Create a device settings profile
Creates a device settings profile to be applied to certain devices matching the criteria.
Security
API Token
The preferred authorization scheme for interacting with the Cloudflare API. Create a token.
API Email + API Key
The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.
The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.
Accepted Permissions (at least one required)
Body ParametersJSON
Whether to receive update notifications when a new version of the client is available.
Whether the policy is the account default. WARP group profiles cannot set this field.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
Determines whether the WARP client can silently reauthenticate the user with device credentials (Microsoft Entra) instead of prompting for browser-based reauthentication.
The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.
The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.
The wirefilter expression to match devices. Available values: “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.service_token_uuid”, “identity.saml_attributes”, “network”, “os.name”, “os.version”, “device.tags”.
The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
Whether to allow the user to turn off the WARP switch and disconnect the client.
Create a device settings profile
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/devices/policy \
-H 'Content-Type: application/json' \
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
-d '{
"name": "Allow Developers",
"allow_mode_switch": true,
"allow_updates": true,
"allowed_to_leave": true,
"captive_portal": 180,
"description": "Policy for test teams.",
"disable_auto_fallback": true,
"enabled": true,
"exclude_office_ips": true,
"lan_allow_minutes": 30,
"lan_allow_subnet_size": 24,
"match": "identity.email == \\"test@cloudflare.com\\"",
"precedence": 100,
"profile_type": "warp",
"register_interface_ip_with_dns": true,
"support_url": "https://1.1.1.1/help",
"switch_locked": true,
"tunnel_protocol": "wireguard"
}'{
"errors": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"messages": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"result": {
"allow_mode_switch": true,
"allow_updates": true,
"allowed_to_leave": true,
"auto_connect": 0,
"browser_extension_config": {
"proxy_control": "unlocked",
"proxy_enabled": true
},
"captive_portal": 180,
"default": false,
"description": "Policy for test teams.",
"disable_auto_fallback": true,
"dns_search_suffixes": [
{
"suffix": "internal.corp",
"description": "Example internal domains"
}
],
"enable_device_credential_authentication": false,
"enabled": true,
"exclude": [
{
"address": "192.0.2.0/24",
"description": "Exclude testing domains from the tunnel"
}
],
"exclude_office_ips": true,
"fallback_domains": [
{
"suffix": "example.com",
"description": "Domain bypass for local development",
"dns_server": [
"1.1.1.1"
]
}
],
"gateway_unique_id": "699d98642c564d2e855e9661899b7252",
"global_acceleration": {
"api_endpoints": [
"198.51.100.1:443"
],
"enabled": true,
"masque_endpoints": [
"198.51.100.1:443"
],
"wireguard_endpoints": [
"198.51.100.1:2408"
],
"autoswitch": true
},
"include": [
{
"address": "192.0.2.0/24",
"description": "Include testing domains in the tunnel"
}
],
"lan_allow_minutes": 30,
"lan_allow_subnet_size": 24,
"match": "identity.email == \"test@cloudflare.com\"",
"name": "Allow Developers",
"policy_id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
"precedence": 100,
"profile_type": "warp",
"register_interface_ip_with_dns": true,
"sccm_vpn_boundary_support": false,
"service_mode_v2": {
"mode": "proxy",
"port": 3000
},
"support_url": "https://1.1.1.1/help",
"switch_locked": true,
"target_tests": [
{
"id": "id",
"name": "name"
}
],
"tunnel_protocol": "wireguard",
"uninstall_protection": false,
"virtual_networks": {
"allowed": [
"f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
],
"default": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
},
"success": true
}Returns Examples
{
"errors": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"messages": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"result": {
"allow_mode_switch": true,
"allow_updates": true,
"allowed_to_leave": true,
"auto_connect": 0,
"browser_extension_config": {
"proxy_control": "unlocked",
"proxy_enabled": true
},
"captive_portal": 180,
"default": false,
"description": "Policy for test teams.",
"disable_auto_fallback": true,
"dns_search_suffixes": [
{
"suffix": "internal.corp",
"description": "Example internal domains"
}
],
"enable_device_credential_authentication": false,
"enabled": true,
"exclude": [
{
"address": "192.0.2.0/24",
"description": "Exclude testing domains from the tunnel"
}
],
"exclude_office_ips": true,
"fallback_domains": [
{
"suffix": "example.com",
"description": "Domain bypass for local development",
"dns_server": [
"1.1.1.1"
]
}
],
"gateway_unique_id": "699d98642c564d2e855e9661899b7252",
"global_acceleration": {
"api_endpoints": [
"198.51.100.1:443"
],
"enabled": true,
"masque_endpoints": [
"198.51.100.1:443"
],
"wireguard_endpoints": [
"198.51.100.1:2408"
],
"autoswitch": true
},
"include": [
{
"address": "192.0.2.0/24",
"description": "Include testing domains in the tunnel"
}
],
"lan_allow_minutes": 30,
"lan_allow_subnet_size": 24,
"match": "identity.email == \"test@cloudflare.com\"",
"name": "Allow Developers",
"policy_id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
"precedence": 100,
"profile_type": "warp",
"register_interface_ip_with_dns": true,
"sccm_vpn_boundary_support": false,
"service_mode_v2": {
"mode": "proxy",
"port": 3000
},
"support_url": "https://1.1.1.1/help",
"switch_locked": true,
"target_tests": [
{
"id": "id",
"name": "name"
}
],
"tunnel_protocol": "wireguard",
"uninstall_protection": false,
"virtual_networks": {
"allowed": [
"f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
],
"default": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
},
"success": true
}