Cloudflare/access

@webframp/cloudflare/accessv2026.08.21.1· 1d agoMODELS

01README

Cloudflare Access (Zero Trust) — applications, policies, identity providers, certificates

02Release Notes

2026.08.21.1

Changed: Error messages for API failures and invalid input are now specific instead of generic.

Every method that calls the Cloudflare API now wraps failures with the operation attempted and the account/identifier involved (e.g. app_id, user_id, identity_provider_id, service_token_id, certificate_id, policy_id, group_id, custom_page_id), instead of surfacing the raw SDK error with no context.
Methods that take an app_id, user_id, id, identity_provider_id, service_token_id, certificate_id, tag_name, policy_id, group_id, custom_page_id, policy_test_id, hostname, nonce, or authenticator_id now reject an empty value up front with a clear validation error, instead of sending a malformed request to the Cloudflare API.

Upgrade note: No behavioral change for valid requests. Callers passing an empty identifier will now get an immediate, descriptive validation error instead of a Cloudflare API failure.

03Models1

cloudflare/access.tsv2026.08.21.1

Global Arguments

Argument	Type	Required	Description
apiToken	string	yes	Cloudflare API token
accountId	string	yes	Cloudflare account ID

fn list_portals(page?: number, per_page?: number, search?: string)

List MCP Portals

Argument	Type	Required
page?	number	no
per_page?	number	no
search?	string	no

fn create_portals(allow_code_mode?: boolean, description?: string, hostname: string, name: string, secure_web_gateway?: boolean, servers?: array)

Create a new MCP Portal

Argument	Type	Required	Description
allow_code_mode?	boolean	no	Allow remote code execution in Dynamic Workers (beta)
description?	string	no
hostname	string	yes
name	string	yes
secure_web_gateway?	boolean	no	Route outbound MCP traffic through Zero Trust Secure Web Gateway
servers?	array	no

fn get_mcp_portals_api_fetch_gateways(id: string)

Read details of an MCP Portal

Argument	Type	Required	Description
id	string	yes

fn update_portals(id: string, allow_code_mode?: boolean, description?: string, hostname?: string, name?: string, secure_web_gateway?: boolean, servers?: array)

Update a MCP Portal

Argument	Type	Required	Description
id	string	yes
allow_code_mode?	boolean	no	Allow remote code execution in Dynamic Workers (beta)
description?	string	no
hostname?	string	no
name?	string	no
secure_web_gateway?	boolean	no	Route outbound MCP traffic through Zero Trust Secure Web Gateway
servers?	array	no

fn delete_portals(id: string)

Delete a MCP Portal

Argument	Type	Required	Description
id	string	yes

fn list_servers(page?: number, per_page?: number, search?: string)

List MCP Servers

Argument	Type	Required
page?	number	no
per_page?	number	no
search?	string	no

fn create_servers(auth_credentials?: string, auth_type: enum, description?: string, hostname: string, is_shared_oauth_callback_enabled?: boolean, name: string, secure_web_gateway?: boolean, updated_prompts?: array, updated_tools?: array)

Create a new MCP Server

Argument	Type	Required	Description
auth_credentials?	string	no
auth_type	enum	yes
description?	string	no
hostname	string	yes
is_shared_oauth_callback_enabled?	boolean	no	When true, the gateway worker uses the shared Cloudflare-owned OAuth callback...
name	string	yes
secure_web_gateway?	boolean	no	Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
updated_prompts?	array	no
updated_tools?	array	no

fn get_mcp_portals_api_fetch_servers(id: string)

Read the details of a MCP Server

Argument	Type	Required	Description
id	string	yes

fn update_servers(id: string, auth_credentials?: string, description?: string, is_shared_oauth_callback_enabled?: boolean, name?: string, secure_web_gateway?: boolean, updated_prompts?: array, updated_tools?: array)

Update a MCP Server

Argument	Type	Required	Description
id	string	yes
auth_credentials?	string	no
description?	string	no
is_shared_oauth_callback_enabled?	boolean	no	When true, the gateway worker uses the shared Cloudflare-owned OAuth callback...
name?	string	no
secure_web_gateway?	boolean	no	Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
updated_prompts?	array	no
updated_tools?	array	no

fn delete_servers(id: string)

