloud services.
Zone Cloud Connector Rules GET
Purge Cached Content by Environment
Purge cached content scoped to a specific environment. Supports the same purge types as the zone-level endpoint (purge everything, by URL, by tag, host, or prefix). ### Availability and limits Please refer to [purge cache availability and limits documentation page](https://developers.cloudflare.com/cache/how-to/purge-cache/#availability-and-limits).
Zone
Add an Access application
Adds a new application to Access.
Zone-Level Access applications
Delete an Access application
Deletes an application from Access.
Zone-Level Access applications
Get an Access application
Fetches information about an Access application.
Zone-Level Access applications
List Access Applications
List all Access Applications in a zone.
Zone-Level Access applications
Update application settings
Updates application settings.
Zone-Level Access applications
Update application settings
Updates application settings.
Zone-Level Access applications
Revoke application tokens
Revokes all tokens issued for an application.
Zone-Level Access applications
Test Access policies
Tests if a specific user has permission to access an application.
Zone-Level Access applications
Update an Access application
Updates an Access application.
Zone-Level Access applications
Create an Access group
Creates a new Access group.
Zone-Level Access groups
Delete an Access group
Deletes an Access group.
Zone-Level Access groups
Get an Access group
Fetches a single Access group.
Zone-Level Access groups
List Access groups
Lists all Access groups.
Zone-Level Access groups
Update an Access group
Updates a configured Access group.
Zone-Level Access groups
Add an Access identity provider
Adds a new identity provider to Access.
Zone-Level Access identity providers
Delete an Access identity provider
Deletes an identity provider from Access.
Zone-Level Access identity providers
Get an Access identity provider
Fetches a configured identity provider.
Zone-Level Access identity providers
List Access identity providers
Lists all configured identity providers.
Zone-Level Access identity providers
Update an Access identity provider
Updates a configured identity provider.
Zone-Level Access identity providers
Add an mTLS certificate
Adds a new mTLS root certificate to Access.
Zone-Level Access mTLS authentication
Delete an mTLS certificate
Deletes an mTLS certificate.
Zone-Level Access mTLS authentication
Get an mTLS certificate
Fetches a single mTLS certificate.
Zone-Level Access mTLS authentication
List mTLS certificates
Lists all mTLS certificates.
Zone-Level Access mTLS authentication
List all mTLS hostname settings
List all mTLS hostname settings for this zone.
Zone-Level Access mTLS authentication
Update an mTLS certificate
Updates a configured mTLS certificate.
Zone-Level Access mTLS authentication
Update an mTLS certificate's hostname settings
Updates an mTLS certificate's hostname settings.
Zone-Level Access mTLS authentication
Create an Access policy
Create a new Access policy for an application.
Zone-Level Access policies
Delete an Access policy
Delete an Access policy.
Zone-Level Access policies
Get an Access policy
Fetches a single Access policy.
Zone-Level Access policies
List Access policies
Lists Access policies configured for an application.
Zone-Level Access policies
Update an Access policy
Update a configured Access policy.
Zone-Level Access policies
Create a service token
Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to create a new service token.
Zone-Level Access service tokens
Delete a service token
Deletes a service token.
Zone-Level Access service tokens
Get a service token
Fetches a single service token.
Zone-Level Access service tokens
List service tokens
Lists all service tokens.
Zone-Level Access service tokens
Update a service token
Updates a configured service token.
Zone-Level Access service tokens
Create a short-lived certificate CA
Generates a new short-lived certificate CA and public key.
Zone-Level Access short-lived certificate CAs
Delete a short-lived certificate CA
Deletes a short-lived certificate CA.
Zone-Level Access short-lived certificate CAs
Get a short-lived certificate CA
Fetches a short-lived certificate CA and its public key.
Zone-Level Access short-lived certificate CAs
List short-lived certificate CAs
Lists short-lived certificate CAs and their public keys.
