API Reference

Zero Trust

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Cloud Workload Security

Cloud Workload SecurityBasic Auth Credentials

List basic-auth credentials for an account

zero_trust.cws.basic_auth_credentials.list(BasicAuthCredentialListParams**kwargs) -> SyncCursorPagination[BasicAuthCredential]

GET/accounts/{account_id}/cws/basic-auth-credentials

Get a basic-auth credential by ID

zero_trust.cws.basic_auth_credentials.get(strcredential_id, BasicAuthCredentialGetParams**kwargs) -> BasicAuthCredential

GET/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}

Create a basic-auth credential

zero_trust.cws.basic_auth_credentials.create(BasicAuthCredentialCreateParams**kwargs) -> BasicAuthCredential

POST/accounts/{account_id}/cws/basic-auth-credentials

Delete a basic-auth credential

zero_trust.cws.basic_auth_credentials.delete(strcredential_id, BasicAuthCredentialDeleteParams**kwargs) -> BasicAuthCredentialDeleteResponse

DELETE/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}

ModelsExpand Collapse

class BasicAuthCredential: …

id: str

Server-assigned UUID

formatuuid

created_at: datetime

formatdate-time

updated_at: datetime

formatdate-time

username: str

Login presented by the client. Printable ASCII only, excluding space and colon (RFC 7617 forbids a colon in the user-id).

maxLength100

minLength1

class BasicAuthCredentialDeleteResponse: …

id: str

formatuuid

Cloud Workload SecurityBasic Auth CredentialsSecrets

List secrets for a basic-auth credential

zero_trust.cws.basic_auth_credentials.secrets.list(strcredential_id, SecretListParams**kwargs) -> SyncCursorPagination[BasicAuthSecret]

GET/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}/secrets

Get a basic-auth secret by ID

zero_trust.cws.basic_auth_credentials.secrets.get(strsecret_id, SecretGetParams**kwargs) -> BasicAuthSecret

GET/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}/secrets/{secret_id}

Add a secret to a basic-auth credential

zero_trust.cws.basic_auth_credentials.secrets.create(strcredential_id, SecretCreateParams**kwargs) -> BasicAuthSecret

POST/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}/secrets

Delete a basic-auth secret

zero_trust.cws.basic_auth_credentials.secrets.delete(strsecret_id, SecretDeleteParams**kwargs) -> SecretDeleteResponse

DELETE/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}/secrets/{secret_id}

ModelsExpand Collapse

class BasicAuthSecret: …

id: str

Server-assigned UUID

formatuuid

created_at: datetime

formatdate-time

expires_at: Optional[datetime]

Optional RFC 3339 expiration time. Omit for no expiration.

formatdate-time

class SecretDeleteResponse: …

id: str

formatuuid

Cloud Workload SecurityDeployments

List deployments

zero_trust.cws.deployments.list(DeploymentListParams**kwargs) -> SyncCursorPagination[Deployment]

GET/accounts/{account_id}/cws/deployments

Get a deployment by ID

zero_trust.cws.deployments.get(strdeployment_id, DeploymentGetParams**kwargs) -> Deployment

GET/accounts/{account_id}/cws/deployments/{deployment_id}

Create a new deployment

zero_trust.cws.deployments.create(DeploymentCreateParams**kwargs) -> Deployment

POST/accounts/{account_id}/cws/deployments

Update a deployment

zero_trust.cws.deployments.update(strdeployment_id, DeploymentUpdateParams**kwargs) -> Deployment

PUT/accounts/{account_id}/cws/deployments/{deployment_id}

Delete a deployment

zero_trust.cws.deployments.delete(strdeployment_id, DeploymentDeleteParams**kwargs) -> DeploymentDeleteResponse

DELETE/accounts/{account_id}/cws/deployments/{deployment_id}

ModelsExpand Collapse

class Deployment: …

id: str

Server-assigned UUID

formatuuid

basic_auth_credential_ids: Optional[List[str]]

IDs of basic-auth credentials attached to this deployment

created_at: datetime

formatdate-time

default_mode: Literal["ALLOW", "BLOCK"]

Default traffic decision when no policy set matches

One of the following:

"ALLOW"

"BLOCK"

name: str

Human-readable name; unique per account

maxLength100

minLength1

on_error_action: Literal["BLOCK", "SKIP"]

