Cloudflare changelogs | Cloudflare Fundamentals

Cloudflare Fundamentals - Service Key authentication deprecated

Thu, 19 Mar 2026 00:00:00 GMT

Service Key authentication for the Cloudflare API is deprecated. Service Keys will stop working on September 30, 2026.

API Tokens replace Service Keys with fine-grained permissions, expiration, and revocation.

What you need to do

Replace any use of the X-Auth-User-Service-Key header with an API Token scoped to the permissions your integration requires.

If you use cloudflared, update to a version from November 2022 or later. These versions already use API Tokens.

If you use origin-ca-issuer, update to a version that supports API Token authentication.

For more information, refer to API deprecations.

Cloudflare Fundamentals - SCIM provisioning for Authentik is now Generally Available

Wed, 18 Mar 2026 00:00:00 GMT

Cloudflare dashboard SCIM provisioning now supports Authentik as an identity provider, joining Okta and Microsoft Entra ID as explicitly supported providers.

Customers can now sync users and group information from Authentik to Cloudflare, apply Permission Policies to those groups, and manage the lifecycle of users & groups directly from your Authentik Identity Provider.

For more information:

Cloudflare Fundamentals - SCIM audit logging Support

Wed, 18 Mar 2026 00:00:00 GMT

Cloudflare dashboard SCIM provisioning operations are now captured in Audit Logs v2, giving you visibility into user and group changes made by your identity provider.

Logged actions:

Action Type	Description
Create SCIM User	User provisioned from IdP
Replace SCIM User	User fully replaced (PUT)
Update SCIM User	User attributes modified (PATCH)
Delete SCIM User	Member deprovisioned
Create SCIM Group	Group provisioned from IdP
Update SCIM Group	Group membership or attributes modified
Delete SCIM Group	Group deprovisioned

For more details, refer to the Audit Logs v2 documentation.

Cloudflare Fundamentals - Retry-After HTTP header for retryable 1xxx errors

Thu, 12 Mar 2026 00:00:00 GMT

Cloudflare-generated 1xxx error responses now include a standard Retry-After HTTP header when the error is retryable. Agents and HTTP clients can read the recommended wait time from response headers alone — no body parsing required.

Changes

Seven retryable error codes now emit Retry-After:

Error code	Retry-After (seconds)	Error name
1004	120	DNS resolution error
1005	120	Banned zone
1015	30	Rate limited
1033	120	Argo Tunnel error
1038	60	HTTP headers limit exceeded
1200	60	Cache connection limit
1205	5	Too many redirects

The header value matches the existing retry_after body field in JSON and Markdown responses.

If a WAF rate limiting rule has already set a dynamic Retry-After value on the response, that value takes precedence.

Availability

Available for all zones on all plans.

Verify

Check for the header on any retryable error:

curl -s --compressed -D - -o /dev/null -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/1015" | grep -i retry-after

References:

Cloudflare Fundamentals - JSON responses and RFC 9457 support for Cloudflare 1xxx errors

Wed, 11 Mar 2026 00:00:00 GMT

Cloudflare-generated 1xxx errors now return structured JSON when clients send Accept: application/json or Accept: application/problem+json. JSON responses follow RFC 9457 (Problem Details for HTTP APIs), so any HTTP client that understands Problem Details can parse the base members without Cloudflare-specific code.

Breaking change

The Markdown frontmatter field http_status has been renamed to status. Agents consuming Markdown frontmatter should update parsers accordingly.

Changes

JSON format. Clients sending Accept: application/json or Accept: application/problem+json now receive a structured JSON object with the same operational fields as Markdown frontmatter, plus RFC 9457 standard members.

RFC 9457 standard members (JSON only):

type — URI pointing to Cloudflare documentation for the specific error code
status — HTTP status code (matching the response status)
title — short, human-readable summary
detail — human-readable explanation specific to this occurrence
instance — Ray ID identifying this specific error occurrence

Field renames:

http_status -> status (JSON and Markdown)
what_happened -> detail (JSON only — Markdown prose sections are unchanged)

Content-Type mirroring. Clients sending Accept: application/problem+json receive Content-Type: application/problem+json; charset=utf-8 back; Accept: application/json receives application/json; charset=utf-8. Same body in both cases.

Negotiation behavior

Request header sent	Response format
`Accept: application/json`	JSON (`application/json` content type)
`Accept: application/problem+json`	JSON (`application/problem+json` content type)
`Accept: application/json, text/markdown;q=0.9`	JSON
`Accept: text/markdown`	Markdown
`Accept: text/markdown, application/json`	Markdown (equal `q`, first-listed wins)
`Accept: /`	HTML (default)

Availability

Available now for Cloudflare-generated 1xxx errors.

Get started

curl -s --compressed -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/1015" | jq .

curl -s --compressed -H "Accept: application/problem+json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/1015" | jq .

References:

Cloudflare Fundamentals - Markdown responses for Cloudflare 1xxx errors

Thu, 26 Feb 2026 00:00:00 GMT

Cloudflare now returns structured Markdown responses for Cloudflare-generated 1xxx errors when clients send Accept: text/markdown.

Each response includes YAML frontmatter plus guidance sections (What happened / What you should do) so agents can make deterministic retry and escalation decisions without parsing HTML.

In measured 1,015 comparisons, Markdown reduced payload size and token footprint by over 98% versus HTML.

Included frontmatter fields:

error_code, error_name, error_category, http_status
ray_id, timestamp, zone
cloudflare_error, retryable, retry_after (when applicable), owner_action_required

Default behavior is unchanged: clients that do not explicitly request Markdown continue to receive HTML error pages.

Negotiation behavior

Cloudflare uses standard HTTP content negotiation on the Accept header.

Accept: text/markdown -> Markdown
Accept: text/markdown, text/html;q=0.9 -> Markdown
Accept: text/* -> Markdown
Accept: */* -> HTML (default browser behavior)

When multiple values are present, Cloudflare selects the highest-priority supported media type using q values. If Markdown is not explicitly preferred, HTML is returned.

Availability

Available now for Cloudflare-generated 1xxx errors.

Get started

curl -H "Accept: text/markdown" https://<your-domain>/cdn-cgi/error/1015

Reference: Cloudflare 1xxx error documentation

Cloudflare Fundamentals - Content encoding support for Markdown for Agents and other improvements

Mon, 16 Feb 2026 00:00:00 GMT

When AI systems request pages from any website that uses Cloudflare and has Markdown for Agents enabled, they can express the preference for text/markdown in the request: our network will automatically and efficiently convert the HTML to markdown, when possible, on the fly.

This release adds the following improvements:

The origin response limit was raised from 1 MB to 2 MB (2,097,152 bytes).
We no longer require the origin to send the content-length header.
We now support content encoded responses from the origin.

If you haven’t enabled automatic Markdown conversion yet, visit the AI Crawl Control section of the Cloudflare dashboard and enable Markdown for Agents.

Refer to our developer documentation for more details.

Cloudflare Fundamentals, Access - Fine-grained permissions for Access policies and service tokens

Fri, 13 Feb 2026 00:00:00 GMT

Fine-grained permissions for Access policies and Access service tokens are available. These new resource-scoped roles expand the existing RBAC model, enabling administrators to grant permissions scoped to individual resources.

New roles

Cloudflare Access policy admin: Can edit a specific Access policy in an account.
Cloudflare Access service token admin: Can edit a specific Access service token in an account.

These roles complement the existing resource-scoped roles for Access applications, identity providers, and infrastructure targets.

For more information:

Cloudflare Fundamentals, SDK - Cloudflare Python SDK v5.0.0-beta.1 now available

Fri, 13 Feb 2026 00:00:00 GMT

Disclaimer: Please note that v5.0.0-beta.1 is in Beta and we are still testing it for stability.

Full Changelog: v4.3.1...v5.0.0-beta.1

In this release, you'll see a large number of breaking changes. This is primarily due to a change in OpenAPI definitions, which our libraries are based off of, and codegen updates that we rely on to read those OpenAPI definitions and produce our SDK libraries. As the codegen is always evolving and improving, so are our code bases.

There may be changes that are not captured in this changelog. Feel free to open an issue to report any inaccuracies, and we will make sure it gets into the changelog before the v5.0.0 release.

Most of the breaking changes below are caused by improvements to the accuracy of the base OpenAPI schemas, which sometimes translates to breaking changes in downstream clients that depend on those schemas.

Please ensure you read through the list of changes below and the migration guide before moving to this version - this will help you understand any down or upstream issues it may cause to your environments.

