Cloudflare/gateway

@webframp/cloudflare/gatewayv2026.09.18.1· 17d agoMODELS

01README

Cloudflare Gateway — DNS/HTTP policies, locations, proxy endpoints

02Release Notes

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

03Models1

@webframp/cloudflare/gatewayv2026.09.18.1cloudflare/gateway.ts

Global Arguments

Argument	Type	Required	Description
apiToken?	string	no	Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
accountId	string	yes	Cloudflare account ID

fn get_zero_trust_account_information()

Get Zero Trust account information

fn create_zero_trust_account()

Create Zero Trust account

fn list_application_and_application_type_mappings()

List application and application type mappings

fn list()

List applications review statuses

fn update(approved_apps: unknown, in_review_apps: unknown, unapproved_apps: unknown)

Update applications review statuses

Argument	Type	Required
approved_apps	unknown	yes
in_review_apps	unknown	yes
unapproved_apps	unknown	yes

fn get_audit_ssh_settings()

Get Zero Trust SSH settings

fn update_audit_ssh_settings(public_key: unknown)

Update Zero Trust SSH settings

Argument	Type	Required	Description
public_key	unknown	yes

fn zero_trust_rotate_ssh_account_seed()

Rotate Zero Trust SSH account seed

fn list_categories()

List categories

fn list_zero_trust_certificates()

List Zero Trust certificates

fn create_zero_trust_certificate(validity_period_days?: number)

Create Zero Trust certificate

Argument	Type	Required	Description
validity_period_days?	number	no

fn get_zero_trust_certificates_zero_trust_certificate_details(certificate_id: string)

Get Zero Trust certificate details

Argument	Type	Required	Description
certificate_id	string	yes

fn delete_zero_trust_certificate(certificate_id: string)

Delete Zero Trust certificate

Argument	Type	Required	Description
certificate_id	string	yes

fn zero_trust_certificates_activate_zero_trust_certificate(certificate_id: string)

Activate a Zero Trust certificate

Argument	Type	Required	Description
certificate_id	string	yes

fn zero_trust_certificates_deactivate_zero_trust_certificate(certificate_id: string)

Deactivate a Zero Trust certificate

Argument	Type	Required	Description
certificate_id	string	yes

fn get_zero_trust_account_configuration()

Get Zero Trust account configuration

fn update_zero_trust_account_configuration(settings?: object)

Update Zero Trust account configuration

Argument	Type	Required	Description
settings?	object	no	Specify account settings.

fn patch_zero_trust_account_configuration(settings?: object)

Patch Zero Trust account configuration

Argument	Type	Required	Description
settings?	object	no	Specify account settings.

fn list_dns_destination_ips()

List Zero Trust Gateway DNS destination IPv4 address pairs

fn get_egress_cidr_pairs()

Get gateway egress CIDRs pairs assigned to this account

fn list_zero_trust_lists(type?: string)

List Zero Trust lists

Argument	Type	Required	Description
type?	string	no

fn list_details(list_id: string)

Get Zero Trust list details

Argument	Type	Required	Description
list_id	string	yes

fn list_items(list_id: string)

Get Zero Trust list items

Argument	Type	Required	Description
list_id	string	yes

fn list_zero_trust_gateway_locations()

List Zero Trust Gateway locations

fn create_zero_trust_gateway_location(client_default?: unknown, dns_destination_ips_id?: unknown, ecs_support?: unknown, endpoints?: unknown, max_ttl?: unknown, name: unknown, networks?: unknown)

Create a Zero Trust Gateway location

Argument	Type	Required
client_default?	unknown	no
dns_destination_ips_id?	unknown	no
ecs_support?	unknown	no
endpoints?	unknown	no
max_ttl?	unknown	no
name	unknown	yes
networks?	unknown	no

fn get_zero_trust_gateway_locations_zero_trust_gateway_location_details(location_id: string)

Get Zero Trust Gateway location details

Argument	Type	Required	Description
location_id	string	yes

fn update_zero_trust_gateway_location(location_id: string, client_default?: unknown, dns_destination_ips_id?: unknown, ecs_support?: unknown, endpoints?: unknown, max_ttl?: unknown, name: unknown, networks?: unknown)

