Cloudflare/access
@swamp/cloudflare/accessv2026.08.15.1
01README
Cloudflare access infrastructure models
02Release Notes
- Updated: portals
- Updated: servers
- Updated: custom_pages
- Updated: service_tokens
03Models
apps.tsv2026.08.11.2
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id? | string | Cloudflare account ID (provide account_id or zone_id) |
| zone_id? | string | Cloudflare zone ID (provide account_id or zone_id) |
| allow_authenticate_via_warp? | boolean | When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication. |
| allow_iframe? | boolean | Enables loading application content in an iFrame. |
| allowed_idps? | array | The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account. |
| app_launcher_visible? | boolean | Displays the application in the App Launcher. |
| auto_redirect_to_identity? | boolean | When set to `true`, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps. |
| cors_headers? | object | |
| custom_deny_message? | string | The custom error message shown to a user when they are denied access to the application. |
| custom_deny_url? | string | The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules. |
| custom_non_identity_deny_url? | string | The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules. |
| custom_pages? | array | The custom pages that will be displayed when applicable for this application |
| destinations? | array | List of destinations secured by Access. This supersedes `self_hosted_domains` to allow for more flexibility in defining different types of domains. If `destinations` are provided, then `self_hosted_domains` will be ignored.\n |
| domain? | string | The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher. |
| eager_redirect_cookie_setting? | boolean | Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior. |
| enable_binding_cookie? | boolean | Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks. |
| http_only_cookie_attribute? | boolean | Enables the HttpOnly cookie attribute, which increases security against XSS attacks. |
| logo_url? | string | The image URL for the logo shown in the App Launcher dashboard. |
| mfa_config? | object | Configures multi-factor authentication (MFA) settings. |
| name? | string | The name of the application. |
| oauth_configuration? | object | **Beta:** Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) (Resource Indicators for OAuth 2.0). This feature is currently in beta.\n |
| options_preflight_bypass? | boolean | Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set. |
| path_cookie_attribute? | boolean | Enables cookie paths to scope an application's JWT to the application path. If disabled, the JWT will scope to the hostname by default |
| read_service_tokens_from_header? | string | Allows matching Access Service Tokens passed HTTP in a single header with this name.\nThis works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers.\nThe header value will be interpreted as a json object similar to:\n {\n "cf-access-client-id": "88bf3b6d86161464f6509f7219099e57.access.example.com",\n "cf-access-client-secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5"\n }\n |
| same_site_cookie_attribute? | string | Sets the SameSite cookie setting, which provides increased security against CSRF attacks. |
| scim_config? | object | Configuration for provisioning to this application via SCIM. This is currently in closed beta. |
| self_hosted_domains? | array | List of public domains that Access will secure. This field is deprecated in favor of `destinations` and will be supported until **November 21, 2025.** If `destinations` are provided, then `self_hosted_domains` will be ignored.\n |
| service_auth_401_redirect? | boolean | Returns a 401 status code when the request is blocked by a Service Auth policy. |
| session_duration? | string | The amount of time that tokens issued for this application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications. |
| skip_interstitial? | boolean | Enables automatic authentication through cloudflared. |
| tags? | array | The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard. |
| type | string | The application type. |
| use_clientless_isolation_app_launcher_url? | boolean | Determines if users can access this application via a clientless browser isolation URL.\nThis allows users to access private domains without connecting to Gateway. The option requires\nClientless Browser Isolation to be set up with policies that allow users of this application.\n |
| policies? | array | The policies that Access applies to the application, in ascending order of precedence. Items can reference existing policies or create new policies exclusive to the application. Reusable and inline policies are mutually exclusive. |
| saas_app? | object | |
| app_launcher_logo_url? | string | The image URL of the logo shown in the App Launcher header. |
| bg_color? | string | The background color of the App Launcher page. |
| footer_links? | array | The links in the App Launcher footer. |
| header_bg_color? | string | The background color of the App Launcher header. |
| landing_page_design? | object | The design of the App Launcher landing page shown to users when they log in. |
| skip_app_launcher_login_page? | boolean | Determines when to skip the App Launcher landing page. |
| target_criteria? | array | |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Apps
fn get(id: string)
Get a Apps
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Apps |
fn lookup()
Look up an existing Apps by matching global argument values and import it into state
fn adopt(id: string)
Import an existing Apps by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Apps to import |
fn update(identifier?: string)
Update Apps attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Apps by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Apps
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Apps |
fn sync(identifier?: string)
Sync Apps state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Apps by id (e.g. one discovered by list) |