Breaking Changes

The following resources have breaking changes. See the v5 Migration Guide for detailed migration instructions.

abusereports
acm.totaltls
apigateway.configurations
cloudforceone.threatevents
d1.database
intel.indicatorfeeds
logpush.edge
origintlsclientauth.hostnames
queues.consumers
radar.bgp
rulesets.rules
schemavalidation.schemas
snippets
zerotrust.dlp
zerotrust.networks

Features

New API Resources

abusereports - Abuse report management
abusereports.mitigations - Abuse report mitigation actions
ai.tomarkdown - AI-powered markdown conversion
aigateway.dynamicrouting - AI Gateway dynamic routing configuration
aigateway.providerconfigs - AI Gateway provider configurations
aisearch - AI-powered search functionality
aisearch.instances - AI Search instance management
aisearch.tokens - AI Search authentication tokens
alerting.silences - Alert silence management
brandprotection.logomatches - Brand protection logo match detection
brandprotection.logos - Brand protection logo management
brandprotection.matches - Brand protection match results
brandprotection.queries - Brand protection query management
cloudforceone.binarystorage - CloudForce One binary storage
connectivity.directory - Connectivity directory services
d1.database - D1 database management
diagnostics.endpointhealthchecks - Endpoint health check diagnostics
fraud - Fraud detection and prevention
iam.sso - IAM Single Sign-On configuration
loadbalancers.monitorgroups - Load balancer monitor groups
organizations - Organization management
organizations.organizationprofile - Organization profile settings
origintlsclientauth.hostnamecertificates - Origin TLS client auth hostname certificates
origintlsclientauth.hostnames - Origin TLS client auth hostnames
origintlsclientauth.zonecertificates - Origin TLS client auth zone certificates
pipelines - Data pipeline management
pipelines.sinks - Pipeline sink configurations
pipelines.streams - Pipeline stream configurations
queues.subscriptions - Queue subscription management
r2datacatalog - R2 Data Catalog integration
r2datacatalog.credentials - R2 Data Catalog credentials
r2datacatalog.maintenanceconfigs - R2 Data Catalog maintenance configurations
r2datacatalog.namespaces - R2 Data Catalog namespaces
radar.bots - Radar bot analytics
radar.ct - Radar certificate transparency data
radar.geolocations - Radar geolocation data
realtimekit.activesession - Real-time Kit active session management
realtimekit.analytics - Real-time Kit analytics
realtimekit.apps - Real-time Kit application management
realtimekit.livestreams - Real-time Kit live streaming
realtimekit.meetings - Real-time Kit meeting management
realtimekit.presets - Real-time Kit preset configurations
realtimekit.recordings - Real-time Kit recording management
realtimekit.sessions - Real-time Kit session management
realtimekit.webhooks - Real-time Kit webhook configurations
tokenvalidation.configuration - Token validation configuration
tokenvalidation.rules - Token validation rules
workers.beta - Workers beta features

New Endpoints (Existing Resources)

`acm.totaltls`

edit()
update()

`cloudforceone.threatevents`

list()

`contentscanning`

create()
get()
update()

`dns.records`

scan_list()
scan_review()
scan_trigger()

`intel.indicatorfeeds`

create()
delete()
list()

`leakedcredentialchecks.detections`

get()

`queues.consumers`

list()

`radar.ai`

summary()
timeseries()
timeseries_groups()

`radar.bgp`

changes()
snapshot()

`workers.subdomains`

delete()

`zerotrust.networks`

create()
delete()
edit()
get()
list()

General Fixes and Improvements

Type System & Compatibility

Type inference improvements: Allow Pyright to properly infer TypedDict types within SequenceNotStr
Type completeness: Add missing types to method arguments and response models
Pydantic compatibility: Ensure compatibility with Pydantic versions prior to 2.8.0 when using additional fields

Request/Response Handling

Multipart form data: Correctly handle sending multipart/form-data requests with JSON data
Header handling: Do not send headers with default values set to omit
GET request headers: Don't send Content-Type header on GET requests
Response body model accuracy: Broad improvements to the correctness of models

Parsing & Data Processing

Discriminated unions: Correctly handle nested discriminated unions in response parsing
Extra field types: Parse extra field types correctly
Empty metadata: Ignore empty metadata fields during parsing
Singularization rules: Update resource name singularization rules for better consistency

Cloudflare Fundamentals - Introducing Markdown for Agents

Thu, 12 Feb 2026 00:00:00 GMT

Cloudflare's network now supports real-time content conversion at the source, for enabled zones using content negotiation headers. When AI systems request pages from any website that uses Cloudflare and has Markdown for Agents enabled, they can express the preference for text/markdown in the request: our network will automatically and efficiently convert the HTML to markdown, when possible, on the fly.

Here is a curl example with the Accept negotiation header requesting this page from our developer documentation:

curl https://developers.cloudflare.com/fundamentals/reference/markdown-for-agents/ \
  -H "Accept: text/markdown"

The response to this request is now formatted in markdown:

HTTP/2 200
date: Wed, 11 Feb 2026 11:44:48 GMT
content-type: text/markdown; charset=utf-8
content-length: 2899
vary: accept
x-markdown-tokens: 725
content-signal: ai-train=yes, search=yes, ai-input=yes

---
title: Markdown for Agents · Cloudflare Agents docs
---

## What is Markdown for Agents

Markdown has quickly become the lingua franca for agents and AI systems
as a whole. The format’s explicit structure makes it ideal for AI processing,
ultimately resulting in better results while minimizing token waste.
...

Refer to our developer documentation and our blog announcement for more details.

Cloudflare Fundamentals, Terraform - Terraform v5.17.0 now available

Thu, 12 Feb 2026 00:00:00 GMT

In January 2025, we announced the launch of the new Terraform v5 Provider. We greatly appreciate the proactive engagement and valuable feedback from the Cloudflare community following the v5 release. In response, we have established a consistent and rapid 2-3 week cadence for releasing targeted improvements, demonstrating our commitment to stability and reliability.

With the help of the community, we have a growing number of resources that we have marked as stable, with that list continuing to grow with every release. The most used resources are on track to be stable by the end of March 2026, when we will also be releasing a new migration tool to help you migrate from v4 to v5 with ease.

This release brings new capabilities for AI Search, enhanced Workers Script placement controls, and numerous bug fixes based on community feedback. We also begun laying foundational work for improving the v4 to v5 migration process. Stay tuned for more details as we approach the March 2026 release timeline.

Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

Features

ai_search_instance: add data source for querying AI Search instances
ai_search_token: add data source for querying AI Search tokens
account: add support for tenant unit management with new unit field
account: add automatic mapping from managed_by.parent_org_id to unit.id
authenticated_origin_pulls_certificate: add data source for querying authenticated origin pull certificates
authenticated_origin_pulls_hostname_certificate: add data source for querying hostname-specific authenticated origin pull certificates
authenticated_origin_pulls_settings: add data source for querying authenticated origin pull settings
workers_kv: add value field to data source to retrieve KV values directly
workers_script: add script field to data source to retrieve script content
workers_script: add support for simple rate limit binding
workers_script: add support for targeted placement mode with placement.target array for specifying placement targets (region, hostname, host)
workers_script: add placement_mode and placement_status computed fields
zero_trust_dex_test: add data source with filter support for finding specific tests
zero_trust_dlp_predefined_profile: add enabled_entries field for flexible entry management

Bug Fixes

account: map managed_by.parent_org_id to unit.id in unmarshall and add acceptance tests
authenticated_origin_pulls_certificate: add certificate normalization to prevent drift
authenticated_origin_pulls: handle array response and implement full lifecycle
authenticated_origin_pulls_hostname_certificate: fix resource and tests
cloudforce_one_request_message: use correct request_id field instead of id in API calls
dns_zone_transfers_incoming: use correct zone_id field instead of id in API calls
dns_zone_transfers_outgoing: use correct zone_id field instead of id in API calls
email_routing_settings: use correct zone_id field instead of id in API calls
hyperdrive_config: add proper handling for write-only fields to prevent state drift
hyperdrive_config: add normalization for empty mtls objects to prevent unnecessary diffs
magic_network_monitoring_rule: use correct account_id field instead of id in API calls
mtls_certificates: fix resource and test
pages_project: revert build_config to computed optional
stream_key: use correct account_id field instead of id in API calls
total_tls: use upsert pattern for singleton zone setting
waiting_room_rules: use correct waiting_room_id field instead of id in API calls
workers_script: add support for placement mode/status
zero_trust_access_application: update v4 version on migration tests
zero_trust_device_posture_rule: update tests to match API
zero_trust_dlp_integration_entry: use correct entry_id field instead of id in API calls
zero_trust_dlp_predefined_entry: use correct entry_id field instead of id in API calls
zero_trust_organization: fix plan issues

Chores

add state upgraders to 95+ resources to lay the foundation for replacing Grit (still under active development)
certificate_pack: add state migration handler for SDKv2 to Framework conversion
custom_hostname_fallback_origin: add comprehensive lifecycle test and migration support
dns_record: add state migration handler for SDKv2 to Framework conversion
leaked_credential_check: add import functionality and tests
load_balancer_pool: add state migration handler with detection for v4 vs v5 format
pages_project: add state migration handlers
tiered_cache: add state migration handlers
zero_trust_dlp_predefined_profile: deprecate entries field in favor of enabled_entries

For more information

Cloudflare Fundamentals - Added Timezone preferences settings

Tue, 27 Jan 2026 00:00:00 GMT

You can now set the timezone in the Cloudflare dashboard as Coordinated Universal Time (UTC) or your browser or system's timezone.

What's New

Unless otherwise specified in the user interface, all dates and times in the Cloudflare dashboard are now displayed in the selected timezone.

You can change the timezone setting from the user profile dropdown.

The page will reload to apply the new timezone setting.