Update a Zero Trust Gateway location

Argument	Type	Required
location_id	string	yes
client_default?	unknown	no
dns_destination_ips_id?	unknown	no
ecs_support?	unknown	no
endpoints?	unknown	no
max_ttl?	unknown	no
name	unknown	yes
networks?	unknown	no

fn delete_zero_trust_gateway_location(location_id: string)

Delete a Zero Trust Gateway location

Argument	Type	Required	Description
location_id	string	yes

fn get_logging_settings_for_the_zero_trust_account()

Get logging settings for the Zero Trust account

fn update_logging_settings_for_the_zero_trust_account(redact_pii?: boolean, settings_by_rule_type?: object)

Update Zero Trust account logging settings

Argument	Type	Required	Description
redact_pii?	boolean	no	Indicate whether to redact personally identifiable information from activity ...
settings_by_rule_type?	object	no	Configure logging settings for each rule type.

fn list_zero_trust_gateway_operations()

List Zero Trust Gateway operations

fn get_zero_trust_gateway_operations_zero_trust_gateway_operation_details(operation_id: string)

Zero Trust Gateway operation details

Argument	Type	Required	Description
operation_id	string	yes

fn create_pacfile(contents: unknown, description?: unknown, name: unknown, slug?: string)

Create a PAC file

Argument	Type	Required	Description
contents	unknown	yes
description?	unknown	no
name	unknown	yes
slug?	string	no	URL-friendly version of the PAC file name. If not provided, it will be auto-g...

fn get_zero_trust_gateway_pacfiles_details(pacfile_id: string)

Get a PAC file

Argument	Type	Required	Description
pacfile_id	string	yes

fn delete(pacfile_id: string)

Delete a PAC file

Argument	Type	Required	Description
pacfile_id	string	yes

fn list_proxy_endpoints()

List proxy endpoints

fn create_proxy_endpoint(body: union)

Create a proxy endpoint

Argument	Type	Required	Description
body	union	yes

fn get_zero_trust_gateway_proxy_endpoints_proxy_endpoint_details(proxy_endpoint_id: string)

Get a proxy endpoint

Argument	Type	Required	Description
proxy_endpoint_id	string	yes

fn update_proxy_endpoint(proxy_endpoint_id: string, ips?: unknown, name?: unknown)

Update a proxy endpoint

Argument	Type	Required
proxy_endpoint_id	string	yes
ips?	unknown	no
name?	unknown	no

fn delete_proxy_endpoint(proxy_endpoint_id: string)

Delete a proxy endpoint

Argument	Type	Required	Description
proxy_endpoint_id	string	yes

fn list_zero_trust_gateway_rules()

List Zero Trust Gateway rules

fn create_zero_trust_gateway_rule(action: unknown, description?: unknown, device_posture?: unknown, enabled?: unknown, expiration?: unknown, filters?: unknown, identity?: unknown, name: unknown, precedence?: unknown, rule_settings?: unknown, schedule?: unknown, traffic?: unknown)

Create a Zero Trust Gateway rule

Argument	Type	Required
action	unknown	yes
description?	unknown	no
device_posture?	unknown	no
enabled?	unknown	no
expiration?	unknown	no
filters?	unknown	no
identity?	unknown	no
name	unknown	yes
precedence?	unknown	no
rule_settings?	unknown	no
schedule?	unknown	no
traffic?	unknown	no

fn patch_multiple_zero_trust_gateway_rules(items: array)

Patch multiple Zero Trust Gateway rules

Argument	Type	Required	Description
items	array	yes

fn list_zero_trust_gateway_rules_tenant()

List Zero Trust Gateway rules inherited from the parent account

fn get_zero_trust_gateway_rules_zero_trust_gateway_rule_details(rule_id: string)

Get Zero Trust Gateway rule details.

