Skip to content
Cloudflare API
Start here
API Reference
Zero Trust

Cloud Workload Security

Cloud Workload SecurityBasic Auth Credentials

List basic-auth credentials for an account
client.ZeroTrust.CWS.BasicAuthCredentials.List(ctx, params) (*CursorPagination[BasicAuthCredential], error)
GET/accounts/{account_id}/cws/basic-auth-credentials
Get a basic-auth credential by ID
client.ZeroTrust.CWS.BasicAuthCredentials.Get(ctx, credentialID, query) (*BasicAuthCredential, error)
GET/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}
Create a basic-auth credential
client.ZeroTrust.CWS.BasicAuthCredentials.New(ctx, params) (*BasicAuthCredential, error)
POST/accounts/{account_id}/cws/basic-auth-credentials
Delete a basic-auth credential
client.ZeroTrust.CWS.BasicAuthCredentials.Delete(ctx, credentialID, body) (*CWSBasicAuthCredentialDeleteResponse, error)
DELETE/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}
ModelsExpand Collapse
type BasicAuthCredential struct{…}
ID string

Server-assigned UUID

formatuuid
CreatedAt Time
formatdate-time
UpdatedAt Time
formatdate-time
Username string

Login presented by the client. Printable ASCII only, excluding space and colon (RFC 7617 forbids a colon in the user-id).

maxLength100
minLength1

Cloud Workload SecurityBasic Auth CredentialsSecrets

List secrets for a basic-auth credential
client.ZeroTrust.CWS.BasicAuthCredentials.Secrets.List(ctx, credentialID, params) (*CursorPagination[BasicAuthSecret], error)
GET/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}/secrets
Get a basic-auth secret by ID
client.ZeroTrust.CWS.BasicAuthCredentials.Secrets.Get(ctx, credentialID, secretID, query) (*BasicAuthSecret, error)
GET/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}/secrets/{secret_id}
Add a secret to a basic-auth credential
client.ZeroTrust.CWS.BasicAuthCredentials.Secrets.New(ctx, credentialID, params) (*BasicAuthSecret, error)
POST/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}/secrets
Delete a basic-auth secret
client.ZeroTrust.CWS.BasicAuthCredentials.Secrets.Delete(ctx, credentialID, secretID, body) (*CWSBasicAuthCredentialSecretDeleteResponse, error)
DELETE/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}/secrets/{secret_id}
ModelsExpand Collapse
type BasicAuthSecret struct{…}
ID string

Server-assigned UUID

formatuuid
CreatedAt Time
formatdate-time
ExpiresAt TimeOptional

Optional RFC 3339 expiration time. Omit for no expiration.

formatdate-time

Cloud Workload SecurityDeployments

List deployments
client.ZeroTrust.CWS.Deployments.List(ctx, params) (*CursorPagination[Deployment], error)
GET/accounts/{account_id}/cws/deployments
Get a deployment by ID
client.ZeroTrust.CWS.Deployments.Get(ctx, deploymentID, query) (*Deployment, error)
GET/accounts/{account_id}/cws/deployments/{deployment_id}
Create a new deployment
client.ZeroTrust.CWS.Deployments.New(ctx, params) (*Deployment, error)
POST/accounts/{account_id}/cws/deployments
Update a deployment
client.ZeroTrust.CWS.Deployments.Update(ctx, deploymentID, params) (*Deployment, error)
PUT/accounts/{account_id}/cws/deployments/{deployment_id}
Delete a deployment
client.ZeroTrust.CWS.Deployments.Delete(ctx, deploymentID, body) (*CWSDeploymentDeleteResponse, error)
DELETE/accounts/{account_id}/cws/deployments/{deployment_id}
ModelsExpand Collapse
type Deployment struct{…}
ID string