Cloudflare Fundamentals - New 2FA Experience for Login

Fri, 23 Jan 2026 00:00:00 GMT

In an effort to improve overall user security, users without 2FA will be prompted upon login to enroll in email 2FA. This will improve user security posture while minimizing friction. Users without email 2FA enabled will see a prompt to secure their account with additional factors upon logging in. Enrolling in 2FA remains optional, but strongly encouraged as it is the best way to prevent account takeovers.

We also made changes to existing 2FA screens to improve the user experience. Now we have distinct experiences for each 2FA factor type, reflective of the way that factor works.

For more information

Configure Email Two Factor Authentication

Cloudflare Fundamentals, SDK - Cloudflare Typescript SDK v6.0.0-beta.1 now available

Tue, 20 Jan 2026 00:00:00 GMT

Disclaimer: Please note that v6.0.0-beta.1 is in Beta and we are still testing it for stability.

Full Changelog: v5.2.0...v6.0.0-beta.1

Some breaking changes were introduced due to bug fixes, also listed below.

Please ensure you read through the list of changes below before moving to this version - this will help you understand any down or upstream issues it may cause to your environments.

Breaking Changes

Addressing - Parameter Requirements Changed

BGPPrefixCreateParams.cidr: optional → required
PrefixCreateParams.asn: number | null → number
PrefixCreateParams.loa_document_id: required → optional
ServiceBindingCreateParams.cidr: optional → required
ServiceBindingCreateParams.service_id: optional → required

API Gateway

ConfigurationUpdateResponse removed
PublicSchema → OldPublicSchema
SchemaUpload → UserSchemaCreateResponse
ConfigurationUpdateParams.properties removed; use normalize

CloudforceOne - Response Type Changes

ThreatEventBulkCreateResponse: number → complex object with counts and errors

D1 Database - Query Parameters

DatabaseQueryParams: simple interface → union type (D1SingleQuery | MultipleQueries)
DatabaseRawParams: same change
Supports batch queries via batch array

DNS Records - Type Renames (21 types)

All record type interfaces renamed from *Record to short names:

RecordResponse.ARecord → RecordResponse.A
RecordResponse.AAAARecord → RecordResponse.AAAA
RecordResponse.CNAMERecord → RecordResponse.CNAME
RecordResponse.MXRecord → RecordResponse.MX
RecordResponse.NSRecord → RecordResponse.NS
RecordResponse.PTRRecord → RecordResponse.PTR
RecordResponse.TXTRecord → RecordResponse.TXT
RecordResponse.CAARecord → RecordResponse.CAA
RecordResponse.CERTRecord → RecordResponse.CERT
RecordResponse.DNSKEYRecord → RecordResponse.DNSKEY
RecordResponse.DSRecord → RecordResponse.DS
RecordResponse.HTTPSRecord → RecordResponse.HTTPS
RecordResponse.LOCRecord → RecordResponse.LOC
RecordResponse.NAPTRRecord → RecordResponse.NAPTR
RecordResponse.SMIMEARecord → RecordResponse.SMIMEA
RecordResponse.SRVRecord → RecordResponse.SRV
RecordResponse.SSHFPRecord → RecordResponse.SSHFP
RecordResponse.SVCBRecord → RecordResponse.SVCB
RecordResponse.TLSARecord → RecordResponse.TLSA
RecordResponse.URIRecord → RecordResponse.URI
RecordResponse.OpenpgpkeyRecord → RecordResponse.Openpgpkey

IAM Resource Groups

ResourceGroupCreateResponse.scope: optional single → required array
ResourceGroupCreateResponse.id: optional → required

Origin CA Certificates - Parameter Requirements Changed

OriginCACertificateCreateParams.csr: optional → required
OriginCACertificateCreateParams.hostnames: optional → required
OriginCACertificateCreateParams.request_type: optional → required

Pipelines - v0 to v1 Migration

Entire v0 API deprecated; use v1 methods (createV1, listV1, etc.)
New sub-resources: Sinks, Streams

R2

EventNotificationUpdateParams.rules: optional → required
Super Slurper: bucket, secret now required in source params

Radar

dataSource: string → typed enum (23 values)
eventType: string → typed enum (6 values)
V2 methods require dimension parameter (breaking signature change)

Resource Sharing

Removed: status_message field from all recipient response types

Schema Validation

Consolidated SchemaCreateResponse, SchemaListResponse, SchemaEditResponse, SchemaGetResponse → PublicSchema
Renamed: SchemaListResponsesV4PagePaginationArray → PublicSchemasV4PagePaginationArray

Spectrum

Renamed union members: AppListResponse.UnionMember0 → SpectrumConfigAppConfig
Renamed union members: AppListResponse.UnionMember1 → SpectrumConfigPaygoAppConfig

Workers

Removed: WorkersBindingKindTailConsumer type (all occurrences)
Renamed: ScriptsSinglePage → ScriptListResponsesSinglePage
Removed: DeploymentsSinglePage

Zero-Trust DLP

datasets.create(), update(), get() return types changed
PredefinedGetResponse union members renamed to UnionMember0-5

Zero-Trust Tunnels

Removed: CloudflaredCreateResponse, CloudflaredListResponse, CloudflaredDeleteResponse, CloudflaredEditResponse, CloudflaredGetResponse
Removed: CloudflaredListResponsesV4PagePaginationArray

Features

Abuse Reports (`client.abuseReports`)

Reports: create, list, get
Mitigations: sub-resource for abuse mitigations

AI Search (`client.aisearch`)

Instances: create, update, list, delete, read, stats
Items: list, get
Jobs: create, list, get, logs
Tokens: create, update, list, delete, read

Connectivity (`client.connectivity`)

Directory Services: create, update, list, delete, get
Supports IPv4, IPv6, dual-stack, and hostname configurations

Organizations (`client.organizations`)

Organizations: create, update, list, delete, get
OrganizationProfile: update, get
Hierarchical organization support with parent/child relationships

R2 Data Catalog (`client.r2DataCatalog`)

Catalog: list, enable, disable, get
Credentials: create
MaintenanceConfigs: update, get
Namespaces: list
Tables: list, maintenance config management
Apache Iceberg integration

Realtime Kit (`client.realtimeKit`)

Apps: get, post
Meetings: create, get, participant management
Livestreams: 10+ methods for streaming
Recordings: start, pause, stop, get
Sessions: transcripts, summaries, chat
Webhooks: full CRUD
ActiveSession: polls, kick participants
Analytics: organization analytics

Token Validation (`client.tokenValidation`)

Configuration: create, list, delete, edit, get
Credentials: update
Rules: create, list, delete, bulkCreate, bulkEdit, edit, get
JWT validation with RS256/384/512, PS256/384/512, ES256, ES384

Alerting Silences (`client.alerting.silences`)

create, update, list, delete, get

IAM SSO (`client.iam.sso`)

create, update, list, delete, get, beginVerification

Pipelines v1 (`client.pipelines`)

Sinks: create, list, delete, get
Streams: create, update, list, delete, get

Zero-Trust AI Controls / MCP (`client.zeroTrust.access.aiControls.mcp`)

Portals: create, update, list, delete, read
Servers: create, update, list, delete, read, sync

Accounts

managed_by field with parent_org_id, parent_org_name

Addressing LOA Documents

auto_generated field on LOADocumentCreateResponse

Addressing Prefixes

delegate_loa_creation, irr_validation_state, ownership_validation_state, ownership_validation_token, rpki_validation_state

AI

Added toMarkdown.supported() method to get all supported conversion formats

AI Gateway

zdr field added to all responses and params

Alerting

New alert type: abuse_report_alert
type field added to PolicyFilter

Browser Rendering

ContentCreateParams: refined to discriminated union (Variant0 | Variant1)
Split into URL-based and HTML-based parameter variants for better type safety

Client Certificates

reactivate parameter in edit

CloudforceOne

ThreatEventCreateParams.indicatorType: required → optional
hasChildren field added to all threat event response types
datasetIds query parameter on AttackerListParams, CategoryListParams, TargetIndustryListParams
categoryUuid field on TagCreateResponse
indicators array for multi-indicator support per event
uuid and preserveUuid fields for UUID preservation in bulk create
format query parameter ('json' | 'stix2') on ThreatEventListParams
createdAt, datasetId fields on ThreatEventEditParams

Content Scanning

Added create(), update(), get() methods

Custom Pages

New page types: basic_challenge, under_attack, waf_challenge

D1

served_by_colo - colo that handled query
jurisdiction - 'eu' | 'fedramp'
Time Travel (client.d1.database.timeTravel): getBookmark(), restore() - point-in-time recovery

Email Security

New fields on InvestigateListResponse/InvestigateGetResponse: envelope_from, envelope_to, postfix_id_outbound, replyto
New detection classification: 'outbound_ndr'
Enhanced Finding interface with attachment, detection, field, portion, reason, score
Added cursor query parameter to InvestigateListParams

Gateway Lists

New list types: CATEGORY, LOCATION, DEVICE

Intel

New issue type: 'configuration_suggestion'
payload field: unknown → typed Payload interface with detection_method, zone_tag

Leaked Credential Checks

Added detections.get() method

Logpush

New datasets: dex_application_tests, dex_device_state_events, ipsec_logs, warp_config_changes, warp_toggle_changes

