Create an Access group
Creates a new Access group.
Security
API Token
The preferred authorization scheme for interacting with the Cloudflare API. Create a token.
Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYYAPI Email + API Key
The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.
X-Auth-Email: user@example.comThe previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.
X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194Accepted Permissions (at least one required)
Access: Organizations, Identity Providers, and Groups WriteParametersExpand Collapse
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.
Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.
class AccessAuthContextRule: …Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
class AuthenticationMethodRule: …Enforce different MFA options
Enforce different MFA options
auth_method: AuthMethod
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
class ExternalEvaluationRule: …Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
class GSuiteGroupRule: …Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
class AccessLinkedAppTokenRule: …Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.