Skip to content
Cloudflare API
Start here
API Reference

IAM

IAMPermission Groups

List Account Permission Groups
client.iam.permissionGroups.list(PermissionGroupListParams { account_id, id, label, 3 more } params, RequestOptionsoptions?): V4PagePaginationArray<PermissionGroupListResponse { id, meta, name } >
GET/accounts/{account_id}/iam/permission_groups
Permission Group Details
client.iam.permissionGroups.get(stringpermissionGroupId, PermissionGroupGetParams { account_id } params, RequestOptionsoptions?): PermissionGroupGetResponse { id, meta, name }
GET/accounts/{account_id}/iam/permission_groups/{permission_group_id}
ModelsExpand Collapse
PermissionGroupListResponse { id, meta, name }

A named group of permissions that map to a group of operations against resources.

id: string

Identifier of the permission group.

meta?: Meta { key, value }

Attributes associated to the permission group.

key?: string
value?: string
name?: string

Name of the permission group.

PermissionGroupGetResponse { id, meta, name }

A named group of permissions that map to a group of operations against resources.

id: string

Identifier of the permission group.

meta?: Meta { key, value }

Attributes associated to the permission group.

key?: string
value?: string
name?: string

Name of the permission group.

IAMResource Groups

List Resource Groups
client.iam.resourceGroups.list(ResourceGroupListParams { account_id, id, name } params, RequestOptionsoptions?): SinglePage<ResourceGroupListResponse { id, scope, meta, name } >
GET/accounts/{account_id}/iam/resource_groups
Resource Group Details
client.iam.resourceGroups.get(stringresourceGroupId, ResourceGroupGetParams { account_id } params, RequestOptionsoptions?): ResourceGroupGetResponse { id, scope, meta, name }
GET/accounts/{account_id}/iam/resource_groups/{resource_group_id}
Create Resource Group
client.iam.resourceGroups.create(ResourceGroupCreateParams { account_id, name, scope } params, RequestOptionsoptions?): ResourceGroupCreateResponse { id, scope, meta, name }
POST/accounts/{account_id}/iam/resource_groups
Update Resource Group
client.iam.resourceGroups.update(stringresourceGroupId, ResourceGroupUpdateParams { account_id, name, scope } params, RequestOptionsoptions?): ResourceGroupUpdateResponse { id, scope, meta, name }
PUT/accounts/{account_id}/iam/resource_groups/{resource_group_id}
Remove Resource Group
client.iam.resourceGroups.delete(stringresourceGroupId, ResourceGroupDeleteParams { account_id } params, RequestOptionsoptions?): ResourceGroupDeleteResponse { id } | null
DELETE/accounts/{account_id}/iam/resource_groups/{resource_group_id}
ModelsExpand Collapse
ResourceGroupListResponse { id, scope, meta, name }

A group of scoped resources.

id: string

Identifier of the resource group.

scope: Array<Scope>

The scope associated to the resource group

key: string

This is a combination of pre-defined resource name and identifier (like Account ID etc.)

objects: Array<Object>

A list of scope objects for additional context.

key: string

This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

meta?: Meta { key, value }

Attributes associated to the resource group.

key?: string
value?: string
name?: string

Name of the resource group.

ResourceGroupGetResponse { id, scope, meta, name }

A group of scoped resources.

id: string

Identifier of the resource group.

scope: Array<Scope>

The scope associated to the resource group

key: string

This is a combination of pre-defined resource name and identifier (like Account ID etc.)

objects: Array<Object>

A list of scope objects for additional context.

key: string

This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

meta?: Meta { key, value }

Attributes associated to the resource group.

key?: string
value?: string
name?: string

Name of the resource group.

ResourceGroupCreateResponse { id, scope, meta, name }

A group of scoped resources.

id: string

Identifier of the resource group.

scope: Array<Scope>

The scope associated to the resource group

key: string

This is a combination of pre-defined resource name and identifier (like Account ID etc.)

objects: Array<Object>

A list of scope objects for additional context.

key: string

This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

meta?: Meta { key, value }

Attributes associated to the resource group.

key?: string
value?: string
name?: string

Name of the resource group.

ResourceGroupUpdateResponse { id, scope, meta, name }

A group of scoped resources.

id: string

Identifier of the resource group.

scope: Array<Scope>

The scope associated to the resource group

key: string

This is a combination of pre-defined resource name and identifier (like Account ID etc.)

objects: Array<Object>

A list of scope objects for additional context.

key: string

This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

meta?: Meta { key, value }

Attributes associated to the resource group.

key?: string
value?: string
name?: string

Name of the resource group.

