Cloudflare/access

@swamp/cloudflare/accessv2026.10.03.1· 3d agoMODELS

01README

Cloudflare access infrastructure models

02Release Notes

Updated: servers

03Models14

apps.tsv2026.10.02.1

Global Arguments

Argument	Type	Required	Description
account_id?	string	no	Cloudflare account ID (provide account_id or zone_id)
zone_id?	string	no	Cloudflare zone ID (provide account_id or zone_id)
allowed_idps?	array	no	The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
destinations?	array	no	Public hostname and Workers destinations secured by Access.
domain?	string	no	The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.
name?	string	no	The name of the application.
oauth_configuration?	object	no	Beta: Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.\n
self_hosted_domains?	array	no	List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until November 21, 2025. If `destinations` are provided, then `self_hosted_domains` will be ignored.\n
type?	string	no	The application type.
user_populations?	array	no	The single user population associated with this application.
allow_authenticate_via_warp?	boolean	no	When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.
allow_iframe?	boolean	no	Enables loading application content in an iFrame.
app_launcher_visible?	boolean	no	Displays the application in the App Launcher.
auto_redirect_to_identity?	boolean	no	When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
cors_headers?	object	no
custom_deny_message?	string	no	The custom error message shown to a user when they are denied access to the application.
custom_deny_url?	string	no	The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.
custom_non_identity_deny_url?	string	no	The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.
custom_pages?	array	no	The custom pages that will be displayed when applicable for this application
eager_redirect_cookie_setting?	boolean	no	Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
enable_binding_cookie?	boolean	no	Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
http_only_cookie_attribute?	boolean	no	Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
logo_url?	string	no	The image URL for the logo shown in the App Launcher dashboard.
mfa_config?	object	no	Configures multi-factor authentication (MFA) settings.
options_preflight_bypass?	boolean	no	Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
path_cookie_attribute?	boolean	no	Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default
read_service_tokens_from_header?	string	no	Allows matching Access Service Tokens passed HTTP in a single header with this name.\nThis works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.\nThe header value will be interpreted as a json object similar to:\n {\n "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",\n "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"\n }\n
same_site_cookie_attribute?	string	no	Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
scim_config?	object	no	Configuration for provisioning to this application via SCIM. This is currently in closed beta.
service_auth_401_redirect?	boolean	no	Returns a 401 status code when the request is blocked by a Service Auth policy.
session_duration?	string	no	The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
skip_interstitial?	boolean	no	Enables automatic authentication through cloudflared.
tags?	array	no	The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.
use_clientless_isolation_app_launcher_url?	boolean	no	Determines if users can access this application via a clientless browser isolation URL.\nThis allows users to access private domains without connecting to Gateway. The option requires\nClientless Browser Isolation to be set up with policies that allow users of this application.\n
policies?	array	no	The policies that Access applies to the application, in ascending order of precedence. Items can reference existing policies or create new policies exclusive to the application. Reusable and inline policies are mutually exclusive.
saas_app?	object	no
app_launcher_logo_url?	string	no	The image URL of the logo shown in the App Launcher header.
bg_color?	string	no	The background color of the App Launcher page.
footer_links?	array	no	The links in the App Launcher footer.
header_bg_color?	string	no	The background color of the App Launcher header.
landing_page_design?	object	no	The design of the App Launcher landing page shown to users when they log in.
skip_app_launcher_login_page?	boolean	no	Determines when to skip the App Launcher landing page.
target_criteria?	array	no
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Apps

fn get(id: string)

Get a Apps

Argument	Type	Required	Description
id	string	yes	The ID of the Apps

fn lookup()

Look up an existing Apps by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Apps by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Apps to import

fn update(identifier?: string)

Update Apps attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Apps by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Apps

Argument	Type	Required	Description
id	string	yes	The ID of the Apps

fn sync(identifier?: string)

Sync Apps state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Apps by id (e.g. one discovered by list)

Resources

state(infinite)— Apps resource state

certificates.tsv2026.09.29.2

Global Arguments

Argument	Type	Required	Description
account_id?	string	no	Cloudflare account ID (provide account_id or zone_id)
zone_id?	string	no	Cloudflare zone ID (provide account_id or zone_id)
associated_hostnames?	array	no	The hostnames of the applications that will use this certificate.
name?	string	no	The name of the certificate.
certificate?	string	no	The certificate content.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Certificates

fn get(id: string)