Load Balancers

Monitor.port: number → number | null
Pool.load_shedding: LoadShedding → LoadShedding | null
Pool.origin_steering: OriginSteering → OriginSteering | null

Magic Transit

license_key field on connectors
provision_license parameter for auto-provisioning
IPSec: custom_remote_identities with FQDN support
Snapshots: Bond interface, probed_mtu field

Queues

Added subscriptions.get() method
Enhanced SubscriptionGetResponse with typed event source interfaces
New event source types: Images, KV, R2, Vectorize, Workers AI, Workers Builds, Workflows

R2

Sippy: new provider s3 (S3-compatible endpoints)
Sippy: bucketUrl field for S3-compatible sources
Super Slurper: keys field on source response schemas (specify specific keys to migrate)
Super Slurper: pathPrefix field on source schemas
Super Slurper: region field on S3 source params

Radar

Added geolocations.list(), geolocations.get() methods
Added V2 dimension-based methods (summaryV2, timeseriesGroupsV2) to radar sub-resources

Resource Sharing

Added terminal boolean field to Resource Error interfaces

Rules

Added id field to ItemDeleteParams.Item

Rulesets

New buffering fields on SetConfigRule: request_body_buffering, response_body_buffering

Secrets Store

New scopes: 'dex', 'access' (in addition to 'workers', 'ai_gateway')

SSL Certificate Packs

Response types now proper interfaces (was unknown)
Fields now required: id, certificates, hosts, status, type

Security Center

payload field: unknown → typed Payload interface with detection_method, zone_tag

Shared Types

Added: CloudflareTunnelsV4PagePaginationArray pagination class

Workers

Added subdomains.delete() method
Worker.references - track external dependencies (domains, Durable Objects, queues)
Worker.startup_time_ms - startup timing
Script.observability - observability settings with logging
Script.tag, Script.tags - immutable ID and tags
Placement: support for region, hostname, host-based placement
tags, tail_consumers now accept | null
Telemetry: traces field, $containers event info, durableObjectId, transactionName, abr_level fields

Workers for Platforms

ScriptUpdateResponse: new fields entry_point, observability, tag, tags
placement field now union of 4 variants (smart mode, region, hostname, host)
tags, tail_consumers now nullable
TagUpdateParams.body now accepts null

Workflows

instance_retention: unknown → typed InstanceRetention interface with error_retention, success_retention
New status option: 'restart' added to StatusEditParams.status

Zero-Trust Devices

External emergency disconnect settings (4 new fields)
antivirus device posture check type
os_version_extra documentation improvements

Zones

New response types: SubscriptionCreateResponse, SubscriptionUpdateResponse, SubscriptionGetResponse

Zero-Trust Access Applications

New ApplicationType values: 'mcp', 'mcp_portal', 'proxy_endpoint'
New destination type: ViaMcpServerPortalDestination for MCP server access

Zero-Trust Gateway

Added rules.listTenant() method

Zero-Trust Gateway - Proxy Endpoints

ProxyEndpoint: interface → discriminated union (ZeroTrustGatewayProxyEndpointIP | ZeroTrustGatewayProxyEndpointIdentity)
ProxyEndpointCreateParams: interface → union type
Added kind field: 'ip' | 'identity'

Zero-Trust Tunnels

WARPConnector*Response: union type → interface

Deprecations

API Gateway: UserSchemas, Settings, SchemaValidation resources
Audit Logs: auditLogId.not (use id.not)
CloudforceOne: ThreatEvents.get(), IndicatorTypes.list()
Devices: public_ip field (use DEX API)
Email Security: item_count field in Move responses
Pipelines: v0 methods (use v1)
Radar: old summary() and timeseriesGroups() methods (use V2)
Rulesets: disable_apps, mirage fields
WARP Connector: connections field
Workers: environment parameter in Domains
Zones: ResponseBuffering page rule

Bug Fixes

mcp: correct code tool API endpoint (599703c)
mcp: return correct lines on typescript errors (5d6f999)
organization_profile: fix bad reference (d84ea77)
schema_validation: correctly reflect model to openapi mapping (bb86151)
workers: fix tests (2ee37f7)

Documentation

Added deprecation notices with migration paths
api_gateway: deprecate API Shield Schema Validation resources (8a4b20f)
Improved JSDoc examples across all resources
workers: expose subdomain delete documentation (4f7cc1f)

Cloudflare Fundamentals, Terraform - Terraform v5.16.0 now available

Tue, 20 Jan 2026 00:00:00 GMT

In January 2025, we announced the launch of the new Terraform v5 Provider. We greatly appreciate the proactive engagement and valuable feedback from the Cloudflare community following the v5 release. In response, we've established a consistent and rapid 2-3 week cadence for releasing targeted improvements, demonstrating our commitment to stability and reliability.

Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

This release includes bug fixes, the stabilization of even more popular resources, and more.

Features

custom_pages: add "waf_challenge" as new supported error page type identifier in both resource and data source schemas
list: enhance CIDR validator to check for normalized CIDR notation requiring network address for IPv4 and IPv6
magic_wan_gre_tunnel: add automatic_return_routing attribute for automatic routing control
magic_wan_gre_tunnel: add BGP configuration support with new BGP model attribute
magic_wan_gre_tunnel: add bgp_status computed attribute for BGP connection status information
magic_wan_gre_tunnel: enhance schema with BGP-related attributes and validators
magic_wan_ipsec_tunnel: add automatic_return_routing attribute for automatic routing control
magic_wan_ipsec_tunnel: add BGP configuration support with new BGP model attribute
magic_wan_ipsec_tunnel: add bgp_status computed attribute for BGP connection status information
magic_wan_ipsec_tunnel: add custom_remote_identities attribute for custom identity configuration
magic_wan_ipsec_tunnel: enhance schema with BGP and identity-related attributes
ruleset: add request body buffering support
ruleset: enhance ruleset data source with additional configuration options
workers_script: add observability logs attributes to list data source model
workers_script: enhance list data source schema with additional configuration options

Bug Fixes

account_member: fix resource importability issues
dns_record: remove unnecessary fmt.Sprintf wrapper around LoadTestCase call in test configuration helper function
load_balancer: fix session_affinity_ttl type expectations to match Float64 in initial creation and Int64 after migration
workers_kv: handle special characters correctly in URL encoding

Documentation

account_subscription: update schema description for rate_plan.sets attribute to clarify it returns an array of strings
api_shield: add resource-level description for API Shield management of auth ID characteristics
api_shield: enhance auth_id_characteristics.name attribute description to include JWT token configuration format requirements
api_shield: specify JSONPath expression format for JWT claim locations
hyperdrive_config: add description attribute to name attribute explaining its purpose in dashboard and API identification
hyperdrive_config: apply description improvements across resource, data source, and list data source schemas
hyperdrive_config: improve schema descriptions for cache settings to clarify default values
hyperdrive_config: update port description to clarify defaults for different database types

For more information

Cloudflare Fundamentals - Enhanced HTTP/3 request cancellation visibility

Mon, 19 Jan 2026 00:00:00 GMT

Enhanced HTTP/3 request cancellation visibility

Cloudflare now provides more accurate visibility into HTTP/3 client request cancellations, giving you better insight into real client behavior and reducing unnecessary load on your origins.

Previously, when an HTTP/3 client cancelled a request, the cancellation was not always actioned immediately. This meant requests could continue through the CDN — potentially all the way to your origin — even after the client had abandoned them. In these cases, logs would show the upstream response status (such as 200 or a timeout-related code) rather than reflecting the client cancellation.

Now, Cloudflare terminates cancelled HTTP/3 requests immediately and accurately logs them with a 499 status code.

Better observability for client behavior

When HTTP/3 clients cancel requests, Cloudflare now immediately reflects this in your logs with a 499 status code. This gives you:

More accurate traffic analysis: Understand exactly when and how often clients cancel requests.
Clearer debugging: Distinguish between true errors and intentional client cancellations.
Better availability metrics: Separate client-initiated cancellations from server-side issues.

Reduced origin load

Cloudflare now terminates cancelled requests faster, which means:

Less wasted compute: Your origin no longer processes requests that clients have already abandoned.
Lower bandwidth usage: Responses are no longer generated and transmitted for cancelled requests.
Improved efficiency: Resources are freed up to handle active requests.

What to expect in your logs

You may notice an increase in 499 status codes for HTTP/3 traffic. For HTTP/3, a 499 indicates the client cancelled the request stream before receiving a complete response — the underlying connection may remain open. This is a normal part of web traffic.

Tip: If you use 499 codes in availability calculations, consider whether client-initiated cancellations should be excluded from error rates. These typically represent normal user behavior — such as closing a browser, navigating away from a page, mobile network drops, or cancelling a download — rather than service issues.

For more information, refer to Error 499.

Cloudflare Fundamentals, Terraform - Terraform v5.15.0 now available

Fri, 19 Dec 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence to ensure its stability and reliability, including the v5.15 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach - we will be focusing on specific resources to not only stabilize the resource but also ensure it is migration-friendly for those migrating from v4 to v5.

Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

This release includes bug fixes, the stabilization of even more popular resources, and more.