Server-assigned UUID

formatuuid
BasicAuthCredentialIDs []string

IDs of basic-auth credentials attached to this deployment

CreatedAt Time
formatdate-time
DefaultMode DeploymentDefaultMode

Default traffic decision when no policy set matches

One of the following:
const DeploymentDefaultModeAllow DeploymentDefaultMode = "ALLOW"
const DeploymentDefaultModeBlock DeploymentDefaultMode = "BLOCK"
Name string

Human-readable name; unique per account

maxLength100
minLength1
OnErrorAction DeploymentOnErrorAction

Action applied when an enforcing policy has a runtime Rego error

One of the following:
const DeploymentOnErrorActionBlock DeploymentOnErrorAction = "BLOCK"
const DeploymentOnErrorActionSkip DeploymentOnErrorAction = "SKIP"
PolicySetIDs []string

IDs of policy sets attached to this deployment

RegoRaiseError bool

Whether OPA builtin failures are raised as runtime evaluation errors

Tags map[string, string]

Tags attached to this deployment

UpdatedAt Time
formatdate-time
Description stringOptional

Optional free-form description.

maxLength1024
DomainACLID stringOptional

ID of the attached domain ACL. Omitted when none.

formatuuid

Cloud Workload SecurityDomain ACLs

List domain ACLs
client.ZeroTrust.CWS.DomainACLs.List(ctx, params) (*CursorPagination[DomainACL], error)
GET/accounts/{account_id}/cws/domain-acls
Get a domain ACL by ID
client.ZeroTrust.CWS.DomainACLs.Get(ctx, domainACLID, query) (*DomainACL, error)
GET/accounts/{account_id}/cws/domain-acls/{domain_acl_id}
Create a new domain ACL
client.ZeroTrust.CWS.DomainACLs.New(ctx, params) (*DomainACL, error)
POST/accounts/{account_id}/cws/domain-acls
Update a domain ACL and replace its entries
client.ZeroTrust.CWS.DomainACLs.Update(ctx, domainACLID, params) (*DomainACL, error)
PUT/accounts/{account_id}/cws/domain-acls/{domain_acl_id}
Delete a domain ACL
client.ZeroTrust.CWS.DomainACLs.Delete(ctx, domainACLID, body) (*CWSDomainACLDeleteResponse, error)
DELETE/accounts/{account_id}/cws/domain-acls/{domain_acl_id}
ModelsExpand Collapse
type DomainACL struct{…}
ID string

Server-assigned UUID

formatuuid
CreatedAt Time
formatdate-time
DefaultAction DomainACLDefaultAction

Action applied when no entry matches the request domain

One of the following:
const DomainACLDefaultActionAllow DomainACLDefaultAction = "ALLOW"
const DomainACLDefaultActionBlock DomainACLDefaultAction = "BLOCK"
Entries []DomainACLEntry

Per-domain action overrides. Each domain appears at most once.

Action DomainACLEntriesAction

Per-domain decision overriding the parent ACL’s default_action

One of the following:
const DomainACLEntriesActionAllow DomainACLEntriesAction = "ALLOW"
const DomainACLEntriesActionBlock DomainACLEntriesAction = "BLOCK"
Domain string

Hostname or domain pattern, capped at 255 UTF-8 bytes

maxLength255
minLength1
Name string

Human-readable name; unique per account

maxLength100
minLength1
UpdatedAt Time
formatdate-time

Cloud Workload SecurityPolicies

List policies
client.ZeroTrust.CWS.Policies.List(ctx, params) (*CursorPagination[Policy], error)
GET/accounts/{account_id}/cws/policies
Get a policy by ID
client.ZeroTrust.CWS.Policies.Get(ctx, policyID, query) (*Policy, error)
GET/accounts/{account_id}/cws/policies/{policy_id}
Create a new policy
client.ZeroTrust.CWS.Policies.New(ctx, params) (*Policy, error)
POST/accounts/{account_id}/cws/policies
Update a policy
client.ZeroTrust.CWS.Policies.Update(ctx, policyID, params) (*Policy, error)
PUT/accounts/{account_id}/cws/policies/{policy_id}
Delete a policy
client.ZeroTrust.CWS.Policies.Delete(ctx, policyID, body) (*CWSPolicyDeleteResponse, error)
DELETE/accounts/{account_id}/cws/policies/{policy_id}
ModelsExpand Collapse
type Policy struct{…}
ID string

