Cloudflare API | R2 › Temporary Credentials › Create Temporary Access Credentials

API Reference

Account & User Management

Resource Sharing

AI

Certificate Management

Certificate Authorities

Client Certificates

Custom Certificates

Custom Hostnames

Keyless Certificates

MTLS Certificates

Origin CA Certificates

Origin Post Quantum Encryption

Origin TLS Client Auth

Cloudflare One

DNS

Account Custom Nameservers

Domain/Zone Management

IP Addresses

Media

Networking

Magic Cloud Networking

Magic Network Monitoring

Network Interconnects

Observability

Security Center

Radar

Routing & Performance

Rules

Cloud Connector

Managed Transforms

URL Normalization

Security

Schema Validation

Content Scanning

Leaked Credential Checks

Token Validation

Storage & Databases

Temporary Credentials

Create Temporary Access Credentials

R2 Data Catalog

Threat Intelligence

Brand Protection

Workers & Pages

Browser Rendering

Durable Objects

Workers For Platforms

Shared

Google Tag Gateway

Resource Tagging

R2

r2

Buckets

r2.buckets

Methods

List Buckets -> Envelope<{ buckets }>

get/accounts/{account_id}/r2/buckets

Lists all R2 buckets on your account.

Get Bucket -> Envelope<

>

get/accounts/{account_id}/r2/buckets/{bucket_name}

Gets properties of an existing R2 bucket.

Create Bucket -> Envelope<

>

post/accounts/{account_id}/r2/buckets

Creates a new R2 bucket.

Patch Bucket -> Envelope<

>

patch/accounts/{account_id}/r2/buckets/{bucket_name}

Updates properties of an existing R2 bucket.

Delete Bucket -> Envelope<unknown>

delete/accounts/{account_id}/r2/buckets/{bucket_name}

Deletes an existing R2 bucket.

Domain types

Bucket = { creation_date, jurisdiction, location, 2 more... }

A single R2 bucket.

CORS

r2.buckets.cors

Methods

Get Bucket CORS Policy -> Envelope<{ rules }>

get/accounts/{account_id}/r2/buckets/{bucket_name}/cors

Get the CORS policy for a bucket.

Put Bucket CORS Policy -> Envelope<unknown>

put/accounts/{account_id}/r2/buckets/{bucket_name}/cors

Set the CORS policy for a bucket.

Delete Bucket CORS Policy -> Envelope<unknown>

delete/accounts/{account_id}/r2/buckets/{bucket_name}/cors

Delete the CORS policy for a bucket.

Domains

r2.buckets.domains

R2 Buckets Domains

Custom

r2.buckets.domains.custom

Methods

List Custom Domains Of Bucket -> Envelope<{ domains }>

get/accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom

Gets a list of all custom domains registered with an existing R2 bucket.

Get Custom Domain Settings -> Envelope<{ domain, enabled, status, 4 more... }>

get/accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom/{domain}

Get the configuration for a custom domain on an existing R2 bucket.

Attach Custom Domain To Bucket -> Envelope<{ domain, enabled, ciphers, 1 more... }>

post/accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom

Register a new custom domain for an existing R2 bucket.

Configure Custom Domain Settings -> Envelope<{ domain, ciphers, enabled, 1 more... }>

put/accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom/{domain}

Edit the configuration for a custom domain on an existing R2 bucket.

Remove Custom Domain From Bucket -> Envelope<{ domain }>

delete/accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom/{domain}

Remove custom domain registration from an existing R2 bucket.

R2 Buckets Domains

Managed

r2.buckets.domains.managed

Methods

Get R2 Dev Domain Of Bucket -> Envelope<{ bucketId, domain, enabled }>

get/accounts/{account_id}/r2/buckets/{bucket_name}/domains/managed

Gets state of public access over the bucket's R2-managed (r2.dev) domain.

Update R2 Dev Domain Of Bucket -> Envelope<{ bucketId, domain, enabled }>

put/accounts/{account_id}/r2/buckets/{bucket_name}/domains/managed

Updates state of public access over the bucket's R2-managed (r2.dev) domain.

Event Notifications

r2.buckets.event_notifications

Methods

List Event Notification Rules -> Envelope<{ bucketName, queues }>

get/accounts/{account_id}/event_notifications/r2/{bucket_name}/configuration

List all event notification rules for a bucket.

Get Event Notification Rule -> Envelope<{ queueId, queueName, rules }>

get/accounts/{account_id}/event_notifications/r2/{bucket_name}/configuration/queues/{queue_id}

Get a single event notification rule.

Create Event Notification Rule -> Envelope<unknown>

put/accounts/{account_id}/event_notifications/r2/{bucket_name}/configuration/queues/{queue_id}

Create event notification rule.

Delete Event Notification Rules -> Envelope<unknown>

delete/accounts/{account_id}/event_notifications/r2/{bucket_name}/configuration/queues/{queue_id}

Delete an event notification rule. If no body is provided, all rules for specified queue will be deleted.

Lifecycle

r2.buckets.lifecycle

Methods

Get Object Lifecycle Rules -> Envelope<{ rules }>

get/accounts/{account_id}/r2/buckets/{bucket_name}/lifecycle

Get object lifecycle rules for a bucket.

