API Reference

Zero Trust

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Cloud Workload Security

Cloud Workload SecurityBasic Auth Credentials

List basic-auth credentials for an account

GET/accounts/{account_id}/cws/basic-auth-credentials

Get a basic-auth credential by ID

GET/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}

Create a basic-auth credential

POST/accounts/{account_id}/cws/basic-auth-credentials

Delete a basic-auth credential

DELETE/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}

ModelsExpand Collapse

BasicAuthCredential object { id, created_at, updated_at, username }

id: string

Server-assigned UUID

formatuuid

created_at: string

formatdate-time

updated_at: string

formatdate-time

username: string

Login presented by the client. Printable ASCII only, excluding space and colon (RFC 7617 forbids a colon in the user-id).

maxLength100

minLength1

BasicAuthCredentialDeleteResponse object { id }

id: string

formatuuid

Cloud Workload SecurityBasic Auth CredentialsSecrets

List secrets for a basic-auth credential

GET/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}/secrets

Get a basic-auth secret by ID

GET/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}/secrets/{secret_id}

Add a secret to a basic-auth credential

POST/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}/secrets

Delete a basic-auth secret

DELETE/accounts/{account_id}/cws/basic-auth-credentials/{credential_id}/secrets/{secret_id}

ModelsExpand Collapse

BasicAuthSecret object { id, created_at, expires_at }

id: string

Server-assigned UUID

formatuuid

created_at: string

formatdate-time

expires_at: optional string

Optional RFC 3339 expiration time. Omit for no expiration.

formatdate-time

SecretDeleteResponse object { id }

id: string

formatuuid

Cloud Workload SecurityDeployments

List deployments

GET/accounts/{account_id}/cws/deployments

Get a deployment by ID

GET/accounts/{account_id}/cws/deployments/{deployment_id}

Create a new deployment

POST/accounts/{account_id}/cws/deployments

Update a deployment

PUT/accounts/{account_id}/cws/deployments/{deployment_id}

Delete a deployment

DELETE/accounts/{account_id}/cws/deployments/{deployment_id}

ModelsExpand Collapse

Deployment object { id, basic_auth_credential_ids, created_at, 9 more }

id: string

Server-assigned UUID

formatuuid

basic_auth_credential_ids: array of string

IDs of basic-auth credentials attached to this deployment

created_at: string

formatdate-time

default_mode: "ALLOW" or "BLOCK"

Default traffic decision when no policy set matches

One of the following:

"ALLOW"

"BLOCK"

name: string

Human-readable name; unique per account

maxLength100

minLength1

on_error_action: "BLOCK" or "SKIP"

Action applied when an enforcing policy has a runtime Rego error

One of the following:

"BLOCK"

"SKIP"

policy_set_ids: array of string

IDs of policy sets attached to this deployment

rego_raise_error: boolean

Whether OPA builtin failures are raised as runtime evaluation errors

tags: map[string]

Tags attached to this deployment

updated_at: string

formatdate-time

description: optional string

Optional free-form description.

maxLength1024

domain_acl_id: optional string

ID of the attached domain ACL. Omitted when none.

formatuuid

DeploymentDeleteResponse object { id }

id: string

formatuuid

Cloud Workload SecurityDomain ACLs

List domain ACLs

GET/accounts/{account_id}/cws/domain-acls

Get a domain ACL by ID

GET/accounts/{account_id}/cws/domain-acls/{domain_acl_id}

Create a new domain ACL

POST/accounts/{account_id}/cws/domain-acls

Update a domain ACL and replace its entries

PUT/accounts/{account_id}/cws/domain-acls/{domain_acl_id}

Delete a domain ACL

DELETE/accounts/{account_id}/cws/domain-acls/{domain_acl_id}

ModelsExpand Collapse

DomainACL object { id, created_at, default_action, 3 more }

id: string

Server-assigned UUID

formatuuid

created_at: string

formatdate-time

default_action: "ALLOW" or "BLOCK"

Action applied when no entry matches the request domain

One of the following:

"ALLOW"

"BLOCK"

entries: array of object { action, domain }

Per-domain action overrides. Each domain appears at most once.

action: "ALLOW" or "BLOCK"

Per-domain decision overriding the parent ACL’s default_action

One of the following:

"ALLOW"

"BLOCK"

domain: string

Hostname or domain pattern, capped at 255 UTF-8 bytes

maxLength255

minLength1

name: string

Human-readable name; unique per account

maxLength100

minLength1

updated_at: string

formatdate-time

DomainACLDeleteResponse object { id }

id: string

formatuuid

Cloud Workload SecurityPolicies

List policies

GET/accounts/{account_id}/cws/policies

Get a policy by ID

GET/accounts/{account_id}/cws/policies/{policy_id}

Create a new policy

POST/accounts/{account_id}/cws/policies

Update a policy

PUT/accounts/{account_id}/cws/policies/{policy_id}

Delete a policy

DELETE/accounts/{account_id}/cws/policies/{policy_id}

ModelsExpand Collapse

Policy object { id, created_at, entrypoint, 7 more }

id: string

Server-assigned UUID

formatuuid

created_at: string

formatdate-time

entrypoint: string

Non-function rule declared in rego_source. Evaluation uses data.<package_path>..