certificates.tsv2026.07.24.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id? | string | Cloudflare account ID (provide account_id or zone_id) |
| zone_id? | string | Cloudflare zone ID (provide account_id or zone_id) |
| associated_hostnames? | array | The hostnames of the applications that will use this certificate. |
| name | string | The name of the certificate. |
| certificate | string | The certificate content. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Certificates
fn get(id: string)
Get a Certificates
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Certificates |
fn lookup()
Look up an existing Certificates by matching global argument values and import it into state
fn adopt(id: string)
Import an existing Certificates by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Certificates to import |
fn update(identifier?: string)
Update Certificates attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Certificates by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Certificates
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Certificates |
fn sync(identifier?: string)
Sync Certificates state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Certificates by id (e.g. one discovered by list) |
custom_pages.tsv2026.08.15.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| app_count? | number | Number of apps the custom page is assigned to. |
| contract_version? | number | Contract version of the page's Liquid template. Present (>= 1) marks a sanitized template; absent or 0 marks a legacy page served verbatim. |
| created_at? | string | |
| custom_html | string | Custom page HTML. |
| name | string | Custom page name. |
| type | enum | Custom page type. |
| uid? | string | UUID. |
| updated_at? | string | |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Custom Pages
fn get(id: string)
Get a Custom Pages
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Custom Pages |
fn lookup()
Look up an existing Custom Pages by matching global argument values and import it into state
fn adopt(id: string)
Import an existing Custom Pages by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Custom Pages to import |
fn update(identifier?: string)
Update Custom Pages attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Custom Pages by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Custom Pages
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Custom Pages |
fn sync(identifier?: string)
Sync Custom Pages state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Custom Pages by id (e.g. one discovered by list) |
groups.tsv2026.08.11.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id? | string | Cloudflare account ID (provide account_id or zone_id) |
| zone_id? | string | Cloudflare zone ID (provide account_id or zone_id) |
| exclude? | array | Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules. |
| include? | array | Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. |
| is_default? | boolean | Whether this is the default group |
| name | string | The name of the Access group. |
| require? | array | Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Groups
fn get(id: string)
Get a Groups
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Groups |
fn lookup()
Look up an existing Groups by matching global argument values and import it into state
fn adopt(id: string)
Import an existing Groups by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Groups to import |
fn update(identifier?: string)
Update Groups attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Groups by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Groups
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Groups |
fn sync(identifier?: string)
Sync Groups state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Groups by id (e.g. one discovered by list) |
identity_providers.tsv2026.07.24.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id? | string | Cloudflare account ID (provide account_id or zone_id) |
| zone_id? | string | Cloudflare zone ID (provide account_id or zone_id) |
| config? | object | |
| id? | string | UUID. |
| name | string | The name of the identity provider, shown to users on the login page. |
| read_only? | boolean | Indicates that the identity provider is immutable and cannot be updated or deleted via the API.\n |
| saml_certificate_set? | object | A SAML encryption certificate set containing current and optionally previous certificates for encryption key rotation. |
| saml_certificate_set_id? | string | The UID of the SAML encryption certificate set assigned to this Identity Provider.\nOnly present for SAML identity providers with encryption configured.\nCreate a certificate set via POST to `/identity_providers/{id}/saml_certificate`.\n |
| scim_config? | object | The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider. |
| type | enum | The type of identity provider. To determine the value for a specific provider, refer to our [developer documentation](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/). |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Identity Providers
fn get(id: string)
Get a Identity Providers
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Identity Providers |
fn lookup()
Look up an existing Identity Providers by matching global argument values and import it into state
fn adopt(id: string)
Import an existing Identity Providers by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Identity Providers to import |
fn update(identifier?: string)
Update Identity Providers attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Identity Providers by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Identity Providers
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Identity Providers |
fn sync(identifier?: string)
Sync Identity Providers state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Identity Providers by id (e.g. one discovered by list) |