Get a Certificates

Argument	Type	Required	Description
id	string	yes	The ID of the Certificates

fn lookup()

Look up an existing Certificates by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Certificates by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Certificates to import

fn update(identifier?: string)

Update Certificates attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Certificates by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Certificates

Argument	Type	Required	Description
id	string	yes	The ID of the Certificates

fn sync(identifier?: string)

Sync Certificates state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Certificates by id (e.g. one discovered by list)

Resources

state(infinite)— Certificates resource state

custom_pages.tsv2026.09.29.2

Global Arguments

Argument	Type	Required	Description
account_id	string	yes	Cloudflare account ID
app_count?	number	no	Number of apps the custom page is assigned to.
contract_version?	number	no	Contract version of the page's Liquid template. Present (>= 1) marks a sanitized template; absent or 0 marks a legacy page served verbatim.
created_at?	string	no
custom_html?	string	no	Custom page HTML.
name?	string	no	Custom page name.
type?	enum	no	Custom page type.
uid?	string	no	UUID.
updated_at?	string	no
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Custom Pages

fn get(id: string)

Get a Custom Pages

Argument	Type	Required	Description
id	string	yes	The ID of the Custom Pages

fn lookup()

Look up an existing Custom Pages by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Custom Pages by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Custom Pages to import

fn update(identifier?: string)

Update Custom Pages attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Custom Pages by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Custom Pages

Argument	Type	Required	Description
id	string	yes	The ID of the Custom Pages

fn sync(identifier?: string)

Sync Custom Pages state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Custom Pages by id (e.g. one discovered by list)

Resources

state(infinite)— Custom Pages resource state

groups.tsv2026.09.29.2

Global Arguments

Argument	Type	Required	Description
account_id?	string	no	Cloudflare account ID (provide account_id or zone_id)
zone_id?	string	no	Cloudflare zone ID (provide account_id or zone_id)
exclude?	array	no	Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.
include?	array	no	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
is_default?	boolean	no	Whether this is the default group
name?	string	no	The name of the Access group.
require?	array	no	Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Groups

fn get(id: string)

Get a Groups

Argument	Type	Required	Description
id	string	yes	The ID of the Groups

fn lookup()

Look up an existing Groups by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Groups by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Groups to import

fn update(identifier?: string)

Update Groups attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Groups by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Groups

Argument	Type	Required	Description
id	string	yes	The ID of the Groups

fn sync(identifier?: string)

Sync Groups state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Groups by id (e.g. one discovered by list)

Resources

state(infinite)— Groups resource state

identity_providers.tsv2026.10.02.1

Global Arguments

Argument	Type	Required	Description
account_id?	string	no	Cloudflare account ID (provide account_id or zone_id)
zone_id?	string	no	Cloudflare zone ID (provide account_id or zone_id)
config?	object	no
id?	string	no	UUID.
name?	string	no	The name of the identity provider, shown to users on the login page.
read_only?	boolean	no	Indicates that the identity provider is immutable and cannot be updated or deleted via the API.\n
saml_certificate_set?	object	no	A SAML encryption certificate set containing current and optionally previous certificates for encryption key rotation.
saml_certificate_set_id?	string	no	The UID of the SAML encryption certificate set assigned to this Identity Provider.\nOnly present for SAML identity providers with encryption configured.\nCreate a certificate set via POST to `/identity_providers/{id}/saml_certificate`.\n
scim_config?	object	no	The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
type?	enum	no	The type of identity provider. To determine the value for a specific provider, refer to our [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/).
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Identity Providers

fn get(id: string)

Get a Identity Providers

Argument	Type	Required	Description
id	string	yes	The ID of the Identity Providers

fn lookup()

Look up an existing Identity Providers by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Identity Providers by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Identity Providers to import

fn update(identifier?: string)

Update Identity Providers attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Identity Providers by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Identity Providers

Argument	Type	Required	Description
id	string	yes	The ID of the Identity Providers

fn sync(identifier?: string)

Sync Identity Providers state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Identity Providers by id (e.g. one discovered by list)

Resources

state(infinite)— Identity Providers resource state

idp_federation_grants.tsv2026.09.29.1

Global Arguments

Argument	Type	Required	Description
account_id	string	yes	Cloudflare account ID
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
idp_id?	string	no	UID of the identity provider to federate. Must be an existing identity provider in this account. One-time pin and Cloudflare-managed identity providers cannot be federated.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Idp Federation Grants

fn get(id: string)