Action applied when an enforcing policy has a runtime Rego error

One of the following:

"BLOCK"

"SKIP"

policy_set_ids: Optional[List[str]]

IDs of policy sets attached to this deployment

rego_raise_error: bool

Whether OPA builtin failures are raised as runtime evaluation errors

tags: Dict[str, str]

Tags attached to this deployment

updated_at: datetime

formatdate-time

description: Optional[str]

Optional free-form description.

maxLength1024

domain_acl_id: Optional[str]

ID of the attached domain ACL. Omitted when none.

formatuuid

class DeploymentDeleteResponse: …

id: str

formatuuid

Cloud Workload SecurityDomain ACLs

List domain ACLs

zero_trust.cws.domain_acls.list(DomainACLListParams**kwargs) -> SyncCursorPagination[DomainACL]

GET/accounts/{account_id}/cws/domain-acls

Get a domain ACL by ID

zero_trust.cws.domain_acls.get(strdomain_acl_id, DomainACLGetParams**kwargs) -> DomainACL

GET/accounts/{account_id}/cws/domain-acls/{domain_acl_id}

Create a new domain ACL

zero_trust.cws.domain_acls.create(DomainACLCreateParams**kwargs) -> DomainACL

POST/accounts/{account_id}/cws/domain-acls

Update a domain ACL and replace its entries

zero_trust.cws.domain_acls.update(strdomain_acl_id, DomainACLUpdateParams**kwargs) -> DomainACL

PUT/accounts/{account_id}/cws/domain-acls/{domain_acl_id}

Delete a domain ACL

zero_trust.cws.domain_acls.delete(strdomain_acl_id, DomainACLDeleteParams**kwargs) -> DomainACLDeleteResponse

DELETE/accounts/{account_id}/cws/domain-acls/{domain_acl_id}

ModelsExpand Collapse

class DomainACL: …

id: str

Server-assigned UUID

formatuuid

created_at: datetime

formatdate-time

default_action: Literal["ALLOW", "BLOCK"]

Action applied when no entry matches the request domain

One of the following:

"ALLOW"

"BLOCK"

entries: Optional[List[Entry]]

Per-domain action overrides. Each domain appears at most once.

action: Literal["ALLOW", "BLOCK"]

Per-domain decision overriding the parent ACL’s default_action

One of the following:

"ALLOW"

"BLOCK"

domain: str

Hostname or domain pattern, capped at 255 UTF-8 bytes

maxLength255

minLength1

name: str

Human-readable name; unique per account

maxLength100

minLength1

updated_at: datetime

formatdate-time

class DomainACLDeleteResponse: …

id: str

formatuuid

Cloud Workload SecurityPolicies

List policies

zero_trust.cws.policies.list(PolicyListParams**kwargs) -> SyncCursorPagination[Policy]

GET/accounts/{account_id}/cws/policies

Get a policy by ID

zero_trust.cws.policies.get(strpolicy_id, PolicyGetParams**kwargs) -> Policy

GET/accounts/{account_id}/cws/policies/{policy_id}

Create a new policy

zero_trust.cws.policies.create(PolicyCreateParams**kwargs) -> Policy

POST/accounts/{account_id}/cws/policies

Update a policy

zero_trust.cws.policies.update(strpolicy_id, PolicyUpdateParams**kwargs) -> Policy

PUT/accounts/{account_id}/cws/policies/{policy_id}

Delete a policy

zero_trust.cws.policies.delete(strpolicy_id, PolicyDeleteParams**kwargs) -> PolicyDeleteResponse

DELETE/accounts/{account_id}/cws/policies/{policy_id}

ModelsExpand Collapse

class Policy: …

id: str

Server-assigned UUID

formatuuid

created_at: datetime

formatdate-time

entrypoint: str

Non-function rule declared in rego_source. Evaluation uses data.<package_path>..

maxLength255

filter: Optional[str]

Optional filter expression that determines whether this policy applies. Null means the policy applies to every request. Maximum 4096 UTF-8 bytes.

maxLength4096

minLength1

name: str

Human-readable name; unique per account

maxLength100

minLength1

package_path: str

Dotted path derived from rego_source. Begins with policy. and is unique per account.

maxLength1024

rego_source: str

Inline Rego source with a package beginning with “policy.” Maximum 16384 UTF-8 bytes.