Delete a MCP Server

Argument	Type	Required	Description
id	string	yes

fn mcp_portals_api_sync_server(id: string)

Sync MCP Server Capabilities

Argument	Type	Required	Description
id	string	yes

fn list_access_applications(name?: string, domain?: string, aud?: string, target_attributes?: string, exact?: boolean, search?: string)

List Access applications

Argument	Type	Required
name?	string	no
domain?	string	no
aud?	string	no
target_attributes?	string	no
exact?	boolean	no
search?	string	no

fn access_applications_add_an_application()

Add an Access application

fn list_short_lived_certificate_c_as(per_page?: number)

List short-lived certificate CAs

Argument	Type	Required	Description
per_page?	number	no

fn get_an_access_application(app_id: string)

Get an Access application

Argument	Type	Required	Description
app_id	string	yes

fn update_an_access_application(app_id: string)

Update an Access application

Argument	Type	Required	Description
app_id	string	yes

fn delete_an_access_application(app_id: string)

Delete an Access application

Argument	Type	Required	Description
app_id	string	yes

fn get_a_short_lived_certificate_ca(app_id: string)

Get a short-lived certificate CA

Argument	Type	Required	Description
app_id	string	yes

fn create_a_short_lived_certificate_ca(app_id: string)

Create a short-lived certificate CA

Argument	Type	Required	Description
app_id	string	yes

fn delete_a_short_lived_certificate_ca(app_id: string)

Delete a short-lived certificate CA

Argument	Type	Required	Description
app_id	string	yes

fn list_access_app_policies(app_id: string, per_page?: number)

List Access application policies

Argument	Type	Required	Description
app_id	string	yes	The application ID.
per_page?	number	no

fn create_an_access_policy(app_id: string, precedence?: unknown, decision: unknown, exclude?: unknown, include: unknown, name: unknown, require?: unknown)

Create an Access application policy

Argument	Type	Required	Description
app_id	string	yes	The application ID.
precedence?	unknown	no
decision	unknown	yes
exclude?	unknown	no
include	unknown	yes
name	unknown	yes
require?	unknown	no

fn get_an_access_policy(app_id: string, policy_id: string)

Get an Access application policy

Argument	Type	Required	Description
app_id	string	yes	The application ID.
policy_id	string	yes	The policy ID.

fn update_an_access_policy(app_id: string, policy_id: string, precedence?: unknown, decision: unknown, exclude?: unknown, include: unknown, name: unknown, require?: unknown)

Update an Access application policy

Argument	Type	Required	Description
app_id	string	yes	The application ID.
policy_id	string	yes	The policy ID.
precedence?	unknown	no
decision	unknown	yes
exclude?	unknown	no
include	unknown	yes
name	unknown	yes
require?	unknown	no

fn delete_an_access_policy(app_id: string, policy_id: string)

Delete an Access application policy

Argument	Type	Required	Description
app_id	string	yes	The application ID.
policy_id	string	yes	The policy ID.

fn update_access_policies_convert_reusable(app_id: string, policy_id: string)

Convert an Access application policy to a reusable policy

Argument	Type	Required	Description
app_id	string	yes	The application ID.
policy_id	string	yes	The policy ID.

fn access_applications_revoke_service_tokens(app_id: string)

Revoke application tokens

Argument	Type	Required	Description
app_id	string	yes

fn update_access_application_settings(app_id: string, allow_iframe?: unknown, skip_interstitial?: unknown)

Update Access application settings

Argument	Type	Required
app_id	string	yes
allow_iframe?	unknown	no
skip_interstitial?	unknown	no

fn get_access_applications_test_access_policies(app_id: string)

Test Access policies

Argument	Type	Required	Description
app_id	string	yes

fn list()

List authenticator device AAGUIDs

fn list_mtls_certificates(per_page?: number)

