Cloudflare API | R2 › Temporary Credentials › Create Temporary Access Credentials

API Reference

Account & User Management

Resource Sharing

AI

Certificate Management

Certificate Authorities

Client Certificates

Custom Certificates

Custom Hostnames

Keyless Certificates

MTLS Certificates

Origin CA Certificates

Origin Post Quantum Encryption

Origin TLS Client Auth

Cloudflare One

DNS

Account Custom Nameservers

Domain/Zone Management

IP Addresses

Media

Networking

Magic Cloud Networking

Magic Network Monitoring

Network Interconnects

Observability

Security Center

Radar

Routing & Performance

Rules

Cloud Connector

Managed Transforms

URL Normalization

Security

Schema Validation

Content Scanning

Leaked Credential Checks

Storage & Databases

Temporary Credentials

Create Temporary Access Credentials

Threat Intelligence

Brand Protection

Workers & Pages

Browser Rendering

Durable Objects

Workers For Platforms

Shared

R2

r2

Buckets

r2.buckets

Methods

Create Bucket -> Envelope<

>

post/accounts/{account_id}/r2/buckets

Creates a new R2 bucket.

Delete Bucket -> Envelope<unknown>

delete/accounts/{account_id}/r2/buckets/{bucket_name}

Deletes an existing R2 bucket.

Patch Bucket -> Envelope<

>

patch/accounts/{account_id}/r2/buckets/{bucket_name}

Updates properties of an existing R2 bucket.

Get Bucket -> Envelope<

>

get/accounts/{account_id}/r2/buckets/{bucket_name}

Gets properties of an existing R2 bucket.

List Buckets -> Envelope<{ buckets }>

get/accounts/{account_id}/r2/buckets

Lists all R2 buckets on your account.

Domain types

Bucket = { creation_date, jurisdiction, location, 2 more... }

A single R2 bucket.

CORS

r2.buckets.cors

Methods

Delete Bucket CORS Policy -> Envelope<unknown>

delete/accounts/{account_id}/r2/buckets/{bucket_name}/cors

Delete the CORS policy for a bucket.

Get Bucket CORS Policy -> Envelope<{ rules }>

get/accounts/{account_id}/r2/buckets/{bucket_name}/cors

Get the CORS policy for a bucket.

Put Bucket CORS Policy -> Envelope<unknown>

put/accounts/{account_id}/r2/buckets/{bucket_name}/cors

Set the CORS policy for a bucket.

Domains

r2.buckets.domains

R2 Buckets Domains

Custom

r2.buckets.domains.custom

Methods

Attach Custom Domain To Bucket -> Envelope<{ domain, enabled, minTLS }>

post/accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom

Register a new custom domain for an existing R2 bucket.

Remove Custom Domain From Bucket -> Envelope<{ domain }>

delete/accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom/{domain}

Remove custom domain registration from an existing R2 bucket.

Get Custom Domain Settings -> Envelope<{ domain, enabled, status, 3 more... }>

get/accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom/{domain}

Get the configuration for a custom domain on an existing R2 bucket.

List Custom Domains Of Bucket -> Envelope<{ domains }>

get/accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom

Gets a list of all custom domains registered with an existing R2 bucket.

Configure Custom Domain Settings -> Envelope<{ domain, enabled, minTLS }>

put/accounts/{account_id}/r2/buckets/{bucket_name}/domains/custom/{domain}

Edit the configuration for a custom domain on an existing R2 bucket.

R2 Buckets Domains

Managed

r2.buckets.domains.managed

Methods

Get R2 Dev Domain Of Bucket -> Envelope<{ bucketId, domain, enabled }>

get/accounts/{account_id}/r2/buckets/{bucket_name}/domains/managed

Gets state of public access over the bucket's R2-managed (r2.dev) domain.

Update R2 Dev Domain Of Bucket -> Envelope<{ bucketId, domain, enabled }>

put/accounts/{account_id}/r2/buckets/{bucket_name}/domains/managed

Updates state of public access over the bucket's R2-managed (r2.dev) domain.

Event Notifications

r2.buckets.event_notifications

Methods

Delete Event Notification Rules -> Envelope<unknown>

delete/accounts/{account_id}/event_notifications/r2/{bucket_name}/configuration/queues/{queue_id}

Delete an event notification rule. If no body is provided, all rules for specified queue will be deleted.

Get Event Notification Rule -> Envelope<{ queueId, queueName, rules }>

get/accounts/{account_id}/event_notifications/r2/{bucket_name}/configuration/queues/{queue_id}

Get a single event notification rule.

List Event Notification Rules -> Envelope<{ bucketName, queues }>

get/accounts/{account_id}/event_notifications/r2/{bucket_name}/configuration

List all event notification rules for a bucket.

Create Event Notification Rule -> Envelope<unknown>

put/accounts/{account_id}/event_notifications/r2/{bucket_name}/configuration/queues/{queue_id}

Create event notification rule.