Server-assigned UUID

formatuuid
CreatedAt Time
formatdate-time
Entrypoint string

Non-function rule declared in rego_source. Evaluation uses data.<package_path>..

maxLength255
Filter string

Optional filter expression that determines whether this policy applies. Null means the policy applies to every request. Maximum 4096 UTF-8 bytes.

maxLength4096
minLength1
Name string

Human-readable name; unique per account

maxLength100
minLength1
PackagePath string

Dotted path derived from rego_source. Begins with policy. and is unique per account.

maxLength1024
RegoSource string

Inline Rego source with a package beginning with “policy.” Maximum 16384 UTF-8 bytes.

maxLength16384
minLength1
Tags map[string, string]

Tags attached to this policy

UpdatedAt Time
formatdate-time
Description stringOptional

Optional free-form description.

maxLength1024

Cloud Workload SecurityPolicy Sets

List policy sets
client.ZeroTrust.CWS.PolicySets.List(ctx, params) (*CursorPagination[PolicySet], error)
GET/accounts/{account_id}/cws/policy-sets
Get a policy set by ID
client.ZeroTrust.CWS.PolicySets.Get(ctx, policySetID, query) (*PolicySet, error)
GET/accounts/{account_id}/cws/policy-sets/{policy_set_id}
Create a new policy set
client.ZeroTrust.CWS.PolicySets.New(ctx, params) (*PolicySet, error)
POST/accounts/{account_id}/cws/policy-sets
Update a policy set
client.ZeroTrust.CWS.PolicySets.Update(ctx, policySetID, params) (*PolicySet, error)
PUT/accounts/{account_id}/cws/policy-sets/{policy_set_id}
Delete a policy set
client.ZeroTrust.CWS.PolicySets.Delete(ctx, policySetID, body) (*CWSPolicySetDeleteResponse, error)
DELETE/accounts/{account_id}/cws/policy-sets/{policy_set_id}
ModelsExpand Collapse
type PolicySet struct{…}
ID string

Server-assigned UUID

formatuuid
CreatedAt Time
formatdate-time
ExcludeWorkloadIDs []string

IDs of workloads that exclude matching requests. Exclusions take precedence.

IncludeWorkloadIDs []string

IDs of workloads that include matching requests. Empty includes all requests before exclusions.

Name string

Human-readable name; unique per account

maxLength100
minLength1
Policies []PolicySetPolicy

Member policies and their per-membership enforcement mode

Enforce bool

Whether this policy should enforce when it matches. False keeps the policy attached for non-enforcing evaluation.

PolicyID string

ID of the member policy

formatuuid
Tags map[string, string]

Tags attached to this policy set

UpdatedAt Time
formatdate-time
Description stringOptional

Optional free-form description.

maxLength1024

Cloud Workload SecurityRego Metadata

List Rego metadata documents
client.ZeroTrust.CWS.RegoMetadata.List(ctx, params) (*CursorPagination[RegoMetadata], error)
GET/accounts/{account_id}/cws/rego-metadata
Get a rego metadata document by ID
client.ZeroTrust.CWS.RegoMetadata.Get(ctx, regoMetadataID, query) (*RegoMetadata, error)
GET/accounts/{account_id}/cws/rego-metadata/{rego_metadata_id}
Create a new rego metadata document
client.ZeroTrust.CWS.RegoMetadata.New(ctx, params) (*RegoMetadata, error)
POST/accounts/{account_id}/cws/rego-metadata
Update a rego metadata document
client.ZeroTrust.CWS.RegoMetadata.Update(ctx, regoMetadataID, params) (*RegoMetadata, error)
PUT/accounts/{account_id}/cws/rego-metadata/{rego_metadata_id}
Delete a rego metadata document
client.ZeroTrust.CWS.RegoMetadata.Delete(ctx, regoMetadataID, body) (*CWSRegoMetadataDeleteResponse, error)
DELETE/accounts/{account_id}/cws/rego-metadata/{rego_metadata_id}
ModelsExpand Collapse
type RegoMetadata struct{…}
ID string