Get a Idp Federation Grants

Argument	Type	Required	Description
id	string	yes	The ID of the Idp Federation Grants

fn lookup()

Look up an existing Idp Federation Grants by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Idp Federation Grants by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Idp Federation Grants to import

fn delete(id: string)

Delete the Idp Federation Grants

Argument	Type	Required	Description
id	string	yes	The ID of the Idp Federation Grants

fn sync(identifier?: string)

Sync Idp Federation Grants state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Idp Federation Grants by id (e.g. one discovered by list)

Resources

state(infinite)— Idp Federation Grants resource state

policies.tsv2026.09.29.2

Global Arguments

Argument	Type	Required	Description
account_id	string	yes	Cloudflare account ID
decision?	enum	no	The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
exclude?	array	no	Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
include?	array	no	Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
name?	string	no	The name of the Access policy.
require?	array	no	Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Policies

fn get(id: string)

Get a Policies

Argument	Type	Required	Description
id	string	yes	The ID of the Policies

fn lookup()

Look up an existing Policies by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Policies by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Policies to import

fn update(identifier?: string)

Update Policies attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Policies by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Policies

Argument	Type	Required	Description
id	string	yes	The ID of the Policies

fn sync(identifier?: string)

Sync Policies state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Policies by id (e.g. one discovered by list)

Resources

state(infinite)— Policies resource state

policy-tests.tsv2026.09.04.1

Global Arguments

Argument	Type	Required	Description
account_id	string	yes	Cloudflare account ID
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
policies?	array	no
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Policy-tests

fn get(id: string)

Get a Policy-tests

Argument	Type	Required	Description
id	string	yes	The ID of the Policy-tests

fn lookup()

Look up an existing Policy-tests by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Policy-tests by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Policy-tests to import

fn sync(identifier?: string)

Sync Policy-tests state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Policy-tests by id (e.g. one discovered by list)

Resources

state(infinite)— Policy-tests resource state

portals.tsv2026.09.29.2

Global Arguments

Argument	Type	Required	Description
account_id	string	yes	Cloudflare account ID
allow_code_mode?	boolean	no	Deprecated: use `code_mode` for new integrations. `true` maps to any non-off Code Mode policy; `false` maps to `code_mode: off`. If both fields are sent, they must be consistent or the request returns a 400.
code_mode?	enum	no	Code Mode policy for this portal. `off`: Code Mode is unavailable; query parameters are ignored. `opt_in`: Code Mode is off by default; clients turn it on with `?codemode=search_and_execute`. `default_on`: Code Mode is on by default; clients can opt out with `?codemode=off`. `enforced`: Code Mode is always on; query parameters are ignored. Defaults to `opt_in` when omitted on create. If both `code_mode` and `allow_code_mode` are sent, they must be consistent or the request returns a 400.
description?	string	no	Optional description of the MCP portal.
hostname?	string	no	Hostname where the MCP portal is available.
name?	string	no	Display name for the MCP portal.
secure_web_gateway?	boolean	no	Route outbound MCP traffic through Zero Trust Secure Web Gateway.
servers?	array	no	MCP servers attached to the portal and their portal-specific settings.
id?	string	no	Unique identifier for the MCP portal.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Portals

fn get(id: string)

Get a Portals

Argument	Type	Required	Description
id	string	yes	The ID of the Portals

fn lookup()

Look up an existing Portals by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Portals by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Portals to import

fn update(identifier?: string)

Update Portals attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Portals by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Portals

Argument	Type	Required	Description
id	string	yes	The ID of the Portals

fn sync(identifier?: string)

Sync Portals state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Portals by id (e.g. one discovered by list)