Zone-Level Access short-lived certificate CAs
Delete Certificate
Removes a client certificate used for zone-level authenticated origin pulls.
Zone-Level Authenticated Origin Pulls
Get Certificate Details
Retrieves details for a specific client certificate used in zone-level authenticated origin pulls.
Zone-Level Authenticated Origin Pulls
Get Enablement Setting for Zone
Get whether zone-level authenticated origin pulls is enabled or not. It is false by default.
Zone-Level Authenticated Origin Pulls
List Certificates
Lists all client certificates configured for zone-level authenticated origin pulls.
Zone-Level Authenticated Origin Pulls
Set Enablement for Zone
Enable or disable zone-level authenticated origin pulls. 'enabled' should be set true either before/after the certificate is uploaded to see the certificate in use.
Zone-Level Authenticated Origin Pulls
Upload Certificate
Upload your own certificate you want Cloudflare to use for edge-to-origin communication to override the shared certificate. Please note that it is important to keep only one certificate active. Also, make sure to enable zone-level authenticated origin pulls by making a PUT call to settings endpoint to see the uploaded certificate in use.
Zone-Level Authenticated Origin Pulls
Create your Zero Trust organization
Sets up a Zero Trust organization for your account.
Zone-Level Zero Trust organization
Get your Zero Trust organization
Returns the configuration for your Zero Trust organization.
Zone-Level Zero Trust organization
Revoke all Access tokens for a user
Revokes a user's access across all applications.
Zone-Level Zero Trust organization
Update your Zero Trust organization
Updates the configuration for your Zero Trust organization.
Zone-Level Zero Trust organization
Create a Zone Lockdown rule
Creates a new Zone Lockdown rule.
Zone Lockdown
Delete a Zone Lockdown rule
Deletes an existing Zone Lockdown rule.
Zone Lockdown
Get a Zone Lockdown rule
Fetches the details of a Zone Lockdown rule.
Zone Lockdown
List Zone Lockdown rules
Fetches Zone Lockdown rules. You can filter the results using several optional parameters.
Zone Lockdown
Update a Zone Lockdown rule
Updates an existing Zone Lockdown rule.
Zone Lockdown
Purge Cached Content
### Purge All Cached Content Removes ALL files from Cloudflare's cache. All tiers can purge everything. ``` {"purge_everything": true} ``` ### Purge Cached Content by URL Granularly removes one or more files from Cloudflare's cache by specifying URLs. All tiers can purge by URL. To purge files with custom cache keys, include the headers used to compute the cache key as in the example. If you have a device type or geo in your cache key, you will need to include the CF-Device-Type or CF-IPCountry headers. If you have lang in your cache key, you will need to include the Accept-Language header. **NB:** When including the Origin header, be sure to include the **scheme** and **hostname**. The port number can be omitted if it is the default port (80 for http, 443 for https), but must be included otherwise. Single file purge example with files: ``` {"files": ["http://www.example.com/css/styles.css", "http://www.example.com/js/index.js"]} ``` Single file purge example with url and header pairs: ``` {"files": [{"url": "http://www.example.com/cat_picture.jpg", "headers": {"CF-IPCountry": "US", "CF-Device-Type": "desktop", "Accept-Language": "zh-CN"}}, {"url": "http://www.example.com/dog_picture.jpg", "headers": {"CF-IPCountry": "EU", "CF-Device-Type": "mobile", "Accept-Language": "en-US"}}]} ``` ### Purge Cached Content by Tag, Host or Prefix Granularly removes one or more files from Cloudflare's cache either by specifying the host, the associated Cache-Tag, or a Prefix. Flex purge with tags: ``` {"tags": ["a-cache-tag", "another-cache-tag"]} ``` Flex purge with hosts: ``` {"hosts": ["www.example.com", "images.example.com"]} ``` Flex purge with prefixes: ``` {"prefixes": ["www.example.com/foo", "images.example.com/bar/baz"]} ``` ### Availability and limits Please refer to [purge cache availability and limits documentation page](https://developers.cloudflare.com/cache/how-to/purge-cache/#availability-and-limits).
