Cloudflare/magic
@swamp/cloudflare/magicv2026.10.23.1
01README
Cloudflare magic infrastructure models
02Release Notes
- Updated: rules
- Updated: allowlist
- Updated: prefixes
- Updated: filters
- Updated: rules_syn_protection
- Updated: filters_tcp_flow_protection
- Updated: rules_tcp_flow_protection
- Updated: filter_profiles
- Updated: catalog-syncs
- Updated: onramps
- Updated: providers
- Updated: connectors
- Updated: gre_tunnels
- Updated: ipsec_tunnels
- Updated: redundancy_groups
- Updated: routes
- Updated: sites
03Behaviors
@swamp/cloudflare/magic/allowlistv2026.10.23.1allowlist.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| comment? | string | An comment describing the allowlist prefix. |
| enabled? | boolean | Whether to enable the allowlist prefix into effect. |
| prefix? | string | The allowlist prefix to add in CIDR format. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Allowlist
fn get(id: string)
Get a Allowlist
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Allowlist |
fn lookup(allowMissing?: boolean)
Look up an existing Allowlist by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Allowlist by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Allowlist to import |
fn update(identifier?: string)
Update Allowlist attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Allowlist by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Allowlist
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Allowlist |
fn sync(identifier?: string)
Sync Allowlist state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Allowlist by id (e.g. one discovered by list) |
Resources
state(infinite)— Allowlist resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/catalog-syncsv2026.10.23.1catalog-syncs.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| description? | string | |
| name? | string | |
| policy? | string | |
| update_mode? | enum | |
| destination_type? | enum | |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Catalog-syncs
fn get(id: string)
Get a Catalog-syncs
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Catalog-syncs |
fn lookup(allowMissing?: boolean)
Look up an existing Catalog-syncs by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Catalog-syncs by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Catalog-syncs to import |
fn update(identifier?: string)
Update Catalog-syncs attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Catalog-syncs by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Catalog-syncs
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Catalog-syncs |
fn sync(identifier?: string)
Sync Catalog-syncs state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Catalog-syncs by id (e.g. one discovered by list) |
Resources
state(infinite)— Catalog-syncs resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/connectorsv2026.10.23.1connectors.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| activated? | boolean | |
| interrupt_window_days_of_week? | array | Allowed days of the week for upgrades. Default is all days. |
| interrupt_window_duration_hours? | number | |
| interrupt_window_embargo_dates? | array | List of dates (YYYY-MM-DD) when upgrades are blocked. |
| interrupt_window_hour_of_day? | number | |
| notes? | string | |
| timezone? | string | |
| provision_license? | boolean | When true, regenerate license key for the connector. |
| device? | object | Exactly one of id, serial_number, or provision_license must be provided. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Connectors
fn get(id: string)
Get a Connectors
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Connectors |
fn lookup(allowMissing?: boolean)
Look up an existing Connectors by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Connectors by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Connectors to import |
fn update(identifier?: string)
Update Connectors attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Connectors by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Connectors
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Connectors |
fn sync(identifier?: string)
Sync Connectors state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Connectors by id (e.g. one discovered by list) |
Resources
state(infinite)— Connectors resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/filter-profilesv2026.10.23.1filter_profiles.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| description? | string | Description of the filter profile |
| match_action? | enum | Action to take when a route matches one of the targets in this profile |
| name? | string | Friendly name for the filter profile |
| targets? | array | List of CIDR prefixes. Each entry may carry an optional suffix that specifies which prefix lengths to match relative to the prefix length N: '{X,Y}' matches prefix lengths in the inclusive range [X, Y] where N <= X <= Y <= max (max is 32 for IPv4, 128 for IPv6), '{X}' matches exactly length X (equivalent to {X,X}), '+' is shorthand for {N, max} (the prefix and all more-specific subnets, including at length N itself; valid even when N is the maximum length). Omit the suffix to match the prefix ex |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Filter Profiles
fn get(id: string)
Get a Filter Profiles
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Filter Profiles |
fn lookup(allowMissing?: boolean)
Look up an existing Filter Profiles by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Filter Profiles by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Filter Profiles to import |
fn update(identifier?: string)
Update Filter Profiles attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Filter Profiles by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Filter Profiles
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Filter Profiles |
