API Reference

Zero Trust

Access

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

AI Controls

AI ControlsMcp

AI ControlsMcpPortals

List MCP Portals

GET/accounts/{account_id}/access/ai-controls/mcp/portals

Create a new MCP Portal

POST/accounts/{account_id}/access/ai-controls/mcp/portals

Read details of an MCP Portal

GET/accounts/{account_id}/access/ai-controls/mcp/portals/{id}

Update a MCP Portal

PUT/accounts/{account_id}/access/ai-controls/mcp/portals/{id}

Delete a MCP Portal

DELETE/accounts/{account_id}/access/ai-controls/mcp/portals/{id}

ModelsExpand Collapse

PortalListResponse object { id, hostname, name, 8 more }

id: string

portal id

maxLength32

minLength1

hostname: string

name: string

maxLength350

servers: array of object { id, auth_type, hostname, 20 more }

id: string

server id

maxLength32

minLength1

auth_type: "oauth" or "bearer" or "unauthenticated"

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

formaturi

name: string

maxLength350

prompts: array of map[unknown]

server_id: string

server id

maxLength32

minLength1

tools: array of map[unknown]

created_at: optional string

formatdate-time

created_by: optional string

default_disabled: optional boolean

description: optional string

maxLength512

error: optional string

error_details: optional object { cause, is_upstream, mcp_code, 2 more }

cause: optional string

Underlying error message

is_upstream: optional boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code: optional number

MCP protocol error code

retryable: optional boolean

Whether the error is transient and worth retrying

status_code: optional number

HTTP status code from the server

is_shared_oauth_callback_enabled: optional boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.

last_successful_sync: optional string

formatdate-time

last_synced: optional string

formatdate-time

modified_at: optional string

formatdate-time

modified_by: optional string

on_behalf: optional boolean

secure_web_gateway: optional boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway

status: optional "waiting" or "ready" or "stale" or "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts: optional array of object { name, enabled, portal_alias, 3 more }

name: string

enabled: optional boolean

portal_alias: optional string

portal_description: optional string

server_alias: optional string

server_description: optional string

updated_tools: optional array of object { name, enabled, portal_alias, 3 more }

name: string

enabled: optional boolean

portal_alias: optional string

portal_description: optional string

server_alias: optional string

server_description: optional string

allow_code_mode: optional boolean

Allow remote code execution in Dynamic Workers (beta)

created_at: optional string

formatdate-time

created_by: optional string

description: optional string

maxLength512

modified_at: optional string

formatdate-time

modified_by: optional string

secure_web_gateway: optional boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway

PortalCreateResponse object { id, hostname, name, 8 more }

id: string

portal id

maxLength32

minLength1

hostname: string

name: string

maxLength350

servers: array of object { id, auth_type, hostname, 20 more }

id: string

server id

maxLength32

minLength1

auth_type: "oauth" or "bearer" or "unauthenticated"

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

formaturi

name: string

maxLength350

prompts: array of map[unknown]

server_id: string

server id

maxLength32

minLength1

tools: array of map[unknown]

created_at: optional string

formatdate-time

created_by: optional string

default_disabled: optional boolean

description: optional string

maxLength512

error: optional string

error_details: optional object { cause, is_upstream, mcp_code, 2 more }

cause: optional string

Underlying error message

is_upstream: optional boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code: optional number

MCP protocol error code

retryable: optional boolean

Whether the error is transient and worth retrying

status_code: optional number

HTTP status code from the server

is_shared_oauth_callback_enabled: optional boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.

last_successful_sync: optional string

formatdate-time

last_synced: optional string

formatdate-time

modified_at: optional string

formatdate-time

modified_by: optional string

on_behalf: optional boolean

secure_web_gateway: optional boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway

status: optional "waiting" or "ready" or "stale" or "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts: optional array of object { name, enabled, portal_alias, 3 more }

name: string

enabled: optional boolean

portal_alias: optional string

portal_description: optional string

server_alias: optional string

server_description: optional string

updated_tools: optional array of object { name, enabled, portal_alias, 3 more }

name: string

enabled: optional boolean

portal_alias: optional string

portal_description: optional string

server_alias: optional string

server_description: optional string

allow_code_mode: optional boolean

Allow remote code execution in Dynamic Workers (beta)

created_at: optional string

formatdate-time

created_by: optional string

description: optional string

maxLength512

modified_at: optional string

formatdate-time

modified_by: optional string

secure_web_gateway: optional boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway

PortalReadResponse object { id, hostname, name, 8 more }

id: string

portal id

maxLength32

minLength1

hostname: string

name: string

maxLength350

servers: array of object { id, auth_type, hostname, 20 more }

id: string

server id

maxLength32

minLength1

auth_type: "oauth" or "bearer" or "unauthenticated"

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

formaturi

name: string

maxLength350

prompts: array of map[unknown]

server_id: string

server id

maxLength32

minLength1

tools: array of map[unknown]

created_at: optional string

formatdate-time

created_by: optional string

default_disabled: optional boolean

description: optional string

maxLength512

error: optional string

error_details: optional object { cause, is_upstream, mcp_code, 2 more }

cause: optional string

Underlying error message

is_upstream: optional boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code: optional number

MCP protocol error code

retryable: optional boolean

Whether the error is transient and worth retrying

status_code: optional number

HTTP status code from the server

is_shared_oauth_callback_enabled: optional boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.

last_successful_sync: optional string

formatdate-time

last_synced: optional string

formatdate-time

modified_at: optional string

formatdate-time

modified_by: optional string

on_behalf: optional boolean

secure_web_gateway: optional boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway

status: optional "waiting" or "ready" or "stale" or "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts: optional array of object { name, enabled, portal_alias, 3 more }

name: string

enabled: optional boolean

portal_alias: optional string

portal_description: optional string

server_alias: optional string

server_description: optional string

updated_tools: optional array of object { name, enabled, portal_alias, 3 more }

name: string

enabled: optional boolean

portal_alias: optional string

portal_description: optional string

server_alias: optional string

server_description: optional string

allow_code_mode: optional boolean

Allow remote code execution in Dynamic Workers (beta)

created_at: optional string

formatdate-time

created_by: optional string

description: optional string

maxLength512

modified_at: optional string

formatdate-time

modified_by: optional string

secure_web_gateway: optional boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway

PortalUpdateResponse object { id, hostname, name, 8 more }

id: string

portal id

maxLength32

minLength1

hostname: string

name: string

maxLength350

servers: array of object { id, auth_type, hostname, 20 more }

id: string

server id

maxLength32

minLength1

auth_type: "oauth" or "bearer" or "unauthenticated"

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

formaturi

name: string

maxLength350

prompts: array of map[unknown]

server_id: string

server id

maxLength32

minLength1

tools: array of map[unknown]

created_at: optional string

formatdate-time

created_by: optional string

default_disabled: optional boolean

description: optional string

maxLength512

error: optional string

error_details: optional object { cause, is_upstream, mcp_code, 2 more }

cause: optional string

Underlying error message

is_upstream: optional boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code: optional number

MCP protocol error code

retryable: optional boolean

Whether the error is transient and worth retrying

status_code: optional number

HTTP status code from the server

is_shared_oauth_callback_enabled: optional boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.

last_successful_sync: optional string

formatdate-time

last_synced: optional string

formatdate-time

modified_at: optional string

formatdate-time

modified_by: optional string

on_behalf: optional boolean

secure_web_gateway: optional boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway

status: optional "waiting" or "ready" or "stale" or "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts: optional array of object { name, enabled, portal_alias, 3 more }

name: string

enabled: optional boolean

portal_alias: optional string

portal_description: optional string

server_alias: optional string

server_description: optional string

updated_tools: optional array of object { name, enabled, portal_alias, 3 more }

name: string

enabled: optional boolean

portal_alias: optional string

portal_description: optional string

server_alias: optional string

server_description: optional string

allow_code_mode: optional boolean

Allow remote code execution in Dynamic Workers (beta)

created_at: optional string

formatdate-time

created_by: optional string

description: optional string

maxLength512

modified_at: optional string

formatdate-time

modified_by: optional string

secure_web_gateway: optional boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway

PortalDeleteResponse object { id, hostname, name, 7 more }

id: string

portal id

maxLength32

minLength1

hostname: string

name: string

maxLength350

allow_code_mode: optional boolean

Allow remote code execution in Dynamic Workers (beta)

created_at: optional string

formatdate-time

created_by: optional string

description: optional string

maxLength512

modified_at: optional string

formatdate-time

modified_by: optional string

secure_web_gateway: optional boolean

Route outbound MCP traffic through Zero Trust Secure Web Gateway

AI ControlsMcpServers

List MCP Servers

GET/accounts/{account_id}/access/ai-controls/mcp/servers

Create a new MCP Server

POST/accounts/{account_id}/access/ai-controls/mcp/servers

Read the details of a MCP Server

GET/accounts/{account_id}/access/ai-controls/mcp/servers/{id}

Update a MCP Server

PUT/accounts/{account_id}/access/ai-controls/mcp/servers/{id}

Delete a MCP Server

DELETE/accounts/{account_id}/access/ai-controls/mcp/servers/{id}

Sync MCP Server Capabilities

POST/accounts/{account_id}/access/ai-controls/mcp/servers/{id}/sync

ModelsExpand Collapse

ServerListResponse object { id, auth_type, hostname, 17 more }

id: string

server id

maxLength32

minLength1

auth_type: "oauth" or "bearer" or "unauthenticated"

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

formaturi

name: string

maxLength350

prompts: array of map[unknown]

tools: array of map[unknown]

created_at: optional string

formatdate-time

created_by: optional string

description: optional string

maxLength512

error: optional string

error_details: optional object { cause, is_upstream, mcp_code, 2 more }

cause: optional string

Underlying error message

is_upstream: optional boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code: optional number

MCP protocol error code

retryable: optional boolean

Whether the error is transient and worth retrying

status_code: optional number

HTTP status code from the server

is_shared_oauth_callback_enabled: optional boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.

last_successful_sync: optional string

formatdate-time

last_synced: optional string

formatdate-time

modified_at: optional string

formatdate-time

modified_by: optional string

secure_web_gateway: optional boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway

status: optional "waiting" or "ready" or "stale" or "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts: optional array of object { name, alias, description, enabled }

name: string

alias: optional string

maxLength40

description: optional string

enabled: optional boolean

updated_tools: optional array of object { name, alias, description, enabled }

name: string

alias: optional string

maxLength40

description: optional string

enabled: optional boolean

ServerCreateResponse object { id, auth_type, hostname, 17 more }

id: string

server id

maxLength32

minLength1

auth_type: "oauth" or "bearer" or "unauthenticated"

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

formaturi

name: string

maxLength350

prompts: array of map[unknown]

tools: array of map[unknown]

created_at: optional string

formatdate-time

created_by: optional string

description: optional string

maxLength512

error: optional string

error_details: optional object { cause, is_upstream, mcp_code, 2 more }

cause: optional string

Underlying error message

is_upstream: optional boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code: optional number

MCP protocol error code

retryable: optional boolean

Whether the error is transient and worth retrying

status_code: optional number

HTTP status code from the server

is_shared_oauth_callback_enabled: optional boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.

last_successful_sync: optional string

formatdate-time

last_synced: optional string

formatdate-time

modified_at: optional string

formatdate-time

modified_by: optional string

secure_web_gateway: optional boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway

status: optional "waiting" or "ready" or "stale" or "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts: optional array of object { name, alias, description, enabled }

name: string

alias: optional string

maxLength40

description: optional string

enabled: optional boolean

updated_tools: optional array of object { name, alias, description, enabled }

name: string

alias: optional string

maxLength40

description: optional string

enabled: optional boolean

ServerReadResponse object { id, auth_type, hostname, 17 more }

id: string

server id

maxLength32

minLength1

auth_type: "oauth" or "bearer" or "unauthenticated"

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

formaturi

name: string

maxLength350

prompts: array of map[unknown]

tools: array of map[unknown]

created_at: optional string

formatdate-time

created_by: optional string

description: optional string

maxLength512

error: optional string

error_details: optional object { cause, is_upstream, mcp_code, 2 more }

cause: optional string

Underlying error message

is_upstream: optional boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code: optional number