ResourceGroupDeleteResponse { id }
id: string

Identifier

maxLength32
minLength32

IAMUser Groups

List User Groups
client.iam.userGroups.list(UserGroupListParams { account_id, id, direction, 4 more } params, RequestOptionsoptions?): V4PagePaginationArray<UserGroupListResponse { id, created_on, modified_on, 2 more } >
GET/accounts/{account_id}/iam/user_groups
User Group Details
client.iam.userGroups.get(stringuserGroupId, UserGroupGetParams { account_id } params, RequestOptionsoptions?): UserGroupGetResponse { id, created_on, modified_on, 2 more }
GET/accounts/{account_id}/iam/user_groups/{user_group_id}
Create User Group
client.iam.userGroups.create(UserGroupCreateParams { account_id, name, policies } params, RequestOptionsoptions?): UserGroupCreateResponse { id, created_on, modified_on, 2 more }
POST/accounts/{account_id}/iam/user_groups
Update User Group
client.iam.userGroups.update(stringuserGroupId, UserGroupUpdateParams { account_id, name, policies } params, RequestOptionsoptions?): UserGroupUpdateResponse { id, created_on, modified_on, 2 more }
PUT/accounts/{account_id}/iam/user_groups/{user_group_id}
Remove User Group
client.iam.userGroups.delete(stringuserGroupId, UserGroupDeleteParams { account_id } params, RequestOptionsoptions?): UserGroupDeleteResponse { id } | null
DELETE/accounts/{account_id}/iam/user_groups/{user_group_id}
ModelsExpand Collapse
UserGroupListResponse { id, created_on, modified_on, 2 more }

A group of policies resources.

id: string

User Group identifier tag.

maxLength32
minLength32
created_on: string

Timestamp for the creation of the user group

formatdate-time
modified_on: string

Last time the user group was modified.

formatdate-time
name: string

Name of the user group.

policies?: Array<Policy>

Policies attached to the User group

id?: string

Policy identifier.

access?: "allow" | "deny"

Allow or deny operations against the resources.

One of the following:
"allow"
"deny"
permission_groups?: Array<PermissionGroup>

A set of permission groups that are specified to the policy.

id: string

Identifier of the permission group.

meta?: Meta { key, value }

Attributes associated to the permission group.

key?: string
value?: string
name?: string

Name of the permission group.

resource_groups?: Array<ResourceGroup>

A list of resource groups that the policy applies to.

id: string

Identifier of the resource group.

scope: Array<Scope>

The scope associated to the resource group

key: string

This is a combination of pre-defined resource name and identifier (like Account ID etc.)

objects: Array<Object>

A list of scope objects for additional context.

key: string

This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

meta?: Meta { key, value }

Attributes associated to the resource group.

key?: string
value?: string
name?: string

Name of the resource group.

UserGroupGetResponse { id, created_on, modified_on, 2 more }

A group of policies resources.

id: string

User Group identifier tag.

maxLength32
minLength32
created_on: string

Timestamp for the creation of the user group

formatdate-time
modified_on: string

Last time the user group was modified.

formatdate-time
name: string

Name of the user group.

policies?: Array<Policy>

Policies attached to the User group

id?: string

Policy identifier.

access?: "allow" | "deny"

Allow or deny operations against the resources.

One of the following:
"allow"
"deny"
permission_groups?: Array<PermissionGroup>

A set of permission groups that are specified to the policy.

id: string

Identifier of the permission group.

meta?: Meta { key, value }

Attributes associated to the permission group.

key?: string
value?: string
name?: string

Name of the permission group.

resource_groups?: Array<ResourceGroup>

A list of resource groups that the policy applies to.

id: string

Identifier of the resource group.

scope: Array<Scope>

The scope associated to the resource group

key: string

This is a combination of pre-defined resource name and identifier (like Account ID etc.)

objects: Array<Object>

A list of scope objects for additional context.

key: string

This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

meta?: Meta { key, value }

Attributes associated to the resource group.

key?: string
value?: string
name?: string

Name of the resource group.

UserGroupCreateResponse { id, created_on, modified_on, 2 more }

A group of policies resources.

id: string

User Group identifier tag.

maxLength32
minLength32
created_on: string

Timestamp for the creation of the user group

formatdate-time
modified_on: string

Last time the user group was modified.

formatdate-time
name: string

Name of the user group.

policies?: Array<Policy>

Policies attached to the User group

id?: string

Policy identifier.

access?: "allow" | "deny"

Allow or deny operations against the resources.