Zone
Available Plan Details
Details of the available plan that the zone can subscribe to.
Zone Rate Plan
List Available Plans
Lists available plans the zone can subscribe to.
Zone Rate Plan
List Available Rate Plans
Lists all rate plans the zone can subscribe to.
Zone Rate Plan
Change Cloudflare Fonts setting
Enhance your website's font delivery with Cloudflare Fonts. Deliver Google Hosted fonts from your own domain, boost performance, and enhance user privacy. Refer to the Cloudflare Fonts documentation for more information.
Zone Settings
Update Google Tag Gateway configuration
Updates the Google Tag Gateway configuration for a zone.
Google Tag Gateway
Change Cloudflare Speed Brain setting
Speed Brain lets compatible browsers speculate on content which can be prefetched or preloaded, making website navigation faster. Refer to the Cloudflare Speed Brain documentation for more information.
Zone Settings
Edit zone setting
Updates a single zone setting by the identifier
Zone Settings
Edit multiple zone settings
Edit settings for a zone.
Zone Settings
Get all zone settings
Available settings for your user in relation to a zone.
Zone Settings
Get Cloudflare Fonts setting
Enhance your website's font delivery with Cloudflare Fonts. Deliver Google Hosted fonts from your own domain, boost performance, and enhance user privacy. Refer to the Cloudflare Fonts documentation for more information.
Zone Settings
Get Google Tag Gateway configuration
Gets the Google Tag Gateway configuration for a zone.
Google Tag Gateway
Get zone setting
Fetch a single zone setting by name
Zone Settings
Get Cloudflare Speed Brain setting
Speed Brain lets compatible browsers speculate on content which can be prefetched or preloaded, making website navigation faster. Refer to the Cloudflare Speed Brain documentation for more information.
Zone Settings
Create Zone Subscription
Create a zone subscription, either plan or add-ons.
Zone Subscription
Create Zone Subscription
Create a zone subscription, either plan or add-ons. Retained for audit-log coverage. Use the singular `/zones/{zone_id}/subscription` path instead.
Zone Subscription
Delete Zone Subscription
Deletes a zone's subscription.
Zone Subscription
Delete Zone Subscription
Deletes a zone's subscription. Retained for audit-log coverage. Use the singular `/zones/{zone_id}/subscription` path instead.
Zone Subscription
Update Zone Subscription
Updates zone subscriptions, either plan or add-ons.
Zone Subscription
Update Zone Subscription
Updates zone subscriptions, either plan or add-ons. Retained for audit-log coverage. Use the singular `/zones/{zone_id}/subscription` path instead.
Zone Subscription
Zone Subscription Details
Lists zone subscription details.
Zone Subscription
Delete Zone
Deletes an existing zone.
Zone
Zone Details
Retrieves detailed information about a specific zone identified by its zone ID. Returns zone configuration, status, nameservers, and associated metadata.
Zone
Remove Zone Hold
Stop enforcement of a zone hold on the zone, permanently or temporarily, allowing the creation and activation of zones with this zone's hostname. Existing zone holds can be removed from CDN-only zones when `hold_after` is not provided. Active holds are automatically disabled when a zone transitions to CDN-only mode.
Zone Holds
Get Zone Hold
Retrieve whether the zone is subject to a zone hold, and metadata about the hold.
Zone Holds
Update Zone Hold
Update the `hold_after` and/or `include_subdomains` values on an existing zone hold. The hold is enabled if the `hold_after` date-time value is in the past. Existing zone holds can be removed from CDN-only zones by setting `hold_after` to `null`. Other zone hold updates cannot be made on CDN-only zones. Active holds are automatically disabled when a zone transitions to CDN-only mode.