maxLength16384

minLength1

tags: Dict[str, str]

Tags attached to this policy

updated_at: datetime

formatdate-time

description: Optional[str]

Optional free-form description.

maxLength1024

class PolicyDeleteResponse: …

id: str

formatuuid

Cloud Workload SecurityPolicy Sets

List policy sets

zero_trust.cws.policy_sets.list(PolicySetListParams**kwargs) -> SyncCursorPagination[PolicySet]

GET/accounts/{account_id}/cws/policy-sets

Get a policy set by ID

zero_trust.cws.policy_sets.get(strpolicy_set_id, PolicySetGetParams**kwargs) -> PolicySet

GET/accounts/{account_id}/cws/policy-sets/{policy_set_id}

Create a new policy set

zero_trust.cws.policy_sets.create(PolicySetCreateParams**kwargs) -> PolicySet

POST/accounts/{account_id}/cws/policy-sets

Update a policy set

zero_trust.cws.policy_sets.update(strpolicy_set_id, PolicySetUpdateParams**kwargs) -> PolicySet

PUT/accounts/{account_id}/cws/policy-sets/{policy_set_id}

Delete a policy set

zero_trust.cws.policy_sets.delete(strpolicy_set_id, PolicySetDeleteParams**kwargs) -> PolicySetDeleteResponse

DELETE/accounts/{account_id}/cws/policy-sets/{policy_set_id}

ModelsExpand Collapse

class PolicySet: …

id: str

Server-assigned UUID

formatuuid

created_at: datetime

formatdate-time

exclude_workload_ids: Optional[List[str]]

IDs of workloads that exclude matching requests. Exclusions take precedence.

include_workload_ids: Optional[List[str]]

IDs of workloads that include matching requests. Empty includes all requests before exclusions.

name: str

Human-readable name; unique per account

maxLength100

minLength1

policies: Optional[List[Policy]]

Member policies and their per-membership enforcement mode

enforce: bool

Whether this policy should enforce when it matches. False keeps the policy attached for non-enforcing evaluation.

policy_id: str

ID of the member policy

formatuuid

tags: Dict[str, str]

Tags attached to this policy set

updated_at: datetime

formatdate-time

description: Optional[str]

Optional free-form description.

maxLength1024

class PolicySetDeleteResponse: …

id: str

formatuuid

Cloud Workload SecurityRego Metadata

List Rego metadata documents

zero_trust.cws.rego_metadata.list(RegoMetadataListParams**kwargs) -> SyncCursorPagination[RegoMetadata]

GET/accounts/{account_id}/cws/rego-metadata

Get a rego metadata document by ID

zero_trust.cws.rego_metadata.get(strrego_metadata_id, RegoMetadataGetParams**kwargs) -> RegoMetadata

GET/accounts/{account_id}/cws/rego-metadata/{rego_metadata_id}

Create a new rego metadata document

zero_trust.cws.rego_metadata.create(RegoMetadataCreateParams**kwargs) -> RegoMetadata

POST/accounts/{account_id}/cws/rego-metadata

Update a rego metadata document

zero_trust.cws.rego_metadata.update(strrego_metadata_id, RegoMetadataUpdateParams**kwargs) -> RegoMetadata

PUT/accounts/{account_id}/cws/rego-metadata/{rego_metadata_id}

Delete a rego metadata document

zero_trust.cws.rego_metadata.delete(strrego_metadata_id, RegoMetadataDeleteParams**kwargs) -> RegoMetadataDeleteResponse

DELETE/accounts/{account_id}/cws/rego-metadata/{rego_metadata_id}

ModelsExpand Collapse

class RegoMetadata: …

id: str

Server-assigned UUID

formatuuid

created_at: datetime

formatdate-time

data: object

import_path: str

Unique Rego import path in the form metadata., with one alphanumeric or underscore segment. Reference it as data.<import_path>.

maxLength255

minLength1

name: str

Human-readable name; unique per account

maxLength100

minLength1

updated_at: datetime

formatdate-time

class RegoMetadataDeleteResponse: …

id: str

formatuuid

Cloud Workload SecurityRego Modules

List Rego modules

zero_trust.cws.rego_modules.list(RegoModuleListParams**kwargs) -> SyncCursorPagination[RegoModule]

