Skip to main content
← back to extensions

Cloudflare/devices

@swamp/cloudflare/devicesv2026.10.23.1· AGPL-3.0-or-later· 3d agoBEHAVIORS
01README

Cloudflare devices infrastructure models

02Release Notes
  • Updated: deployment-groups
  • Updated: ip-profiles
  • Updated: networks
  • Updated: policy
  • Updated: posture
  • Updated: integration
03Behaviors6
deployment-groups.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
account_idstringCloudflare account ID
name?stringA user-friendly name for the deployment group.
policy_ids?arrayContains an optional list of policy IDs assigned to a group.
version_config?arrayContains at least one version configuration.
apiToken?stringCloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?stringCloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?stringCloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.
fn create()
Create a Deployment-groups
fn get(id: string)
Get a Deployment-groups
ArgumentTypeDescription
idstringThe ID of the Deployment-groups
fn lookup(allowMissing?: boolean)
Look up an existing Deployment-groups by matching global argument values and import it into state
ArgumentTypeDescription
allowMissing?booleanSucceed and record found: false in lookupResult when nothing matches, instead of failing
fn adopt(id: string)
Import an existing Deployment-groups by ID into state for management
ArgumentTypeDescription
idstringThe ID of the Deployment-groups to import
fn update(identifier?: string)
Update Deployment-groups attributes
ArgumentTypeDescription
identifier?stringTarget a specific Deployment-groups by id (e.g. one discovered by list)
fn delete(id: string)
Delete the Deployment-groups
ArgumentTypeDescription
idstringThe ID of the Deployment-groups
fn sync(identifier?: string)
Sync Deployment-groups state from Cloudflare
ArgumentTypeDescription
identifier?stringTarget a specific Deployment-groups by id (e.g. one discovered by list)

Resources

state(infinite)— Deployment-groups resource state
lookupResult(infinite)— Outcome of the most recent lookup
integration.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
account_idstringCloudflare account ID
config?recordThe configuration object containing third-party integration information.
interval?stringThe interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`).
name?stringThe name of the device posture integration.
type?enumThe type of device posture integration.
apiToken?stringCloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?stringCloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?stringCloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.
fn create()
Create a Integration
fn get(id: string)
Get a Integration
ArgumentTypeDescription
idstringThe ID of the Integration
fn lookup(allowMissing?: boolean)
Look up an existing Integration by matching global argument values and import it into state
ArgumentTypeDescription
allowMissing?booleanSucceed and record found: false in lookupResult when nothing matches, instead of failing
fn adopt(id: string)
Import an existing Integration by ID into state for management
ArgumentTypeDescription
idstringThe ID of the Integration to import
fn update(identifier?: string)
Update Integration attributes
ArgumentTypeDescription
identifier?stringTarget a specific Integration by id (e.g. one discovered by list)
fn delete(id: string)
Delete the Integration
ArgumentTypeDescription
idstringThe ID of the Integration
fn sync(identifier?: string)
Sync Integration state from Cloudflare
ArgumentTypeDescription
identifier?stringTarget a specific Integration by id (e.g. one discovered by list)

Resources

state(infinite)— Integration resource state
lookupResult(infinite)— Outcome of the most recent lookup
ip-profiles.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
account_idstringCloudflare account ID
description?stringAn optional description of the Device IP profile.
enabled?booleanWhether the Device IP profile will be applied to matching devices.
match?stringThe wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".
name?stringA user-friendly name for the Device IP profile.
precedence?numberThe precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.
subnet_id?stringThe ID of the Subnet.
apiToken?stringCloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?stringCloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?stringCloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.
fn create()
Create a Ip-profiles
fn get(id: string)
Get a Ip-profiles
ArgumentTypeDescription
idstringThe ID of the Ip-profiles
fn lookup(allowMissing?: boolean)
Look up an existing Ip-profiles by matching global argument values and import it into state
ArgumentTypeDescription
allowMissing?booleanSucceed and record found: false in lookupResult when nothing matches, instead of failing
fn adopt(id: string)
Import an existing Ip-profiles by ID into state for management
ArgumentTypeDescription
idstringThe ID of the Ip-profiles to import
fn update(identifier?: string)
Update Ip-profiles attributes
ArgumentTypeDescription
identifier?stringTarget a specific Ip-profiles by id (e.g. one discovered by list)
fn delete(id: string)
Delete the Ip-profiles
ArgumentTypeDescription
idstringThe ID of the Ip-profiles
fn sync(identifier?: string)
Sync Ip-profiles state from Cloudflare
ArgumentTypeDescription
identifier?stringTarget a specific Ip-profiles by id (e.g. one discovered by list)

