Cloudflare

Adds a new application to Access.

Deletes an application from Access.

Fetches information about an Access application.

Lists all Access applications in an account.

Updates Access application settings.

Updates Access application settings.

Revokes all tokens issued for an application.

Tests if a specific user has permission to access an application.

Updates an Access application.

Gets a list of Access authentication audit logs for an account.

Returns a list of Authenticator Device AAGUIDs for MFA configuration.

Create a new Bookmark application.

Deletes a Bookmark application.

Fetches a single Bookmark application.

Lists Bookmark applications.

Updates a configured Bookmark application.

Create a custom page

Delete a custom page

Fetches a custom page and also returns its HTML.

List custom pages

Update a custom page

Adds a new SSH Certificate Authority (CA).

Deletes an SSH Certificate Authority.

Lists SSH Certificate Authorities (CA).

Creates a new Access group.

Deletes an Access group.

Fetches a single Access group.

Lists all Access groups.

Updates a configured Access group.

Adds a new identity provider to Access.

Creates a new SAML encryption certificate set and assigns it to the specified SAML Identity Provider. This endpoint is idempotent - if the IdP already has a certificate set assigned, the existing certificate set is returned with a 200 status. **Workflow for enabling SAML encryption:** 1. Call this endpoint to create and assign a certificate set to the IdP 2. Update the IdP configuration (PUT `/identity_providers/{id}`) with: - `config.enable_encryption: true` - `saml_certificate_set_id: <uid from step 1>` 3. Configure the certificate's public key in your external SAML Identity Provider

Deletes an identity provider from Access.

Fetches a configured identity provider.

Lists all configured identity providers.

Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).

Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).

Updates a configured identity provider.

Creates an IdP federation grant for the specified identity provider, making it available for federation to other accounts in the same Cloudflare organization. The account must belong to a Cloudflare organization. One-time pin and Cloudflare-managed identity providers cannot be federated. An account can federate at most five identity providers at a time.

Deletes an IdP federation grant. The identity provider remains in the account, but it is no longer available for federation to other accounts.

Retrieves a single IdP federation grant by its UID.

Lists the IdP federation grants owned by the account.

Gets an account-scoped Access JIT request summary and its lifecycle events in chronological order.

Lists account-wide Access JIT request logs reconstructed from request lifecycle events.

Gets the Access key rotation settings for an account.

Perfoms a key rotation for an account.

Updates the Access key rotation settings for an account.

Adds a new mTLS root certificate to Access.

Deletes an mTLS certificate.

Fetches a single mTLS certificate.

Lists all mTLS root certificates.

List all mTLS hostname settings for this account.

Updates a configured mTLS certificate.

Updates an mTLS certificate's hostname settings.

Converts an application-scoped policy to a reusable policy. The policy will no longer be exclusively scoped to the application. Further updates to the policy should go through the /accounts/{account_id}/policies/{uid} endpoint.

Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array.

Creates a new Access reusable policy.

Deletes an Access policy specific to an application. To delete a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.

Deletes an Access reusable policy.

Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.

Fetches a single Access reusable policy.

Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.

Lists Access reusable policies.

Updates an Access policy specific to an application. To update a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.

Updates a Access reusable policy.

Starts an Access policy test.

Fetches a single page of user results from an Access policy test.

Fetches the current status of a given Access policy test.

Retrieves a specific SAML encryption certificate set by its UID, including both current and previous certificates if available.

Downloads the current SAML encryption certificate's public key in PEM format for the specified certificate set. This endpoint is useful for providing the certificate to Identity Providers for SAML assertion encryption configuration.

Returns a paginated list of the organization's SAML encryption certificate sets. Each certificate set includes the current and (if present) previous certificates.

Rotates the SAML encryption certificates within the specified certificate set. This generates a new certificate and moves the current certificate to the previous slot. If a previous certificate exists, it will be deactivated and removed. This endpoint ensures zero-downtime rotation by maintaining both current and previous certificates during the transition period, allowing IdPs time to update their configurations. Automated rotation happens 30 days before a current certificate's expiration.

Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).

Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token.

Deletes a service token.

Fetches a single service token.

Lists all service tokens.

Refreshes the expiration of a service token.

Generates a new Client Secret for a service token and revokes the old one.

Updates a configured service token.

Generates a new short-lived certificate CA and public key.

Deletes a short-lived certificate CA.

Fetches a short-lived certificate CA and its public key.

Lists short-lived certificate CAs and their public keys.