fn sync(identifier?: string)
Sync Filter Profiles state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Filter Profiles by id (e.g. one discovered by list) |
Resources
state(infinite)— Filter Profiles resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/filtersv2026.10.23.1filters.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| expression? | string | The filter expression. |
| mode? | string | The filter's mode. Must be one of 'enabled', 'disabled', 'monitoring'. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Filters
fn get(id: string)
Get a Filters
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Filters |
fn lookup(allowMissing?: boolean)
Look up an existing Filters by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Filters by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Filters to import |
fn update(identifier?: string)
Update Filters attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Filters by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Filters
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Filters |
fn sync(identifier?: string)
Sync Filters state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Filters by id (e.g. one discovered by list) |
Resources
state(infinite)— Filters resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/filters-tcp_flow_protectionv2026.10.23.1filters_tcp_flow_protection.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| expression? | string | The filter expression. |
| mode? | string | The filter's mode. Must be one of 'enabled', 'disabled', 'monitoring'. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Filters
fn get(id: string)
Get a Filters
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Filters |
fn lookup(allowMissing?: boolean)
Look up an existing Filters by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Filters by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Filters to import |
fn update(identifier?: string)
Update Filters attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Filters by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Filters
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Filters |
fn sync(identifier?: string)
Sync Filters state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Filters by id (e.g. one discovered by list) |
Resources
state(infinite)— Filters resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/gre-tunnelsv2026.10.23.1gre_tunnels.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| automatic_return_routing? | boolean | True if automatic stateful return routing should be enabled for a tunnel, false otherwise. Requires the `coupler_integration` account flag to be enabled; requests setting this to `true` without that flag will be rejected. |
| cloudflare_gre_endpoint? | string | The IP address assigned to the Cloudflare side of the GRE tunnel. |
| customer_gre_endpoint? | string | The IP address assigned to the customer side of the GRE tunnel. |
| description? | string | An optional description of the GRE tunnel. |
| health_check? | object | |
| interface_address? | string | A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255. |
| interface_address6? | string | A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127 |
| mtu? | number | Maximum Transmission Unit (MTU) in bytes for the GRE tunnel. The minimum value is 576. |
| name? | string | The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel. |
| ttl? | number | Time To Live (TTL) in number of hops of the GRE tunnel. |
| bgp? | object | |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Gre Tunnels
fn get(id: string)
Get a Gre Tunnels
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Gre Tunnels |
fn lookup(allowMissing?: boolean)
Look up an existing Gre Tunnels by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Gre Tunnels by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Gre Tunnels to import |
fn update(identifier?: string)
Update Gre Tunnels attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Gre Tunnels by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Gre Tunnels
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Gre Tunnels |
fn sync(identifier?: string)
Sync Gre Tunnels state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Gre Tunnels by id (e.g. one discovered by list) |
Resources
state(infinite)— Gre Tunnels resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/ipsec-tunnelsv2026.10.23.1ipsec_tunnels.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| automatic_return_routing? | boolean | True if automatic stateful return routing should be enabled for a tunnel, false otherwise. Requires the `coupler_integration` account flag to be enabled; requests setting this to `true` without that flag will be rejected. |
| bgp? | object | |
| cloudflare_endpoint? | string | The IP address assigned to the Cloudflare side of the IPsec tunnel. |
| custom_remote_identities? | object | |
| customer_endpoint? | string | The IP address assigned to the customer side of the IPsec tunnel. Not required, but must be set for proactive traceroutes to work. |
| description? | string | An optional description forthe IPsec tunnel. |
| health_check? | object | |
| interface_address? | string | A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255. |
| interface_address6? | string | A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127 |
| name? | string | The name of the IPsec tunnel. The name cannot share a name with other tunnels. |
| psk? | string | A randomly generated or provided string for use in the IPsec tunnel. |
| replay_protection? | boolean | If `true`, then IPsec replay protection will be supported in the Cloudflare-to-customer direction. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Ipsec Tunnels
fn get(id: string)
Get a Ipsec Tunnels
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Ipsec Tunnels |
