API token permissions

Permissions are segmented into three categories based on resource:

• Zone permissions
• Account permissions
• User permissions

Each category contains permission groups related to those resources. DNS permissions belong to the Zone category, while Billing permissions belong to the Account category. Below is a list of the available token permissions.

To obtain an updated list of token permissions, including the permission ID and the scope of each permission, use the List permission groups endpoint.

User permissions

The applicable scope of user permissions is com.cloudflare.api.user.

Dashboard

Name	Description
API Tokens Read	Grants read access to user's API tokens.
API Tokens Edit	Grants write access to user's API tokens.
Memberships Read	Grants read access to a user's account memberships.
Memberships Edit	Grants write access to a user's account memberships.
User Details Read	Grants read access to user details.
User Details Edit	Grants write access to user details.

API

Name	Description
API Tokens Read	Grants read access to user's API tokens.
API Tokens Write	Grants write access to user's API tokens.
Memberships Read	Grants read access to a user's account memberships.
Memberships Write	Grants write access to a user's account memberships.
User Details Read	Grants read access to user details.
User Details Write	Grants write access to user details.

Account permissions

The applicable scope of account permissions is com.cloudflare.api.account.

Dashboard

Name	Description
Access: Apps and Policies Read	Grants read access to Cloudflare Access account resources.
Access: Apps and Policies Revoke	Grants ability to revoke all tokens to Cloudflare Access account resources.
Access: Apps and Policies Edit	Grants write access to Cloudflare Access account resources.
Access: Audit Logs Read	Grants read access to Cloudflare Access audit logs.
Access: Custom Pages Read	Grants read access to Cloudflare Access Custom Pages.
Access: Custom Pages Edit	Grants write access to Cloudflare Access Custom Pages.
Access: Device Posture Read	Grants read access to Cloudflare Access Device Posture.
Access: Device Posture Edit	Grants write access to Cloudflare Access Device Posture.
Access: Mutual TLS Certificates Read	Grants read access to Cloudflare Access mTLS certificates.
Access: Mutual TLS Certificates Edit	Grants write access to Cloudflare Access mTLS certificates.
Access: Organizations, Identity Providers, and Groups Read	Grants read access to Cloudflare Access account resources.
Access: Organizations, Identity Providers, and Groups Revoke	Grants ability to revoke user sessions to Cloudflare Access account resources.
Access: Organizations, Identity Providers, and Groups Edit	Grants write access to Cloudflare Access account resources.
Access: Service Tokens Read	Grants read access to Cloudflare Access Service Tokens.
Access: Service Tokens Edit	Grants write access to Cloudflare Access Service Tokens.
Access: SSH Auditing Read	Grants read access to SSH Auditing.
Access: SSH Auditing Edit	Grants write access to SSH Auditing.
Account Analytics Read	Grants read access to account analytics.
Account Custom Pages Read	Grants read access to account-level Custom Pages.
Account Custom Pages Edit	Grants write access to account-level Custom Pages.
Account Filter Lists Read	Grants read access to Account Filter Lists.
Account Filter Lists Edit	Grants write access to Account Filter Lists.
Account Firewall Access Rules Read	Grants read access to account firewall access rules.
Account Firewall Access Rules Edit	Grants write access to account firewall access rules.
Account Rulesets Read	Grants read access to Account Rulesets.
Account Rulesets Edit	Grants write access to Account Rulesets.
Account Settings Read	Grants read access to Account resources, account membership, and account level features.