MCP protocol error code

retryable: optional boolean

Whether the error is transient and worth retrying

status_code: optional number

HTTP status code from the server

is_shared_oauth_callback_enabled: optional boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.

last_successful_sync: optional string

formatdate-time

last_synced: optional string

formatdate-time

modified_at: optional string

formatdate-time

modified_by: optional string

secure_web_gateway: optional boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway

status: optional "waiting" or "ready" or "stale" or "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts: optional array of object { name, alias, description, enabled }

name: string

alias: optional string

maxLength40

description: optional string

enabled: optional boolean

updated_tools: optional array of object { name, alias, description, enabled }

name: string

alias: optional string

maxLength40

description: optional string

enabled: optional boolean

ServerUpdateResponse object { id, auth_type, hostname, 17 more }

id: string

server id

maxLength32

minLength1

auth_type: "oauth" or "bearer" or "unauthenticated"

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

formaturi

name: string

maxLength350

prompts: array of map[unknown]

tools: array of map[unknown]

created_at: optional string

formatdate-time

created_by: optional string

description: optional string

maxLength512

error: optional string

error_details: optional object { cause, is_upstream, mcp_code, 2 more }

cause: optional string

Underlying error message

is_upstream: optional boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code: optional number

MCP protocol error code

retryable: optional boolean

Whether the error is transient and worth retrying

status_code: optional number

HTTP status code from the server

is_shared_oauth_callback_enabled: optional boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.

last_successful_sync: optional string

formatdate-time

last_synced: optional string

formatdate-time

modified_at: optional string

formatdate-time

modified_by: optional string

secure_web_gateway: optional boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway

status: optional "waiting" or "ready" or "stale" or "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts: optional array of object { name, alias, description, enabled }

name: string

alias: optional string

maxLength40

description: optional string

enabled: optional boolean

updated_tools: optional array of object { name, alias, description, enabled }

name: string

alias: optional string

maxLength40

description: optional string

enabled: optional boolean

ServerDeleteResponse object { id, auth_type, hostname, 17 more }

id: string

server id

maxLength32

minLength1

auth_type: "oauth" or "bearer" or "unauthenticated"

One of the following:

"oauth"

"bearer"

"unauthenticated"

hostname: string

formaturi

name: string

maxLength350

prompts: array of map[unknown]

tools: array of map[unknown]

created_at: optional string

formatdate-time

created_by: optional string

description: optional string

maxLength512

error: optional string

error_details: optional object { cause, is_upstream, mcp_code, 2 more }

cause: optional string

Underlying error message

is_upstream: optional boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code: optional number

MCP protocol error code

retryable: optional boolean

Whether the error is transient and worth retrying

status_code: optional number

HTTP status code from the server

is_shared_oauth_callback_enabled: optional boolean

When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.

last_successful_sync: optional string

formatdate-time

last_synced: optional string

formatdate-time

modified_at: optional string

formatdate-time

modified_by: optional string

secure_web_gateway: optional boolean

Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway

status: optional "waiting" or "ready" or "stale" or "error"

Current sync state of the server

One of the following:

"waiting"

"ready"

"stale"

"error"

updated_prompts: optional array of object { name, alias, description, enabled }

name: string

alias: optional string

maxLength40

description: optional string

enabled: optional boolean

updated_tools: optional array of object { name, alias, description, enabled }

name: string

alias: optional string

maxLength40

description: optional string

enabled: optional boolean

ServerSyncResponse object { error, error_details, status }

error: optional string

error_details: optional object { cause, is_upstream, mcp_code, 2 more }

cause: optional string

Underlying error message

is_upstream: optional boolean

True = MCP server returned an error. False = couldn’t reach the server

mcp_code: optional number

MCP protocol error code

retryable: optional boolean

Whether the error is transient and worth retrying

status_code: optional number

HTTP status code from the server

status: optional "waiting" or "ready" or "stale" or "error"

One of the following:

"waiting"

"ready"

"stale"

"error"