fn lookup(allowMissing?: boolean)
Look up an existing Ipsec Tunnels by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Ipsec Tunnels by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Ipsec Tunnels to import |
fn update(identifier?: string)
Update Ipsec Tunnels attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Ipsec Tunnels by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Ipsec Tunnels
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Ipsec Tunnels |
fn sync(identifier?: string)
Sync Ipsec Tunnels state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Ipsec Tunnels by id (e.g. one discovered by list) |
Resources
state(infinite)— Ipsec Tunnels resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/onrampsv2026.10.23.1onramps.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| attached_hubs? | array | |
| attached_vpcs? | array | |
| description? | string | |
| install_routes_in_cloud? | boolean | |
| install_routes_in_magic_wan? | boolean | |
| manage_hub_to_hub_attachments? | boolean | |
| manage_vpc_to_hub_attachments? | boolean | |
| name? | string | |
| vpc? | string | |
| adopted_hub_id? | string | |
| cloud_asn? | number | Sets the cloud-side ASN. If unset or zero, the cloud's default ASN takes effect. |
| cloud_type? | enum | |
| dynamic_routing? | boolean | Enables BGP routing. When enabling this feature, set both install_routes_in_cloud and install_routes_in_magic_wan to false. |
| hub_provider_id? | string | |
| region? | string | |
| type? | enum | |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Onramps
fn get(id: string)
Get a Onramps
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Onramps |
fn lookup(allowMissing?: boolean)
Look up an existing Onramps by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Onramps by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Onramps to import |
fn update(identifier?: string)
Update Onramps attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Onramps by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Onramps
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Onramps |
fn sync(identifier?: string)
Sync Onramps state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Onramps by id (e.g. one discovered by list) |
Resources
state(infinite)— Onramps resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/prefixesv2026.10.23.1prefixes.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| comment? | string | A comment describing the prefix. |
| excluded? | boolean | Whether to exclude the prefix from protection. |
| prefix? | string | The prefix to add in CIDR format. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Prefixes
fn get(id: string)
Get a Prefixes
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Prefixes |
fn lookup(allowMissing?: boolean)
Look up an existing Prefixes by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Prefixes by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Prefixes to import |
fn update(identifier?: string)
Update Prefixes attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Prefixes by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Prefixes
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Prefixes |
fn sync(identifier?: string)
Sync Prefixes state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Prefixes by id (e.g. one discovered by list) |
Resources
state(infinite)— Prefixes resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/providersv2026.10.23.1providers.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| aws_arn? | string | |
| azure_subscription_id? | string | |
| azure_tenant_id? | string | |
| description? | string | |
| friendly_name? | string | |
| gcp_project_id? | string | |
| gcp_service_account_email? | string | |
| cloud_type? | enum | |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Providers
fn get(id: string)
Get a Providers
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Providers |
fn lookup(allowMissing?: boolean)
Look up an existing Providers by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Providers by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Providers to import |
fn update(identifier?: string)
Update Providers attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Providers by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Providers
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Providers |
fn sync(identifier?: string)
Sync Providers state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Providers by id (e.g. one discovered by list) |
Resources
state(infinite)— Providers resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/redundancy-groupsv2026.10.23.1redundancy_groups.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| description? | string | Optional description |
| members? | array | Tunnels to add to the group |
| name? | string | Human-readable name for the redundancy group |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Redundancy Groups
fn get(id: string)
Get a Redundancy Groups
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Redundancy Groups |
fn lookup(allowMissing?: boolean)
Look up an existing Redundancy Groups by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Redundancy Groups by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Redundancy Groups to import |
fn update(identifier?: string)
Update Redundancy Groups attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Redundancy Groups by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Redundancy Groups
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Redundancy Groups |
fn sync(identifier?: string)
Sync Redundancy Groups state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Redundancy Groups by id (e.g. one discovered by list) |
Resources