Account Settings Edit	Grants write access to Account resources, account membership, and account level features.
Account: SSL and Certificates Read	Grants read access to SSL and Certificates.
Account: SSL and Certificates Edit	Grants write access to SSL and Certificates.
Account WAF Read	Grants read access to Account WAF.
Account WAF Edit	Grants write access to Account WAF.
Address Maps Edit	Grants write access to Address Maps
Address Maps Read	Grants read access to Address Maps
Allow Request Tracer Read	Grants read access to Request Tracer.
API Gateway Read	Grants read access to API Gateway (including API Shield) for all domains in an account.
API Gateway Edit	Grants write access to API Gateway (including API Shield) for all domains in an account.
Billing Read	Grants read access to billing profile, subscriptions, and access to fetch invoices and entitlements.
Billing Edit	Grants write access to billing profile, subscriptions, and access to fetch invoices and entitlements.
Bulk URL Redirects Read	Grants read access to Bulk URL Redirects.
Bulk URL Redirects Edit	Grants write access to Bulk URL Redirects.
China Network Steering Read	Grants read access to China Network Steering.
China Network Steering Edit	Grants write access to China Network Steering.
Cloudchamber Read	Grants read access to Cloudchamber deployments.
Cloudchamber Edit	Grants write access to Cloudchamber deployments.
Cloudflare Calls Read	Grants read access to Cloudflare Calls.
Cloudflare Calls Edit	Grants write access to Cloudflare Calls.
Cloudflare DEX Read	Grants read access to Digital Experience Monitoring.
Cloudflare DEX Edit	Grants write access to Digital Experience Monitoring.
Cloudflare Images Read	Grants read access to Cloudflare Images.
Cloudflare Images Edit	Grants write access to Cloudflare Images.
Cloudflare One Connector: cloudflared Read	Grants read access to cloudflared Connectors
Cloudflare One Connector: cloudflared Edit	Grants write access to cloudflared Connectors
Cloudflare One Connector: WARP Read	Grants read access to Warp Connectors
Cloudflare One Connector: WARP Edit	Grants write access to Warp Connectors
Cloudflare One Connectors Read	Grants read access to Cloudflare One Connectors
Cloudflare One Connectors Edit	Grants write access to Cloudflare One Connectors
Cloudflare One Networks Read	Grants read access to Cloudflare One Networks
Cloudflare One Networks Edit	Grants write access to Cloudflare One Networks
Cloudflare Pages Read	Grants access to view Cloudflare Pages projects.
Cloudflare Pages Edit	Grants access to create, edit and delete Cloudflare Pages projects.
Cloudflare Tunnel Read	Grants access to view Cloudflare Tunnels.
Cloudflare Tunnel Edit	Grants access to create and delete Cloudflare Tunnels.
Cloudforce One Read	Grants read access to Cloudforce One.
Cloudforce One Edit	Grants write access to Cloudforce One.
Cloud Email Security Read	Grants read access to Cloud Email Security.
Email Security Edit	Grants write access to Email Security.
Constellation Read	Grants read access to Constellation.
Constellation Edit	Grants write access to Constellation.
D1 Read	Grants read access to D1.
D1 Edit	Grants write access to D1.
DDoS Botnet Feed Read	Grants read access to Botnet Feed reports.
DDoS Botnet Feed Edit	Grants write access to Botnet Feed configuration.
DDoS Protection Read	Grants read access to DDoS protection.
DDoS Protection Edit	Grants write access to DDoS protection.
DNS Firewall Read	Grants read access to DNS Firewall.
DNS Firewall Edit	Grants write access to DNS Firewall.
Email Routing Addresses Read	Grants read access to Email Routing Addresses.
Email Routing Addresses Edit	Grants write access to Email Routing Addresses.
Hyperdrive Read	Grants read access to Hyperdrive.
Hyperdrive Edit	Grants write access to Hyperdrive.
Intel Read	Grants read access to Intel.
Intel Edit	Grants write access to Intel.