idp_federation_grants.tsv2026.07.21.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| idp_id | string | UID of the identity provider to federate. Must be an existing identity provider in this account. One-time pin and Cloudflare-managed identity providers cannot be federated. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Idp Federation Grants
fn get(id: string)
Get a Idp Federation Grants
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Idp Federation Grants |
fn lookup()
Look up an existing Idp Federation Grants by matching global argument values and import it into state
fn adopt(id: string)
Import an existing Idp Federation Grants by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Idp Federation Grants to import |
fn delete(id: string)
Delete the Idp Federation Grants
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Idp Federation Grants |
fn sync(identifier?: string)
Sync Idp Federation Grants state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Idp Federation Grants by id (e.g. one discovered by list) |
policies.tsv2026.08.11.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| decision | enum | The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action. |
| exclude? | array | Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules. |
| include? | array | Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. |
| name | string | The name of the Access policy. |
| require? | array | Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Policies
fn get(id: string)
Get a Policies
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Policies |
fn lookup()
Look up an existing Policies by matching global argument values and import it into state
fn adopt(id: string)
Import an existing Policies by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Policies to import |
fn update(identifier?: string)
Update Policies attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Policies by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Policies
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Policies |
fn sync(identifier?: string)
Sync Policies state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Policies by id (e.g. one discovered by list) |
policy-tests.tsv2026.08.11.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| policies? | array | |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Policy-tests
fn get(id: string)
Get a Policy-tests
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Policy-tests |
fn lookup()
Look up an existing Policy-tests by matching global argument values and import it into state
fn adopt(id: string)
Import an existing Policy-tests by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Policy-tests to import |
fn sync(identifier?: string)
Sync Policy-tests state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Policy-tests by id (e.g. one discovered by list) |
portals.tsv2026.08.15.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| allow_code_mode? | boolean | Deprecated: use `code_mode` for new integrations. `true` maps to any non-off Code Mode policy; `false` maps to `code_mode: off`. If both fields are sent, they must be consistent or the request returns a 400. |
| code_mode? | enum | Code Mode policy for this portal. `off`: Code Mode is unavailable; query parameters are ignored. `opt_in`: Code Mode is off by default; clients turn it on with `?codemode=search_and_execute`. `default_on`: Code Mode is on by default; clients can opt out with `?codemode=off`. `enforced`: Code Mode is always on; query parameters are ignored. Defaults to `opt_in` when omitted on create. If both `code_mode` and `allow_code_mode` are sent, they must be consistent or the request returns a 400. |
| description? | string | Optional description of the MCP portal. |
| hostname | string | Hostname where the MCP portal is available. |
| name | string | Display name for the MCP portal. |
| secure_web_gateway? | boolean | Route outbound MCP traffic through Zero Trust Secure Web Gateway. |
| servers? | array | MCP servers attached to the portal and their portal-specific settings. |
| id | string | Unique identifier for the MCP portal. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Portals
fn get(id: string)
Get a Portals
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Portals |
fn lookup()
Look up an existing Portals by matching global argument values and import it into state
fn adopt(id: string)
Import an existing Portals by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Portals to import |
fn update(identifier?: string)
Update Portals attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Portals by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Portals
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Portals |
fn sync(identifier?: string)
Sync Portals state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Portals by id (e.g. one discovered by list) |
servers.tsv2026.08.15.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| auth_credentials? | string | Static credential for the upstream MCP server. For auth_type "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as `Authorization: Bearer <token>`, or a JSON-encoded object of the form `{"headers":{"Header-Name":"value",...}}` for custom or multiple static headers (e.g. Cloudflare Access service tokens: `{"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}`). |
| client_secret? | string | Pre-registered OAuth client_secret. Write-only - accepted on create/update when auth_credentials.auth_mode is 'manual'. Stored AES-GCM-encrypted in server_oauth_secrets; never returned by read endpoints. |
| description? | string | Optional description of the MCP server. |
| is_shared_oauth_callback_enabled? | boolean | When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. |
| name | string | Display name for the MCP server. |
| secure_web_gateway? | boolean | Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway. |
| updated_prompts? | array | Server-wide prompt capability overrides. |
| updated_tools? | array | Server-wide tool capability overrides. |
