API Reference

Zero Trust

Cloud Workload Security

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Tenant Structures

List tenant structures for an account

zero_trust.cws.tenant_structures.list(TenantStructureListParams**kwargs) -> SyncCursorPagination[TenantStructure]

GET/accounts/{account_id}/cws/tenant-structures

Get a tenant structure by ID

zero_trust.cws.tenant_structures.get(strstructure_id, TenantStructureGetParams**kwargs) -> TenantStructure

GET/accounts/{account_id}/cws/tenant-structures/{structure_id}

Create a tenant structure

zero_trust.cws.tenant_structures.create(TenantStructureCreateParams**kwargs) -> TenantStructure

POST/accounts/{account_id}/cws/tenant-structures

Update a tenant structure

zero_trust.cws.tenant_structures.update(strstructure_id, TenantStructureUpdateParams**kwargs) -> TenantStructure

PUT/accounts/{account_id}/cws/tenant-structures/{structure_id}

Delete a tenant structure

zero_trust.cws.tenant_structures.delete(strstructure_id, TenantStructureDeleteParams**kwargs) -> TenantStructureDeleteResponse

DELETE/accounts/{account_id}/cws/tenant-structures/{structure_id}

ModelsExpand Collapse

class TenantStructure: …

id: str

Server-assigned UUID

formatuuid

application: Literal["aws", "cloudflare"]

Platform this structure models. Immutable after creation; determines valid node kinds and identifier formats.

One of the following:

"aws"

"cloudflare"

created_at: datetime

formatdate-time

name: str

Human-readable name; unique per account

maxLength100

minLength1

updated_at: datetime

formatdate-time

import_path: Optional[str]

Optional unique Rego mount path in the form tenant... The application segment must match application; omitted when unmounted.

maxLength255

minLength1

class TenantStructureDeleteResponse: …

id: str

formatuuid

Tenant StructuresNodes

List nodes for a tenant structure

zero_trust.cws.tenant_structures.nodes.list(strstructure_id, NodeListParams**kwargs) -> SyncCursorPagination[TenantStructureNode]

GET/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes

Get a tenant node by ID

zero_trust.cws.tenant_structures.nodes.get(strnode_id, NodeGetParams**kwargs) -> TenantStructureNode

GET/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/{node_id}

Add a node to a tenant structure

zero_trust.cws.tenant_structures.nodes.create(strstructure_id, NodeCreateParams**kwargs) -> TenantStructureNode

POST/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes

Update a tenant node

zero_trust.cws.tenant_structures.nodes.update(strnode_id, NodeUpdateParams**kwargs) -> TenantStructureNode

PUT/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/{node_id}

Delete a tenant node

zero_trust.cws.tenant_structures.nodes.delete(strnode_id, NodeDeleteParams**kwargs) -> NodeDeleteResponse

DELETE/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/{node_id}

Apply a batch of tenant node mutations

zero_trust.cws.tenant_structures.nodes.batch(strstructure_id, NodeBatchParams**kwargs) -> NodeBatchResponse

POST/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/batch

ModelsExpand Collapse

class TenantStructureNode: …

id: str

Server-assigned UUID

formatuuid

created_at: datetime

formatdate-time

native_id: str

Cloud-native identifier of this node, unique within the structure; the parent-reference target. Shape depends on the structure’s application. Immutable after create.

maxLength255

minLength1

node_kind: str

Position in the tree. Legal values depend on the structure’s application (aws: root/ou/account; cloudflare: org/account/zone). At most one root per structure. Immutable after create.

maxLength64

minLength1

updated_at: datetime

formatdate-time

name: Optional[str]

Display name (e.g. an OU or account name), mutable. Optional; empty by default.

maxLength100

parent: Optional[str]

Native ID of this node’s parent. Required for non-root nodes and omitted for the root. The parent must be in the same structure and able to contain this node kind.

maxLength255

class NodeDeleteResponse: …

id: str

formatuuid

class NodeBatchResponse: …

created: List[TenantStructureNode]

id: str

Server-assigned UUID

formatuuid

created_at: datetime

formatdate-time

native_id: str

Cloud-native identifier of this node, unique within the structure; the parent-reference target. Shape depends on the structure’s application. Immutable after create.

maxLength255

minLength1

node_kind: str

Position in the tree. Legal values depend on the structure’s application (aws: root/ou/account; cloudflare: org/account/zone). At most one root per structure. Immutable after create.

maxLength64

minLength1

updated_at: datetime

formatdate-time

name: Optional[str]

Display name (e.g. an OU or account name), mutable. Optional; empty by default.

maxLength100

parent: Optional[str]

Native ID of this node’s parent. Required for non-root nodes and omitted for the root. The parent must be in the same structure and able to contain this node kind.

maxLength255

deleted: List[Deleted]

id: str

formatuuid

updated: List[TenantStructureNode]

id: str

Server-assigned UUID

formatuuid

created_at: datetime

formatdate-time

native_id: str

Cloud-native identifier of this node, unique within the structure; the parent-reference target. Shape depends on the structure’s application. Immutable after create.

maxLength255

minLength1

node_kind: str

Position in the tree. Legal values depend on the structure’s application (aws: root/ou/account; cloudflare: org/account/zone). At most one root per structure. Immutable after create.

maxLength64

minLength1

updated_at: datetime

formatdate-time

name: Optional[str]

Display name (e.g. an OU or account name), mutable. Optional; empty by default.

maxLength100

parent: Optional[str]

Native ID of this node’s parent. Required for non-root nodes and omitted for the root. The parent must be in the same structure and able to contain this node kind.

maxLength255