List mTLS certificates

Argument	Type	Required	Description
per_page?	number	no

fn create_access_mtls_authentication_add_an_mtls_certificate(associated_hostnames?: unknown, certificate: string, name: unknown)

Add an mTLS certificate

Argument	Type	Required	Description
associated_hostnames?	unknown	no
certificate	string	yes	The certificate content.
name	unknown	yes

fn list_mtls_certificates_hostname_settings()

List all mTLS hostname settings

fn update_an_mtls_certificate_settings(settings: array)

Update an mTLS certificate

Argument	Type	Required	Description
settings	array	yes

fn get_an_mtls_certificate(certificate_id: string)

Get an mTLS certificate

Argument	Type	Required	Description
certificate_id	string	yes

fn update_an_mtls_certificate(certificate_id: string, associated_hostnames: unknown, name?: unknown)

Update an mTLS certificate

Argument	Type	Required
certificate_id	string	yes
associated_hostnames	unknown	yes
name?	unknown	no

fn delete_an_mtls_certificate(certificate_id: string)

Delete an mTLS certificate

Argument	Type	Required	Description
certificate_id	string	yes

fn list_custom_pages(per_page?: number)

List custom pages

Argument	Type	Required	Description
per_page?	number	no

fn create_a_custom_page(app_count?: unknown, created_at?: unknown, custom_html: string, name: unknown, type: unknown, uid?: unknown, updated_at?: unknown)

Create a custom page

Argument	Type	Required	Description
app_count?	unknown	no
created_at?	unknown	no
custom_html	string	yes	Custom page HTML.
name	unknown	yes
type	unknown	yes
uid?	unknown	no
updated_at?	unknown	no

fn get_a_custom_page(custom_page_id: string)

Get a custom page

Argument	Type	Required	Description
custom_page_id	string	yes

fn update_a_custom_page(custom_page_id: string, app_count?: unknown, created_at?: unknown, custom_html: string, name: unknown, type: unknown, uid?: unknown, updated_at?: unknown)

Update a custom page

Argument	Type	Required	Description
custom_page_id	string	yes
app_count?	unknown	no
created_at?	unknown	no
custom_html	string	yes	Custom page HTML.
name	unknown	yes
type	unknown	yes
uid?	unknown	no
updated_at?	unknown	no

fn delete_a_custom_page(custom_page_id: string)

Delete a custom page

Argument	Type	Required	Description
custom_page_id	string	yes

fn list_ssh_ca()

List SSH Certificate Authorities (CA)

fn access_gateway_ca_add_an_ssh_ca()

Add a new SSH Certificate Authority (CA)

fn delete_an_ssh_ca(certificate_id: string)

Delete an SSH Certificate Authority (CA)

Argument	Type	Required	Description
certificate_id	string	yes

fn list_access_groups(name?: string, search?: string)

List Access groups

Argument	Type	Required	Description
name?	string	no
search?	string	no

fn create_an_access_group(exclude?: unknown, include: unknown, is_default?: unknown, name: unknown, require?: unknown)

Create an Access group

Argument	Type	Required
exclude?	unknown	no
include	unknown	yes
is_default?	unknown	no
name	unknown	yes
require?	unknown	no

fn get_an_access_group(group_id: string)

Get an Access group

Argument	Type	Required	Description
group_id	string	yes

fn update_an_access_group(group_id: string, exclude?: unknown, include: unknown, is_default?: unknown, name: unknown, require?: unknown)

Update an Access group

Argument	Type	Required
group_id	string	yes
exclude?	unknown	no
include	unknown	yes
is_default?	unknown	no
name	unknown	yes
require?	unknown	no

fn delete_an_access_group(group_id: string)

Delete an Access group

Argument	Type	Required	Description
group_id	string	yes

fn list_access_identity_providers(scim_enabled?: string, per_page?: number)

List Access identity providers

Argument	Type	Required	Description
scim_enabled?	string	no
per_page?	number	no

fn access_identity_providers_add_an_access_identity_provider()

Add an Access identity provider

fn get_an_access_identity_provider(identity_provider_id: string)