Zone Holds
Create Zone Hold
Enforce a zone hold on the zone, blocking the creation and activation of zones with this zone's hostname. Zone holds cannot be enabled on CDN-only zones.
Zone Holds
Get Zone Hold by Zone Name
Retrieve whether a given hostname is subject to a zone hold, and metadata about the hold. This endpoint checks whether the given hostname (or any of its ancestor domains) is blocked by an active zone hold. If a hold with `include_subdomains` is active on an ancestor domain, that hold is returned. This endpoint is used internally by SSL/COMS to check hold status during zone activation.
Zone Holds
Edit Zone
Edits a zone. Only one zone property can be changed at a time.
Zone
Create zone environments
Creates environments for a zone.
Zone Environments
Delete zone environment
Deletes a zone environment by reference identifier.
Zone Environments
Partially update zone environments
Applies partial updates to zone environments.
Zone Environments
List zone environments
Lists configured environments for a zone.
Zone Environments
Roll back zone environment
Rolls a zone environment back to its previous version.
Zone Environments
Upsert zone environments
Replaces the full environment configuration for a zone.
Zone Environments
List Zones
Lists, searches, sorts, and filters your zones. Listing zones across more than 500 accounts is currently not allowed.
Zone
List available zone datasets
Returns all dataset types that this zone can create. Each entry includes the dataset schema and timestamp field. The schema shows all possible fields for a dataset. However, not all fields may be available for your account. When creating or updating a dataset, only fields available to your account can be enabled. If you request a field that is not available, you will receive an error.
Log Explorer Datasets
Create a zone dataset
Create a new Log Explorer dataset for the zone. List available zone datasets to see the dataset types and fields you can use. The `fields` property is optional. If not specified, all available fields will be enabled. For dataset field definitions, see: https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/
Log Explorer Datasets
Get a zone dataset
Retrieve a single Log Explorer dataset by ID for the zone.
Log Explorer Datasets
List zone datasets
Returns all Log Explorer datasets configured for the zone. List responses omit the `fields` property; use the single-dataset endpoint to retrieve field configuration.
Log Explorer Datasets
Update a zone dataset
Updates the enabled state and/or field configuration of a zone dataset.
Log Explorer Datasets
Run a log query
Run a SQL query against zone-level datasets. The SQL query is passed as the `query` query parameter. Because the query appears in the URL, it is subject to gateway and proxy URL-length limits and may be recorded in access logs. This endpoint is deprecated in favour of the POST variant which sends the query in the request body.
Log Explorer Queries
Run a log query
Run a SQL query against zone-level datasets. Timestamp fields are RFC3339 strings. Filter with: WHERE {timestamp_field} >= now() - INTERVAL '30' DAY WHERE {timestamp_field} >= '2026-04-01T00:00:00Z' WHERE {timestamp_field} BETWEEN '2026-04-01T00:00:00Z' AND '2026-04-30T23:59:59Z' List configured zone datasets to see enabled zone-level datasets. List available zone datasets to inspect their schemas and timestamp fields. For more information about the datasets, and the meaning of each field, check out https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/
Log Explorer Queries
Create Zone
Creates a new zone (domain) in your Cloudflare account. The zone is created in a pending state and must be activated by updating your domain's nameservers to point to Cloudflare, or by completing the verification process for partial (CNAME) setups.
Zone
FAQ

Cloudflare integration, answered

How do AI agents use Cloudflare through Open Connector?
Your user connects Cloudflare once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Cloudflare tools to your agent over MCP or a typed API, with credentials injected server-side on each call.
Is this a Cloudflare MCP server?
Yes. Open Connector can serve Cloudflare as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Cloudflare actions with credentials injected server-side.
Where do Cloudflare credentials live?
In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Give your agents Cloudflare — keep the keys.

Open source, self-hostable, with Cloudflare credentials that never leave your infrastructure. Run it from source today.

View source on GitHubHow the MCP gateway works →