Zero Trust
Zero TrustDevices
ModelsExpand Collapse
Device object { id, created, deleted, 17 more }
Registration ID. Equal to Device ID except for accounts which enabled multi-user mode.
Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
DeviceGetResponse object { id, account, created, 16 more }
Registration ID. Equal to Device ID except for accounts which enabled multi-user mode.
Zero TrustDevicesDevices
List devices
Get device
Delete device
Revoke device registrations
ModelsExpand Collapse
DeviceListResponse object { id, active_registrations, created_at, 16 more } A WARP Device.
A WARP Device.
The number of active registrations for the device. Active registrations are those which haven’t been revoked or deleted.
last_seen_registration: optional object { policy } The last seen registration for the device.
The last seen registration for the device.
Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
Deprecated: IP information is provided by DEX - see https://developers.cloudflare.com/api/resources/zero_trust/subresources/dex/subresources/fleet_status/subresources/devices/methods/list/
DeviceGetResponse object { id, active_registrations, created_at, 16 more } A WARP Device.
A WARP Device.
The number of active registrations for the device. Active registrations are those which haven’t been revoked or deleted.
last_seen_registration: optional object { policy } The last seen registration for the device.
The last seen registration for the device.
Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
Deprecated: IP information is provided by DEX - see https://developers.cloudflare.com/api/resources/zero_trust/subresources/dex/subresources/fleet_status/subresources/devices/methods/list/
Zero TrustDevicesResilience
Zero TrustDevicesResilienceGlobal WARP Override
Retrieve Global WARP override state
Set Global WARP override state
ModelsExpand Collapse
Zero TrustDevicesRegistrations
List registrations
Get registration
Delete registration
Delete registrations
Revoke registrations
Unrevoke registrations
ModelsExpand Collapse
RegistrationListResponse object { id, created_at, device, 11 more } A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device.
A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device.
The type of encryption key used by the WARP client for the active key. Currently ‘curve25519’ for WireGuard and ‘secp256r1’ for MASQUE.
policy: optional object { id, default, deleted, 2 more } The device settings profile assigned to this registration.
The device settings profile assigned to this registration.
RegistrationGetResponse object { id, created_at, device, 11 more } A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device.
A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device.
The type of encryption key used by the WARP client for the active key. Currently ‘curve25519’ for WireGuard and ‘secp256r1’ for MASQUE.
policy: optional object { id, default, deleted, 2 more } The device settings profile assigned to this registration.
The device settings profile assigned to this registration.
Zero TrustDevicesDEX Tests
List Device DEX tests
Get Device DEX test
Create Device DEX test
Update Device DEX test
Delete Device DEX test
ModelsExpand Collapse
Zero TrustDevicesIP Profiles
List IP profiles
Get IP profile
Create IP profile
Update IP profile
Delete IP profile
ModelsExpand Collapse
IPProfile object { id, created_at, description, 6 more }
The wirefilter expression to match registrations. Available values: “identity.name”, “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.saml_attributes”.
Zero TrustDevicesDeployment Groups
List deployment groups
Get deployment group
Create deployment group
Update deployment group
Delete deployment group
Zero TrustDevicesNetworks
List your device managed networks
Get device managed network details
Create a device managed network
Update a device managed network
Delete a device managed network
ModelsExpand Collapse
DeviceNetwork object { config, name, network_id, type }
Zero TrustDevicesFleet Status
Get the latest status of a device.
ModelsExpand Collapse
FleetStatusGetResponse object { colo, deviceId, mode, 40 more }
deviceIpv4: optional object { address, asn, aso, 4 more }
deviceIpv6: optional object { address, asn, aso, 4 more }
Use registrationId instead.
Deprecated: use registrationId. Device registration identifier (UUID).
gatewayIpv4: optional object { address, asn, aso, 4 more }
gatewayIpv6: optional object { address, asn, aso, 4 more }
ispIpv4: optional object { address, asn, aso, 4 more }
ispIpv6: optional object { address, asn, aso, 4 more }
Device registration identifier (UUID v4). On multi-user devices, this uniquely identifies a user’s registration on the device.
rtt: optional object { minRttUs, rttUs, rttVarUs } Round-trip time statistics for the WARP tunnel.
Round-trip time statistics for the WARP tunnel.
tunnelStats: optional object { bytesLost, bytesReceived, bytesRetransmitted, 6 more } WARP tunnel packet and byte counters.
WARP tunnel packet and byte counters.
bytesReceived: optional object { downstream, upstream } Number of bytes received, split by direction.