Get an Access identity provider

Argument	Type	Required	Description
identity_provider_id	string	yes

fn update_an_access_identity_provider(identity_provider_id: string)

Update an Access identity provider

Argument	Type	Required	Description
identity_provider_id	string	yes

fn delete_an_access_identity_provider(identity_provider_id: string)

Delete an Access identity provider

Argument	Type	Required	Description
identity_provider_id	string	yes

fn create_saml_certificate_for_identity_provider(identity_provider_id: string)

Create SAML encryption certificate for Identity Provider

Argument	Type	Required	Description
identity_provider_id	string	yes

fn list_scim_group_resources(identity_provider_id: string, cf_resource_id?: string, idp_resource_id?: string, name?: string, per_page?: number)

List SCIM Group resources

Argument	Type	Required
identity_provider_id	string	yes
cf_resource_id?	string	no
idp_resource_id?	string	no
name?	string	no
per_page?	number	no

fn list_scim_user_resources(identity_provider_id: string, cf_resource_id?: string, idp_resource_id?: string, username?: string, email?: string, name?: string, per_page?: number)

List SCIM User resources

Argument	Type	Required
identity_provider_id	string	yes
cf_resource_id?	string	no
idp_resource_id?	string	no
username?	string	no
email?	string	no
name?	string	no
per_page?	number	no

fn create(idp_id: string)

Create an IdP federation grant

Argument	Type	Required	Description
idp_id	string	yes	UID of the identity provider to federate. Must be an existing identity provid...

fn get(grant_id: string)

Get an IdP federation grant

Argument	Type	Required	Description
grant_id	string	yes	UID of the IdP federation grant.

fn delete(grant_id: string)

Delete an IdP federation grant

Argument	Type	Required	Description
grant_id	string	yes	UID of the IdP federation grant.

fn get_the_access_key_configuration()

Get the Access key configuration

fn update_the_access_key_configuration(key_rotation_interval_days: unknown)

Update the Access key configuration

Argument	Type	Required	Description
key_rotation_interval_days	unknown	yes

fn access_key_configuration_rotate_access_keys()

Rotate Access keys

fn get_access_authentication_logs(limit?: number, direction?: enum, since?: string, until?: string, per_page?: number, email?: string, email_exact?: boolean, user_id?: string, allowedOp?: enum, country_codeOp?: enum, app_typeOp?: enum, app_uidOp?: enum, ray_idOp?: enum, emailOp?: enum, idpOp?: enum, non_identityOp?: enum, user_idOp?: enum, fields?: string)

Get Access authentication logs

Argument	Type	Required	Description
limit?	number	no	The maximum number of log entries to retrieve.
direction?	enum	no	The chronological sorting order for the logs.
since?	string	no	The earliest event timestamp to query.
until?	string	no	The latest event timestamp to query.
per_page?	number	no
email?	string	no	Filter by user email. Match mode is controlled by `emailOp` (preferred) or the legacy `email_exact` flag. - Default (no `emailOp`, `email_exact=false` or unset): substring match — `email=@example.com` returns all events with that domain. - Exact match: set `emailOp=eq` (preferred) or `email_exact=true` — e.g. `email=user@example.com&email_exact=true` returns only that user. - Explicit substring match: set `emailOp=contains` (without `email_exact=true`). When both are set, `email_exact=true` takes precedence and the match is exact. - Exclusion: set `emailOp=neq`. With `email_exact=true` this is an exact-value exclusion; without it, a fuzzy substring exclusion.
email_exact?	boolean	no	When true, `email` is matched exactly instead of substring matching.
user_id?	string	no	Deprecated. Accepted for backward compatibility but no longer applied as a filter. Use `email` instead.
allowedOp?	enum	no	Operator for the `allowed` filter.
country_codeOp?	enum	no	Operator for the `country_code` filter.
app_typeOp?	enum	no	Operator for the `app_type` filter.
app_uidOp?	enum	no	Operator for the `app_uid` filter.
ray_idOp?	enum	no	Operator for the `ray_id` filter.
emailOp?	enum	no	Operator for the `email` filter. `contains` performs a substring (case-sensitive) match. When `email_exact=true` is also set, `email_exact` takes precedence and `contains` is ignored.
idpOp?	enum	no	Operator for the `idp` filter.
non_identityOp?	enum	no	Operator for the `non_identity` filter.
user_idOp?	enum	no	Deprecated. Accepted for backward compatibility but no longer applied as a filter (the `user_id` parameter is itself deprecated).
fields?	string	no	Comma-separated list of fields to include in the response. When omitted, all fields are returned.

