Zero Trust
Zero TrustDevices
ModelsExpand Collapse
Device object { id, created, deleted, 17 more }
Registration ID. Equal to Device ID except for accounts which enabled multi-user mode.
Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
DeviceGetResponse object { id, account, created, 16 more }
Registration ID. Equal to Device ID except for accounts which enabled multi-user mode.
Zero TrustDevicesDevices
List devices
Get device
Delete device
Revoke device registrations
ModelsExpand Collapse
DeviceListResponse object { id, active_registrations, created_at, 16 more } A WARP Device.
A WARP Device.
The number of active registrations for the device. Active registrations are those which haven’t been revoked or deleted.
last_seen_registration: optional object { policy } The last seen registration for the device.
The last seen registration for the device.
Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
Deprecated: IP information is provided by DEX - see https://developers.cloudflare.com/api/resources/zero_trust/subresources/dex/subresources/fleet_status/subresources/devices/methods/list/
DeviceGetResponse object { id, active_registrations, created_at, 16 more } A WARP Device.
A WARP Device.
The number of active registrations for the device. Active registrations are those which haven’t been revoked or deleted.
last_seen_registration: optional object { policy } The last seen registration for the device.
The last seen registration for the device.
Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
Deprecated: IP information is provided by DEX - see https://developers.cloudflare.com/api/resources/zero_trust/subresources/dex/subresources/fleet_status/subresources/devices/methods/list/
Zero TrustDevicesResilience
Zero TrustDevicesResilienceGlobal WARP Override
Retrieve Global WARP override state
Set Global WARP override state
ModelsExpand Collapse
Zero TrustDevicesRegistrations
List registrations
Get registration
Delete registration
Delete registrations
Revoke registrations
Unrevoke registrations
ModelsExpand Collapse
RegistrationListResponse object { id, created_at, device, 9 more } A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device.
A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device.
The type of encryption key used by the WARP client for the active key. Currently ‘curve25519’ for WireGuard and ‘secp256r1’ for MASQUE.
RegistrationGetResponse object { id, created_at, device, 9 more } A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device.
A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device.
The type of encryption key used by the WARP client for the active key. Currently ‘curve25519’ for WireGuard and ‘secp256r1’ for MASQUE.
Zero TrustDevicesDEX Tests
List Device DEX tests
Get Device DEX test
Create Device DEX test
Update Device DEX test
Delete Device DEX test
ModelsExpand Collapse
DEXTestDeleteResponse object { dex_tests }
Zero TrustDevicesIP Profiles
List IP profiles
Get IP profile
Create IP profile
Update IP profile
Delete IP profile
ModelsExpand Collapse
IPProfile object { id, created_at, description, 6 more }
The wirefilter expression to match registrations. Available values: “identity.name”, “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.saml_attributes”.
Zero TrustDevicesNetworks
List your device managed networks
Get device managed network details
Create a device managed network
Update a device managed network
Delete a device managed network
ModelsExpand Collapse
DeviceNetwork object { config, name, network_id, type }
Zero TrustDevicesFleet Status
Get the live status of a latest device
ModelsExpand Collapse
FleetStatusGetResponse object { colo, deviceId, mode, 36 more }
Zero TrustDevicesPolicies
ModelsExpand Collapse
SettingsPolicy object { allow_mode_switch, allow_updates, allowed_to_leave, 24 more }
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
List of routes excluded in the WARP client’s tunnel.
List of routes excluded in the WARP client’s tunnel.
List of routes included in the WARP client’s tunnel.
List of routes included in the WARP client’s tunnel.
The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.
The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.
The wirefilter expression to match devices. Available values: “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.service_token_uuid”, “identity.saml_attributes”, “network”, “os.name”, “os.version”.
The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
Whether to allow the user to turn off the WARP switch and disconnect the client.
Zero TrustDevicesPoliciesDefault
Get the default device settings profile
Update the default device settings profile
ModelsExpand Collapse
DefaultGetResponse object { allow_mode_switch, allow_updates, allowed_to_leave, 17 more }
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
List of routes excluded in the WARP client’s tunnel.
List of routes excluded in the WARP client’s tunnel.
List of routes included in the WARP client’s tunnel.
List of routes included in the WARP client’s tunnel.
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
DefaultEditResponse object { allow_mode_switch, allow_updates, allowed_to_leave, 17 more }
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
List of routes excluded in the WARP client’s tunnel.
List of routes excluded in the WARP client’s tunnel.
List of routes included in the WARP client’s tunnel.
List of routes included in the WARP client’s tunnel.