One of the following:
"allow"
"deny"
permission_groups?: Array<PermissionGroup>

A set of permission groups that are specified to the policy.

id: string

Identifier of the permission group.

meta?: Meta { key, value }

Attributes associated to the permission group.

key?: string
value?: string
name?: string

Name of the permission group.

resource_groups?: Array<ResourceGroup>

A list of resource groups that the policy applies to.

id: string

Identifier of the resource group.

scope: Array<Scope>

The scope associated to the resource group

key: string

This is a combination of pre-defined resource name and identifier (like Account ID etc.)

objects: Array<Object>

A list of scope objects for additional context.

key: string

This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

meta?: Meta { key, value }

Attributes associated to the resource group.

key?: string
value?: string
name?: string

Name of the resource group.

UserGroupUpdateResponse { id, created_on, modified_on, 2 more }

A group of policies resources.

id: string

User Group identifier tag.

maxLength32
minLength32
created_on: string

Timestamp for the creation of the user group

formatdate-time
modified_on: string

Last time the user group was modified.

formatdate-time
name: string

Name of the user group.

policies?: Array<Policy>

Policies attached to the User group

id?: string

Policy identifier.

access?: "allow" | "deny"

Allow or deny operations against the resources.

One of the following:
"allow"
"deny"
permission_groups?: Array<PermissionGroup>

A set of permission groups that are specified to the policy.

id: string

Identifier of the permission group.

meta?: Meta { key, value }

Attributes associated to the permission group.

key?: string
value?: string
name?: string

Name of the permission group.

resource_groups?: Array<ResourceGroup>

A list of resource groups that the policy applies to.

id: string

Identifier of the resource group.

scope: Array<Scope>

The scope associated to the resource group

key: string

This is a combination of pre-defined resource name and identifier (like Account ID etc.)

objects: Array<Object>

A list of scope objects for additional context.

key: string

This is a combination of pre-defined resource name and identifier (like Zone ID etc.)

meta?: Meta { key, value }

Attributes associated to the resource group.

key?: string
value?: string
name?: string

Name of the resource group.

UserGroupDeleteResponse { id }
id: string

Identifier

maxLength32
minLength32

IAMUser GroupsMembers

List User Group Members
client.iam.userGroups.members.list(stringuserGroupId, MemberListParams { account_id, page, per_page } params, RequestOptionsoptions?): V4PagePaginationArray<MemberListResponse { id, email, status } >
GET/accounts/{account_id}/iam/user_groups/{user_group_id}/members
Add User Group Members
client.iam.userGroups.members.create(stringuserGroupId, MemberCreateParams { account_id, body } params, RequestOptionsoptions?): MemberCreateResponse { id, email, status }
POST/accounts/{account_id}/iam/user_groups/{user_group_id}/members
Update User Group Members
client.iam.userGroups.members.update(stringuserGroupId, MemberUpdateParams { account_id, body } params, RequestOptionsoptions?): SinglePage<MemberUpdateResponse { id, email, status } >
PUT/accounts/{account_id}/iam/user_groups/{user_group_id}/members
Remove User Group Member
client.iam.userGroups.members.delete(stringuserGroupId, stringmemberId, MemberDeleteParams { account_id } params, RequestOptionsoptions?): MemberDeleteResponse { id, email, status }
DELETE/accounts/{account_id}/iam/user_groups/{user_group_id}/members/{member_id}
ModelsExpand Collapse
MemberListResponse { id, email, status }

Member attached to a User Group.

id: string

Account member identifier.

email?: string

The contact email address of the user.

maxLength90
status?: "accepted" | "pending"

The member's status in the account.

One of the following:
"accepted"
"pending"
MemberCreateResponse { id, email, status }

Member attached to a User Group.

id: string

Account member identifier.

email?: string

The contact email address of the user.

maxLength90
status?: "accepted" | "pending"

The member's status in the account.

One of the following:
"accepted"
"pending"
MemberUpdateResponse { id, email, status }

Member attached to a User Group.

id: string

Account member identifier.

email?: string

The contact email address of the user.

maxLength90
status?: "accepted" | "pending"

The member's status in the account.

One of the following:
"accepted"
"pending"
MemberDeleteResponse { id, email, status }

Member attached to a User Group.

id: string

Account member identifier.

email?: string

The contact email address of the user.

maxLength90
status?: "accepted" | "pending"

The member's status in the account.