Integration Edit	Grants write access to integrations.
IOT Read	Grants read access to IOT ↗.
IOT Edit	Grants write access to IOT ↗.
IP Prefixes: Read	Grants access to read IP prefix settings.
IP Prefixes: Edit	Grants access to read/write IP prefix settings.
IP Prefixes: BGP On Demand Read	Grants access to read IP prefix BGP configuration.
IP Prefixes: BGP On Demand Edit	Grants access to read and change IP prefix BGP configuration.
L3/4 DDoS Managed Ruleset Read	Grants read access to L3/4 DDoS managed ruleset.
L3/4 DDoS Managed Ruleset Edit	Grants write access to L3/4 DDoS managed ruleset.
Load Balancing: Monitors and Pools Read	Grants read access to account level load balancer resources.
Load Balancing: Monitors and Pools Edit	Grants write access to account level load balancer resources.
Logs Read	Grants read access to logs using Logpull or Instant Logs.
Logs Edit	Grants read and write access to Logpull, Logpush, and Instant Logs.
Magic Firewall Read	Grants read access to Magic Firewall.
Magic Firewall Edit	Grants write access to Magic Firewall.
Magic Firewall Packet Captures - Read PCAPs API	Grants read access to Packet Captures.
Magic Firewall Packet Captures - Edit PCAPs API	Grants write access to Packet Captures.
Magic Network Monitoring Read	Grants read access to Magic Network Monitoring.
Magic Network Monitoring Edit	Grants write access to Magic Network Monitoring.
Magic Transit Read	Grants read access to manage a user's Magic Transit prefixes.
Magic Transit Edit	Grants write access to manage a user's Magic Transit prefixes.
Notifications Read	Grants read access to Notifications.
Notifications Edit	Grants write access to Notifications.
Page Shield Read	Grants read access to Page Shield.
Page Shield Edit	Grants write access to Page Shield.
Pipelines Read	Grants read access to Cloudflare Pipelines.
Pipelines Edit	Grants write access to Cloudflare Pipelines.
Pub/Sub Read	Grants read access to Pub/Sub.
Pub/Sub Edit	Grants write access to Pub/Sub.
Queues Read	Grants read access to Queues.
Queues Edit	Grants write access to Queues.
Rule Policies Read	Grants read access to Rule Policies.
Rule Policies Edit	Grants write access to Rule Policies.
Stream Read	Grants read access to Cloudflare Stream.
Stream Edit	Grants write access to Cloudflare Stream.
Transform Rules Read	Grants read access to Transform Rules.
Transform Rules Edit	Grants write access to Transform Rules.
Turnstile Read	Grants read access to Turnstile.
Turnstile Edit	Grants write access to Turnstile.
URL Scanner Read	Grants read access to URL Scanner.
URL Scanner Edit	Grants write access to URL Scanner.
Vectorize Read	Grants read access to Vectorize.
Vectorize Edit	Grants write access to Vectorize.
Workers AI Read	Grants read access to Workers AI.
Workers AI Edit	Grants write access to Workers AI.
Workers CI Read	Grants read access to [Workers CI] (/workers/).
Workers CI Edit	Grants write access to Workers CI.
Workers KV Storage Read	Grants read access to Cloudflare Workers KV Storage.
Workers KV Storage Edit	Grants write access to Cloudflare Workers KV Storage.
Workers R2 Storage Read	Grants read access to Cloudflare R2 Storage.
Workers R2 Storage Edit	Grants write access to Cloudflare R2 Storage.
Workers Scripts Read	Grants read access to Cloudflare Workers scripts.
Workers Scripts Edit	Grants write access to Cloudflare Workers scripts.
Workers Tail Read	Grants wrangler tail read permissions.
Zero Trust Read	Grants read access to Cloudflare Zero Trust.
Zero Trust Report	Grants reporting access to Cloudflare Zero Trust.
Zero Trust Edit	Grants write access to Cloudflare Zero Trust.
Zero Trust PII Read	Grants read access to Cloudflare Zero Trust PII.
Zero Trust PII Edit	Grants write access to Cloudflare Zero Trust PII.
Zero Trust Seats Edit	Grants write access to the number of Zero Trust Seats your organization can use (and be billed for).