Features

ai_search: Add AI Search endpoints (6f02adb)
certificate_pack: Ensure proper Terraform resource ID handling for path parameters in API calls (081f32a)
worker_version: Support startup_time_ms (286ab55)
zero_trust_dlp_custom_entry: Support upload_status (7dc0fe3)
zero_trust_dlp_entry: Support upload_status (7dc0fe3)
zero_trust_dlp_integration_entry: Support upload_status (7dc0fe3)
zero_trust_dlp_predefined_entry: Support upload_status (7dc0fe3)
zero_trust_gateway_policy: Support forensic_copy (5741fd0)
zero_trust_list: Support additional types (category, location, device) (5741fd0)

Bug fixes

access_rules: Add validation to prevent state drift. Ideally, we'd use Semantic Equality but since that isn't an option, this will remove a foot-gun. (4457791)
cloudflare_pages_project: Addressing drift issues (6edffcf) (3db318e)
cloudflare_worker: Can be cleanly imported (4859b52)
cloudflare_worker: Ensure clean imports (5b525bc)
list_items: Add validation for IP List items to avoid inconsistent state (b6733dc)
zero_trust_access_application: Remove all conditions from sweeper (3197f1a)
spectrum_application: Map missing fields during spectrum resource import (#6495) (ddb4e72)

Upgrade to newer version

We suggest waiting to migrate to v5 while we work on stabilization. This helps with avoiding any blocking issues while the Terraform resources are actively being stabilized. We will be releasing a new migration tool in March 2026 to help support v4 to v5 transitions for our most popular resources.

For more information

Cloudflare Fundamentals, Terraform - Terraform v5.14.0 now available

Fri, 05 Dec 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence to ensure its stability and reliability, including the v5.14 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach - we will be focusing on specific resources to not only stabilize the resource but also ensure it is migration-friendly for those migrating from v4 to v5.

Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

This release includes bug fixes, the stabilization of even more popular resources, and more.

Deprecation notice

Resource affected: api_shield_discovery_operation

Cloudflare continuously discovers and updates API endpoints and web assets of your web applications. To improve the maintainability of these dynamic resources, we are working on reducing the need to actively engage with discovered operations.

The corresponding public API endpoint of discovered operations is not affected and will continue to be supported.

Features

pages_project: Add v4 -> v5 migration tests (#6506)

Bug fixes

account_members: Makes member policies a set (#6488)
pages_project: Ensures non empty refresh plans (#6515)
R2: Improves sweeper (#6512)
workers_kv: Ignores value import state for verify (#6521)
workers_script: No longer treats the migrations attribute as WriteOnly (#6489)
workers_script: Resolves resource drift when worker has unmanaged secret (#6504)
zero_trust_device_posture_rule: Preserves input.version and other fields (#6500) and (#6503)
zero_trust_dlp_custom_profile: Adds sweepers for dlp_custom_profile
zone_subscription|account_subscription: Adds partners_ent as valid enum for rate_plan.id (#6505)
zone: Ensures datasource model schema parity (#6487)
subscription: Updates import signature to accept account_id/subscription_id to import account subscription (#6510)

Upgrade to newer version

For more information

Cloudflare Fundamentals, Terraform - Terraform v5.13.0 now available

Thu, 20 Nov 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence to ensure its stability and reliability, including the v5.13 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach - we will be focusing on specific resources to not only stabilize the resource but also ensure it is migration-friendly for those migrating from v4 to v5.

Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

This release includes new features, new resources and data sources, bug fixes, updates to our Developer Documentation, and more.

Breaking Change

Please be aware that there are breaking changes for the cloudflare_api_token and cloudflare_account_token resources. These changes eliminate configuration drift caused by policy ordering differences in the Cloudflare API.

For more specific information about the changes or the actions required, please see the detailed Repository changelog.

Features

New resources and data sources added
- cloudflare_connectivity_directory
- cloudflare_sso_connector
- cloudflare_universal_ssl_setting
api_token+account_tokens: state upgrader and schema bump (#6472)
docs: make docs explicit when a resource does not have import support
magic_transit_connector: support self-serve license key (#6398)
worker_version: add content_base64 support
worker_version: boolean support for run_worker_first (#6407)
workers_script_subdomains: add import support (#6375)
zero_trust_access_application: add proxy_endpoint for ZT Access Application (#6453)
zero_trust_dlp_predefined_profile: Switch DLP Predefined Profile endpoints, introduce enabled_entries attribut

Bug Fixes

account_token: token policy order and nested resources (#6440)
allow r2_bucket_event_notification to be applied twice without failing (#6419)
cloudflare_worker+cloudflare_worker_version: import for the resources (#6357)
dns_record: inconsistent apply error (#6452)
pages_domain: resource tests (#6338)
pages_project: unintended resource state drift (#6377)
queue_consumer: id population (#6181)
workers_kv: multipart request (#6367)
workers_kv: updating workers metadata attribute to be read from endpoint (#6386)
workers_script_subdomain: add note to cloudflare_workers_script_subdomain about redundancy with cloudflare_worker (#6383)
workers_script: allow config.run_worker_first to accept list input
zero_trust_device_custom_profile_local_domain_fallback: drift issues (#6365)
zero_trust_device_custom_profile: resolve drift issues (#6364)
zero_trust_dex_test: correct configurability for 'targeted' attribute to fix drift
zero_trust_tunnel_cloudflared_config: remove warp_routing from cloudflared_config (#6471)

Upgrading

We suggest holding off on migration to v5 while we work on stabilization. This help will you avoid any blocking issues while the Terraform resources are actively being stabilized. We will be releasing a new migration tool in March 2026 to help support v4 to v5 transitions for our most popular resources.

For more info

Cloudflare Fundamentals - Introducing email two-factor authentication

Thu, 30 Oct 2025 00:00:00 GMT

Two-factor authentication (2FA) is one of the best ways to protect your account from the risk of account takeover. Cloudflare has offered phishing resistant 2FA options including hardware based keys (for example, a Yubikey) and app based TOTP (time-based one-time password) options which use apps like Google or Microsoft's Authenticator app. Unfortunately, while these solutions are very secure, they can be lost if you misplace the hardware based key, or lose the phone which includes that app. The result is that users sometimes get locked out of their accounts and need to contact support.

Today, we are announcing the addition of email as a 2FA factor for all Cloudflare accounts. Email 2FA is in wide use across the industry as a least common denominator for 2FA because it is low friction, loss resistant, and still improves security over username/password login only. We also know that most commercial email providers already require 2FA, so your email address is usually well protected already.

You can now enable email 2FA on the Cloudflare dashboard:

Go to Profile at the top right corner.
Select Authentication.
Under Two-Factor Authentication, select Set up.

Sign-in security best practices

Cloudflare is critical infrastructure, and you should protect it as such. Review the following best practices and make sure you are doing your part to secure your account:

Use a unique password for every website, including Cloudflare, and store it in a password manager like 1Password or Keeper. These services are cross-platform and simplify the process of managing secure passwords.
Use 2FA to make it harder for an attacker to get into your account in the event your password is leaked.
Store your backup codes securely. A password manager is the best place since it keeps the backup codes encrypted, but you can also print them and put them somewhere safe in your home.
If you use an app to manage your 2FA keys, enable cloud backup, so that you don't lose your keys in the event you lose your phone.
If you use a custom email domain to sign in, configure SSO.
If you use a public email domain like Gmail or Hotmail, you can also use social login with Apple, GitHub, or Google to sign in.
If you manage a Cloudflare account for work:
- Have at least two administrators in case one of them unexpectedly leaves your company.
- Use SCIM to automate permissions management for members in your Cloudflare account.

Cloudflare Fundamentals - Revamped Member Management UI

Thu, 30 Oct 2025 00:00:00 GMT

As Cloudflare's platform has grown, so has the need for precise, role-based access control. We’ve redesigned the Member Management experience in the Dashboard to help administrators more easily discover, assign, and refine permissions for specific principals.

What's New

Refreshed member invite flow

We overhauled the Invite Members UI to simplify inviting users and assigning permissions.

Refreshed Members Overview Page

We've updated the Members Overview Page to clearly display:

Member 2FA status
Which members hold Super Admin privileges
API access settings per member
Member onboarding state (accepted vs pending invite)

New Member Permission Policies Details View

We've created a new member details screen that shows all permission policies associated with a member; including policies inherited from group associations to make it easier for members to understand the effective permissions they have.

Improved Member Permission Workflow

We redesigned the permission management experience to make it faster and easier for administrators to review roles and grant access.

Account-scoped Policies Restrictions Relaxed

Previously, customers could only associate a single account-scoped policy with a member. We've relaxed this restriction, and now Administrators can now assign multiple account-scoped policies to the same member; bringing policy assignment behavior in-line with user-groups and providing greater flexibility in managing member permissions.

Cloudflare Fundamentals - Increased HTTP header size limit to 128 KB

Thu, 16 Oct 2025 00:00:00 GMT

CDN now supports 128 KB request and response headers 🚀

We're excited to announce a significant increase in the maximum header size supported by Cloudflare's Content Delivery Network (CDN). Cloudflare now supports up to 128 KB for both request and response headers.

Previously, customers were limited to a total of 32 KB for request or response headers, with a maximum of 16 KB per individual header. Larger headers could cause requests to fail with HTTP 413 (Request Header Fields Too Large) errors.