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
Zero TrustDevicesPoliciesDefaultExcludes
Get the Split Tunnel exclude list
Set the Split Tunnel exclude list
Zero TrustDevicesPoliciesDefaultIncludes
Get the Split Tunnel include list
Set the Split Tunnel include list
Zero TrustDevicesPoliciesDefaultFallback Domains
Get your Local Domain Fallback list
Set your Local Domain Fallback list
Zero TrustDevicesPoliciesDefaultCertificates
Get device certificate provisioning status
Update device certificate provisioning status
Zero TrustDevicesPoliciesCustom
List device settings profiles
Get device settings profile by ID
Create a device settings profile
Update a device settings profile
Delete a device settings profile
Zero TrustDevicesPoliciesCustomExcludes
Get the Split Tunnel exclude list for a device settings profile
Set the Split Tunnel exclude list for a device settings profile
Zero TrustDevicesPoliciesCustomIncludes
Get the Split Tunnel include list for a device settings profile
Set the Split Tunnel include list for a device settings profile
Zero TrustDevicesPoliciesCustomFallback Domains
Get the Local Domain Fallback list for a device settings profile
Set the Local Domain Fallback list for a device settings profile
Zero TrustDevicesPosture
List device posture rules
Get device posture rule details
Create a device posture rule
Update a device posture rule
Delete a device posture rule
ModelsExpand Collapse
DeviceInput = FileInput { operating_system, path, exists, 2 more } or UniqueClientIDInput { id, operating_system } or DomainJoinedInput { operating_system, domain } or 17 moreThe value to be checked against.
The value to be checked against.
DiskEncryptionInput object { checkDisks, requireAll }
TeamsDevicesClientCertificateV2InputRequest object { certificate_id, check_private_key, operating_system, 4 more }
Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.
Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial_number} and ${hostname} are valid variables.
extended_key_usage: optional array of "clientAuth" or "emailProtection"List of values indicating purposes for which the certificate public key can be used.
List of values indicating purposes for which the certificate public key can be used.
CrowdstrikeInput object { connection_id, last_seen, operator, 6 more }
KolideInput object { connection_id, auth_state, countOperator, issue_count }
TaniumInput object { connection_id, eid_last_seen, operator, 3 more }
SentineloneS2sInput object { connection_id, active_threats, infected, 4 more }
DevicePostureRule object { id, description, expiration, 5 more }
Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.
Polling frequency for the WARP client posture check. Default: 5m (poll every five minutes). Minimum: 1m.
KolideInput object { connection_id, auth_state, countOperator, issue_count }
SentineloneS2sInput object { connection_id, active_threats, infected, 4 more }
TaniumInput object { connection_id, eid_last_seen, operator, 3 more }
Zero TrustDevicesPostureIntegrations
List your device posture integrations
Get device posture integration details
Create a device posture integration
Update a device posture integration
Delete a device posture integration
ModelsExpand Collapse
Integration object { id, config, interval, 2 more }
Zero TrustDevicesRevoke
Zero TrustDevicesSettings
Get device settings for a Zero Trust account
Update device settings for a Zero Trust account
Patch device settings for a Zero Trust account
Reset device settings for a Zero Trust account with defaults. This turns off all proxying.
ModelsExpand Collapse
DeviceSettings object { disable_for_time, external_emergency_signal_enabled, external_emergency_signal_fingerprint, 6 more }
Sets the time limit, in seconds, that a user can use an override code to bypass WARP.
Controls whether the external emergency disconnect feature is enabled.
The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server’s identity. The device will ignore any response if the server’s certificate fingerprint does not exactly match this value.
The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., “5m”, “2m30s”, “1h”). Minimum 30 seconds.
The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.
Zero TrustDevicesUnrevoke
Zero TrustDevicesOverride Codes
Get override codes (deprecated)
Get override codes
Zero TrustIdentity Providers
List Access identity providers
Get an Access identity provider
Add an Access identity provider
Update an Access identity provider
Delete an Access identity provider
ModelsExpand Collapse
AzureAD object { config, name, type, 2 more }
config: object { claims, client_id, client_secret, 5 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Should Cloudflare try to load authentication contexts from your account
prompt: optional "login" or "select_account" or "none"Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
IdentityProvider = AzureAD { config, name, type, 2 more } or object { config, name, type, 2 more } or object { config, name, type, 2 more } or 11 more
AzureAD object { config, name, type, 2 more }
config: object { claims, client_id, client_secret, 5 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Should Cloudflare try to load authentication contexts from your account
prompt: optional "login" or "select_account" or "none"Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessCentrify object { config, name, type, 2 more }
config: object { centrify_account, centrify_app_id, claims, 3 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessFacebook object { config, name, type, 2 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGitHub object { config, name, type, 2 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGoogle object { config, name, type, 2 more }
config: object { claims, client_id, client_secret, email_claim_name } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGoogleApps object { config, name, type, 2 more }
config: object { apps_domain, claims, client_id, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessLinkedin object { config, name, type, 2 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOIDC object { config, name, type, 2 more }
config: object { auth_url, certs_url, claims, 6 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOkta object { config, name, type, 2 more }
config: object { authorization_server_id, claims, client_id, 3 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOnelogin object { config, name, type, 2 more }
config: object { claims, client_id, client_secret, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessPingone object { config, name, type, 2 more }
config: object { claims, client_id, client_secret, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessSAML object { config, name, type, 2 more }
config: object { attributes, email_attribute_name, header_attributes, 4 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
header_attributes: optional array of object { attribute_name, header_name } Add a list of attribute names that will be returned in the response header from the Access callback.