Server-assigned UUID

formatuuid
CreatedAt Time
formatdate-time
Data unknown
ImportPath string

Unique Rego import path in the form metadata., with one alphanumeric or underscore segment. Reference it as data.<import_path>.

maxLength255
minLength1
Name string

Human-readable name; unique per account

maxLength100
minLength1
UpdatedAt Time
formatdate-time

Cloud Workload SecurityRego Modules

List Rego modules
client.ZeroTrust.CWS.RegoModules.List(ctx, params) (*CursorPagination[RegoModule], error)
GET/accounts/{account_id}/cws/rego-modules
Get a Rego module by ID
client.ZeroTrust.CWS.RegoModules.Get(ctx, regoModuleID, query) (*RegoModule, error)
GET/accounts/{account_id}/cws/rego-modules/{rego_module_id}
Create a new Rego module
client.ZeroTrust.CWS.RegoModules.New(ctx, params) (*RegoModule, error)
POST/accounts/{account_id}/cws/rego-modules
Update a Rego module
client.ZeroTrust.CWS.RegoModules.Update(ctx, regoModuleID, params) (*RegoModule, error)
PUT/accounts/{account_id}/cws/rego-modules/{rego_module_id}
Delete a Rego module
client.ZeroTrust.CWS.RegoModules.Delete(ctx, regoModuleID, body) (*CWSRegoModuleDeleteResponse, error)
DELETE/accounts/{account_id}/cws/rego-modules/{rego_module_id}
ModelsExpand Collapse
type RegoModule struct{…}
ID string

Server-assigned UUID

formatuuid
CreatedAt Time
formatdate-time
Name string

Human-readable name; unique per account

maxLength100
minLength1
PackagePath string

Dotted path derived from rego_source. Begins with lib. and is unique per account.

maxLength1024
RegoSource string

Library Rego source with a package beginning with “lib.” Maximum 16384 UTF-8 bytes.

maxLength16384
minLength1
UpdatedAt Time
formatdate-time

Cloud Workload SecurityTenant Structures

List tenant structures for an account
client.ZeroTrust.CWS.TenantStructures.List(ctx, params) (*CursorPagination[TenantStructure], error)
GET/accounts/{account_id}/cws/tenant-structures
Get a tenant structure by ID
client.ZeroTrust.CWS.TenantStructures.Get(ctx, structureID, query) (*TenantStructure, error)
GET/accounts/{account_id}/cws/tenant-structures/{structure_id}
Create a tenant structure
client.ZeroTrust.CWS.TenantStructures.New(ctx, params) (*TenantStructure, error)
POST/accounts/{account_id}/cws/tenant-structures
Update a tenant structure
client.ZeroTrust.CWS.TenantStructures.Update(ctx, structureID, params) (*TenantStructure, error)
PUT/accounts/{account_id}/cws/tenant-structures/{structure_id}
Delete a tenant structure
client.ZeroTrust.CWS.TenantStructures.Delete(ctx, structureID, body) (*CWSTenantStructureDeleteResponse, error)
DELETE/accounts/{account_id}/cws/tenant-structures/{structure_id}
ModelsExpand Collapse
type TenantStructure struct{…}
ID string

Server-assigned UUID

formatuuid
Application TenantStructureApplication

Platform this structure models. Immutable after creation; determines valid node kinds and identifier formats.