Number of bytes received, split by direction.
bytesRetransmitted: optional object { downstream, upstream } Number of bytes retransmitted, split by direction.
Number of bytes retransmitted, split by direction.
packetsReceived: optional object { downstream, upstream } Number of packets received, split by direction.
Number of packets received, split by direction.
packetsRetransmitted: optional object { downstream, upstream } Number of packets retransmitted, split by direction.
Number of packets retransmitted, split by direction.
Zero TrustDevicesPolicies
ModelsExpand Collapse
SettingsPolicy object { allow_mode_switch, allow_updates, allowed_to_leave, 27 more }
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
dns_search_suffixes: optional array of object { suffix, description } List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
List of routes excluded in the WARP client’s tunnel.
List of routes excluded in the WARP client’s tunnel.
global_acceleration: optional object { api_endpoints, enabled, masque_endpoints, wireguard_endpoints } Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
List of routes included in the WARP client’s tunnel.
List of routes included in the WARP client’s tunnel.
The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.
The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.
The wirefilter expression to match devices. Available values: “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.service_token_uuid”, “identity.saml_attributes”, “network”, “os.name”, “os.version”.
The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
Whether to allow the user to turn off the WARP switch and disconnect the client.
Zero TrustDevicesPoliciesDefault
Get the default device settings profile
Update the default device settings profile
ModelsExpand Collapse
DefaultGetResponse object { allow_mode_switch, allow_updates, allowed_to_leave, 20 more }
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
dns_search_suffixes: optional array of object { suffix, description } List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
List of routes excluded in the WARP client’s tunnel.
List of routes excluded in the WARP client’s tunnel.
global_acceleration: optional object { api_endpoints, enabled, masque_endpoints, wireguard_endpoints } Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
List of routes included in the WARP client’s tunnel.
List of routes included in the WARP client’s tunnel.
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
Whether to allow the user to turn off the WARP switch and disconnect the client.
DefaultEditResponse object { allow_mode_switch, allow_updates, allowed_to_leave, 20 more }
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
dns_search_suffixes: optional array of object { suffix, description } List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
List of routes excluded in the WARP client’s tunnel.
List of routes excluded in the WARP client’s tunnel.
global_acceleration: optional object { api_endpoints, enabled, masque_endpoints, wireguard_endpoints } Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
List of routes included in the WARP client’s tunnel.
List of routes included in the WARP client’s tunnel.
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
Whether to allow the user to turn off the WARP switch and disconnect the client.
Zero TrustDevicesPoliciesDefaultExcludes
Get the Split Tunnel exclude list
Set the Split Tunnel exclude list
Zero TrustDevicesPoliciesDefaultIncludes
Get the Split Tunnel include list
Set the Split Tunnel include list
Zero TrustDevicesPoliciesDefaultFallback Domains
Get your Local Domain Fallback list
Set your Local Domain Fallback list
Zero TrustDevicesPoliciesDefaultCertificates
Get device certificate provisioning status
Update device certificate provisioning status
Zero TrustDevicesPoliciesCustom
List device settings profiles
Get device settings profile by ID
Create a device settings profile
Update a device settings profile
Delete a device settings profile
Zero TrustDevicesPoliciesCustomExcludes
Get the Split Tunnel exclude list for a device settings profile
Set the Split Tunnel exclude list for a device settings profile
Zero TrustDevicesPoliciesCustomIncludes
Get the Split Tunnel include list for a device settings profile
Set the Split Tunnel include list for a device settings profile
Zero TrustDevicesPoliciesCustomFallback Domains
Get the Local Domain Fallback list for a device settings profile
Set the Local Domain Fallback list for a device settings profile
Zero TrustDevicesPosture
List device posture rules
Get device posture rule details
Create a device posture rule
Update a device posture rule
Delete a device posture rule
ModelsExpand Collapse
DeviceInput = FileInput { operating_system, path, exists, 2 more } or UniqueClientIDInput { id, operating_system } or DomainJoinedInput { operating_system, domain } or 17 moreThe value to be checked against.
The value to be checked against.
DiskEncryptionInput object { checkDisks, requireAll }
TeamsDevicesClientCertificateV2InputRequest object { certificate_id, check_private_key, operating_system, 4 more }
Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.
Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial_number} and ${hostname} are valid variables.
extended_key_usage: optional array of "clientAuth" or "emailProtection"List of values indicating purposes for which the certificate public key can be used.
List of values indicating purposes for which the certificate public key can be used.