API

Name	Description
Access: Apps and Policies Read	Grants read access to Cloudflare Access account resources.
Access: Apps and Policies Revoke	Grants ability to revoke all tokens to Cloudflare Access account resources.
Access: Apps and Policies Write	Grants write access to Cloudflare Access account resources.
Access: Audit Logs Read	Grants read access to Cloudflare Access audit logs.
Access: Custom Pages Read	Grants read access to Cloudflare Access Custom Pages.
Access: Custom Pages Write	Grants write access to Cloudflare Access Custom Pages.
Access: Device Posture Read	Grants read access to Cloudflare Access Device Posture.
Access: Device Posture Write	Grants write access to Cloudflare Access Device Posture.
Access: Mutual TLS Certificates Read	Grants read access to Cloudflare Access mTLS certificates.
Access: Mutual TLS Certificates Write	Grants write access to Cloudflare Access mTLS certificates.
Access: Organizations, Identity Providers, and Groups Read	Grants read access to Cloudflare Access account resources.
Access: Organizations, Identity Providers, and Groups Revoke	Grants ability to revoke user sessions to Cloudflare Access account resources.
Access: Organizations, Identity Providers, and Groups Write	Grants write access to Cloudflare Access account resources.
Access: Service Tokens Read	Grants read access to Cloudflare Access Service Tokens.
Access: Service Tokens Write	Grants write access to Cloudflare Access Service Tokens.
Access: SSH Auditing Read	Grants read access to SSH Auditing.
Access: SSH Auditing Write	Grants write access to SSH Auditing.
Account Analytics Read	Grants read access to account analytics.
Account Custom Pages Read	Grants read access to account-level Custom Pages.
Account Custom Pages Write	Grants write access to account-level Custom Pages.
Account Filter Lists Read	Grants read access to Account Filter Lists.
Account Filter Lists Write	Grants write access to Account Filter Lists.
Account Firewall Access Rules Read	Grants read access to account firewall access rules.
Account Firewall Access Rules Write	Grants write access to account firewall access rules.
Account Rulesets Read	Grants read access to Account Rulesets.
Account Rulesets Write	Grants write access to Account Rulesets.
Account Settings Read	Grants read access to Account resources, account membership, and account level features.
Account Settings Write	Grants write access to Account resources, account membership, and account level features.
Account: SSL and Certificates Read	Grants read access to SSL and Certificates.
Account: SSL and Certificates Write	Grants write access to SSL and Certificates.
Account WAF Read	Grants read access to Account WAF.
Account WAF Write	Grants write access to Account WAF.
Address Maps Write	Grants write access to Address Maps
Address Maps Read	Grants read access to Address Maps
Allow Request Tracer Read	Grants read access to Request Tracer.
API Gateway Read	Grants read access to API Gateway (including API Shield) for all domains in an account.
API Gateway Write	Grants write access to API Gateway (including API Shield) for all domains in an account.
Billing Read	Grants read access to billing profile, subscriptions, and access to fetch invoices and entitlements.
Billing Write	Grants write access to billing profile, subscriptions, and access to fetch invoices and entitlements.