What's new?

Support for large headers: You can now utilize much larger headers, whether as a single large header up to 128 KB or split over multiple headers.
Reduces 413 and 520 HTTP errors: This change drastically reduces the likelihood of customers encountering HTTP 413 errors from large request headers or HTTP 520 errors caused by oversized response headers, improving the overall reliability of your web applications.
Enhanced functionality: This is especially beneficial for applications that rely on:
- A large number of cookies.
- Large Content-Security-Policy (CSP) response headers.
- Advanced use cases with Cloudflare Workers that generate large response headers.

This enhancement improves compatibility with Cloudflare's CDN, enabling more use cases that previously failed due to header size limits.

To learn more and get started, refer to the Cloudflare Fundamentals documentation.

Cloudflare Fundamentals - Single sign-on now manageable in the user experience

Tue, 14 Oct 2025 00:00:00 GMT

During Birthday Week, we announced that single sign-on (SSO) is available for free to everyone who signs in with a custom email domain and maintains a compatible identity provider. SSO minimizes user friction around login and provides the strongest security posture available. At the time, this could only be configured using the API.

Today, we are launching a new user experience which allows users to manage their SSO configuration from within the Cloudflare dashboard. You can access this by going to Manage account > Members > Settings.

For more information

Cloudflare dashboard SSO

Cloudflare Fundamentals - Automated reminders for backup codes

Tue, 07 Oct 2025 00:00:00 GMT

The most common reason users contact Cloudflare support is lost two-factor authentication (2FA) credentials. Cloudflare supports both app-based and hardware keys for 2FA, but you could lose access to your account if you lose these. Over the past few weeks, we have been rolling out email and in-product reminders that remind you to also download backup codes (sometimes called recovery keys) that can get you back into your account in the event you lose your 2FA credentials. Download your backup codes now by logging into Cloudflare, then navigating to Profile > Security & Authentication > Backup codes.

Sign-in security best practices

Cloudflare is critical infrastructure, and you should protect it as such. Please review the following best practices and make sure you are doing your part to secure your account.

Use a unique password for every website, including Cloudflare, and store it in a password manager like 1Password or Keeper. These services are cross-platform and simplify the process of managing secure passwords.
Use 2FA to make it harder for an attacker to get into your account in the event your password is leaked
Store your backup codes securely. A password manager is the best place since it keeps the backup codes encrypted, but you can also print them and put them somewhere safe in your home.
If you use an app to manage your 2FA keys, enable cloud backup, so that you don't lose your keys in the event you lose your phone.
If you use a custom email domain to sign in, configure SSO.
If you use a public email domain like Gmail or Hotmail, you can also use social login with Apple, GitHub, or Google to sign in.
If you manage a Cloudflare account for work:
- Have at least two administrators in case one of them unexpectedly leaves your company
- Use SCIM to automate permissions management for members in your Cloudflare account

Cloudflare Fundamentals, Access - Fine-grained Permissioning for Access for Apps, IdPs, & Targets now in Public Beta

Thu, 02 Oct 2025 00:00:00 GMT

Fine-grained permissions for Access Applications, Identity Providers (IdPs), and Targets is now available in Public Beta. This expands our RBAC model beyond account & zone-scoped roles, enabling administrators to grant permissions scoped to individual resources.

What's New

Access Applications: Grant admin permissions to specific Access Applications.
Identity Providers: Grant admin permissions to individual Identity Providers.
Targets: Grant admin rights to specific Targets

For more info:

Cloudflare Fundamentals - Return markdown

Wed, 01 Oct 2025 00:00:00 GMT

Users can now specify that they want to retrieve Cloudflare documentation as markdown rather than the previous HTML default. This can significantly reduce token consumption when used alongside Large Language Model (LLM) tools.

curl https://developers.cloudflare.com/workers/ -H 'Accept: text/markdown'  -v

If you maintain your own site and want to adopt this practice using Cloudflare Workers for your own users you can follow the example here.

Cloudflare Fundamentals - Sign in with GitHub

Thu, 25 Sep 2025 00:00:00 GMT

Cloudflare has launched sign in with GitHub as a log in option. This feature is available to all users with a verified email address who are not using SSO. To use it, simply click on the Sign in with GitHub button on the dashboard login page. You will be logged in with your primary GitHub email address.

For more information

Cloudflare Fundamentals - SSO for all

Thu, 25 Sep 2025 00:00:00 GMT

Single sign-on (SSO) streamlines the process of logging into Cloudflare for Enterprise customers who manage a custom email domain and manage their own identity provider. Instead of managing a password and two-factor authentication credentials directly for Cloudflare, SSO lets you reuse your existing login infrastructure to seamlessly log in. SSO also provides additional security opportunities such as device health checks which are not available natively within Cloudflare.

Historically, SSO was only available for Enterprise accounts. Today, we are announcing that we are making SSO available to all users for free. We have also added the ability to directly manage SSO configurations using the API. This removes the previous requirement to contact support to configure SSO.

For more information

Cloudflare Fundamentals - Reminders about two-factor authentication backup codes

Mon, 08 Sep 2025 00:00:00 GMT

Two-factor authentication is the best way to help protect your account from account takeovers, but if you lose your second factor, you could be locked out of your account. Lock outs are one of the top reasons customers contact Cloudflare support, and our policies often don't allow us to bypass two-factor authentication for customers that are locked out. Today we are releasing an improvement where Cloudflare will periodically remind you to securely save your backup codes so you don't get locked out in the future.

For more information

Two-factor authentication

Cloudflare Fundamentals - Introducing new headers for rate limiting on Cloudflare's API

Wed, 03 Sep 2025 00:00:00 GMT

Cloudflare's API now supports rate limiting headers using the pattern developed by the IETF draft on rate limiting. This allows API consumers to know how many more calls are left until the rate limit is reached, as well as how long you will need to wait until more capacity is available.

Our SDKs automatically work with these new headers, backing off when rate limits are approached. There is no action required for users of the latest Cloudflare SDKs to take advantage of this.

As always, if you need any help with rate limits, please contact Support.

Changes

New Headers

Headers that are always returned:

Ratelimit: List of service limit items, composed of the limit name, the remaining quota (r) and the time next window resets (t). For example: "default";r=50;t=30
Ratelimit-Policy: List of quota policy items, composed of the policy name, the total quota (q) and the time window the quota applies to (w). For example: "burst";q=100;w=60

Returned only when a rate limit has been reached (error code: 429):

Retry-After: Number of Seconds until more capacity is available, rounded up

SDK Back offs

All of Cloudflare's latest SDKs will automatically respond to the headers, instituting a backoff when limits are approached.

GraphQL and Edge APIs

These new headers and back offs are only available for Cloudflare REST APIs, and will not affect GraphQL.

For more information

Rate limits at Cloudflare

Cloudflare Fundamentals, Terraform - Terraform v5.9 now available

Fri, 29 Aug 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2 week cadence to ensure its stability and reliability, including the v5.9 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach - we will be focusing on specific resources for every release, stabilizing the release, and closing all associated bugs with that resource before moving onto resolving migration issues.

Thank you for continuing to raise issues. We triage them weekly and they help make our products stronger.

This release includes a new resource, cloudflare_snippet, which replaces cloudflare_snippets. cloudflare_snippet is now considered deprecated but can still be used. Please utilize cloudflare_snippet as soon as possible.

Changes

Resources stabilized:
- cloudflare_zone_setting
- cloudflare_worker_script
- cloudflare_worker_route
- tiered_cache
NEW resource cloudflare_snippet which should be used in place of cloudflare_snippets. cloudflare_snippets is now deprecated. This enables the management of Cloudflare's snippet functionality through Terraform.
DNS Record Improvements: Enhanced handling of DNS record drift detection
Load Balancer Fixes: Resolved created_on field inconsistencies and improved pool configuration handling
Bot Management: Enhanced auto-update model state consistency and fight mode configurations
Other bug fixes

For a more detailed look at all of the changes, refer to the changelog in GitHub.

Issues Closed

If you have an unaddressed issue with the provider, we encourage you to check the open issues and open a new issue if one does not already exist for what you are experiencing.

Upgrading

We suggest holding off on migration to v5 while we work on stabilization. This help will you avoid any blocking issues while the Terraform resources are actively being stabilized.

If you'd like more information on migrating from v4 to v5, please make use of the migration guide. We have provided automated migration scripts using Grit which simplify the transition. These do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository.

For more info

Cloudflare Fundamentals, Terraform - Terraform v5.8.4 now available

Fri, 15 Aug 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare Community related to the v5 release. We have committed to releasing improvements on a two week cadence to ensure stability and reliability.

One key change we adopted in recent weeks is a pivot to more comprehensive, test-driven development. We are still evaluating individual issues, but are also investing in much deeper testing to drive our stabilization efforts. We will subsequently be investing in comprehensive migration scripts. As a result, you will see several of the highest traffic APIs have been stabilized in the most recent release, and are supported by comprehensive acceptance tests.

Thank you for continuing to raise issues. We triage them weekly and they help make our products stronger.