One of the following:
"accepted"
"pending"

IAMSSO

Get all SSO connectors
client.iam.sso.list(SSOListParams { account_id } params, RequestOptionsoptions?): SinglePage<SSOListResponse { id, created_on, email_domain, 4 more } >
GET/accounts/{account_id}/sso_connectors
Get single SSO connector
client.iam.sso.get(stringssoConnectorId, SSOGetParams { account_id } params, RequestOptionsoptions?): SSOGetResponse { id, created_on, email_domain, 4 more }
GET/accounts/{account_id}/sso_connectors/{sso_connector_id}
Initialize new SSO connector
client.iam.sso.create(SSOCreateParams { account_id, email_domain, begin_verification, use_fedramp_language } params, RequestOptionsoptions?): SSOCreateResponse { id, created_on, email_domain, 4 more }
POST/accounts/{account_id}/sso_connectors
Update SSO connector state
client.iam.sso.update(stringssoConnectorId, SSOUpdateParams { account_id, enabled, use_fedramp_language } params, RequestOptionsoptions?): SSOUpdateResponse { id, created_on, email_domain, 4 more }
PATCH/accounts/{account_id}/sso_connectors/{sso_connector_id}
Delete SSO connector
client.iam.sso.delete(stringssoConnectorId, SSODeleteParams { account_id } params, RequestOptionsoptions?): SSODeleteResponse { id } | null
DELETE/accounts/{account_id}/sso_connectors/{sso_connector_id}
Begin SSO connector verification
client.iam.sso.beginVerification(stringssoConnectorId, SSOBeginVerificationParams { account_id } params, RequestOptionsoptions?): SSOBeginVerificationResponse { errors, messages, success }
POST/accounts/{account_id}/sso_connectors/{sso_connector_id}/begin_verification
ModelsExpand Collapse
SSOListResponse { id, created_on, email_domain, 4 more }
id?: string

SSO Connector identifier tag.

maxLength32
minLength32
created_on?: string

Timestamp for the creation of the SSO connector

formatdate-time
email_domain?: string
enabled?: boolean
updated_on?: string

Timestamp for the last update of the SSO connector

formatdate-time
use_fedramp_language?: boolean

Controls the display of FedRAMP language to the user during SSO login

verification?: Verification { code, status }
code?: string

DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership.

status?: "awaiting" | "pending" | "failed" | "verified"

The status of the verification code from the verification process.

One of the following:
"awaiting"
"pending"
"failed"
"verified"
SSOGetResponse { id, created_on, email_domain, 4 more }
id?: string

SSO Connector identifier tag.

maxLength32
minLength32
created_on?: string

Timestamp for the creation of the SSO connector

formatdate-time
email_domain?: string
enabled?: boolean
updated_on?: string

Timestamp for the last update of the SSO connector

formatdate-time
use_fedramp_language?: boolean

Controls the display of FedRAMP language to the user during SSO login

verification?: Verification { code, status }
code?: string

DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership.

status?: "awaiting" | "pending" | "failed" | "verified"

The status of the verification code from the verification process.

One of the following:
"awaiting"
"pending"
"failed"
"verified"
SSOCreateResponse { id, created_on, email_domain, 4 more }
id?: string

SSO Connector identifier tag.

maxLength32
minLength32
created_on?: string

Timestamp for the creation of the SSO connector

formatdate-time
email_domain?: string
enabled?: boolean
updated_on?: string

Timestamp for the last update of the SSO connector

formatdate-time
use_fedramp_language?: boolean

Controls the display of FedRAMP language to the user during SSO login

verification?: Verification { code, status }
code?: string

DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership.

status?: "awaiting" | "pending" | "failed" | "verified"

The status of the verification code from the verification process.

One of the following:
"awaiting"
"pending"
"failed"
"verified"
SSOUpdateResponse { id, created_on, email_domain, 4 more }
id?: string

SSO Connector identifier tag.

maxLength32
minLength32
created_on?: string

Timestamp for the creation of the SSO connector

formatdate-time
email_domain?: string
enabled?: boolean
updated_on?: string

Timestamp for the last update of the SSO connector

formatdate-time
use_fedramp_language?: boolean

Controls the display of FedRAMP language to the user during SSO login

verification?: Verification { code, status }
code?: string

DNS verification code. Add this entire string to the DNS TXT record of the email domain to validate ownership.

status?: "awaiting" | "pending" | "failed" | "verified"

The status of the verification code from the verification process.

One of the following:
"awaiting"
"pending"
"failed"
"verified"
SSODeleteResponse { id }
id: string

Identifier

maxLength32
minLength32
SSOBeginVerificationResponse { errors, messages, success }
errors: Array<Error>
code: number
minimum1000
message: string
documentation_url?: string
source?: Source { pointer }
pointer?: string
messages: Array<Message>
code: number
minimum1000
message: string
documentation_url?: string
source?: Source { pointer }
pointer?: string
success: true

Whether the API call was successful.