Bulk URL Redirects Read	Grants read access to Bulk URL Redirects.
Bulk URL Redirects Write	Grants write access to Bulk URL Redirects.
China Network Steering Read	Grants read access to China Network Steering.
China Network Steering Write	Grants write access to China Network Steering.
Cloudchamber Read	Grants read access to Cloudchamber deployments.
Cloudchamber Write	Grants write access to Cloudchamber deployments.
Cloudflare Calls Read	Grants read access to Cloudflare Calls.
Cloudflare Calls Write	Grants write access to Cloudflare Calls.
Cloudflare DEX Read	Grants read access to Digital Experience Monitoring.
Cloudflare DEX Write	Grants write access to Digital Experience Monitoring.
Cloudflare Images Read	Grants read access to Cloudflare Images.
Cloudflare Images Write	Grants write access to Cloudflare Images.
Cloudflare One Connector: cloudflared Read	Grants read access to cloudflared Connectors
Cloudflare One Connector: cloudflared Write	Grants write access to cloudflared Connectors
Cloudflare One Connector: WARP Read	Grants read access to Warp Connectors
Cloudflare One Connector: WARP Write	Grants write access to Warp Connectors
Cloudflare One Connectors Read	Grants read access to Cloudflare One Connectors
Cloudflare One Connectors Write	Grants write access to Cloudflare One Connectors
Cloudflare One Networks Read	Grants read access to Cloudflare One Networks
Cloudflare One Networks Write	Grants write access to Cloudflare One Networks
Pages Read	Grants access to view Cloudflare Pages projects.
Pages Write	Grants access to create, edit and delete Cloudflare Pages projects.
Argo Tunnel Read	Grants access to view Cloudflare Tunnels.
Argo Tunnel Write	Grants access to create and delete Cloudflare Tunnels.
Cloudforce One Read	Grants read access to Cloudforce One.
Cloudforce One Write	Grants write access to Cloudforce One.
Cloud Email Security Read	Grants read access to Cloud Email Security.
Email Security Write	Grants write access to Email Security.
Constellation Read	Grants read access to Constellation.
Constellation Write	Grants write access to Constellation.
D1 Read	Grants read access to D1.
D1 Write	Grants write access to D1.
DDoS Botnet Feed Read	Grants read access to Botnet Feed reports.
DDoS Botnet Feed Write	Grants write access to Botnet Feed configuration.
DDoS Protection Read	Grants read access to DDoS protection.
DDoS Protection Write	Grants write access to DDoS protection.
DNS Firewall Read	Grants read access to DNS Firewall.
DNS Firewall Write	Grants write access to DNS Firewall.
Email Routing Addresses Read	Grants read access to Email Routing Addresses.
Email Routing Addresses Write	Grants write access to Email Routing Addresses.
Hyperdrive Read	Grants read access to Hyperdrive.
Hyperdrive Write	Grants write access to Hyperdrive.
Intel Read	Grants read access to Intel.
Intel Write	Grants write access to Intel.
Integration Write	Grants write access to integrations.
IOT Read	Grants read access to IOT ↗.
IOT Write	Grants write access to IOT ↗.
IP Prefixes: Read	Grants access to read IP prefix settings.
IP Prefixes: Write	Grants access to read/write IP prefix settings.
IP Prefixes: BGP On Demand Read	Grants access to read IP prefix BGP configuration.
IP Prefixes: BGP On Demand Write	Grants access to read and change IP prefix BGP configuration.
L3/4 DDoS Managed Ruleset Read	Grants read access to L3/4 DDoS managed ruleset.