Changes

Resources stabilized:
- cloudflare_argo_smart_routing
- cloudflare_bot_management
- cloudflare_list
- cloudflare_list_item
- cloudflare_load_balancer
- cloudflare_load_balancer_monitor
- cloudflare_load_balancer_pool
- cloudflare_spectrum_application
- cloudflare_managed_transforms
- cloudflare_url_normalization_settings
- cloudflare_snippet
- cloudflare_snippet_rules
- cloudflare_zero_trust_access_application
- cloudflare_zero_trust_access_group
- cloudflare_zero_trust_access_identity_provider
- cloudflare_zero_trust_access_mtls_certificate
- cloudflare_zero_trust_access_mtls_hostname_settings
- cloudflare_zero_trust_access_policy
- cloudflare_zone
Multipart handling restored for cloudflare_snippet
cloudflare_bot_management diff issues resolves when running terraform plan and terraform apply
Other bug fixes

For a more detailed look at all of the changes, refer to the changelog in GitHub.

Issues Closed

If you have an unaddressed issue with the provider, we encourage you to check the open issues and open a new one if one does not already exist for what you are experiencing.

Upgrading

We suggest holding off on migration to v5 while we work on stablization. This help will you avoid any blocking issues while the Terraform resources are actively being stablized.

If you'd like more information on migrating to v5, please make use of the migration guide. We have provided automated migration scripts using Grit which simplify the transition. These migration scripts do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository.

For more info

Cloudflare Fundamentals, Terraform - Terraform v5.8.2 now available

Fri, 01 Aug 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high mumber of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2 week cadeance to ensure it's stability and reliability. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach - we will be focusing on specific resources for every release, stablizing the release and closing all associated bugs with that resource before moving onto resolving migration issues.

Thank you for continuing to raise issues. We triage them weekly and they help make our products stronger.

Changes

Resources stablized:
- cloudflare_custom_pages
- cloudflare_page_rule
- cloudflare_dns_record
- cloudflare_argo_tiered_caching
Addressed chronic drift issues in cloudflare_logpush_job, cloudflare_zero_trust_dns_location, cloudflare_ruleset & cloudflare_api_token
cloudflare_zone_subscripton returns expected values rate_plan.id from former versions
cloudflare_workers_script can now successfully be destroyed with bindings & migration for Durable Objects now recorded in tfstate
Ability to configure add_headers under cloudflare_zero_trust_gateway_policy
Other bug fixes

For a more detailed look at all of the changes, see the changelog in GitHub.

Issues Closed

If you have an unaddressed issue with the provider, we encourage you to check the open issues and open a new one if one does not already exist for what you are experiencing.

Upgrading

We suggest holding off on migration to v5 while we work on stablization. This help will you avoid any blocking issues while the Terraform resources are actively being stablized.

If you'd like more information on migrating from v4 to v5, please make use of the migration guide. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository.

For more info

Cloudflare Fundamentals, Terraform - Terraform v5.7.0 now available

Mon, 14 Jul 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high mumber of issues reported by the Cloudflare community related to the v5 release, with 13.5% of resources impacted. We have committed to releasing improvements on a 2 week cadeance to ensure it's stability and relability, including the v5.7 release.

Thank you for continuing to raise issues and please keep an eye on this changelog for more information about upcoming releases.

Changes

Addressed permanent diff bug on Cloudflare Tunnel config
State is now saved correctly for Zero Trust Access applications
Exact match is now working as expected within data.cloudflare_zero_trust_access_applications
cloudflare_zero_trust_access_policy now supports OIDC claims & diff issues resolved
Self hosted applications with private IPs no longer require a public domain for cloudflare_zero_trust_access_application.
New resource:
- cloudflare_zero_trust_tunnel_warp_connector
Other bug fixes

For a more detailed look at all of the changes, see the changelog in GitHub.

Issues Closed

If you have an unaddressed issue with the provider, we encourage you to check the open issues and open a new one if one does not already exist for what you are experiencing.

Upgrading

We suggest holding on migration to v5 while we work on stablization of the v5 provider. This will ensure Cloudflare can work ahead and avoid any blocking issues.

If you'd like more information on migrating from v4 to v5, please make use of the migration guide. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository.

For more info

Cloudflare Fundamentals - Cloudflare User Groups & SCIM User Groups are now in GA

Mon, 23 Jun 2025 00:00:00 GMT

We're announcing the GA of User Groups for Cloudflare Dashboard and System for Cross Domain Identity Management (SCIM) User Groups, strengthening our RBAC capabilities with stable, production-ready primitives for managing access at scale.

What's New

User Groups [GA]: User Groups are a new Cloudflare IAM primitive that enable administrators to create collections of account members that are treated equally from an access control perspective. User Groups can be assigned permission policies, with individual members in the group inheriting all permissions granted to the User Group. User Groups can be created manually or via our APIs.

SCIM User Groups [GA]: Centralize & simplify your user and group management at scale by syncing memberships directly from your upstream identity provider (like Okta or Entra ID) to the Cloudflare Platform. This ensures Cloudflare stays in sync with your identity provider, letting you apply Permission Policies to those synced groups directly within the Cloudflare Dashboard.

Stability & Scale: These features have undergone extensive testing during the Public Beta period and are now ready for production use across enterprises of all sizes.

For more info:

Cloudflare Fundamentals, Terraform - Terraform v5.6.0 now available

Tue, 17 Jun 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. Unlike the earlier Terraform providers, v5 is automatically generated based on the OpenAPI Schemas for our REST APIs. Since launch, we have seen an unexpectedly high number of issues reported by customers. These issues currently impact about 15% of resources. We have been working diligently to address these issues across the company, and have released the v5.6.0 release which includes a number of bug fixes. Please keep an eye on this changelog for more information about upcoming releases.

Changes

Broad fixes across resources with recurring diffs, including, but not limited to:
- cloudflare_zero_trust_access_identity_provider
  - cloudflare_zone
cloudflare_page_rules runtime panic when setting cache_level to cache_ttl_by_status
Failure to serialize requests in cloudflare_zero_trust_tunnel_cloudflared_config
Undocumented field 'priority' on zone_lockdown resource
Missing importability for cloudflare_zero_trust_device_default_profile_local_domain_fallback and cloudflare_account_subscription
New resources:
- cloudflare_schema_validation_operation_settings
- cloudflare_schema_validation_schemas
- cloudflare_schema_validation_settings
- cloudflare_zero_trust_device_settings
Other bug fixes

For a more detailed look at all of the changes, see the changelog in GitHub.

Issues Closed

If you have an unaddressed issue with the provider, we encourage you to check the open issues and open a new one if one does not already exist for what you are experiencing.

Upgrading

If you are evaluating a move from v4 to v5, please make use of the migration guide. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository.

For more info

Cloudflare Fundamentals - Cloudflare User Groups & Enhanced Permission Policies are now in Beta

Mon, 02 Jun 2025 00:00:00 GMT

We're excited to announce the Public Beta launch of User Groups for Cloudflare Dashboard and System for Cross Domain Identity Management (SCIM) User Groups, expanding our RBAC capabilities to simplify user and group management at scale.

We've also visually overhauled the Permission Policies UI to make defining permissions more intuitive.

What's New

User Groups [BETA]: User Groups are a new Cloudflare IAM primitive that enable administrators to create collections of account members that are treated equally from an access control perspective. User Groups can be assigned permission policies, with individual members in the group inheriting all permissions granted to the User Group. User Groups can be created manually or via our APIs.

SCIM User Groups [BETA]: Centralize & simplify your user and group management at scale by syncing memberships directly from your upstream identity provider (like Okta or Entra ID) to the Cloudflare Platform. This ensures Cloudflare stays in sync with your identity provider, letting you apply Permission Policies to those synced groups directly within the Cloudflare Dashboard.

Revamped Permission Policies UI [BETA]: As Cloudflare's services have grown, so has the need for precise, role-based access control. We've given the Permission Policies builder a visual overhaul to make it much easier for administrators to find and define the exact permissions they want for specific principals.

For more info:

Cloudflare Fundamentals, Terraform - Terraform v5.5.0 now available

Mon, 19 May 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. Unlike the earlier Terraform providers, v5 is automatically generated based on the OpenAPI Schemas for our REST APIs. Since launch, we have seen an unexpectedly high number of issues reported by customers. These issues currently impact about 15% of resources. We have been working diligently to address these issues across the company, and have released the v5.5.0 release which includes a number of bug fixes. Please keep an eye on this changelog for more information about upcoming releases.

Changes

Broad fixes across resources with recurring diffs, including, but not limited to:
- cloudflare_zero_trust_gateway_policy
- cloudflare_zero_trust_access_application
- cloudflare_zero_trust_tunnel_cloudflared_route
- cloudflare_zone_setting
- cloudflare_ruleset
- cloudflare_page_rule
Zone settings can be re-applied without client errors
Page rules conversion errors are fixed
Failure to apply changes to cloudflare_zero_trust_tunnel_cloudflared_route
Other bug fixes

For a more detailed look at all of the changes, see the changelog in GitHub.

Issues Closed

If you have an unaddressed issue with the provider, we encourage you to check the open issues and open a new one if one does not already exist for what you are experiencing.