CrowdstrikeInput object { connection_id, last_seen, operator, 6 more }
KolideInput object { connection_id, auth_state, countOperator, issue_count }
TaniumInput object { connection_id, eid_last_seen, operator, 3 more }
SentineloneS2sInput object { connection_id, active_threats, infected, 4 more }
DevicePostureRule object { id, description, enabled, 6 more }
Whether the rule is enabled. This is a computed, read-only value. It is false for deprecated Kolide posture rules that still use the issue_count input, and true otherwise.
Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.
Polling frequency for the WARP client posture check. Default: 5m (poll every five minutes). Minimum: 1m.
KolideInput object { connection_id, auth_state, countOperator, issue_count }
SentineloneS2sInput object { connection_id, active_threats, infected, 4 more }
TaniumInput object { connection_id, eid_last_seen, operator, 3 more }
Zero TrustDevicesPostureIntegrations
List your device posture integrations
Get device posture integration details
Create a device posture integration
Update a device posture integration
Delete a device posture integration
ModelsExpand Collapse
Integration object { id, config, interval, 2 more }
Zero TrustDevicesRevoke
Zero TrustDevicesSettings
Get device settings for a Zero Trust account
Update device settings for a Zero Trust account
Patch device settings for a Zero Trust account
Reset device settings for a Zero Trust account with defaults. This turns off all proxying.
ModelsExpand Collapse
DeviceSettings object { disable_for_time, external_emergency_signal_enabled, external_emergency_signal_fingerprint, 6 more }
Sets the time limit, in seconds, that a user can use an override code to bypass WARP.
Controls whether the external emergency disconnect feature is enabled.
The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server’s identity. The device will ignore any response if the server’s certificate fingerprint does not exactly match this value.
The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., “5m”, “2m30s”, “1h”). Minimum 30 seconds.
The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.
Zero TrustDevicesUnrevoke
Zero TrustDevicesOverride Codes
Get override codes (deprecated)
Get override codes
Zero TrustIdentity Providers
List Access identity providers
Get an Access identity provider
Add an Access identity provider
Update an Access identity provider
Delete an Access identity provider
ModelsExpand Collapse
AzureAD object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, 5 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Should Cloudflare try to load authentication contexts from your account
prompt: optional "login" or "select_account" or "none"Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
IdentityProvider = AzureAD { config, name, type, 5 more } or object { config, name, type, 5 more } or object { config, name, type, 5 more } or 12 more
AzureAD object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, 5 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Should Cloudflare try to load authentication contexts from your account
prompt: optional "login" or "select_account" or "none"Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessCentrify object { config, name, type, 5 more }
config: object { centrify_account, centrify_app_id, claims, 3 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessFacebook object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGitHub object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGoogle object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, email_claim_name } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGoogleApps object { config, name, type, 5 more }
config: object { apps_domain, claims, client_id, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessLinkedin object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOIDC object { config, name, type, 5 more }
config: object { auth_url, certs_url, claims, 6 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOkta object { config, name, type, 5 more }
config: object { authorization_server_id, claims, client_id, 3 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOnelogin object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessPingone object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessSAML object { config, name, type, 5 more }
config: object { attributes, email_attribute_name, enable_encryption, 5 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.
To enable encryption:
- Create a certificate set via POST to
/identity_providers/{id}/saml_certificate - Set this field to
trueand includesaml_certificate_set_idin the PUT request - Configure the public certificate in your external Identity Provider
Note: Requires saml_certificate_set_id to be set when true.
header_attributes: optional array of object { attribute_name, header_name } Add a list of attribute names that will be returned in the response header from the Access callback.
Add a list of attribute names that will be returned in the response header from the Access callback.
X509 certificate to verify the signature in the SAML authentication response
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessYandex object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOnetimepin object { config, name, type, 5 more }
config: object { redirect_url } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessCloudflare object { config, name, type, 5 more }
config: object { redirect_url, restrict_to_account_members } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
IdentityProviderSCIMConfig object { enabled, identity_update_behavior, scim_base_url, 3 more } The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
identity_update_behavior: optional "automatic" or "reauth" or "no_action"Indicates how a SCIM event updates a user identity used for policy evaluation. Use “automatic” to automatically update a user’s identity and augment it with fields from the SCIM user resource. Use “reauth” to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With “reauth” identities will not contain fields from the SCIM user resource. With “no_action” identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.