Argument	Type	Required	Description
rule_id	string	yes

fn update_zero_trust_gateway_rule(rule_id: string, action: unknown, description?: unknown, device_posture?: unknown, enabled?: unknown, expiration?: unknown, filters?: unknown, identity?: unknown, name: unknown, precedence?: unknown, rule_settings?: unknown, schedule?: unknown, traffic?: unknown)

Update a Zero Trust Gateway rule

Argument	Type	Required
rule_id	string	yes
action	unknown	yes
description?	unknown	no
device_posture?	unknown	no
enabled?	unknown	no
expiration?	unknown	no
filters?	unknown	no
identity?	unknown	no
name	unknown	yes
precedence?	unknown	no
rule_settings?	unknown	no
schedule?	unknown	no
traffic?	unknown	no

fn patch_zero_trust_gateway_rule(rule_id: string, description?: unknown, enabled?: unknown, name?: unknown, precedence?: unknown)

Patch a Zero Trust Gateway rule

Argument	Type	Required
rule_id	string	yes
description?	unknown	no
enabled?	unknown	no
name?	unknown	no
precedence?	unknown	no

fn delete_zero_trust_gateway_rule(rule_id: string)

Delete a Zero Trust Gateway rule

Argument	Type	Required	Description
rule_id	string	yes

fn zero_trust_gateway_rules_reset_expiration_zero_trust_gateway_rule(rule_id: string)

Reset the expiration of a Zero Trust Gateway Rule

Argument	Type	Required	Description
rule_id	string	yes

Resources

zero_trust_account_information(infinite)— Get Zero Trust account information

zero_trust_account(infinite)— Create Zero Trust account

application_and_application_type_mappings(infinite)— List application and application type mappings

list(infinite)— List applications review statuses

update(infinite)— Update applications review statuses

audit_ssh_settings(infinite)— Get Zero Trust SSH settings

zero_trust_rotate_ssh_account_seed(infinite)— Rotate Zero Trust SSH account seed

categories(infinite)— List categories

zero_trust_certificates(infinite)— List Zero Trust certificates

zero_trust_certificate(infinite)— Create Zero Trust certificate

zero_trust_certificates_zero_trust_certificate_details(infinite)— Get Zero Trust certificate details

zero_trust_certificates_activate_zero_trust_certificate(infinite)— Activate a Zero Trust certificate

zero_trust_certificates_deactivate_zero_trust_certificate(infinite)— Deactivate a Zero Trust certificate

zero_trust_account_configuration(infinite)— Get Zero Trust account configuration

patch_zero_trust_account_configuration(infinite)— Patch Zero Trust account configuration

dns_destination_ips(infinite)— List Zero Trust Gateway DNS destination IPv4 address pairs

get_egress_cidr_pairs(infinite)— Get gateway egress CIDRs pairs assigned to this account

zero_trust_lists(infinite)— List Zero Trust lists

list_details(infinite)— Get Zero Trust list details

items(infinite)— Get Zero Trust list items

zero_trust_gateway_locations(infinite)— List Zero Trust Gateway locations

zero_trust_gateway_location(infinite)— Create a Zero Trust Gateway location

zero_trust_gateway_locations_zero_trust_gateway_location_details(infinite)— Get Zero Trust Gateway location details

logging_settings_for_the_zero_trust_account(infinite)— Get logging settings for the Zero Trust account

zero_trust_gateway_operations(infinite)— List Zero Trust Gateway operations

zero_trust_gateway_operations_zero_trust_gateway_operation_details(infinite)— Zero Trust Gateway operation details

pacfile(infinite)— Create a PAC file

zero_trust_gateway_pacfiles_details(infinite)— Get a PAC file

proxy_endpoints(infinite)— List proxy endpoints

proxy_endpoint(infinite)— Create a proxy endpoint

zero_trust_gateway_proxy_endpoints_proxy_endpoint_details(infinite)— Get a proxy endpoint

zero_trust_gateway_rules(infinite)— List Zero Trust Gateway rules

zero_trust_gateway_rule(infinite)— Create a Zero Trust Gateway rule

patch_multiple_zero_trust_gateway_rules(infinite)— Patch multiple Zero Trust Gateway rules

zero_trust_gateway_rules_tenant(infinite)— List Zero Trust Gateway rules inherited from the parent account

zero_trust_gateway_rules_zero_trust_gateway_rule_details(infinite)— Get Zero Trust Gateway rule details.

patch_zero_trust_gateway_rule(infinite)— Patch a Zero Trust Gateway rule

zero_trust_gateway_rules_reset_expiration_zero_trust_gateway_rule(infinite)— Reset the expiration of a Zero Trust Gateway Rule

04Previous Versions11

2026.09.17.2Sep 17, 2026

2026.09.17.2

No changes to this extension's methods. Regenerated to refresh the shared _lib/api.ts helper library after PR #427 review fixes to cfApiPaginatedCursor (used by r2, kv, durable-objects, and workers-ai, but emitted into every extension's api.ts since it's part of the shared template).