state(infinite)— Redundancy Groups resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/routesv2026.10.23.1routes.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| description? | string | An optional human provided description of the static route. |
| nexthop? | string | The next-hop IP Address for the static route. |
| prefix? | string | IP Prefix in Classless Inter-Domain Routing format. |
| priority? | number | Priority of the static route. |
| scope? | object | Used only for ECMP routes. |
| weight? | number | Optional weight of the ECMP scope - if provided. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Routes
fn get(id: string)
Get a Routes
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Routes |
fn lookup(allowMissing?: boolean)
Look up an existing Routes by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Routes by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Routes to import |
fn update(identifier?: string)
Update Routes attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Routes by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Routes
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Routes |
fn sync(identifier?: string)
Sync Routes state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Routes by id (e.g. one discovered by list) |
Resources
state(infinite)— Routes resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/rulesv2026.10.23.1rules.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| block_any_queries? | boolean | Whether to block DNS ANY queries. Optional. Defaults to true. |
| burst_sensitivity? | string | The burst sensitivity. Must be one of 'low', 'medium', 'high'. |
| mode? | string | The mode for DNS Protection. Must be one of 'enabled', 'disabled', 'monitoring'. |
| profile_sensitivity? | string | The profile sensitivity. Recommended setting is 'low'. Must be one of 'low', 'medium', 'high', or 'very_high'. |
| rate_sensitivity? | string | The rate sensitivity. Must be one of 'low', 'medium', 'high'. |
| name? | string | The name of the DNS Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'. |
| scope? | string | The scope for the DNS Protection rule. Must be one of 'global', 'region', or 'datacenter'. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Rules
fn get(id: string)
Get a Rules
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Rules |
fn lookup(allowMissing?: boolean)
Look up an existing Rules by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Rules by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Rules to import |
fn update(identifier?: string)
Update Rules attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Rules by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Rules
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Rules |
fn sync(identifier?: string)
Sync Rules state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Rules by id (e.g. one discovered by list) |
Resources
state(infinite)— Rules resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/rules-syn_protectionv2026.10.23.1rules_syn_protection.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| burst_sensitivity? | string | The burst sensitivity. Must be one of 'low', 'medium', 'high'. |
| mitigation_type? | string | The type of mitigation. Must be one of 'challenge' or 'retransmit'. Optional. Defaults to 'challenge'. |
| mode? | string | The mode for SYN Protection. Must be one of 'enabled', 'disabled', 'monitoring'. |
| rate_sensitivity? | string | The rate sensitivity. Must be one of 'low', 'medium', 'high'. |
| name? | string | The name of the SYN Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'. |
| scope? | string | The scope for the SYN Protection rule. Must be one of 'global', 'region', or 'datacenter'. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Rules
fn get(id: string)
Get a Rules
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Rules |
fn lookup(allowMissing?: boolean)
Look up an existing Rules by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Rules by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Rules to import |
fn update(identifier?: string)
Update Rules attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Rules by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Rules
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Rules |
fn sync(identifier?: string)
Sync Rules state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Rules by id (e.g. one discovered by list) |
Resources
state(infinite)— Rules resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/rules-tcp_flow_protectionv2026.10.23.1rules_tcp_flow_protection.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| burst_sensitivity? | string | The burst sensitivity. Must be one of 'low', 'medium', 'high'. |
| mode? | string | The mode for the TCP Flow Protection. Must be one of 'enabled', 'disabled', 'monitoring'. |
| rate_sensitivity? | string | The rate sensitivity. Must be one of 'low', 'medium', 'high'. |
| name? | string | The name of the TCP Flow Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'. |
| scope? | string | The scope for the TCP Flow Protection rule. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Rules
fn get(id: string)
Get a Rules
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Rules |
fn lookup(allowMissing?: boolean)
Look up an existing Rules by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Rules by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Rules to import |
fn update(identifier?: string)
Update Rules attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Rules by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Rules
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Rules |
fn sync(identifier?: string)
Sync Rules state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Rules by id (e.g. one discovered by list) |
Resources
state(infinite)— Rules resource state