Resources

state(infinite)— Portals resource state

servers.tsv2026.10.03.1

Global Arguments

Argument	Type	Required	Description
account_id	string	yes	Cloudflare account ID
auth_credentials?	string	no	Credential configuration for the upstream MCP server. For auth_type "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as `Authorization: Bearer <token>`, or a JSON-encoded object of the form `{"headers":{"Header-Name":"value",...}}` for custom or multiple static headers (e.g. Cloudflare Access service tokens: `{"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}`). For auth_type "oauth" with a pre-registered client, send a JSON-encoded object containing `auth_mode:"manual"`, `config.authorization_endpoint`, `config.token_endpoint`, and `registration_info.client_id`. Also provide `registration_info.redirect_uris` unless `is_shared_oauth_callback_enabled` is true. Optional fields include `config.issuer`, `config.revocation_endpoint`, `registration_info.scope`, and `registration_info.token_endpoint_auth_method`. Send the client secret in the separate `client_secret` field. Omit `auth_credentials` on update to preserve the existing configuration.
client_secret?	string	no	Pre-registered OAuth client_secret. Write-only - accepted on create/update when auth_credentials.auth_mode is 'manual'. Required when creating a manual OAuth server or converting an existing server to manual mode. Omit it on update to preserve the existing secret; provide it to rotate the secret. Stored AES-GCM-encrypted in server_oauth_secrets; never returned by read endpoints.
description?	string	no	Optional description of the MCP server.
is_shared_oauth_callback_enabled?	boolean	no	When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
name?	string	no	Display name for the MCP server.
secure_web_gateway?	boolean	no	Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
updated_prompts?	array	no	Server-wide prompt capability overrides.
updated_tools?	array	no	Server-wide tool capability overrides.
auth_type?	enum	no	Authentication method used to connect to the upstream MCP server.
hostname?	string	no	URL of the upstream MCP endpoint.
id?	string	no	Unique identifier for the MCP server.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Servers

fn get(id: string)

Get a Servers

Argument	Type	Required	Description
id	string	yes	The ID of the Servers

fn lookup()

Look up an existing Servers by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Servers by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Servers to import

fn update(identifier?: string)

Update Servers attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Servers by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Servers

Argument	Type	Required	Description
id	string	yes	The ID of the Servers

fn sync(identifier?: string)

Sync Servers state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Servers by id (e.g. one discovered by list)

Resources

state(infinite)— Servers resource state

service_tokens.tsv2026.09.29.2

Global Arguments

Argument	Type	Required	Description
account_id?	string	no	Cloudflare account ID (provide account_id or zone_id)
zone_id?	string	no	Cloudflare zone ID (provide account_id or zone_id)
client_secret_version?	number	no	A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.
duration?	string	no	The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).
enabled?	boolean	no	Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous `client_secret` stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create.
name?	string	no	The name of the service token.
previous_client_secret_expires_at?	string	no	The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Service Tokens

fn get(id: string)

Get a Service Tokens

Argument	Type	Required	Description
id	string	yes	The ID of the Service Tokens

fn lookup()

Look up an existing Service Tokens by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Service Tokens by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Service Tokens to import

fn update(identifier?: string)

Update Service Tokens attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Service Tokens by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Service Tokens

Argument	Type	Required	Description
id	string	yes	The ID of the Service Tokens

fn sync(identifier?: string)

Sync Service Tokens state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Service Tokens by id (e.g. one discovered by list)

Resources

state(infinite)— Service Tokens resource state

tags.tsv2026.09.29.1

Global Arguments

Argument	Type	Required	Description
account_id	string	yes	Cloudflare account ID
created_at?	string	no
name?	string	no	The name of the tag
updated_at?	string	no
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a Tags

fn get(id: string)

Get a Tags

Argument	Type	Required	Description
id	string	yes	The ID of the Tags

fn lookup()

Look up an existing Tags by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Tags by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Tags to import

fn update(identifier?: string)

Update Tags attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Tags by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Tags

Argument	Type	Required	Description
id	string	yes	The ID of the Tags

fn sync(identifier?: string)

Sync Tags state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Tags by id (e.g. one discovered by list)

Resources

state(infinite)— Tags resource state

user_populations.tsv2026.10.02.1

Global Arguments

Argument	Type	Required	Description
account_id	string	yes	Cloudflare account ID
name?	string	no	The name of the user population. Leading and trailing whitespace is trimmed before validation. After trimming, the name must contain at least one non-whitespace character and must not exceed 128 UTF-8 bytes.\n
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?	string	no	Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?	string	no	Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.

fn create()

Create a User Populations

fn get(id: string)

Get a User Populations

Argument	Type	Required	Description
id	string	yes	The ID of the User Populations

fn lookup()

Look up an existing User Populations by matching global argument values and import it into state

fn adopt(id: string)

Import an existing User Populations by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the User Populations to import

fn update(identifier?: string)

Update User Populations attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific User Populations by id (e.g. one discovered by list)

fn delete(id: string)