Indicates how a SCIM event updates a user identity used for policy evaluation. Use “automatic” to automatically update a user’s identity and augment it with fields from the SCIM user resource. Use “reauth” to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With “reauth” identities will not contain fields from the SCIM user resource. With “no_action” identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.
A flag to remove a user’s seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
IdentityProviderType = "onetimepin" or "azureAD" or "saml" or 12 moreThe type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
IdentityProviderListResponse = AzureAD { config, name, type, 5 more } or object { config, name, type, 5 more } or object { config, name, type, 5 more } or 12 more
AzureAD object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, 5 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Should Cloudflare try to load authentication contexts from your account
prompt: optional "login" or "select_account" or "none"Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessCentrify object { config, name, type, 5 more }
config: object { centrify_account, centrify_app_id, claims, 3 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessFacebook object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGitHub object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGoogle object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, email_claim_name } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGoogleApps object { config, name, type, 5 more }
config: object { apps_domain, claims, client_id, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessLinkedin object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOIDC object { config, name, type, 5 more }
config: object { auth_url, certs_url, claims, 6 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOkta object { config, name, type, 5 more }
config: object { authorization_server_id, claims, client_id, 3 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOnelogin object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessPingone object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessSAML object { config, name, type, 5 more }
config: object { attributes, email_attribute_name, enable_encryption, 5 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.
To enable encryption:
- Create a certificate set via POST to
/identity_providers/{id}/saml_certificate - Set this field to
trueand includesaml_certificate_set_idin the PUT request - Configure the public certificate in your external Identity Provider
Note: Requires saml_certificate_set_id to be set when true.
header_attributes: optional array of object { attribute_name, header_name } Add a list of attribute names that will be returned in the response header from the Access callback.
Add a list of attribute names that will be returned in the response header from the Access callback.
X509 certificate to verify the signature in the SAML authentication response
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessYandex object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOnetimepin object { config, name, type, 5 more }
config: object { redirect_url } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessCloudflare object { config, name, type, 5 more }
config: object { redirect_url, restrict_to_account_members } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Zero TrustIdentity ProvidersSCIM
Zero TrustIdentity ProvidersSCIMGroups
List SCIM Group resources
Zero TrustIdentity ProvidersSCIMUsers
List SCIM User resources
Zero TrustIdentity ProvidersSAML Certificate
Create SAML encryption certificate for Identity Provider
ModelsExpand Collapse
SAMLCertificateCreateResponse object { created_at, uid, updated_at, 2 more } A SAML encryption certificate set containing current and optionally previous certificates for encryption key rotation.
A SAML encryption certificate set containing current and optionally previous certificates for encryption key rotation.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
Zero TrustOrganizations
Get your Zero Trust organization
Create your Zero Trust organization
Update your Zero Trust organization
Revoke all Access tokens for a user
ModelsExpand Collapse
Organization object { allow_authenticate_via_warp, auth_domain, auto_redirect_to_identity, 14 more }
When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
When set to true, users skip the identity provider selection step during login.
Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array.
Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
mfa_config: optional object { allowed_authenticators, amr_matching_session_duration, required_aaguids, session_duration } Configures multi-factor authentication (MFA) settings for an organization.
Configures multi-factor authentication (MFA) settings for an organization.
allowed_authenticators: optional array of "totp" or "biometrics" or "security_key" or "piv_key"Lists the MFA methods that users can authenticate with.
Lists the MFA methods that users can authenticate with.
Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains “mfa”. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).
mfa_piv_key_requirements: optional object { pin_policy, require_fips_device, ssh_key_size, 2 more } Configures PIV key requirements for MFA using hardware security keys.
Configures PIV key requirements for MFA using hardware security keys.
pin_policy: optional "never" or "once" or "always"Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use).
Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use).
Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.
ssh_key_size: optional array of 256 or 384 or 521 or 3 moreSpecifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.
Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.
Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: ‘allowed_authenticators’ cannot only contain ‘piv_key’ if the organization has any non-infrastructure applications because PIV keys are only compatible with infrastructure apps.
The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
A description of the reason why the UI read only field is being toggled.
The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
Zero TrustOrganizationsDOH
Get your Zero Trust organization DoH settings
Update your Zero Trust organization DoH settings
ModelsExpand Collapse
DOHGetResponse object { id, client_id, doh_jwt_duration, 3 more }
The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
The duration the DoH JWT is valid for. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Note that the maximum duration for this setting is the same as the key rotation period on the account.
DOHUpdateResponse object { id, client_id, doh_jwt_duration, 3 more }
The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
The duration the DoH JWT is valid for. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h