maxLength255

filter: string

Optional filter expression that determines whether this policy applies. Null means the policy applies to every request. Maximum 4096 UTF-8 bytes.

maxLength4096

minLength1

name: string

Human-readable name; unique per account

maxLength100

minLength1

package_path: string

Dotted path derived from rego_source. Begins with policy. and is unique per account.

maxLength1024

rego_source: string

Inline Rego source with a package beginning with “policy.” Maximum 16384 UTF-8 bytes.

maxLength16384

minLength1

tags: map[string]

Tags attached to this policy

updated_at: string

formatdate-time

description: optional string

Optional free-form description.

maxLength1024

PolicyDeleteResponse object { id }

id: string

formatuuid

Cloud Workload SecurityPolicy Sets

List policy sets

GET/accounts/{account_id}/cws/policy-sets

Get a policy set by ID

GET/accounts/{account_id}/cws/policy-sets/{policy_set_id}

Create a new policy set

POST/accounts/{account_id}/cws/policy-sets

Update a policy set

PUT/accounts/{account_id}/cws/policy-sets/{policy_set_id}

Delete a policy set

DELETE/accounts/{account_id}/cws/policy-sets/{policy_set_id}

ModelsExpand Collapse

PolicySet object { id, created_at, exclude_workload_ids, 6 more }

id: string

Server-assigned UUID

formatuuid

created_at: string

formatdate-time

exclude_workload_ids: array of string

IDs of workloads that exclude matching requests. Exclusions take precedence.

include_workload_ids: array of string

IDs of workloads that include matching requests. Empty includes all requests before exclusions.

name: string

Human-readable name; unique per account

maxLength100

minLength1

policies: array of object { enforce, policy_id }

Member policies and their per-membership enforcement mode

enforce: boolean

Whether this policy should enforce when it matches. False keeps the policy attached for non-enforcing evaluation.

policy_id: string

ID of the member policy

formatuuid

tags: map[string]

Tags attached to this policy set

updated_at: string

formatdate-time

description: optional string

Optional free-form description.

maxLength1024

PolicySetDeleteResponse object { id }

id: string

formatuuid

Cloud Workload SecurityRego Metadata

List Rego metadata documents

GET/accounts/{account_id}/cws/rego-metadata

Get a rego metadata document by ID

GET/accounts/{account_id}/cws/rego-metadata/{rego_metadata_id}

Create a new rego metadata document

POST/accounts/{account_id}/cws/rego-metadata

Update a rego metadata document

PUT/accounts/{account_id}/cws/rego-metadata/{rego_metadata_id}

Delete a rego metadata document

DELETE/accounts/{account_id}/cws/rego-metadata/{rego_metadata_id}

ModelsExpand Collapse

RegoMetadata object { id, created_at, data, 3 more }

id: string

Server-assigned UUID

formatuuid

created_at: string

formatdate-time

data: unknown

import_path: string

Unique Rego import path in the form metadata., with one alphanumeric or underscore segment. Reference it as data.<import_path>.

maxLength255

minLength1

name: string

Human-readable name; unique per account

maxLength100

minLength1

updated_at: string

formatdate-time

RegoMetadataDeleteResponse object { id }

id: string

formatuuid

Cloud Workload SecurityRego Modules

List Rego modules

GET/accounts/{account_id}/cws/rego-modules

Get a Rego module by ID

GET/accounts/{account_id}/cws/rego-modules/{rego_module_id}

Create a new Rego module

POST/accounts/{account_id}/cws/rego-modules

Update a Rego module

PUT/accounts/{account_id}/cws/rego-modules/{rego_module_id}

Delete a Rego module

DELETE/accounts/{account_id}/cws/rego-modules/{rego_module_id}

ModelsExpand Collapse

RegoModule object { id, created_at, name, 3 more }

id: string

Server-assigned UUID

formatuuid

created_at: string

formatdate-time

name: string

Human-readable name; unique per account

maxLength100

minLength1

package_path: string

Dotted path derived from rego_source. Begins with lib. and is unique per account.

maxLength1024

rego_source: string

Library Rego source with a package beginning with “lib.” Maximum 16384 UTF-8 bytes.

maxLength16384

minLength1

updated_at: string

formatdate-time

RegoModuleDeleteResponse object { id }

id: string

formatuuid

Cloud Workload SecurityTenant Structures

List tenant structures for an account

GET/accounts/{account_id}/cws/tenant-structures

Get a tenant structure by ID

GET/accounts/{account_id}/cws/tenant-structures/{structure_id}

Create a tenant structure

POST/accounts/{account_id}/cws/tenant-structures

Update a tenant structure

PUT/accounts/{account_id}/cws/tenant-structures/{structure_id}

Delete a tenant structure

DELETE/accounts/{account_id}/cws/tenant-structures/{structure_id}

ModelsExpand Collapse

TenantStructure object { id, application, created_at, 3 more }

id: string

Server-assigned UUID

formatuuid

application: "aws" or "cloudflare"

Platform this structure models. Immutable after creation; determines valid node kinds and identifier formats.