Create a tag

Delete a tag

Get a tag

List tags

Update a tag

Create a new Account Owned API token.

Destroy an Account Owned API token.

Find all available permission groups for Account Owned API Tokens

List all Account Owned API tokens created for this account. Results include active, disabled, and recently-expired tokens when include_expired is set to true.

Roll the Account Owned API token secret.

Get information about a specific Account Owned API token.

Update an existing token.

Test whether a token works.

Gets the current billing profile for the account.

Create an account (only available for tenant admins at this time)

Delete a specific account (only available for tenant admins at this time). This is a permanent operation that will delete any zones or other resources under the account

Adds a custom nameserver to the account for use as a vanity nameserver on zones.

Removes a custom nameserver from the account.

List an account's custom nameservers.

Get metadata for account-level custom nameservers on a zone. Deprecated in favor of [Show DNS Settings](https://developers.cloudflare.com/api/operations/dns-settings-for-a-zone-list-dns-settings).

Set metadata for account-level custom nameservers on a zone. If you would like new zones in the account to use account custom nameservers by default, use PUT /accounts/:identifier to set the account setting use_account_custom_ns_by_default to true. Deprecated in favor of [Update DNS Settings](https://developers.cloudflare.com/api/operations/dns-settings-for-a-zone-update-dns-settings).

Create a new monitor group.

Delete a configured monitor group.

Get the list of resources that reference the provided monitor group.

List configured monitor groups.

Fetch a single configured monitor group.

Apply changes to an existing monitor group, overwriting the supplied properties.

Modify a configured monitor group.

Create a configured monitor.

Delete a configured monitor.

Get the list of resources that reference the provided monitor.

List configured monitors for an account.

List a single configured monitor for an account.

Apply changes to an existing monitor, overwriting the supplied properties.

Preview pools using the specified monitor with provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results.

Get the result of a previous preview operation using the provided preview_id.

Modify a configured monitor.

Create a new pool.

Delete a configured pool.

Get the list of resources that reference the provided pool.

List configured pools.

Apply changes to an existing pool, overwriting the supplied properties.

Apply changes to a number of existing pools, overwriting the supplied properties. Pools are ordered by ascending `name`. Returns the list of affected pools. Supports the standard pagination query parameters, either `limit`/`offset` or `per_page`/`page`.

Fetch a single configured pool.

Fetch the latest pool health status for a single pool.

Preview pool health using provided monitor details. The returned preview_id can be used in the preview endpoint to retrieve the results.

Modify a configured pool.

Search for Load Balancing resources.

Fetch a single configured account-scoped load balancer.

Create a new account-scoped load balancer.

Delete a configured account-scoped load balancer.

List configured account-scoped load balancers.

Get current load balancer resource usage counts for an account.

Apply changes to an existing account-scoped load balancer, overwriting the supplied properties.

Update a configured account-scoped load balancer.

Add a user to the list of members for this account.

List all members of an account.

Get information about a specific member of an account.

Remove a member from an account.

Modify an account member.

Get information about a specific permission group in an account.

List all the permissions groups for an account.

Traces a simulated HTTP request through Cloudflare's edge to analyze how rules, settings, and configurations would process the request. Useful for debugging firewall rules, page rules, and other request transformations without sending actual traffic. Supports custom headers, cookies, body content, and geolocation context.

Create a new Resource Group under the specified account.

Remove a resource group from an account.

Get information about a specific resource group in an account.

List all the resource groups for an account.

Modify an existing resource group.

Get all available roles for an account.

Get information about a specific role for an account.

Smartly applies the incoming subscription into the lifecycle of the subscription.

Creates multiple subscriptions for an account in a single request.

Creates an account subscription.

Deletes an account's subscription.

Lists all of an account's subscriptions.

Updates an account subscription.

Create a new user group under the specified account.

Remove a user group from an account.

Get information about a specific user group in an account.

List all the user groups for an account.

Add members to a User Group.

Remove a member from User Group

Get details of a specific member in a user group.

List all the members attached to a user group.

Replace the set of members attached to a User Group.

Modify an existing user group.

Get information about a specific account that you are a member of.

Batch move a collection of accounts to a specific organization. ⚠️ Not implemented.

Returns the browser extension configuration for an account. This endpoint is currently backed by the scaffolded service response while the runtime configuration surface is being implemented.

Retrieves the profile information for a specific Cloudflare account, including organization details, settings, and metadata. This endpoint is commonly used to verify account access and retrieve account-level configuration.