Upgrading

For more info

Cloudflare Fundamentals, Terraform - Terraform v5.4.0 now available

Tue, 06 May 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. Unlike the earlier Terraform providers, v5 is automatically generated based on the OpenAPI Schemas for our REST APIs. Since launch, we have seen an unexpectedly high number of issues reported by customers. These issues currently impact about 15% of resources. We have been working diligently to address these issues across the company, and have released the v5.4.0 release which includes a number of bug fixes. Please keep an eye on this changelog for more information about upcoming releases.

Changes

Removes the worker_platforms_script_secret resource from the provider (see migration guide for alternatives—applicable to both Workers and Workers for Platforms)
Removes duplicated fields in cloudflare_cloud_connector_rules resource
Fixes cloudflare_workers_route id issues #5134 #5501
Fixes issue around refreshing resources that have unsupported response types
Affected resources
- cloudflare_certificate_pack
- cloudflare_registrar_domain
- cloudflare_stream_download
- cloudflare_stream_webhook
- cloudflare_user
- cloudflare_workers_kv
- cloudflare_workers_script
Fixes cloudflare_workers_kv state refresh issues
Fixes issues around configurability of nested properties without computed values for the following resources
Affected resources
- cloudflare_account
- cloudflare_account_dns_settings
- cloudflare_account_token
- cloudflare_api_token
- cloudflare_cloud_connector_rules
- cloudflare_custom_ssl
- cloudflare_d1_database
- cloudflare_dns_record
- email_security_trusted_domains
- cloudflare_hyperdrive_config
- cloudflare_keyless_certificate
- cloudflare_list_item
- cloudflare_load_balancer
- cloudflare_logpush_dataset_job
- cloudflare_magic_network_monitoring_configuration
- cloudflare_magic_transit_site
- cloudflare_magic_transit_site_lan
- cloudflare_magic_transit_site_wan
- cloudflare_magic_wan_static_route
- cloudflare_notification_policy
- cloudflare_pages_project
- cloudflare_queue
- cloudflare_queue_consumer
- cloudflare_r2_bucket_cors
- cloudflare_r2_bucket_event_notification
- cloudflare_r2_bucket_lifecycle
- cloudflare_r2_bucket_lock
- cloudflare_r2_bucket_sippy
- cloudflare_ruleset
- cloudflare_snippet_rules
- cloudflare_snippets
- cloudflare_spectrum_application
- cloudflare_workers_deployment
- cloudflare_zero_trust_access_application
- cloudflare_zero_trust_access_group
Fixed defaults that made cloudflare_workers_script fail when using Assets
Fixed Workers Logpush setting in cloudflare_workers_script mistakenly being readonly
Fixed cloudflare_pages_project broken when using "source"

The detailed changelog is available on GitHub.

Upgrading

For more info

Cloudflare Fundamentals - Updates to Account Home - Quick actions, traffic insights, Workers projects, and more

Wed, 26 Mar 2025 06:00:00 GMT

Recently, Account Home has been updated to streamline your workflows:

Recent Workers projects: You'll now find your projects readily accessible from a new Developer Platform tab on Account Home. See recently-modified projects and explore what you can work our developer-focused products.
Traffic and security insights: Get a snapshot of domain performance at a glance with key metrics and trends.
Quick actions: You can now perform common actions for your account, domains, and even Workers in just 1-2 clicks from the 3-dot menu.
Keep starred domains front and center: Now, when you filter for starred domains on Account Home, we'll save your preference so you'll continue to only see starred domains by default.

We can't wait for you to take the new Account Home for a spin.

For more info:

Cloudflare Fundamentals, Terraform - Dozens of Cloudflare Terraform Provider resources now have proper drift detection

Fri, 21 Mar 2025 00:00:00 GMT

In Cloudflare Terraform Provider versions 5.2.0 and above, dozens of resources now have proper drift detection. Before this fix, these resources would indicate they needed to be updated or replaced — even if there was no real change. Now, you can rely on your terraform plan to only show what resources are expected to change.

This issue affected resources related to these products and features:

API Shield
Argo Smart Routing
Argo Tiered Caching
Bot Management
BYOIP
D1
DNS
Email Routing
Hyperdrive
Observatory
Pages
R2
Rules
SSL/TLS
Waiting Room
Workers
Zero Trust

Cloudflare Fundamentals, Terraform - Cloudflare Terraform Provider now properly redacts sensitive values

Fri, 21 Mar 2025 00:00:00 GMT

In the Cloudflare Terraform Provider versions 5.2.0 and above, sensitive properties of resources are redacted in logs. Sensitive properties in Cloudflare's OpenAPI Schema are now annotated with x-sensitive: true. This results in proper auto-generation of the corresponding Terraform resources, and prevents sensitive values from being shown when you run Terraform commands.

This issue affected resources related to these products and features:

Alerts and Audit Logs
Device API
DLP
DNS
Magic Visibility
Magic WAN
TLS Certs and Hostnames
Tunnels
Turnstile
Workers
Zaraz

Cloudflare Fundamentals, Terraform - Terraform v5 Provider is now generally available

Mon, 03 Feb 2025 00:00:00 GMT

Cloudflare's v5 Terraform Provider is now generally available. With this release, Terraform resources are now automatically generated based on OpenAPI Schemas. This change brings alignment across our SDKs, API documentation, and now Terraform Provider. The new provider boosts coverage by increasing support for API properties to 100%, adding 25% more resources, and more than 200 additional data sources. Going forward, this will also reduce the barriers to bringing more resources into Terraform across the broader Cloudflare API. This is a small, but important step to making more of our platform manageable through GitOps, making it easier for you to manage Cloudflare just like you do your other infrastructure.

The Cloudflare Terraform Provider v5 is a ground-up rewrite of the provider and introduces breaking changes for some resource types. Please refer to the upgrade guide for best practices, or the blog post on automatically generating Cloudflare's Terraform Provider for more information about the approach.

For more info

Cloudflare changelogs | Cloudflare Fundamentals

Cloudflare Fundamentals - Service Key authentication deprecated

What you need to do

Cloudflare Fundamentals - SCIM provisioning for Authentik is now Generally Available

Cloudflare Fundamentals - SCIM audit logging Support

Cloudflare Fundamentals - Retry-After HTTP header for retryable 1xxx errors

Changes

Availability

Verify

Cloudflare Fundamentals - JSON responses and RFC 9457 support for Cloudflare 1xxx errors

Breaking change

Changes

Negotiation behavior

Availability

Get started

Cloudflare Fundamentals - Markdown responses for Cloudflare 1xxx errors

Negotiation behavior

Availability

Get started

Cloudflare Fundamentals - Content encoding support for Markdown for Agents and other improvements

Cloudflare Fundamentals, Access - Fine-grained permissions for Access policies and service tokens

New roles

Cloudflare Fundamentals, SDK - Cloudflare Python SDK v5.0.0-beta.1 now available

Breaking Changes

Features

New API Resources

New Endpoints (Existing Resources)

acm.totaltls

cloudforceone.threatevents

contentscanning

dns.records

intel.indicatorfeeds

leakedcredentialchecks.detections

queues.consumers

radar.ai

radar.bgp

workers.subdomains

zerotrust.networks

General Fixes and Improvements

Type System & Compatibility

Request/Response Handling

Parsing & Data Processing

Cloudflare Fundamentals - Introducing Markdown for Agents

Cloudflare Fundamentals, Terraform - Terraform v5.17.0 now available

Features

Bug Fixes

Chores

For more information

Cloudflare Fundamentals - Added Timezone preferences settings

What's New

Cloudflare Fundamentals - New 2FA Experience for Login

For more information

Cloudflare Fundamentals, SDK - Cloudflare Typescript SDK v6.0.0-beta.1 now available

Breaking Changes

Addressing - Parameter Requirements Changed

API Gateway

CloudforceOne - Response Type Changes

D1 Database - Query Parameters

DNS Records - Type Renames (21 types)

IAM Resource Groups

Origin CA Certificates - Parameter Requirements Changed

Pages

Pipelines - v0 to v1 Migration

R2

Radar

Resource Sharing

Schema Validation

Spectrum

Workers

Zero-Trust DLP

Zero-Trust Tunnels

Features

Abuse Reports (client.abuseReports)

AI Search (client.aisearch)

Connectivity (client.connectivity)

Organizations (client.organizations)

R2 Data Catalog (client.r2DataCatalog)

Realtime Kit (client.realtimeKit)

Token Validation (client.tokenValidation)

Alerting Silences (client.alerting.silences)

`acm.totaltls`

`cloudforceone.threatevents`

`contentscanning`

`dns.records`

`intel.indicatorfeeds`

`leakedcredentialchecks.detections`

`queues.consumers`

`radar.ai`

`radar.bgp`

`workers.subdomains`

`zerotrust.networks`

Abuse Reports (`client.abuseReports`)

AI Search (`client.aisearch`)

Connectivity (`client.connectivity`)

Organizations (`client.organizations`)

R2 Data Catalog (`client.r2DataCatalog`)

Realtime Kit (`client.realtimeKit`)

Token Validation (`client.tokenValidation`)

Alerting Silences (`client.alerting.silences`)

IAM SSO (`client.iam.sso`)

Pipelines v1 (`client.pipelines`)

Zero-Trust AI Controls / MCP (`client.zeroTrust.access.aiControls.mcp`)