Resources

state(infinite)— Ip-profiles resource state
lookupResult(infinite)— Outcome of the most recent lookup
networks.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
account_idstringCloudflare account ID
config?recordThe configuration object containing information for the WARP client to detect the managed network.
name?stringThe name of the device managed network. This name must be unique.
type?enumThe type of device managed network.
apiToken?stringCloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?stringCloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?stringCloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.
fn create()
Create a Networks
fn get(id: string)
Get a Networks
ArgumentTypeDescription
idstringThe ID of the Networks
fn lookup(allowMissing?: boolean)
Look up an existing Networks by matching global argument values and import it into state
ArgumentTypeDescription
allowMissing?booleanSucceed and record found: false in lookupResult when nothing matches, instead of failing
fn adopt(id: string)
Import an existing Networks by ID into state for management
ArgumentTypeDescription
idstringThe ID of the Networks to import
fn update(identifier?: string)
Update Networks attributes
ArgumentTypeDescription
identifier?stringTarget a specific Networks by id (e.g. one discovered by list)
fn delete(id: string)
Delete the Networks
ArgumentTypeDescription
idstringThe ID of the Networks
fn sync(identifier?: string)
Sync Networks state from Cloudflare
ArgumentTypeDescription
identifier?stringTarget a specific Networks by id (e.g. one discovered by list)

Resources

state(infinite)— Networks resource state
lookupResult(infinite)— Outcome of the most recent lookup
policy.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
account_idstringCloudflare account ID
allow_mode_switch?booleanWhether to allow the user to switch WARP between modes.
allow_updates?booleanWhether to receive update notifications when a new version of the client is available.
allowed_to_leave?booleanWhether to allow devices to leave the organization.
auto_connect?numberThe amount of time in seconds to reconnect after having been disabled.
browser_extension_config?objectBrowser extension proxy settings. Required when profile_type is browser_extension and invalid for WARP profiles.
captive_portal?numberTurn on the captive portal after the specified amount of time.
default?booleanWhether the policy is the account default. WARP group profiles cannot set this field.
description?stringA description of the policy.
disable_auto_fallback?booleanIf the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`.
dns_search_suffixes?arrayList of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
enable_device_credential_authentication?booleanDetermines whether the WARP client can silently reauthenticate the user with device credentials (Microsoft Entra) instead of prompting for browser-based reauthentication.
enabled?booleanWhether the policy will be applied to matching devices.
exclude?arrayList of routes excluded in the WARP client's tunnel. Both 'exclude' and 'include' cannot be set in the same request.
exclude_office_ips?booleanWhether to add Microsoft IPs to Split Tunnel exclusions.
global_acceleration?objectGlobal Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
include?arrayList of routes included in the WARP client's tunnel. Both 'exclude' and 'include' cannot be set in the same request.
lan_allow_minutes?numberThe amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.
lan_allow_subnet_size?numberThe size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.
match?stringThe wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version", "device.tags".
name?stringThe name of the device settings profile.
precedence?numberThe precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.
register_interface_ip_with_dns?booleanDetermines if the operating system will register WARP's local interface IP with your on-premises DNS server.
sccm_vpn_boundary_support?booleanDetermines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
service_mode_v2?object
support_url?stringThe URL to launch when the Send Feedback button is clicked.
switch_locked?booleanWhether to allow the user to turn off the WARP switch and disconnect the client.
tunnel_protocol?stringDetermines which tunnel protocol to use.
uninstall_protection?booleanDetermines whether uninstalling the WARP client requires an override code. (Windows only).
virtual_networks?objectVirtual network access settings for the device.
profile_type?enumThe client type to which the device settings profile applies. This field is set when the profile is created and cannot be changed.
apiToken?stringCloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?stringCloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?stringCloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.
fn create()
Create a Policy
fn get(id: string)
Get a Policy
ArgumentTypeDescription
idstringThe ID of the Policy
fn lookup(allowMissing?: boolean)
Look up an existing Policy by matching global argument values and import it into state
ArgumentTypeDescription
allowMissing?booleanSucceed and record found: false in lookupResult when nothing matches, instead of failing
fn adopt(id: string)
Import an existing Policy by ID into state for management
ArgumentTypeDescription
idstringThe ID of the Policy to import
fn update(identifier?: string)
Update Policy attributes
ArgumentTypeDescription
identifier?stringTarget a specific Policy by id (e.g. one discovered by list)
fn delete(id: string)
Delete the Policy
ArgumentTypeDescription
idstringThe ID of the Policy
fn sync(identifier?: string)
Sync Policy state from Cloudflare
ArgumentTypeDescription
identifier?stringTarget a specific Policy by id (e.g. one discovered by list)