Delete the User Populations

Argument	Type	Required	Description
id	string	yes	The ID of the User Populations

fn sync(identifier?: string)

Sync User Populations state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific User Populations by id (e.g. one discovered by list)

Resources

state(infinite)— User Populations resource state

users.tsv2026.09.29.2

Global Arguments

Argument	Type	Required	Description
account_id	string	yes	Cloudflare account ID
email?	string	no	The email of the user.
name?	string	no	The name of the user.
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.

fn create()

Create a Users

fn get(id: string)

Get a Users

Argument	Type	Required	Description
id	string	yes	The ID of the Users

fn lookup()

Look up an existing Users by matching global argument values and import it into state

fn adopt(id: string)

Import an existing Users by ID into state for management

Argument	Type	Required	Description
id	string	yes	The ID of the Users to import

fn update(identifier?: string)

Update Users attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific Users by id (e.g. one discovered by list)

fn delete(id: string)

Delete the Users

Argument	Type	Required	Description
id	string	yes	The ID of the Users

fn sync(identifier?: string)

Sync Users state from Cloudflare

Argument	Type	Required	Description
identifier?	string	no	Target a specific Users by id (e.g. one discovered by list)

Resources

state(infinite)— Users resource state

04Previous Versions19

2026.10.02.1Oct 2, 2026

Updated: apps
Updated: identity_providers
Added: user_populations

2026.09.29.2Sep 29, 2026

Updated: portals
Updated: servers
Updated: apps
Updated: certificates
Updated: custom_pages
Updated: groups
Updated: identity_providers
Updated: policies
Updated: service_tokens
Updated: tags
Updated: users

2026.09.29.1Sep 28, 2026

Updated: portals
Updated: servers
Updated: apps
Updated: certificates
Updated: custom_pages
Updated: groups
Updated: identity_providers
Updated: idp_federation_grants
Updated: policies
Updated: service_tokens
Updated: users

2026.09.24.1Sep 24, 2026

Updated: apps

2026.09.15.1Sep 15, 2026

Updated: apps

Modified 1 models

2026.09.11.1Sep 11, 2026

Updated: servers

2026.09.04.1Sep 4, 2026

Updated: apps
Updated: groups
Updated: policies
Updated: policy-tests

2026.08.25.2Aug 25, 2026

Updated: portals
Updated: servers
Updated: apps
Updated: custom_pages
Updated: identity_providers
Added: idp_federation_grants
Updated: service_tokens

2026.08.25.1Aug 25, 2026

Updated: portals
Updated: servers
Updated: apps
Updated: custom_pages
Updated: identity_providers
Updated: service_tokens

2026.08.15.1Aug 15, 2026

Updated: portals
Updated: servers
Updated: custom_pages
Updated: service_tokens

2026.08.11.2Aug 11, 2026

Updated: apps
Updated: groups
Updated: policies
Updated: policy-tests

2026.08.07.1Aug 7, 2026

Updated: portals
Updated: servers

2026.08.06.1Aug 6, 2026

Updated: portals

2026.08.02.1Aug 2, 2026

Updated: portals
Updated: servers

2026.07.24.1Jul 24, 2026

Updated: apps
Updated: certificates
Updated: groups
Updated: identity_providers
Updated: service_tokens

2026.07.21.1Jul 21, 2026

Updated: portals
Updated: servers
Updated: apps
Updated: certificates
Updated: custom_pages
Updated: groups
Updated: identity_providers
Updated: idp_federation_grants
Updated: policies
Updated: policy-tests
Updated: service_tokens
Updated: tags
Updated: users

2026.07.18.2Jul 18, 2026

Modified 1 models

2026.07.14.1Jul 14, 2026

Updated: portals

2026.06.24.1Jun 24, 2026

Updated: portals
Updated: servers
Updated: apps

05Stats

100 / 100

Downloads

Archive size

72.7 KB

Verified by Swamp

Has README or module doc2/2earned
README has a code example1/1earned
README is substantive1/1earned
Most symbols documented1/1earned
No slow types (deprecated)1/1earned
Dependencies pass trust audit2/2earned
Has description1/1earned
Platform support declared (or universal)2/2earned
License declared1/1earned
Verified public repository2/2earned

Repository

https://github.com/swamp-club/swamp-extensions

06Platforms

linux · x86_64 linux · aarch64 macOS · x86_64 macOS · aarch64

07Labels

#cloudflare #access #cloud #infrastructure