fn list_access_scim_update_logs(limit?: string, direction?: string, since?: string, until?: string, idp_id?: string, status?: string, resource_type?: string, request_method?: string, resource_user_email?: string, resource_group_name?: string, cf_resource_id?: string, idp_resource_id?: string, per_page?: number)

List Access SCIM update logs

Argument	Type	Required
limit?	string	no
direction?	string	no
since?	string	no
until?	string	no
idp_id?	string	no
status?	string	no
resource_type?	string	no
request_method?	string	no
resource_user_email?	string	no
resource_group_name?	string	no
cf_resource_id?	string	no
idp_resource_id?	string	no
per_page?	number	no

fn get_your_zero_trust_organization()

Get your Zero Trust organization

fn create_your_zero_trust_organization(allow_authenticate_via_warp?: unknown, auth_domain: unknown, auto_redirect_to_identity?: unknown, deny_unmatched_requests?: unknown, deny_unmatched_requests_exempted_zone_names?: unknown, is_ui_read_only?: unknown, login_design?: unknown, mfa_config?: unknown, mfa_piv_key_requirements?: unknown, mfa_required_for_all_apps?: unknown, name: unknown, session_duration?: unknown, ui_read_only_toggle_reason?: unknown, user_seat_expiration_inactive_time?: unknown, warp_auth_session_duration?: unknown)

Create your Zero Trust organization

Argument	Type	Required
allow_authenticate_via_warp?	unknown	no
auth_domain	unknown	yes
auto_redirect_to_identity?	unknown	no
deny_unmatched_requests?	unknown	no
deny_unmatched_requests_exempted_zone_names?	unknown	no
is_ui_read_only?	unknown	no
login_design?	unknown	no
mfa_config?	unknown	no
mfa_piv_key_requirements?	unknown	no
mfa_required_for_all_apps?	unknown	no
name	unknown	yes
session_duration?	unknown	no
ui_read_only_toggle_reason?	unknown	no
user_seat_expiration_inactive_time?	unknown	no
warp_auth_session_duration?	unknown	no

fn update_your_zero_trust_organization(allow_authenticate_via_warp?: unknown, auth_domain?: unknown, auto_redirect_to_identity?: unknown, custom_pages?: unknown, deny_unmatched_requests?: unknown, deny_unmatched_requests_exempted_zone_names?: unknown, is_ui_read_only?: unknown, login_design?: unknown, mfa_config?: unknown, mfa_piv_key_requirements?: unknown, mfa_required_for_all_apps?: unknown, name?: unknown, session_duration?: unknown, ui_read_only_toggle_reason?: unknown, user_seat_expiration_inactive_time?: unknown, warp_auth_session_duration?: unknown)

Update your Zero Trust organization

Argument	Type	Required
allow_authenticate_via_warp?	unknown	no
auth_domain?	unknown	no
auto_redirect_to_identity?	unknown	no
custom_pages?	unknown	no
deny_unmatched_requests?	unknown	no
deny_unmatched_requests_exempted_zone_names?	unknown	no
is_ui_read_only?	unknown	no
login_design?	unknown	no
mfa_config?	unknown	no
mfa_piv_key_requirements?	unknown	no
mfa_required_for_all_apps?	unknown	no
name?	unknown	no
session_duration?	unknown	no
ui_read_only_toggle_reason?	unknown	no
user_seat_expiration_inactive_time?	unknown	no
warp_auth_session_duration?	unknown	no

fn get_your_zero_trust_organization_doh_settings()