Retrieve a list of the organizations that "contain" this account or are managing it. The returned list will be in order from "root" to "leaf", where the "leaf" will be the organization that _immediately_ contains the specified account.

List all accounts you have ownership or verified access to.

Returns all dataset types that this account can create. Each entry includes the dataset schema and timestamp field. The schema shows all possible fields for a dataset. However, not all fields may be available for your account. When creating or updating a dataset, only fields available to your account can be enabled. If you request a field that is not available, you will receive an error.

Create a new Log Explorer dataset for the account. List available account datasets to see the dataset types and fields you can use. The `fields` property is optional. If not specified, all available fields will be enabled. For dataset field definitions, see: https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/

Retrieve a single Log Explorer dataset by ID for the account.

Returns all Log Explorer datasets configured for the account. Pass `include_zones=true` to also include zone-level datasets that belong to this account. List responses omit the `fields` property; use the single-dataset endpoint to retrieve field configuration.

Updates the enabled state and/or field configuration of an account dataset.

Run a SQL query against account-level datasets. The SQL query is passed as the `query` query parameter. Because the query appears in the URL, it is subject to gateway and proxy URL-length limits and may be recorded in access logs. This endpoint is deprecated in favour of the POST variant which sends the query in the request body.

Run a SQL query against account-level datasets. Timestamp fields are RFC3339 strings. Filter with: WHERE {timestamp_field} >= now() - INTERVAL '30' DAY WHERE {timestamp_field} >= '2026-04-01T00:00:00Z' WHERE {timestamp_field} BETWEEN '2026-04-01T00:00:00Z' AND '2026-04-30T23:59:59Z' List configured account datasets to see enabled account-level datasets. Zone-level datasets will not appear here. List available account datasets to inspect their schemas and timestamp fields. For more information about the datasets, and the meaning of each field, check out https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/

Updates the profile information for a Cloudflare account. Allows modification of account-level settings and organizational details. Requires Account Settings Write permission.

Move an account within an organization hierarchy or an account outside an organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/)

Lists challenge widgets.

Destroy a Turnstile Widget.

Show a single challenge widget configuration.

Generate a new secret key for this widget. If `invalidate_immediately` is set to `false`, the previous secret remains valid for 2 hours. Note that secrets cannot be rotated again during the grace period.

Update the configuration of a widget.

Lists all turnstile widgets of an account.

Update an existing account.

Adds an additional audio track to a video using the provided audio track URL.

Adds a participant to the given meeting ID.

Adds a new webhook to an App.

Processes a conversation and extracts structured memories from it. Agent Memory identifies facts, events, instructions, and tasks automatically.

Deletes a memory by ID. Removes the memory and any source messages linked to it. Returns the deleted memory.

Retrieves a memory by ID.

List memories stored in a profile.

Creates a new memory namespace owned by the account.

Deletes a namespace.

Gets a namespace by name.

Lists all namespaces for the given account. Results are paginated.

Marks a profile for deletion.

Retrieves memories relevant to the query and returns a synthesized answer.

Stores a single memory explicitly.

Marks all memories and messages in a profile that are tagged with the given session ID for deletion.

Generates a structured Markdown summary of everything stored in a memory profile.

Fetches and parses robots.txt files for multiple domains within a zone in a single request. Each domain must belong to the specified zone. Results are keyed by hostname.

Fetches and parses the robots.txt file for a zone or a specific subdomain within the zone. Returns parsed user-agent rules, content signals, and sitemaps.

Create a new AI Search instance with the given configuration.

Create a namespace for organizing AI Search instances.

Create a stored Cloudflare credential for an AI Search instance to access its data source.

Permanently delete an AI Search instance and all its indexed data.

Permanently delete a namespace. The namespace must be empty (no instances), and the default namespace cannot be deleted.

Permanently delete a stored AI Search credential. Credentials in use by an instance cannot be deleted.

Retrieve the configuration and status of an AI Search instance.

Retrieve a namespace and its description.

Retrieve a stored AI Search credential without exposing its secret.

Cancel an in-progress indexing job for an AI Search instance.

Performs a chat completion request against an AI Search instance, using indexed content as context for generating responses.

Creates a new indexing job for an AI Search instance.

Retrieves details for a specific AI Search indexing job.

Lists log entries for an AI Search indexing job.

Lists indexing jobs for an AI Search instance.

Executes a semantic search query against an AI Search instance to find relevant indexed content.