| auth_type | enum | Authentication method used to connect to the upstream MCP server. |
| hostname | string | URL of the upstream MCP endpoint. |
| id | string | Unique identifier for the MCP server. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Servers
fn get(id: string)
Get a Servers
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Servers |
fn lookup()
Look up an existing Servers by matching global argument values and import it into state
fn adopt(id: string)
Import an existing Servers by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Servers to import |
fn update(identifier?: string)
Update Servers attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Servers by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Servers
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Servers |
fn sync(identifier?: string)
Sync Servers state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Servers by id (e.g. one discovered by list) |
service_tokens.tsv2026.08.15.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id? | string | Cloudflare account ID (provide account_id or zone_id) |
| zone_id? | string | Cloudflare zone ID (provide account_id or zone_id) |
| client_secret_version? | number | A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`. |
| duration? | string | The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h). |
| enabled? | boolean | Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous `client_secret` stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create. |
| name | string | The name of the service token. |
| previous_client_secret_expires_at? | string | The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Service Tokens
fn get(id: string)
Get a Service Tokens
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Service Tokens |
fn lookup()
Look up an existing Service Tokens by matching global argument values and import it into state
fn adopt(id: string)
Import an existing Service Tokens by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Service Tokens to import |
fn update(identifier?: string)
Update Service Tokens attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Service Tokens by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Service Tokens
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Service Tokens |
fn sync(identifier?: string)
Sync Service Tokens state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Service Tokens by id (e.g. one discovered by list) |
tags.tsv2026.07.21.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| created_at? | string | |
| name? | string | The name of the tag |
| updated_at? | string | |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Tags
fn get(id: string)
Get a Tags
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Tags |
fn lookup()
Look up an existing Tags by matching global argument values and import it into state
fn adopt(id: string)
Import an existing Tags by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Tags to import |
fn update(identifier?: string)
Update Tags attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Tags by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Tags
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Tags |
fn sync(identifier?: string)
Sync Tags state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Tags by id (e.g. one discovered by list) |
users.tsv2026.07.21.1
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| string | The email of the user. | |
| name? | string | The name of the user. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
fn create()
Create a Users
fn get(id: string)
Get a Users
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Users |
fn lookup()
Look up an existing Users by matching global argument values and import it into state
fn adopt(id: string)
Import an existing Users by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Users to import |
fn update(identifier?: string)
Update Users attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Users by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Users
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Users |
fn sync(identifier?: string)
Sync Users state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Users by id (e.g. one discovered by list) |
04Previous Versions
2026.08.11.2
- Updated: apps
- Updated: groups
- Updated: policies
- Updated: policy-tests
2026.08.07.1
- Updated: portals
- Updated: servers
2026.08.06.1
- Updated: portals
2026.08.02.1
- Updated: portals
- Updated: servers
2026.07.24.1
- Updated: apps
- Updated: certificates
- Updated: groups
- Updated: identity_providers
- Updated: service_tokens
2026.07.21.1
- Updated: portals
- Updated: servers
- Updated: apps
- Updated: certificates
- Updated: custom_pages
- Updated: groups
- Updated: identity_providers
- Updated: idp_federation_grants
- Updated: policies
- Updated: policy-tests
- Updated: service_tokens
- Updated: tags
- Updated: users
2026.07.18.2
Modified 1 models
2026.07.14.1
- Updated: portals
2026.06.24.1
- Updated: portals
- Updated: servers
- Updated: apps
2026.06.08.2
- Updated: portals
- Updated: servers
- Updated: apps
- Updated: certificates
- Updated: custom_pages
- Updated: groups
- Updated: identity_providers
- Updated: idp_federation_grants
- Updated: policies
- Updated: policy-tests
- Updated: service_tokens
- Updated: tags
- Updated: users
2026.05.29.1
- Updated: portals
- Updated: servers
- Updated: apps
- Updated: certificates
- Updated: custom_pages
- Updated: groups
- Updated: identity_providers
- Updated: policies
- Updated: policy-tests
- Updated: service_tokens
- Updated: tags
- Updated: users
2026.05.22.1
- Added: portals
- Added: servers
- Added: apps
- Added: certificates
- Added: custom_pages
- Added: groups
- Added: identity_providers
- Added: policies
- Added: policy-tests
- Added: service_tokens
- Added: tags
- Added: users
05Stats
A
100 / 100
Downloads
7
Archive size
91.8 KB
Verified by Swamp
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned
06Platforms
07Labels