Get your Zero Trust organization DoH settings

fn update_your_zero_trust_organization_doh_settings(doh_jwt_duration?: unknown, service_token_id?: string)

Update your Zero Trust organization DoH settings

Argument	Type	Required	Description
doh_jwt_duration?	unknown	no
service_token_id?	string	no	The uuid of the service token you want to use for DoH authentication

fn create_zero_trust_organization_revoke_all_access_tokens_for_a_user(devices?: boolean, email: string, user_uid?: string, warp_session_reauth?: boolean)

Revoke all Access tokens for a user

Argument	Type	Required	Description
devices?	boolean	no	When set to `true`, all devices associated with the user will be revoked.
email	string	yes	The email of the user to revoke.
user_uid?	string	no	The uuid of the user to revoke.
warp_session_reauth?	boolean	no	When set to `true`, the user will be required to re-authenticate to WARP for ...

fn list_access_reusable_policies(per_page?: number)

List Access reusable policies

Argument	Type	Required	Description
per_page?	number	no

fn create_an_access_reusable_policy(decision: unknown, exclude?: unknown, include: unknown, name: unknown, require?: unknown)

Create an Access reusable policy

Argument	Type	Required
decision	unknown	yes
exclude?	unknown	no
include	unknown	yes
name	unknown	yes
require?	unknown	no

fn get_an_access_reusable_policy(policy_id: string)

Get an Access reusable policy

Argument	Type	Required	Description
policy_id	string	yes

fn update_an_access_reusable_policy(policy_id: string, decision: unknown, exclude?: unknown, include: unknown, name: unknown, require?: unknown)

Update an Access reusable policy

Argument	Type	Required
policy_id	string	yes
decision	unknown	yes
exclude?	unknown	no
include	unknown	yes
name	unknown	yes
require?	unknown	no

fn delete_an_access_reusable_policy(policy_id: string)

Delete an Access reusable policy

Argument	Type	Required	Description
policy_id	string	yes

fn create_access_policy_tests(policies?: array)

Start Access policy test

Argument	Type	Required	Description
policies?	array	no

fn get_an_update(policy_test_id: string)

Get the current status of a given Access policy test

Argument	Type	Required	Description
policy_test_id	string	yes

fn get_a_user_page(policy_test_id: string, per_page?: number, status?: enum)

Get an Access policy test users page

Argument	Type	Required	Description
policy_test_id	string	yes
per_page?	number	no
status?	enum	no	Filter users by their policy evaluation status.

fn list_certificate_sets(page?: number, per_page?: number, id?: string)

List SAML certificate sets

Argument	Type	Required	Description
page?	number	no	Page number of paginated results.
per_page?	number	no	Maximum number of results per page.
id?	string	no	Filter by SAML certificate set UID. Accepts a comma-separated list of UIDs.

fn get_certificate_set(saml_cert_set_id: string)

Get SAML certificate set

Argument	Type	Required	Description
saml_cert_set_id	string	yes	UID of the SAML certificate set.

fn access_saml_certificates_rotate_certificate(saml_cert_set_id: string)

Rotate SAML certificate

Argument	Type	Required	Description
saml_cert_set_id	string	yes	UID of the SAML certificate set to rotate.

fn update_a_user_seat()

Update a user seat

fn list_service_tokens(name?: string, search?: string)

List service tokens

Argument	Type	Required	Description
name?	string	no
search?	string	no

fn create_a_service_token(client_secret_version?: unknown, duration?: unknown, name: unknown, previous_client_secret_expires_at?: unknown)

Create a service token

Argument	Type	Required
client_secret_version?	unknown	no
duration?	unknown	no
name	unknown	yes
previous_client_secret_expires_at?	unknown	no

fn get_a_service_token(service_token_id: string)

Get a service token

Argument	Type	Required	Description
service_token_id	string	yes

fn update_a_service_token(service_token_id: string, client_secret_version?: unknown, duration?: unknown, name?: unknown, previous_client_secret_expires_at?: unknown)