One of the following:
const TenantStructureApplicationAws TenantStructureApplication = "aws"
const TenantStructureApplicationCloudflare TenantStructureApplication = "cloudflare"
CreatedAt Time
formatdate-time
Name string

Human-readable name; unique per account

maxLength100
minLength1
UpdatedAt Time
formatdate-time
ImportPath stringOptional

Optional unique Rego mount path in the form tenant... The application segment must match application; omitted when unmounted.

maxLength255
minLength1

Cloud Workload SecurityTenant StructuresNodes

List nodes for a tenant structure
client.ZeroTrust.CWS.TenantStructures.Nodes.List(ctx, structureID, params) (*CursorPagination[TenantStructureNode], error)
GET/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes
Get a tenant node by ID
client.ZeroTrust.CWS.TenantStructures.Nodes.Get(ctx, structureID, nodeID, query) (*TenantStructureNode, error)
GET/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/{node_id}
Add a node to a tenant structure
client.ZeroTrust.CWS.TenantStructures.Nodes.New(ctx, structureID, params) (*TenantStructureNode, error)
POST/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes
Update a tenant node
client.ZeroTrust.CWS.TenantStructures.Nodes.Update(ctx, structureID, nodeID, params) (*TenantStructureNode, error)
PUT/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/{node_id}
Delete a tenant node
client.ZeroTrust.CWS.TenantStructures.Nodes.Delete(ctx, structureID, nodeID, body) (*CWSTenantStructureNodeDeleteResponse, error)
DELETE/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/{node_id}
Apply a batch of tenant node mutations
client.ZeroTrust.CWS.TenantStructures.Nodes.Batch(ctx, structureID, params) (*CWSTenantStructureNodeBatchResponse, error)
POST/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/batch
ModelsExpand Collapse
type TenantStructureNode struct{…}
ID string

Server-assigned UUID

formatuuid
CreatedAt Time
formatdate-time
NativeID string

Cloud-native identifier of this node, unique within the structure; the parent-reference target. Shape depends on the structure’s application. Immutable after create.

maxLength255
minLength1
NodeKind string

Position in the tree. Legal values depend on the structure’s application (aws: root/ou/account; cloudflare: org/account/zone). At most one root per structure. Immutable after create.

maxLength64
minLength1
UpdatedAt Time
formatdate-time
Name stringOptional

Display name (e.g. an OU or account name), mutable. Optional; empty by default.

maxLength100
Parent stringOptional

Native ID of this node’s parent. Required for non-root nodes and omitted for the root. The parent must be in the same structure and able to contain this node kind.

maxLength255

Cloud Workload SecurityWorkloads

List workloads
client.ZeroTrust.CWS.Workloads.List(ctx, params) (*CursorPagination[Workload], error)
GET/accounts/{account_id}/cws/workloads
Get a workload by ID
client.ZeroTrust.CWS.Workloads.Get(ctx, workloadID, query) (*Workload, error)
GET/accounts/{account_id}/cws/workloads/{workload_id}
Create a new workload
client.ZeroTrust.CWS.Workloads.New(ctx, params) (*Workload, error)
POST/accounts/{account_id}/cws/workloads
Update a workload
client.ZeroTrust.CWS.Workloads.Update(ctx, workloadID, params) (*Workload, error)
PUT/accounts/{account_id}/cws/workloads/{workload_id}
Delete a workload
client.ZeroTrust.CWS.Workloads.Delete(ctx, workloadID, body) (*CWSWorkloadDeleteResponse, error)
DELETE/accounts/{account_id}/cws/workloads/{workload_id}
ModelsExpand Collapse
type Workload struct{…}
ID string

Server-assigned UUID

formatuuid
CreatedAt Time
formatdate-time
Filter string

Filter expression selecting the requests this workload matches. Maximum 4096 UTF-8 bytes.

maxLength4096
minLength1
Name string

Human-readable handle; unique per account.

maxLength100
minLength1
Tags map[string, string]

Tags attached to this workload

UpdatedAt Time
formatdate-time
Description stringOptional

Optional free-form description.

maxLength1024