Cloudflare API | Accounts › Logs › Audit › Get Account Audit Logs Version 2 Beta Release

Delete a specific account (only available for tenant admins at this time). This is a permanent operation that will delete any zones or other resources under the account

Domain types

Account = { id, name, type, 3 more... }

Accounts

Account Organizations

accounts.account_organizations

Methods

Move Account -> Envelope<{ account_id, destination_organization_id, source_organization_id }>

post/accounts/{account_id}/move

Move an account within an organization hierarchy or an account outside an organization. (Currently in Closed Beta - see https://developers.cloudflare.com/fundamentals/organizations/)

Accounts

Account Profile

accounts.account_profile

Methods

Get Account Profile -> Envelope<

AccountProfile

get/accounts/{account_id}/profile

Get account profile

Modify Account Profile ->

put/accounts/{account_id}/profile

Modify account profile

Domain types

AccountProfile = { business_address, business_email, business_name, 2 more... }

Accounts

Logs

accounts.logs

Accounts Logs

Audit

accounts.logs.audit

Methods

Get Account Audit Logs Version 2 Beta Release -> CursorPaginationAfter<{ id, account, action, 4 more... }>

get/accounts/{account_id}/logs/audit

Gets a list of audit logs for an account.

This is the beta release of Audit Logs Version 2. Since this is a beta version, there may be gaps or missing entries in the available audit logs. Be aware of the following limitations.

Audit logs are available only for the past 30 days.
Error handling is not yet implemented.

Security

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example: Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

Accepted Permissions (at least one required)

Account Settings Write Account Settings Read

path Parameters

account_id: string

The unique id that identifies the account.

query Parameters

before: string

(format: date)

Limits the returned results to logs older than the specified date. This can be a date string 2019-04-30 (interpreted in UTC) or an absolute timestamp that conforms to RFC3339.

since: string

(format: date)

Limits the returned results to logs newer than the specified date. This can be a date string 2019-04-30 (interpreted in UTC) or an absolute timestamp that conforms to RFC3339.

id: {

Optional

not: Array<string>

Optional

Filters out audit logs by their IDs.

}

account_name: {

Optional

not: Array<string>

Optional

Filters out audit logs by the account name.

}

action_result: {

Optional

not: Array<"success" | "failure">

Optional

Filters out audit logs by whether the action was successful or not.

}

action_type: {

Optional

not: Array<"create" | "delete" | "view" | 1 more...>

Optional

Filters out audit logs by the action type.

}

actor_context: {

Optional

not: Array<"api_key" | "api_token" | "dash" | 2 more...>

Optional

Filters out audit logs by the actor context.

}

actor_email: {

Optional

not: Array<string>

Optional

Filters out audit logs by the actor's email address.

}

actor_id: {

Optional

not: Array<string>

Optional

Filters out audit logs by the actor ID. This can be either the Account ID or User ID.

}

actor_ip_address: {

Optional

not: Array<string>

Optional

Filters out audit logs IP address where the action was initiated.

}

actor_token_id: {

Optional

not: Array<string>

Optional

Filters out audit logs by the API token ID when the actor context is an api_token or oauth.

}

actor_token_name: {

Optional

not: Array<string>

Optional

Filters out audit logs by the API token name when the actor context is an api_token or oauth.

}

actor_type: {

Optional

not: Array<"account" | "cloudflare_admin" | "system" | 1 more...>

Optional

Filters out audit logs by the actor type.

}

audit_log_id: {

Optional

not: Array<string>

Optional

Deprecated

Filters out audit logs by their IDs.

}

cursor: string

Optional

The cursor is an opaque token used to paginate through large sets of records. It indicates the position from which to continue when requesting the next set of records. A valid cursor value can be obtained from the cursor object in the result_info structure of a previous response.

direction:

Optional

(default: "desc")

Sets sorting order.

"desc"

"asc"

limit: number

Optional

(maximum: 1000, minimum: 1, default: 100)

The number limits the objects to return. The cursor attribute may be used to iterate over the next batch of objects if there are more than the limit.

raw_cf_ray_id: {

Optional

not: Array<string>

Optional

Filters out audit logs by the response CF Ray ID.

}

raw_method: {

Optional

not: Array<string>

Optional

Filters out audit logs by the HTTP method for the API call.

}

raw_status_code: {

Optional

not: Array<number>

Optional

Filters out audit logs by the response status code that was returned.

}

raw_uri: {

Optional

not: Array<string>

Optional

Filters out audit logs by the request URI.

}

resource_id: {

Optional

not: Array<string>

Optional

Filters out audit logs by the resource ID.

}

resource_product: {

Optional

not: Array<string>

Optional

Filters out audit logs by the Cloudflare product associated with the changed resource.

}

resource_scope: {

Optional

not: Array<"accounts" | "user" | "zones">

Optional

Filters out audit logs by the resource scope, specifying whether the resource is associated with an user, an account, or a zone.

}

resource_type: {

Optional

not: Array<string>

Optional

Filters out audit logs based on the unique type of resource changed by the action.

}

zone_id: {

Optional

not: Array<string>

Optional

Filters out audit logs by the zone ID.