Resources

state(infinite)— Policy resource state
lookupResult(infinite)— Outcome of the most recent lookup
posture.tsv2026.10.23.1

Global Arguments

ArgumentTypeDescription
account_idstringCloudflare account ID
description?stringThe description of the device posture rule.
expiration?stringSets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.
input?object
match?arrayThe conditions that the client must match to run the rule.
name?stringThe name of the device posture rule.
schedule?stringPolling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`.
type?enumThe type of device posture rule.
apiToken?stringCloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
apiKey?stringCloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email.
email?stringCloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey.
fn create()
Create a Posture
fn get(id: string)
Get a Posture
ArgumentTypeDescription
idstringThe ID of the Posture
fn lookup(allowMissing?: boolean)
Look up an existing Posture by matching global argument values and import it into state
ArgumentTypeDescription
allowMissing?booleanSucceed and record found: false in lookupResult when nothing matches, instead of failing
fn adopt(id: string)
Import an existing Posture by ID into state for management
ArgumentTypeDescription
idstringThe ID of the Posture to import
fn update(identifier?: string)
Update Posture attributes
ArgumentTypeDescription
identifier?stringTarget a specific Posture by id (e.g. one discovered by list)
fn delete(id: string)
Delete the Posture
ArgumentTypeDescription
idstringThe ID of the Posture
fn sync(identifier?: string)
Sync Posture state from Cloudflare
ArgumentTypeDescription
identifier?stringTarget a specific Posture by id (e.g. one discovered by list)

Resources

state(infinite)— Posture resource state
lookupResult(infinite)— Outcome of the most recent lookup
04Previous Versions19
2026.10.20.1AGPL-3.0-or-later
  • Updated: deployment-groups
  • Updated: ip-profiles
  • Updated: networks
  • Updated: policy
  • Updated: posture
  • Updated: integration

Modified 1 behaviors

2026.10.17.1AGPL-3.0-or-later
  • Updated: networks
  • Updated: integration
2026.10.16.2AGPL-3.0-or-later
2026.10.16.1AGPL-3.0-or-later(was none)
  • Updated: policy
2026.10.13.1
  • Updated: deployment-groups
  • Updated: ip-profiles
  • Updated: networks
  • Updated: policy
  • Updated: posture
  • Updated: integration
2026.09.29.2
  • Updated: networks
  • Updated: posture
2026.09.29.1
  • Updated: deployment-groups
  • Updated: ip-profiles
  • Updated: networks
  • Updated: policy
  • Updated: posture
  • Updated: integration
2026.09.25.1
  • Updated: policy
2026.09.23.1
  • Updated: policy

Added 1, removed 6 behaviors

2026.09.08.1
  • Updated: policy
2026.08.25.2
  • Updated: ip-profiles
  • Updated: policy
  • Updated: posture
2026.08.25.1
  • Updated: ip-profiles
  • Updated: policy
  • Updated: posture
2026.08.11.1
  • Updated: policy
  • Updated: posture
  • Updated: integration
2026.07.21.1
  • Updated: deployment-groups
  • Updated: ip-profiles
  • Updated: networks
  • Updated: policy
  • Updated: posture
  • Updated: integration
2026.07.18.2

Modified 6 behaviors

2026.07.15.1
  • Updated: posture
2026.06.24.1
  • Updated: policy
2026.06.08.2
  • Updated: deployment-groups
  • Updated: ip-profiles
  • Updated: networks
  • Updated: policy
  • Updated: posture
  • Updated: integration
2026.05.29.1
  • Updated: deployment-groups
  • Updated: ip-profiles
  • Updated: networks
  • Updated: policy
  • Updated: posture
  • Updated: integration
05Stats
A
100 / 100
Downloads
25
Archive size
33.8 KB
Verified by Swamp
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Docs keep secrets in a vault1/1earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License2/2earned
  • Verified public repository2/2earned
Repository
https://github.com/swamp-club/swamp-extensions
06Platforms
07Labels
#cloudflare#devices#cloud#infrastructure