GET/accounts/{account_id}/cws/rego-modules

Get a Rego module by ID

zero_trust.cws.rego_modules.get(strrego_module_id, RegoModuleGetParams**kwargs) -> RegoModule

GET/accounts/{account_id}/cws/rego-modules/{rego_module_id}

Create a new Rego module

zero_trust.cws.rego_modules.create(RegoModuleCreateParams**kwargs) -> RegoModule

POST/accounts/{account_id}/cws/rego-modules

Update a Rego module

zero_trust.cws.rego_modules.update(strrego_module_id, RegoModuleUpdateParams**kwargs) -> RegoModule

PUT/accounts/{account_id}/cws/rego-modules/{rego_module_id}

Delete a Rego module

zero_trust.cws.rego_modules.delete(strrego_module_id, RegoModuleDeleteParams**kwargs) -> RegoModuleDeleteResponse

DELETE/accounts/{account_id}/cws/rego-modules/{rego_module_id}

ModelsExpand Collapse

class RegoModule: …

id: str

Server-assigned UUID

formatuuid

created_at: datetime

formatdate-time

name: str

Human-readable name; unique per account

maxLength100

minLength1

package_path: str

Dotted path derived from rego_source. Begins with lib. and is unique per account.

maxLength1024

rego_source: str

Library Rego source with a package beginning with “lib.” Maximum 16384 UTF-8 bytes.

maxLength16384

minLength1

updated_at: datetime

formatdate-time

class RegoModuleDeleteResponse: …

id: str

formatuuid

Cloud Workload SecurityTenant Structures

List tenant structures for an account

zero_trust.cws.tenant_structures.list(TenantStructureListParams**kwargs) -> SyncCursorPagination[TenantStructure]

GET/accounts/{account_id}/cws/tenant-structures

Get a tenant structure by ID

zero_trust.cws.tenant_structures.get(strstructure_id, TenantStructureGetParams**kwargs) -> TenantStructure

GET/accounts/{account_id}/cws/tenant-structures/{structure_id}

Create a tenant structure

zero_trust.cws.tenant_structures.create(TenantStructureCreateParams**kwargs) -> TenantStructure

POST/accounts/{account_id}/cws/tenant-structures

Update a tenant structure

zero_trust.cws.tenant_structures.update(strstructure_id, TenantStructureUpdateParams**kwargs) -> TenantStructure

PUT/accounts/{account_id}/cws/tenant-structures/{structure_id}

Delete a tenant structure

zero_trust.cws.tenant_structures.delete(strstructure_id, TenantStructureDeleteParams**kwargs) -> TenantStructureDeleteResponse

DELETE/accounts/{account_id}/cws/tenant-structures/{structure_id}

ModelsExpand Collapse

class TenantStructure: …

id: str

Server-assigned UUID

formatuuid

application: Literal["aws", "cloudflare"]

Platform this structure models. Immutable after creation; determines valid node kinds and identifier formats.

One of the following:

"aws"

"cloudflare"

created_at: datetime

formatdate-time

name: str

Human-readable name; unique per account

maxLength100

minLength1

updated_at: datetime

formatdate-time

import_path: Optional[str]

Optional unique Rego mount path in the form tenant... The application segment must match application; omitted when unmounted.

maxLength255

minLength1

class TenantStructureDeleteResponse: …

id: str

formatuuid

Cloud Workload SecurityTenant StructuresNodes

List nodes for a tenant structure

zero_trust.cws.tenant_structures.nodes.list(strstructure_id, NodeListParams**kwargs) -> SyncCursorPagination[TenantStructureNode]

GET/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes

Get a tenant node by ID

zero_trust.cws.tenant_structures.nodes.get(strnode_id, NodeGetParams**kwargs) -> TenantStructureNode

GET/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/{node_id}

Add a node to a tenant structure

zero_trust.cws.tenant_structures.nodes.create(strstructure_id, NodeCreateParams**kwargs) -> TenantStructureNode

POST/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes

Update a tenant node

zero_trust.cws.tenant_structures.nodes.update(strnode_id, NodeUpdateParams**kwargs) -> TenantStructureNode

PUT/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/{node_id}

Delete a tenant node

zero_trust.cws.tenant_structures.nodes.delete(strnode_id, NodeDeleteParams**kwargs) -> NodeDeleteResponse