Update a service token

Argument	Type	Required
service_token_id	string	yes
client_secret_version?	unknown	no
duration?	unknown	no
name?	unknown	no
previous_client_secret_expires_at?	unknown	no

fn delete_a_service_token(service_token_id: string)

Delete a service token

Argument	Type	Required	Description
service_token_id	string	yes

fn access_service_tokens_refresh_a_service_token(service_token_id: string)

Refresh a service token

Argument	Type	Required	Description
service_token_id	string	yes

fn create_access_service_tokens_rotate_a_service_token(service_token_id: string, previous_client_secret_expires_at?: string)

Rotate a service token

Argument	Type	Required	Description
service_token_id	string	yes
previous_client_secret_expires_at?	string	no	The expiration of the previous `client_secret`. If not provided, it defaults ...

fn list_tags(per_page?: number)

List tags

Argument	Type	Required	Description
per_page?	number	no

fn create_tag(name?: unknown)

Create a tag

Argument	Type	Required	Description
name?	unknown	no

fn get_a_tag(tag_name: string)

Get a tag

Argument	Type	Required	Description
tag_name	string	yes

fn update_a_tag(tag_name: string, created_at?: unknown, name: unknown, updated_at?: unknown)

Update a tag

Argument	Type	Required
tag_name	string	yes
created_at?	unknown	no
name	unknown	yes
updated_at?	unknown	no

fn delete_a_tag(tag_name: string)

Delete a tag

Argument	Type	Required	Description
tag_name	string	yes

fn get_users(name?: string, email?: string, search?: string)

Get users

Argument	Type	Required
name?	string	no
email?	string	no
search?	string	no

fn create_user(email: unknown, name?: unknown)

Create a user

Argument	Type	Required	Description
email	unknown	yes
name?	unknown	no

fn get_user(user_id: string)

Get a user

Argument	Type	Required	Description
user_id	string	yes

fn update_user(user_id: string, email: unknown, name: unknown)

Update a user

Argument	Type	Required
user_id	string	yes
email	unknown	yes
name	unknown	yes

fn delete_user(user_id: string)

Delete a user

Argument	Type	Required	Description
user_id	string	yes

fn get_active_sessions(user_id: string)

Get active sessions

Argument	Type	Required	Description
user_id	string	yes

fn get_active_session(user_id: string, nonce: string)

Get single active session

Argument	Type	Required	Description
user_id	string	yes
nonce	string	yes

fn get_failed_logins(user_id: string)

Get failed logins

Argument	Type	Required	Description
user_id	string	yes

fn get_last_seen_identity(user_id: string)

Get last seen identity

Argument	Type	Required	Description
user_id	string	yes

fn delete_mfa_authenticator(user_id: string, authenticator_id: string)

Delete a user

Argument	Type	Required	Description
user_id	string	yes
authenticator_id	string	yes

04Previous Versions2

2026.07.27.1Jul 27, 2026

2026.07.27.1

Fixed: Regenerated from scripts/cloudflare-codegen after two generator bugs were repaired (webframp/swamp-extensions#284).

Methods referencing an undeclared path parameter did not compile. The generator derived a method's arguments schema and execute signature from the OpenAPI parameters list, but built the request URL from the path template. Where the Cloudflare spec omits a declaration for a {placeholder} — which it does in several places — the result was a method with arguments: z.object({}) and an unused _args parameter whose body still interpolated args.<name>. Those methods failed type checking and were uncallable even if they had compiled, because the argument was never declared. Path-template placeholders are now unioned into the declared parameters, so the schema, the signature, and the body agree.
Generated tests could request a URL the mock server did not serve. Test arguments merged the request-body fixture over the path-parameter values, so a body property sharing a name with a path parameter (commonly id) substituted its own example value into the URL. The request then missed the mock and failed with Cloudflare API error: Not found. Path parameters now take precedence, matching what the generated model already does by excluding path-parameter names from the request body.

Upgrade note: No API surface change and no method was added or removed. If this extension type-checked and tested cleanly before, its behavior is unchanged and only the version moved. Extensions that previously failed deno check or deno task test now pass.

2026.07.19.1Jul 19, 2026