lookupResult(infinite)— Outcome of the most recent lookup
@swamp/cloudflare/magic/sitesv2026.10.23.1sites.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| account_id | string | Cloudflare account ID |
| connector_id? | string | Magic Connector identifier tag. |
| description? | string | |
| ha_mode? | boolean | Site high availability mode. If set to true, the site can have two connectors and runs in high availability mode. |
| location? | object | Location of site in latitude and longitude. |
| name? | string | The name of the site. |
| secondary_connector_id? | string | Magic Connector identifier tag. Used when high availability mode is on. |
| apiToken? | string | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| apiKey? | string | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
| email? | string | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
fn create()
Create a Sites
fn get(id: string)
Get a Sites
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Sites |
fn lookup(allowMissing?: boolean)
Look up an existing Sites by matching global argument values and import it into state
| Argument | Type | Description |
|---|---|---|
| allowMissing? | boolean | Succeed and record found: false in lookupResult when nothing matches, instead of failing |
fn adopt(id: string)
Import an existing Sites by ID into state for management
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Sites to import |
fn update(identifier?: string)
Update Sites attributes
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Sites by id (e.g. one discovered by list) |
fn delete(id: string)
Delete the Sites
| Argument | Type | Description |
|---|---|---|
| id | string | The ID of the Sites |
fn sync(identifier?: string)
Sync Sites state from Cloudflare
| Argument | Type | Description |
|---|---|---|
| identifier? | string | Target a specific Sites by id (e.g. one discovered by list) |
Resources
state(infinite)— Sites resource state
lookupResult(infinite)— Outcome of the most recent lookup
04Previous Versions
2026.10.20.1AGPL-3.0-or-later
- Updated: rules
- Updated: allowlist
- Updated: prefixes
- Updated: filters
- Updated: rules_syn_protection
- Updated: filters_tcp_flow_protection
- Updated: rules_tcp_flow_protection
- Updated: filter_profiles
- Updated: catalog-syncs
- Updated: onramps
- Updated: providers
- Updated: connectors
- Updated: gre_tunnels
- Updated: ipsec_tunnels
- Updated: redundancy_groups
- Updated: routes
- Updated: sites
Modified 17 behaviors
2026.10.16.1AGPL-3.0-or-later(was none)
2026.10.13.1
- Updated: rules
- Updated: allowlist
- Updated: prefixes
- Updated: filters
- Updated: rules_syn_protection
- Updated: filters_tcp_flow_protection
- Updated: rules_tcp_flow_protection
- Updated: filter_profiles
- Updated: catalog-syncs
- Updated: onramps
- Updated: providers
- Updated: connectors
- Updated: gre_tunnels
- Updated: ipsec_tunnels
- Updated: redundancy_groups
- Updated: routes
- Updated: sites
2026.09.29.2
- Updated: filter_profiles
- Updated: gre_tunnels
- Updated: ipsec_tunnels
- Updated: redundancy_groups
- Updated: routes
2026.09.29.1
- Updated: rules
- Updated: allowlist
- Updated: prefixes
- Updated: filters
- Updated: rules_syn_protection
- Updated: filters_tcp_flow_protection
- Updated: rules_tcp_flow_protection
- Updated: filter_profiles
- Updated: catalog-syncs
- Updated: onramps
- Updated: providers
- Updated: connectors
- Updated: gre_tunnels
- Updated: ipsec_tunnels
- Updated: redundancy_groups
- Updated: routes
- Updated: sites
2026.09.23.1
- Updated: connectors
2026.08.25.2
- Updated: rules
- Added: filter_profiles
- Updated: connectors
- Updated: gre_tunnels
- Updated: ipsec_tunnels
Added 1 behaviors
2026.08.25.1
- Updated: rules
- Updated: connectors
- Updated: gre_tunnels
- Updated: ipsec_tunnels
Removed 1 behaviors
2026.07.24.1
- Updated: rules
2026.07.21.1
- Updated: rules
- Updated: allowlist
- Updated: prefixes
- Updated: filters
- Updated: rules_syn_protection
- Updated: filters_tcp_flow_protection
- Updated: rules_tcp_flow_protection
- Updated: filter_profiles
- Updated: catalog-syncs
- Updated: onramps
- Updated: providers
- Updated: connectors
- Updated: gre_tunnels
- Updated: ipsec_tunnels
- Updated: redundancy_groups
- Updated: routes
- Updated: sites
2026.07.18.2
Modified 17 behaviors
2026.06.24.1
- Added: filter_profiles
- Updated: connectors
- Updated: gre_tunnels
- Updated: ipsec_tunnels
Added 17, removed 1 behaviors
2026.06.08.2
- Updated: rules
- Updated: allowlist
- Updated: prefixes
- Updated: filters
- Updated: rules_syn_protection
- Updated: filters_tcp_flow_protection
- Updated: rules_tcp_flow_protection
- Updated: catalog-syncs
- Updated: onramps
- Updated: providers
- Updated: connectors
- Updated: gre_tunnels
- Updated: ipsec_tunnels
- Updated: redundancy_groups
- Updated: routes
- Updated: sites
2026.05.29.1
- Updated: rules
- Updated: allowlist
- Updated: prefixes
- Updated: filters
- Updated: rules_syn_protection
- Updated: filters_tcp_flow_protection
- Updated: rules_tcp_flow_protection
- Updated: catalog-syncs
- Updated: onramps
- Updated: providers
- Updated: connectors
- Updated: gre_tunnels
- Updated: ipsec_tunnels
- Updated: redundancy_groups
- Updated: routes
- Updated: sites
2026.05.22.1
- Added: rules
- Added: allowlist
- Added: prefixes
- Added: filters
- Added: rules_syn_protection
- Added: filters_tcp_flow_protection
- Added: rules_tcp_flow_protection
- Added: catalog-syncs
- Added: onramps
- Added: providers
- Added: connectors
- Added: gre_tunnels
- Added: ipsec_tunnels
- Added: redundancy_groups
- Added: routes
- Added: sites
05Stats
A
100 / 100
Downloads
25
Archive size
54.3 KB
Verified by Swamp
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Docs keep secrets in a vault1/1earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License2/2earned
- Verified public repository2/2earned
06Platforms
07Labels