List all AI Search instances in the account.

List namespaces in the account, including their descriptions and creation times.

List stored AI Search credentials in the account without exposing their secrets.

Moves an instance from its current namespace to the specified target namespace. Use 'default' with --destination-namespace to move the instance back to the default namespace. Fails with 400 if the target namespace already has an instance with the same id (ids must be unique within a namespace — the same id can exist in different namespaces).

Create a new AI Search instance with the given configuration.

Permanently delete an AI Search instance and all its indexed data.

Retrieve the configuration and status of an AI Search instance.

Cancel an in-progress indexing job for an AI Search instance.

Performs a chat completion request against an AI Search instance, using indexed content as context for generating responses.

Creates a new indexing job for an AI Search instance.

Creates or updates an indexed item in an AI Search instance.

Deletes a file from a managed AI Search instance and triggers a reindex.

Retrieves a specific indexed item from an AI Search instance.

Downloads the raw file content for a specific item from the managed AI Search instance storage.

Retrieves details for a specific AI Search indexing job.

Lists chunks for a specific item in an AI Search instance, including their text content.

Lists indexed items in an AI Search instance.

Lists log entries for an AI Search indexing job.

Lists indexing jobs for an AI Search instance.

Lists processing logs for a specific item in an AI Search instance.

Executes a semantic search query against an AI Search instance to find relevant indexed content.

Syncs an item to an AI Search instance index.

Downloads a file from a public HTTPS URL with redirect, timeout, and size guards, then uploads it to a Cloudflare AI Search instance as multipart/form-data.

List all AI Search instances in the account.

Performs a chat completion request against multiple AI Search instances in parallel, merging retrieved content as context for generating a response.

Performs a semantic search query against multiple AI Search instances in parallel, merging the retrieved results into a single ranked response.

Purges all cached search results for an AI Search instance. A new internal cache key is generated, immediately orphaning all prior cached entries.

Retrieve usage and indexing statistics for an AI Search instance.

Update the configuration of an AI Search instance.

Retrieve usage and indexing statistics for an AI Search instance.

Update the configuration of an AI Search instance.

Update the description of an existing namespace. The default namespace cannot be modified.

Replace a stored AI Search credential and invalidate cached credentials for instances that use it.

Get the AI Security for Apps custom topic categories for a zone.

Set the AI Security for Apps custom topic categories for a zone. A maximum of 20 custom topics can be configured per zone. Each topic label must be 2–20 characters using only lowercase letters (a–z), digits (0–9), and hyphens. Each topic description must be 2–50 printable ASCII characters. Changes can take up to a minute to propagate to the zone.

Get whether AI Security for Apps is enabled or disabled for a zone.

Enable or disable AI Security for Apps for a zone. Changes can take up to a minute to propagate to the zone.

Get the payment processing status of a top-up by its invoice ID.

Create a credit top-up via Stripe PaymentIntent for the given account.

Remove the spending limit for the account.

Remove the auto top-up configuration for the account.

Retrieve the current credit balance, payment method info, and top-up configuration.

Retrieve a list of past invoices with pagination, optionally filtered by type.

Retrieve a preview of the upcoming invoice including line items and tax.

Retrieve the current spending limit configuration for the account.

Retrieve the current auto top-up threshold, amount, and any error state.

Retrieve the minimum and maximum allowed top-up amounts (in cents) for this account.

Retrieve aggregated usage meter event summaries for the given time range.

Deprecated: spending limits can no longer be created, enabled, or modified and this endpoint always responds 403. Use the new AI Gateway spend limits instead: https://developers.cloudflare.com/ai-gateway/features/spend-limits/. Existing limits can be removed via DELETE /spending-limit.

Configure auto top-up with a balance threshold and top-up amount.

Creates a new AI Gateway.

Creates a new AI Gateway.

Creates a new AI Gateway.

Creates a new AI Gateway.

Creates a new AI Gateway.

Creates a new AI Gateway.

Deletes an AI Gateway dataset.

Deletes an AI Gateway dataset.

Deletes an AI Gateway dataset.

Deletes an AI Gateway dataset.

Deletes an AI Gateway dataset.

Delete an AI Gateway Dynamic Route.

Deletes gateway log entries matching the specified criteria.

Deletes an AI Gateway dataset.

Retrieves details for a specific AI Gateway dataset.

Retrieves details for a specific AI Gateway dataset.

Retrieves details for a specific AI Gateway dataset.