L3/4 DDoS Managed Ruleset Write	Grants write access to L3/4 DDoS managed ruleset.
Load Balancing: Monitors and Pools Read	Grants read access to account level load balancer resources.
Load Balancing: Monitors and Pools Write	Grants write access to account level load balancer resources.
Logs Read	Grants read access to logs using Logpull or Instant Logs.
Logs Write	Grants read and write access to Logpull, Logpush, and Instant Logs.
Magic Firewall Read	Grants read access to Magic Firewall.
Magic Firewall Write	Grants write access to Magic Firewall.
Magic Firewall Packet Captures - Read PCAPs API	Grants read access to Packet Captures.
Magic Firewall Packet Captures - Write PCAPs API	Grants write access to Packet Captures.
Magic Network Monitoring Read	Grants read access to Magic Network Monitoring.
Magic Network Monitoring Write	Grants write access to Magic Network Monitoring.
Magic Transit Read	Grants read access to manage a user's Magic Transit prefixes.
Magic Transit Write	Grants write access to manage a user's Magic Transit prefixes.
Notifications Read	Grants read access to Notifications.
Notifications Write	Grants write access to Notifications.
Page Shield Read	Grants read access to Page Shield.
Page Shield Write	Grants write access to Page Shield.
Pipelines Read	Grants read access to Cloudflare Pipelines.
Pipelines Write	Grants write access to Cloudflare Pipelines.
Pub/Sub Read	Grants read access to Pub/Sub.
Pub/Sub Write	Grants write access to Pub/Sub.
Queues Read	Grants read access to Queues.
Queues Write	Grants write access to Queues.
Rule Policies Read	Grants read access to Rule Policies.
Rule Policies Write	Grants write access to Rule Policies.
Stream Read	Grants read access to Cloudflare Stream.
Stream Write	Grants write access to Cloudflare Stream.
Transform Rules Read	Grants read access to Transform Rules.
Transform Rules Write	Grants write access to Transform Rules.
Turnstile Read	Grants read access to Turnstile.
Turnstile Write	Grants write access to Turnstile.
URL Scanner Read	Grants read access to URL Scanner.
URL Scanner Write	Grants write access to URL Scanner.
Vectorize Read	Grants read access to Vectorize.
Vectorize Write	Grants write access to Vectorize.
Workers AI Read	Grants read access to Workers AI.
Workers AI Write	Grants write access to Workers AI.
Workers CI Read	Grants read access to [Workers CI] (/workers/).
Workers CI Write	Grants write access to Workers CI.
Workers KV Storage Read	Grants read access to Cloudflare Workers KV Storage.
Workers KV Storage Write	Grants write access to Cloudflare Workers KV Storage.
Workers R2 Storage Read	Grants read access to Cloudflare R2 Storage.
Workers R2 Storage Write	Grants write access to Cloudflare R2 Storage.
Workers Scripts Read	Grants read access to Cloudflare Workers scripts.
Workers Scripts Write	Grants write access to Cloudflare Workers scripts.
Workers Tail Read	Grants wrangler tail read permissions.
Zero Trust Read	Grants read access to Cloudflare Zero Trust.
Zero Trust Report	Grants reporting access to Cloudflare Zero Trust.
Zero Trust Write	Grants write access to Cloudflare Zero Trust.
Zero Trust PII Read	Grants read access to Cloudflare Zero Trust PII.
Zero Trust PII Write	Grants write access to Cloudflare Zero Trust PII.
Zero Trust Seats Write	Grants write access to the number of Zero Trust Seats your organization can use (and be billed for).