Lifecycle

r2.buckets.lifecycle

Methods

Get Object Lifecycle Rules -> Envelope<{ rules }>

get/accounts/{account_id}/r2/buckets/{bucket_name}/lifecycle

Get object lifecycle rules for a bucket.

Put Object Lifecycle Rules -> Envelope<unknown>

put/accounts/{account_id}/r2/buckets/{bucket_name}/lifecycle

Set the object lifecycle rules for a bucket.

Locks

r2.buckets.locks

Methods

Get Bucket Lock Rules -> Envelope<{ rules }>

get/accounts/{account_id}/r2/buckets/{bucket_name}/lock

Get lock rules for a bucket.

Put Bucket Lock Rules -> Envelope<unknown>

put/accounts/{account_id}/r2/buckets/{bucket_name}/lock

Set lock rules for a bucket.

Metrics

r2.buckets.metrics

Methods

Get Account Level Metrics -> Envelope<{ infrequentAccess, standard }>

get/accounts/{account_id}/r2/metrics

Get Storage/Object Count Metrics across all buckets in your account. Note that Account-Level Metrics may not immediately reflect the latest data.

Sippy

r2.buckets.sippy

Methods

Disable Sippy -> Envelope<{ enabled }>

delete/accounts/{account_id}/r2/buckets/{bucket_name}/sippy

Disables Sippy on this bucket.

Get Sippy Configuration -> Envelope<

>

get/accounts/{account_id}/r2/buckets/{bucket_name}/sippy

Gets configuration for Sippy for an existing R2 bucket.

Enable Sippy -> Envelope<

>

put/accounts/{account_id}/r2/buckets/{bucket_name}/sippy

Sets configuration for Sippy for an existing R2 bucket.

Domain types

Provider = "r2"

Sippy = { destination, enabled, source }

Super Slurper

r2.super_slurper

R2 Super Slurper

Connectivity Precheck

r2.super_slurper.connectivity_precheck

Methods

Check Source Connectivity -> Envelope<{ connectivityStatus }>

put/accounts/{account_id}/slurper/source/connectivity-precheck

Check whether tokens are valid against the source bucket

Check Target Connectivity -> Envelope<{ connectivityStatus }>

put/accounts/{account_id}/slurper/target/connectivity-precheck

Check whether tokens are valid against the target bucket

R2 Super Slurper

Jobs

r2.super_slurper.jobs

Methods

Abort A Job -> Envelope<string>

put/accounts/{account_id}/slurper/jobs/{job_id}/abort

Abort a job

Abort All Jobs -> Envelope<string>

put/accounts/{account_id}/slurper/jobs/abortAll

Abort all jobs

Create A Job -> Envelope<{ id }>

post/accounts/{account_id}/slurper/jobs

Create a job

Get Job Details -> Envelope<{ id, createdAt, finishedAt, 4 more... }>

get/accounts/{account_id}/slurper/jobs/{job_id}

Get job details

List Jobs -> SinglePage<{ id, createdAt, finishedAt, 4 more... }>

get/accounts/{account_id}/slurper/jobs

List jobs

Pause A Job -> Envelope<string>

put/accounts/{account_id}/slurper/jobs/{job_id}/pause

Pause a job

Get Job Progress -> Envelope<{ id, createdAt, failedObjects, 4 more... }>

get/accounts/{account_id}/slurper/jobs/{job_id}/progress

Get job progress

Resume A Job -> Envelope<string>

put/accounts/{account_id}/slurper/jobs/{job_id}/resume

Resume a job

R2 Super Slurper Jobs

Logs

r2.super_slurper.jobs.logs

Methods

Get Job Logs -> SinglePage<{ createdAt, job, logType, 2 more... }>

get/accounts/{account_id}/slurper/jobs/{job_id}/logs

Get job logs

Temporary Credentials

r2.temporary_credentials

Methods

Create Temporary Access Credentials -> Envelope<{ accessKeyId, secretAccessKey, sessionToken }>

post/accounts/{account_id}/r2/temp-access-credentials

Creates temporary access credentials on a bucket that can be optionally scoped to prefixes or objects.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example: Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

path Parameters

account_id: string

(maxLength: 32)

Account ID.

Response fields

errors: Array<

>

messages: Array<string>

result: { accessKeyId, secretAccessKey, sessionToken }

success: true

Whether the API call was successful.

Request example

curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/r2/temp-access-credentials \
    -H 'Content-Type: application/json' \
    -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
    -H "X-Auth-Key: $CLOUDFLARE_API_KEY" \
    -d '{
      "bucket": "example-bucket",
      "parentAccessKeyId": "example-access-key-id",
      "permission": "object-read-write",
      "ttlSeconds": 3600
    }'

200Example

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    "string"
  ],
  "result": {
    "accessKeyId": "example-access-key-id",
    "secretAccessKey": "example-secret-key",
    "sessionToken": "example-session-token"
  },
  "success": true
}

Domain types

TemporaryCredential = { bucket, parentAccessKeyId, permission, 3 more... }