Retrieves details for a specific AI Gateway dataset.

Retrieves details for a specific AI Gateway dataset.

Get an AI Gateway Dynamic Route.

Get an AI Gateway Dynamic Route Version.

Retrieves detailed information for a specific AI Gateway log entry.

Retrieves the original request payload for an AI Gateway log entry.

Retrieves the response payload for an AI Gateway log entry.

Retrieves the endpoint URL for an AI Gateway.

Lists all AI Gateway evaluator types configured for the account.

Lists all AI Gateway evaluator types configured for the account.

Lists all AI Gateway evaluator types configured for the account.

Lists all AI Gateway evaluator types configured for the account.

Lists all available evaluator types for scoring AI gateway responses.

Lists all AI Gateway evaluator types configured for the account.

List all AI Gateway Dynamic Route Deployments.

List all AI Gateway Dynamic Route Versions.

List all AI Gateway Dynamic Routes.

Lists request/response log entries for the AI gateway with filtering and pagination.

Lists all AI Gateway evaluator types configured for the account.

Updates metadata for an AI Gateway log entry.

Create a new AI Gateway Dynamic Route.

Create a new AI Gateway Dynamic Route Deployment.

Create a new AI Gateway Dynamic Route Version.

Updates an existing AI Gateway dataset.

Updates an existing AI Gateway dataset.

Updates an existing AI Gateway dataset.

Updates an existing AI Gateway dataset.

Update an AI Gateway Dynamic Route.

Updates an existing AI Gateway dataset.

Executes a SQL query against Workers Analytics Engine data. Pass the SQL query as a query parameter. The response uses newline-delimited JSON (NDJSON) by default, or a single JSON object when the query includes a FORMAT JSON clause. Use the POST method for longer queries that may exceed URL length limits.

Executes a SQL query against Workers Analytics Engine data. Pass the SQL query in the request body as plain text. The response uses newline-delimited JSON (NDJSON) by default, or a single JSON object when the query includes a FORMAT JSON clause. Prefer this method for longer queries that may exceed URL length limits.

Returns the set of hostnames, the signature algorithm, and the expiration date of the certificate.

Retrieve a single discovered operation by ID

Retrieve the most up to date view of discovered operations

Retrieve the most up to date view of discovered operations, rendered as OpenAPI schemas

Update the `state` on a discovered operation

Update the `state` on one or more discovered operations

Delete user label

Add one operation to a zone. Endpoints can contain path variables. Host, method, endpoint will be normalized to a canoncial form when creating an operation and must be unique on the zone. Inserting an operation that matches an existing one will return the record of the already existing operation and update its last_updated date.

Add one or more operations to a zone. Endpoints can contain path variables. Host, method, endpoint will be normalized to a canoncial form when creating an operation and must be unique on the zone. Inserting an operation that matches an existing one will return the record of the already existing operation and update its last_updated date.

Removes a single API operation from API Shield endpoint management. The operation will no longer be tracked or protected by API Shield rules.

Bulk removes multiple API operations from API Shield endpoint management in a single request. Efficient for cleaning up unused endpoints.

Lists all API operations tracked by API Shield for a zone with pagination. Returns operation details including method, path, and feature configurations.

Gets detailed information about a specific API operation in API Shield, including its schema validation settings and traffic statistics.

Retrieves API operations and their features exported as OpenAPI schemas.

Creates an expression template fallthrough rule for API Shield. Used for configuring default behavior when no other expression templates match.

Create user labels

Delete user labels

Retrieve all labels

Retrieve managed label

Retrieve user label

Replace all operations(s) attached to a managed label

Replace all operations(s) attached to a user label

Bulk remove label(s) on operation(s) in endpoint management

Bulk attach label(s) on operation(s) in endpoint management

Bulk replace label(s) on operation(s) in endpoint management

Remove label(s) on an operation in endpoint management

Attach label(s) on an operation in endpoint management

Replace label(s) on an operation in endpoint management

Update certain fields on a label

Update all fields on a label

Permanently removes an uploaded OpenAPI schema from API Shield schema validation. Operations using this schema will lose their validation rules.

Activates schema validation for an uploaded OpenAPI schema. Requests to matching endpoints will be validated against the schema definitions.

Retrieves all operations from the schema. Operations that already exist in API Shield Endpoint Management will be returned as full operations.

Updates zone level schema validation settings on the zone

Lists all OpenAPI schemas uploaded to API Shield for the zone, including their validation status and associated operations.