Zone permissions

The applicable scope of zone permissions is com.cloudflare.api.account.zone.

Dashboard

Name	Description
Access: Apps and Policies Read	Grants read access to Cloudflare Access zone resources.
Access: Apps and Policies Revoke	Grants ability to revoke all tokens to Cloudflare Access zone resources.
Access: Apps and Policies Edit	Grants write access to Cloudflare Access zone resources.
Analytics Read	Grants read access to analytics.
API Gateway Read	Grants read access to API Gateway zone resources.
API Gateway Edit	Grants write access to API Gateway zone resources.
Apps Edit	Grants full access to Cloudflare Apps.
Bot Management Read	Grants read access to Bot Management.
Bot Management Edit	Grants write access to Bot Management.
Bot Management Feedback Read	Grants read access to Bot Management feedback.
Bot Management Feedback Edit	Grants write access to Bot Management feedback.
Cache Purge	Grants access to purge cache.
Cache Rules Read	Grants read access to Cache Rules.
Cache Rules Edit	Grants write access to Cache Rules.
Cloud Connector Read	Grants read access to Cloud Connector rules.
Cloud Connector Edit	Grants write access to Cloud Connector rules.
Config Rules Read	Grants read access to Configuration Rules.
Config Rules Edit	Grants write access to Configuration Rules.
Custom Errors Read	Grants read access to Custom Errors Phase.
Custom Errors Edit	Grants write access to Custom Errors Phase.
Custom Error Rules Read	Grants read access to Custom Error Rules.
Custom Error Rules Edit	Grants write access to Custom Error Rules.
Custom Pages Read	Grants read access to Custom Pages.
Custom Pages Edit	Grants write access to Custom Pages.
DMARC Management Read	Grants read access to DMARC Management.
DMARC Management Edit	Grants write access to DMARC Management.
DNS Read	Grants read access to DNS.
DNS Write	Grants write access to DNS.
Dynamic URL Redirect Read	Grants read access to zone-level Single Redirects.
Dynamic URL Redirect Edit	Grants write access to zone-level Single Redirects.
Email Routing Rules Read	Grants read access to Email Routing Rules.
Email Routing Rules Edit	Grants write access to Email Routing Rules.
Firewall Services Read	Grants read access to Firewall resources.
Firewall Services Edit	Grants write access to Firewall resources.
Health Checks Read	Grants read access to Health Checks.
Health Checks Edit	Grants write access to Health Checks.
HTTP DDoS Managed Ruleset Read	Grants read access to HTTP DDoS managed ruleset.
HTTP DDoS Managed Ruleset Edit	Grants write access to HTTP DDoS managed ruleset.
Load Balancers Read	Grants read access to load balancer resources.
Load Balancers Edit	Grants write access to load balancer resources.
Logs Read	Grants read access to logs using Logpull.
Logs Edit	Grants write access to Logpull and Logpush.
Managed Headers Read	Grants read access to Managed Headers.
Managed Headers Edit	Grants write access to Managed Headers.
Origin Rules Read	Grants read access to Origin Rules.
Origin Rules Edit	Grants write access to Origin Rules.
Page Rules Read	Grants read access to Page Rules.
Page Rules Edit	Grants write access to Page Rules.
Page Shield Read	Grants read access to Page Shield.
Page Shield Edit	Grants write access to Page Shield.
Response Compression Read	Grants read access to Response Compression.
Response Compression Edit	Grants write access to Response Compression.
Sanitize Read	Grants read access to sanitization.
Sanitize Edit	Grants write access to sanitization.
SSL and Certificates Read	Grants read access to SSL configuration and certificate management.
SSL and Certificates Edit	Grants write access to SSL configuration and certificate management.
Transform Rules Read	Grants read access to Transform Rules.
Transform Rules Edit	Grants write access to Transform Rules.
Waiting Room Read	Grants read access to Waiting Room.
Waiting Room Edit	Grants write access to Waiting Room.
Web3 Hostnames Read	Grants read access to Web3 Hostnames.
Web3 Hostnames Edit	Grants write access to Web3 Hostnames.
Workers Routes Read	Grants read access to Cloudflare Workers and Workers KV Storage.
Workers Routes Edit	Grants write access to Cloudflare Workers and Workers KV Storage.
Zaraz Read	Grants read access to Zaraz zone level settings.
Zaraz Edit	Grants write access to Zaraz zone level settings.
Zone Read	Grants read access to zone management.
Zone Edit	Grants write access to zone management.
Zone Settings Read	Grants read access to zone settings.
Zone Settings Edit	Grants write access to zone settings.
Zone Versioning Read	Grants read access to Zone Versioning at zone level.
Zone Versioning Edit	Grants write access to Zone Versioning at zone level.
Zone WAF Read	Grants read access to Zone WAF.
Zone WAF Edit	Grants write access to Zone WAF.