2026.09.15.1Sep 15, 2026

2026.09.15.1

Changed: Bump zod 4.4.3 → 4.6.5

2026.08.28.2

Hardened codegen: instance names sanitized against path traversal; 429 rate-limit retry with Retry-After; string schema patterns emit regex validation; output schemas passthrough unknown fields; apiToken now optional and vault-wireable with CLOUDFLARE_API_TOKEN env fallback.

Added 1, removed 1 models

2026.08.28.2Aug 28, 2026

2026.08.28.2

updated labels

2026.08.28.1Aug 28, 2026

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.26.2

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.2Aug 27, 2026

2026.08.26.2

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.25.1Aug 26, 2026

2026.08.25.1

Changed: Updated labels for improved extension discoverability. Added cross-cutting category labels (security, observability, finops, infrastructure, networking, compliance, devops, ai, incident-response) where applicable.

updated labels

2026.08.24.1Aug 24, 2026

2026.08.24.1

Added: Output metadata attributes for observability.

durationMs: Method execution duration in milliseconds.
collectedBy: Extension name that produced the data.
fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).

2026.08.21.2Aug 22, 2026

2026.08.21.2

Changed: Error messages for API failures and invalid input are now specific instead of generic.

Every method that calls the Cloudflare API now wraps failures with the operation attempted and the account/identifier involved (e.g. certificate_id, list_id, location_id, pacfile_id, proxy_endpoint_id, rule_id), instead of surfacing the raw SDK error with no context.
Methods that take a certificate_id, list_id, location_id, operation_id, pacfile_id, proxy_endpoint_id, or rule_id now reject an empty value up front with a clear validation error, instead of sending a malformed request to the Cloudflare API.

Upgrade note: No behavioral change for valid requests. Callers passing an empty identifier will now get an immediate, descriptive validation error instead of a Cloudflare API failure.

2026.08.21.1Aug 21, 2026

2026.08.21.1

Fixed: Regenerated with three cloudflare-codegen fixes: (1) discriminated-union request bodies with a sibling top-level discriminator property (e.g. gateway proxy_endpoints kind) now correctly build the body from the full oneOf variant instead of silently dropping it to undefined; (2) DELETE methods with a request body (e.g. r2 delete_objects bulk-delete-by-list) now send that body instead of ignoring it; (3) oneOf/anyOf request body variants that are $ref (e.g. r2 sippy config) are now resolved to their real schema instead of collapsing to z.unknown(). Same generator fix as workers-scripts in #352, now caught up for these 7 services.

Changed: list_from_csv was removed — it is no longer present in the upstream Cloudflare API spec this extension is generated from.

Upgrade note: create_proxy_endpoint's arguments changed shape. It previously took { kind } directly and silently discarded any name you passed. It now takes { body: { kind, name } }, with name required inside body. Calls using the old { kind } shape will fail schema validation and must be updated to { body: { kind, name } }.

Modified 1 models

2026.07.27.1Jul 27, 2026

2026.07.27.1

Fixed: Regenerated from scripts/cloudflare-codegen after two generator bugs were repaired (webframp/swamp-extensions#284).

Methods referencing an undeclared path parameter did not compile. The generator derived a method's arguments schema and execute signature from the OpenAPI parameters list, but built the request URL from the path template. Where the Cloudflare spec omits a declaration for a {placeholder} — which it does in several places — the result was a method with arguments: z.object({}) and an unused _args parameter whose body still interpolated args.<name>. Those methods failed type checking and were uncallable even if they had compiled, because the argument was never declared. Path-template placeholders are now unioned into the declared parameters, so the schema, the signature, and the body agree.
Generated tests could request a URL the mock server did not serve. Test arguments merged the request-body fixture over the path-parameter values, so a body property sharing a name with a path parameter (commonly id) substituted its own example value into the URL. The request then missed the mock and failed with Cloudflare API error: Not found. Path parameters now take precedence, matching what the generated model already does by excluding path-parameter names from the request body.

Upgrade note: No API surface change and no method was added or removed. If this extension type-checked and tested cleanly before, its behavior is unchanged and only the version moved. Extensions that previously failed deno check or deno task test now pass.

2026.07.19.1Jul 19, 2026