Put Object Lifecycle Rules -> Envelope<unknown>

put/accounts/{account_id}/r2/buckets/{bucket_name}/lifecycle

Set the object lifecycle rules for a bucket.

Locks

r2.buckets.locks

Methods

Get Bucket Lock Rules -> Envelope<{ rules }>

get/accounts/{account_id}/r2/buckets/{bucket_name}/lock

Get lock rules for a bucket.

Put Bucket Lock Rules -> Envelope<unknown>

put/accounts/{account_id}/r2/buckets/{bucket_name}/lock

Set lock rules for a bucket.

Metrics

r2.buckets.metrics

Methods

Get Account Level Metrics -> Envelope<{ infrequentAccess, standard }>

get/accounts/{account_id}/r2/metrics

Get Storage/Object Count Metrics across all buckets in your account. Note that Account-Level Metrics may not immediately reflect the latest data.

Sippy

r2.buckets.sippy

Methods

Get Sippy Configuration -> Envelope<

>

get/accounts/{account_id}/r2/buckets/{bucket_name}/sippy

Gets configuration for Sippy for an existing R2 bucket.

Enable Sippy -> Envelope<

>

put/accounts/{account_id}/r2/buckets/{bucket_name}/sippy

Sets configuration for Sippy for an existing R2 bucket.

Disable Sippy -> Envelope<{ enabled }>

delete/accounts/{account_id}/r2/buckets/{bucket_name}/sippy

Disables Sippy on this bucket.

Domain types

Provider = "r2"

Sippy = { destination, enabled, source }

Super Slurper

r2.super_slurper

R2 Super Slurper

Connectivity Precheck

r2.super_slurper.connectivity_precheck

Methods

Check Source Connectivity -> Envelope<{ connectivityStatus }>

put/accounts/{account_id}/slurper/source/connectivity-precheck

Check whether tokens are valid against the source bucket

Check Target Connectivity -> Envelope<{ connectivityStatus }>

put/accounts/{account_id}/slurper/target/connectivity-precheck

Check whether tokens are valid against the target bucket

R2 Super Slurper

Jobs

r2.super_slurper.jobs

Methods

List Jobs -> SinglePage<{ id, createdAt, finishedAt, 4 more... }>

get/accounts/{account_id}/slurper/jobs

Lists all R2 Super Slurper migration jobs for the account with their status.

Get Job Details -> Envelope<{ id, createdAt, finishedAt, 4 more... }>

get/accounts/{account_id}/slurper/jobs/{job_id}

Retrieves detailed status and configuration for a specific R2 Super Slurper migration job.

Create A Job -> Envelope<{ id }>

post/accounts/{account_id}/slurper/jobs

Creates a new R2 Super Slurper migration job to transfer objects from a source bucket (e.g. S3, GCS, R2) to R2.

Abort All Jobs -> Envelope<string>

put/accounts/{account_id}/slurper/jobs/abortAll

Cancels all running R2 Super Slurper migration jobs for the account. Any objects in the middle of a transfer will finish, but no new objects will start transferring.

Abort A Job -> Envelope<string>

put/accounts/{account_id}/slurper/jobs/{job_id}/abort

Cancels a specific R2 Super Slurper migration job. Any objects in the middle of a transfer will finish, but no new objects will start transferring.

Pause A Job -> Envelope<string>

put/accounts/{account_id}/slurper/jobs/{job_id}/pause

Pauses a running R2 Super Slurper migration job. The job can be resumed later to continue transferring.

Get Job Progress -> Envelope<{ id, createdAt, failedObjects, 4 more... }>

get/accounts/{account_id}/slurper/jobs/{job_id}/progress

Retrieves current progress metrics for an R2 Super Slurper migration job

Resume A Job -> Envelope<string>

put/accounts/{account_id}/slurper/jobs/{job_id}/resume

Resumes a paused R2 Super Slurper migration job, continuing the transfer from where it stopped.

R2 Super Slurper Jobs

Logs

r2.super_slurper.jobs.logs

Methods

Get Job Logs -> SinglePage<{ createdAt, job, logType, 2 more... }>

get/accounts/{account_id}/slurper/jobs/{job_id}/logs

Gets log entries for an R2 Super Slurper migration job, showing migration status changes, errors, etc.

Temporary Credentials

r2.temporary_credentials

Methods

Create Temporary Access Credentials -> Envelope<{ accessKeyId, secretAccessKey, sessionToken }>

post/accounts/{account_id}/r2/temp-access-credentials

Creates temporary access credentials on a bucket that can be optionally scoped to prefixes or objects.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example: Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

path Parameters

account_id: string

(maxLength: 32)

Account ID.

Response fields

errors: Array<

>

messages: Array<string>

result: { accessKeyId, secretAccessKey, sessionToken }

success: true

Whether the API call was successful.

Request example

curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/r2/temp-access-credentials \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
    -d '{
          "bucket": "example-bucket",
          "parentAccessKeyId": "example-access-key-id",
          "permission": "object-read-write",
          "ttlSeconds": 3600
        }'

200Example

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    "string"
  ],
  "result": {
    "accessKeyId": "example-access-key-id",
    "secretAccessKey": "example-secret-key",
    "sessionToken": "example-session-token"
  },
  "success": true
}

Domain types

TemporaryCredential = { bucket, parentAccessKeyId, permission, 3 more... }