}

zone_name: {

Optional

not: Array<string>

Optional

Filters out audit logs by the zone name associated with the change.

}

Response fields

errors: Array<{ message }>

Optional

result: Array<{ id, account, action, 4 more... }>

Optional

result_info: { count, cursor }

Optional

Provides information about the result of the request, including count and cursor.

success: true

Optional

Indicates whether the API call was successful

Request example

curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/logs/audit \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

200Example

{
  "errors": [
    {
      "message": "message"
    }
  ],
  "result": [
    {
      "id": "023e105f4ecef8ad9ca31a8372d0c353",
      "account": {
        "id": "4bb334f7c94c4a29a045f03944f072e5",
        "name": "Example Account"
      },
      "action": {
        "description": "Add Member",
        "result": "success",
        "time": "2024-04-26T17:31:07Z",
        "type": "create"
      },
      "actor": {
        "id": "f6b5de0326bb5182b8a4840ee01ec774",
        "context": "dash",
        "email": "alice@example.com",
        "ip_address": "198.41.129.166",
        "token_id": "token_id",
        "token_name": "token_name",
        "type": "user"
      },
      "raw": {
        "cf_ray_id": "8e9b1c60ef9e1c9a",
        "method": "POST",
        "status_code": 200,
        "uri": "/accounts/4bb334f7c94c4a29a045f03944f072e5/members",
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Safari/605.1.15"
      },
      "resource": {
        "id": "id",
        "product": "members",
        "request": {},
        "response": {},
        "scope": {},
        "type": "type"
      },
      "zone": {
        "id": "id",
        "name": "example.com"
      }
    }
  ],
  "result_info": {
    "count": "1",
    "cursor": "ASqdKd7dKgxh-aZ8bm0mZos1BtW4BdEqifCzNkEeGRzi_5SN_-362Y8sF-C1TRn60_6rd3z2dIajf9EAPyQ_NmIeAMkacmaJPXipqvP7PLU4t72wyqBeJfjmjdE="
  },
  "success": true
}

Accounts

Members

accounts.members

Methods

List Members -> V4PagePaginationArray<

Member

get/accounts/{account_id}/members

List all members of an account.

Member Details -> Envelope<

Member

get/accounts/{account_id}/members/{member_id}

Get information about a specific member of an account.

Add Member -> Envelope<

Member

post/accounts/{account_id}/members

Add a user to the list of members for this account.

Update Member -> Envelope<

Member

put/accounts/{account_id}/members/{member_id}

Modify an account member.

Remove Member -> Envelope<{ id }>

delete/accounts/{account_id}/members/{member_id}

Remove a member from an account.

Domain types

Status = "member" | "invited"

Whether the user is a member of the organization or has an invitation pending.

Accounts

Roles

accounts.roles

Methods

List Roles -> V4PagePaginationArray<

Role

get/accounts/{account_id}/roles

Get all available roles for an account.

Role Details -> Envelope<

Role

get/accounts/{account_id}/roles/{role_id}

Get information about a specific role for an account.

Accounts

Subscriptions

accounts.subscriptions

Methods

List Subscriptions -> SinglePage<

Subscription

get/accounts/{account_id}/subscriptions

Lists all of an account's subscriptions.

Create Subscription -> Envelope<

Subscription

post/accounts/{account_id}/subscriptions

Creates an account subscription.

Update Subscription -> Envelope<

Subscription

put/accounts/{account_id}/subscriptions/{subscription_identifier}

Updates an account subscription.

Delete Subscription -> Envelope<{ subscription_id }>

delete/accounts/{account_id}/subscriptions/{subscription_identifier}

Deletes an account's subscription.

Accounts

Tokens

accounts.tokens

Methods

List Tokens -> V4PagePaginationArray<

Token

get/accounts/{account_id}/tokens

List all Account Owned API tokens created for this account.

Token Details -> Envelope<

Token

get/accounts/{account_id}/tokens/{token_id}

Get information about a specific Account Owned API token.

Create Token -> Envelope<{ id, condition, expires_on, 8 more... }>

post/accounts/{account_id}/tokens

Create a new Account Owned API token.

Update Token -> Envelope<

Token

put/accounts/{account_id}/tokens/{token_id}

Update an existing token.

Delete Token -> Envelope<{ id }>

delete/accounts/{account_id}/tokens/{token_id}

Destroy an Account Owned API token.

Verify Token -> Envelope<{ id, status, expires_on, 1 more... }>

get/accounts/{account_id}/tokens/verify

Test whether a token works.

Accounts Tokens

Permission Groups

accounts.tokens.permission_groups

Methods

List Permission Groups -> SinglePage<{ id, name, scopes }>

get/accounts/{account_id}/tokens/permission_groups

Find all available permission groups for Account Owned API Tokens

List Permission Groups -> Envelope<Array<{ id, name, scopes }>>

get/accounts/{account_id}/tokens/permission_groups

Find all available permission groups for Account Owned API Tokens

Accounts Tokens

Value

accounts.tokens.value

Methods

Roll Token -> Envelope<

TokenValue

put/accounts/{account_id}/tokens/{token_id}/value

Roll the Account Owned API token secret.