DELETE/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/{node_id}

Apply a batch of tenant node mutations

zero_trust.cws.tenant_structures.nodes.batch(strstructure_id, NodeBatchParams**kwargs) -> NodeBatchResponse

POST/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/batch

ModelsExpand Collapse

class TenantStructureNode: …

id: str

Server-assigned UUID

formatuuid

created_at: datetime

formatdate-time

native_id: str

Cloud-native identifier of this node, unique within the structure; the parent-reference target. Shape depends on the structure’s application. Immutable after create.

maxLength255

minLength1

node_kind: str

Position in the tree. Legal values depend on the structure’s application (aws: root/ou/account; cloudflare: org/account/zone). At most one root per structure. Immutable after create.

maxLength64

minLength1

updated_at: datetime

formatdate-time

name: Optional[str]

Display name (e.g. an OU or account name), mutable. Optional; empty by default.

maxLength100

parent: Optional[str]

Native ID of this node’s parent. Required for non-root nodes and omitted for the root. The parent must be in the same structure and able to contain this node kind.

maxLength255

class NodeDeleteResponse: …

id: str

formatuuid

class NodeBatchResponse: …

created: List[TenantStructureNode]

id: str

Server-assigned UUID

formatuuid

created_at: datetime

formatdate-time

native_id: str

Cloud-native identifier of this node, unique within the structure; the parent-reference target. Shape depends on the structure’s application. Immutable after create.

maxLength255

minLength1

node_kind: str

Position in the tree. Legal values depend on the structure’s application (aws: root/ou/account; cloudflare: org/account/zone). At most one root per structure. Immutable after create.

maxLength64

minLength1

updated_at: datetime

formatdate-time

name: Optional[str]

Display name (e.g. an OU or account name), mutable. Optional; empty by default.

maxLength100

parent: Optional[str]

Native ID of this node’s parent. Required for non-root nodes and omitted for the root. The parent must be in the same structure and able to contain this node kind.

maxLength255

deleted: List[Deleted]

id: str

formatuuid

updated: List[TenantStructureNode]

id: str

Server-assigned UUID

formatuuid

created_at: datetime

formatdate-time

native_id: str

Cloud-native identifier of this node, unique within the structure; the parent-reference target. Shape depends on the structure’s application. Immutable after create.

maxLength255

minLength1

node_kind: str

Position in the tree. Legal values depend on the structure’s application (aws: root/ou/account; cloudflare: org/account/zone). At most one root per structure. Immutable after create.

maxLength64

minLength1

updated_at: datetime

formatdate-time

name: Optional[str]

Display name (e.g. an OU or account name), mutable. Optional; empty by default.

maxLength100

parent: Optional[str]

Native ID of this node’s parent. Required for non-root nodes and omitted for the root. The parent must be in the same structure and able to contain this node kind.

maxLength255

Cloud Workload SecurityWorkloads

List workloads

zero_trust.cws.workloads.list(WorkloadListParams**kwargs) -> SyncCursorPagination[Workload]

GET/accounts/{account_id}/cws/workloads

Get a workload by ID

zero_trust.cws.workloads.get(strworkload_id, WorkloadGetParams**kwargs) -> Workload

GET/accounts/{account_id}/cws/workloads/{workload_id}

Create a new workload

zero_trust.cws.workloads.create(WorkloadCreateParams**kwargs) -> Workload

POST/accounts/{account_id}/cws/workloads

Update a workload

zero_trust.cws.workloads.update(strworkload_id, WorkloadUpdateParams**kwargs) -> Workload

PUT/accounts/{account_id}/cws/workloads/{workload_id}

Delete a workload

zero_trust.cws.workloads.delete(strworkload_id, WorkloadDeleteParams**kwargs) -> WorkloadDeleteResponse

DELETE/accounts/{account_id}/cws/workloads/{workload_id}

ModelsExpand Collapse

class Workload: …

id: str

Server-assigned UUID

formatuuid

created_at: datetime

formatdate-time

filter: str

Filter expression selecting the requests this workload matches. Maximum 4096 UTF-8 bytes.

maxLength4096

minLength1

name: str

Human-readable handle; unique per account.

maxLength100

minLength1

tags: Dict[str, str]

Tags attached to this workload

updated_at: datetime

formatdate-time

description: Optional[str]

Optional free-form description.

maxLength1024

class WorkloadDeleteResponse: …

id: str

formatuuid