Add a list of attribute names that will be returned in the response header from the Access callback.
X509 certificate to verify the signature in the SAML authentication response
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessYandex object { config, name, type, 2 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOnetimepin object { config, name, type, 2 more }
config: object { redirect_url } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
IdentityProviderSCIMConfig object { enabled, identity_update_behavior, scim_base_url, 3 more } The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
identity_update_behavior: optional "automatic" or "reauth" or "no_action"Indicates how a SCIM event updates a user identity used for policy evaluation. Use “automatic” to automatically update a user’s identity and augment it with fields from the SCIM user resource. Use “reauth” to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With “reauth” identities will not contain fields from the SCIM user resource. With “no_action” identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.
Indicates how a SCIM event updates a user identity used for policy evaluation. Use “automatic” to automatically update a user’s identity and augment it with fields from the SCIM user resource. Use “reauth” to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With “reauth” identities will not contain fields from the SCIM user resource. With “no_action” identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.
A flag to remove a user’s seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
IdentityProviderType = "onetimepin" or "azureAD" or "saml" or 11 moreThe type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
IdentityProviderListResponse = AzureAD { config, name, type, 2 more } or object { config, name, type, 2 more } or object { config, name, type, 2 more } or 10 more
AzureAD object { config, name, type, 2 more }
config: object { claims, client_id, client_secret, 5 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Should Cloudflare try to load authentication contexts from your account
prompt: optional "login" or "select_account" or "none"Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessCentrify object { config, name, type, 2 more }
config: object { centrify_account, centrify_app_id, claims, 3 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessFacebook object { config, name, type, 2 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGitHub object { config, name, type, 2 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGoogle object { config, name, type, 2 more }
config: object { claims, client_id, client_secret, email_claim_name } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGoogleApps object { config, name, type, 2 more }
config: object { apps_domain, claims, client_id, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessLinkedin object { config, name, type, 2 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOIDC object { config, name, type, 2 more }
config: object { auth_url, certs_url, claims, 6 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOkta object { config, name, type, 2 more }
config: object { authorization_server_id, claims, client_id, 3 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOnelogin object { config, name, type, 2 more }
config: object { claims, client_id, client_secret, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessPingone object { config, name, type, 2 more }
config: object { claims, client_id, client_secret, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessSAML object { config, name, type, 2 more }
config: object { attributes, email_attribute_name, header_attributes, 4 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
header_attributes: optional array of object { attribute_name, header_name } Add a list of attribute names that will be returned in the response header from the Access callback.
Add a list of attribute names that will be returned in the response header from the Access callback.
X509 certificate to verify the signature in the SAML authentication response
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessYandex object { config, name, type, 2 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Zero TrustIdentity ProvidersSCIM
Zero TrustIdentity ProvidersSCIMGroups
List SCIM Group resources
Zero TrustIdentity ProvidersSCIMUsers
List SCIM User resources
Zero TrustOrganizations
Get your Zero Trust organization
Create your Zero Trust organization
Update your Zero Trust organization
Revoke all Access tokens for a user
ModelsExpand Collapse
Organization object { allow_authenticate_via_warp, auth_domain, auto_redirect_to_identity, 13 more }
When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
When set to true, users skip the identity provider selection step during login.
Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array.
Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
mfa_config: optional object { allowed_authenticators, amr_matching_session_duration, required_aaguids, session_duration } Configures multi-factor authentication (MFA) settings for an organization.
Configures multi-factor authentication (MFA) settings for an organization.
allowed_authenticators: optional array of "totp" or "biometrics" or "security_key" or "ssh_piv_key"Lists the MFA methods that users can authenticate with.
Lists the MFA methods that users can authenticate with.
Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains “mfa”. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).
Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
mfa_ssh_piv_key_requirements: optional object { pin_policy, require_fips_device, ssh_key_size, 2 more } Configures SSH PIV key requirements for MFA using hardware security keys.
Configures SSH PIV key requirements for MFA using hardware security keys.
pin_policy: optional "never" or "once" or "always"Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use).
Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use).
Requires the SSH PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.
ssh_key_size: optional array of 256 or 384 or 521 or 3 moreSpecifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.
Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.
The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
A description of the reason why the UI read only field is being toggled.
The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
Zero TrustOrganizationsDOH
Get your Zero Trust organization DoH settings
Update your Zero Trust organization DoH settings
ModelsExpand Collapse
DOHGetResponse object { id, client_id, doh_jwt_duration, 3 more }
The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
The duration the DoH JWT is valid for. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Note that the maximum duration for this setting is the same as the key rotation period on the account.
DOHUpdateResponse object { id, client_id, doh_jwt_duration, 3 more }
The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
The duration the DoH JWT is valid for. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h