Create an Access group
Creates a new Access group.
Security
API Token
The preferred authorization scheme for interacting with the Cloudflare API. Create a token.
Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYYAPI Email + API Key
The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.
X-Auth-Email: user@example.comThe previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.
X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194Accepted Permissions (at least one required)
Access: Organizations, Identity Providers, and Groups WriteParametersExpand Collapse
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.
Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
ReturnsExpand Collapse
class GroupCreateResponse: …
Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.
Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Create an Access group
import os
from cloudflare import Cloudflare
client = Cloudflare(
api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted
)
group = client.zero_trust.access.groups.create(
include=[{
"group": {
"id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
}
}],
name="Allow devs",
account_id="account_id",
)
print(group.id){
"errors": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"messages": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"success": true,
"result": {
"id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
"created_at": "2014-01-01T05:20:00.12345Z",
"exclude": [
{
"group": {
"id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
}
}
],
"include": [
{
"group": {
"id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
}
}
],
"is_default": [
{
"group": {
"id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
}
}
],
"name": "Allow devs",
"require": [
{
"group": {
"id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
}
}
],
"updated_at": "2014-01-01T05:20:00.12345Z"
}
}Returns Examples
{
"errors": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"messages": [
{
"code": 1000,
"message": "message",
"documentation_url": "documentation_url",
"source": {
"pointer": "pointer"
}
}
],
"success": true,
"result": {
"id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",
"created_at": "2014-01-01T05:20:00.12345Z",
"exclude": [
{
"group": {
"id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
}
}
],
"include": [
{
"group": {
"id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
}
}
],
"is_default": [
{
"group": {
"id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
}
}
],
"name": "Allow devs",
"require": [
{
"group": {
"id": "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
}
}
],
"updated_at": "2014-01-01T05:20:00.12345Z"
}
}