One of the following:

"aws"

"cloudflare"

created_at: string

formatdate-time

name: string

Human-readable name; unique per account

maxLength100

minLength1

updated_at: string

formatdate-time

import_path: optional string

Optional unique Rego mount path in the form tenant... The application segment must match application; omitted when unmounted.

maxLength255

minLength1

TenantStructureDeleteResponse object { id }

id: string

formatuuid

Cloud Workload SecurityTenant StructuresNodes

List nodes for a tenant structure

GET/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes

Get a tenant node by ID

GET/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/{node_id}

Add a node to a tenant structure

POST/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes

Update a tenant node

PUT/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/{node_id}

Delete a tenant node

DELETE/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/{node_id}

Apply a batch of tenant node mutations

POST/accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes/batch

ModelsExpand Collapse

TenantStructureNode object { id, created_at, native_id, 4 more }

id: string

Server-assigned UUID

formatuuid

created_at: string

formatdate-time

native_id: string

Cloud-native identifier of this node, unique within the structure; the parent-reference target. Shape depends on the structure’s application. Immutable after create.

maxLength255

minLength1

node_kind: string

Position in the tree. Legal values depend on the structure’s application (aws: root/ou/account; cloudflare: org/account/zone). At most one root per structure. Immutable after create.

maxLength64

minLength1

updated_at: string

formatdate-time

name: optional string

Display name (e.g. an OU or account name), mutable. Optional; empty by default.

maxLength100

parent: optional string

Native ID of this node’s parent. Required for non-root nodes and omitted for the root. The parent must be in the same structure and able to contain this node kind.

maxLength255

NodeDeleteResponse object { id }

id: string

formatuuid

NodeBatchResponse object { created, deleted, updated }

created: array of TenantStructureNode { id, created_at, native_id, 4 more }

id: string

Server-assigned UUID

formatuuid

created_at: string

formatdate-time

native_id: string

Cloud-native identifier of this node, unique within the structure; the parent-reference target. Shape depends on the structure’s application. Immutable after create.

maxLength255

minLength1

node_kind: string

Position in the tree. Legal values depend on the structure’s application (aws: root/ou/account; cloudflare: org/account/zone). At most one root per structure. Immutable after create.

maxLength64

minLength1

updated_at: string

formatdate-time

name: optional string

Display name (e.g. an OU or account name), mutable. Optional; empty by default.

maxLength100

parent: optional string

Native ID of this node’s parent. Required for non-root nodes and omitted for the root. The parent must be in the same structure and able to contain this node kind.

maxLength255

deleted: array of object { id }

id: string

formatuuid

updated: array of TenantStructureNode { id, created_at, native_id, 4 more }

id: string

Server-assigned UUID

formatuuid

created_at: string

formatdate-time

native_id: string

Cloud-native identifier of this node, unique within the structure; the parent-reference target. Shape depends on the structure’s application. Immutable after create.

maxLength255

minLength1

node_kind: string

Position in the tree. Legal values depend on the structure’s application (aws: root/ou/account; cloudflare: org/account/zone). At most one root per structure. Immutable after create.

maxLength64

minLength1

updated_at: string

formatdate-time

name: optional string

Display name (e.g. an OU or account name), mutable. Optional; empty by default.

maxLength100

parent: optional string

Native ID of this node’s parent. Required for non-root nodes and omitted for the root. The parent must be in the same structure and able to contain this node kind.

maxLength255

Cloud Workload SecurityWorkloads

List workloads

GET/accounts/{account_id}/cws/workloads

Get a workload by ID

GET/accounts/{account_id}/cws/workloads/{workload_id}

Create a new workload

POST/accounts/{account_id}/cws/workloads

Update a workload

PUT/accounts/{account_id}/cws/workloads/{workload_id}

Delete a workload

DELETE/accounts/{account_id}/cws/workloads/{workload_id}

ModelsExpand Collapse

Workload object { id, created_at, filter, 4 more }

id: string

Server-assigned UUID

formatuuid

created_at: string

formatdate-time

filter: string

Filter expression selecting the requests this workload matches. Maximum 4096 UTF-8 bytes.

maxLength4096

minLength1

name: string

Human-readable handle; unique per account.

maxLength100

minLength1

tags: map[string]

Tags attached to this workload

updated_at: string

formatdate-time

description: optional string

Optional free-form description.

maxLength1024

WorkloadDeleteResponse object { id }

id: string

formatuuid