API

Name	Description
Access: Apps and Policies Read	Grants read access to Cloudflare Access zone resources.
Access: Apps and Policies Revoke	Grants ability to revoke all tokens to Cloudflare Access zone resources.
Access: Apps and Policies Write	Grants write access to Cloudflare Access zone resources.
Analytics Read	Grants read access to analytics.
API Gateway Read	Grants read access to API Gateway zone resources.
API Gateway Write	Grants write access to API Gateway zone resources.
Apps Write	Grants full access to Cloudflare Apps.
Bot Management Read	Grants read access to Bot Management.
Bot Management Write	Grants write access to Bot Management.
Bot Management Feedback Read	Grants read access to Bot Management feedback.
Bot Management Feedback Write	Grants write access to Bot Management feedback.
Cache Purge	Grants access to purge cache.
Cache Rules Read	Grants read access to Cache Rules.
Cache Rules Write	Grants write access to Cache Rules.
Cloud Connector Read	Grants read access to Cloud Connector rules.
Cloud Connector Write	Grants write access to Cloud Connector rules.
Config Rules Read	Grants read access to Configuration Rules.
Config Rules Write	Grants write access to Configuration Rules.
Custom Errors Read	Grants read access to Custom Errors Phase.
Custom Errors Write	Grants write access to Custom Errors Phase.
Custom Error Rules Read	Grants read access to Custom Error Rules.
Custom Error Rules Write	Grants write access to Custom Error Rules.
Custom Pages Read	Grants read access to Custom Pages.
Custom Pages Write	Grants write access to Custom Pages.
DMARC Management Read	Grants read access to DMARC Management.
DMARC Management Write	Grants write access to DMARC Management.
DNS Read	Grants read access to DNS.
DNS Write	Grants write access to DNS.
Dynamic URL Redirect Read	Grants read access to zone-level Single Redirects.
Dynamic URL Redirect Write	Grants write access to zone-level Single Redirects.
Email Routing Rules Read	Grants read access to Email Routing Rules.
Email Routing Rules Write	Grants write access to Email Routing Rules.
Firewall Services Read	Grants read access to Firewall resources.
Firewall Services Write	Grants write access to Firewall resources.
Health Checks Read	Grants read access to Health Checks.
Health Checks Write	Grants write access to Health Checks.
HTTP DDoS Managed Ruleset Read	Grants read access to HTTP DDoS managed ruleset.
HTTP DDoS Managed Ruleset Write	Grants write access to HTTP DDoS managed ruleset.
Load Balancers Read	Grants read access to load balancer resources.
Load Balancers Write	Grants write access to load balancer resources.
Logs Read	Grants read access to logs using Logpull.
Logs Write	Grants write access to Logpull and Logpush.
Managed Headers Read	Grants read access to Managed Headers.
Managed Headers Write	Grants write access to Managed Headers.
Origin Rules Read	Grants read access to Origin Rules.
Origin Rules Write	Grants write access to Origin Rules.
Page Rules Read	Grants read access to Page Rules.
Page Rules Write	Grants write access to Page Rules.
Page Shield Read	Grants read access to Page Shield.
Page Shield Write	Grants write access to Page Shield.
Response Compression Read	Grants read access to Response Compression.
Response Compression Write	Grants write access to Response Compression.
Sanitize Read	Grants read access to sanitization.
Sanitize Write	Grants write access to sanitization.
SSL and Certificates Read	Grants read access to SSL configuration and certificate management.
SSL and Certificates Write	Grants write access to SSL configuration and certificate management.
Transform Rules Read	Grants read access to Transform Rules.
Transform Rules Write	Grants write access to Transform Rules.
Waiting Room Read	Grants read access to Waiting Room.
Waiting Room Write	Grants write access to Waiting Room.
Web3 Hostnames Read	Grants read access to Web3 Hostnames.
Web3 Hostnames Write	Grants write access to Web3 Hostnames.
Workers Routes Read	Grants read access to Cloudflare Workers and Workers KV Storage.
Workers Routes Write	Grants write access to Cloudflare Workers and Workers KV Storage.
Zaraz Read	Grants read access to Zaraz zone level settings.
Zaraz Write	Grants write access to Zaraz zone level settings.
Zone Read	Grants read access to zone management.
Zone Write	Grants write access to zone management.
Zone Settings Read	Grants read access to zone settings.
Zone Settings Write	Grants write access to zone settings.
Zone Versioning Read	Grants read access to Zone Versioning at zone level.
Zone Versioning Write	Grants write access to Zone Versioning at zone level.
Zone WAF Read	Grants read access to Zone WAF.
Zone WAF Write	Grants write access to Zone WAF.

Was this helpful?

What did you like?

Accurate

Easy to understand

Solved my problem

Helped me decide to use the product

Other

What went wrong?

Hard to understand

Incorrect information

Missing the information

Other

Thank you for helping improve Cloudflare's documentation!