Zero Trust
Zero TrustDevices
ModelsExpand Collapse
Device object { id, created, deleted, 17 more }
Registration ID. Equal to Device ID except for accounts which enabled multi-user mode.
Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
DeviceGetResponse object { id, account, created, 16 more }
Registration ID. Equal to Device ID except for accounts which enabled multi-user mode.
Zero TrustDevicesDevices
List devices
Get device
Delete device
Revoke device registrations
ModelsExpand Collapse
DeviceListResponse object { id, active_registrations, created_at, 16 more } A WARP Device.
A WARP Device.
The number of active registrations for the device. Active registrations are those which haven’t been revoked or deleted.
last_seen_registration: optional object { policy } The last seen registration for the device.
The last seen registration for the device.
Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
Deprecated: IP information is provided by DEX - see https://developers.cloudflare.com/api/resources/zero_trust/subresources/dex/subresources/fleet_status/subresources/devices/methods/list/
DeviceGetResponse object { id, active_registrations, created_at, 16 more } A WARP Device.
A WARP Device.
The number of active registrations for the device. Active registrations are those which haven’t been revoked or deleted.
last_seen_registration: optional object { policy } The last seen registration for the device.
The last seen registration for the device.
Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.
Deprecated: IP information is provided by DEX - see https://developers.cloudflare.com/api/resources/zero_trust/subresources/dex/subresources/fleet_status/subresources/devices/methods/list/
Zero TrustDevicesResilience
Zero TrustDevicesResilienceGlobal WARP Override
Retrieve Global WARP override state
Set Global WARP override state
ModelsExpand Collapse
Zero TrustDevicesRegistrations
List registrations
Get registration
Delete registration
Delete registrations
Revoke registrations
Unrevoke registrations
ModelsExpand Collapse
RegistrationListResponse object { id, created_at, device, 11 more } A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device.
A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device.
The type of encryption key used by the WARP client for the active key. Currently ‘curve25519’ for WireGuard and ‘secp256r1’ for MASQUE.
policy: optional object { id, default, deleted, 2 more } The device settings profile assigned to this registration.
The device settings profile assigned to this registration.
RegistrationGetResponse object { id, created_at, device, 11 more } A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device.
A WARP configuration tied to a single user. Multiple registrations can be created from a single WARP device.
The type of encryption key used by the WARP client for the active key. Currently ‘curve25519’ for WireGuard and ‘secp256r1’ for MASQUE.
policy: optional object { id, default, deleted, 2 more } The device settings profile assigned to this registration.
The device settings profile assigned to this registration.
Zero TrustDevicesDEX Tests
List Device DEX tests
Get Device DEX test
Create Device DEX test
Update Device DEX test
Delete Device DEX test
ModelsExpand Collapse
Zero TrustDevicesIP Profiles
List IP profiles
Get IP profile
Create IP profile
Update IP profile
Delete IP profile
ModelsExpand Collapse
IPProfile object { id, created_at, description, 6 more }
The wirefilter expression to match registrations. Available values: “identity.name”, “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.saml_attributes”.
Zero TrustDevicesDeployment Groups
List deployment groups
Get deployment group
Create deployment group
Update deployment group
Delete deployment group
Zero TrustDevicesNetworks
List your device managed networks
Get device managed network details
Create a device managed network
Update a device managed network
Delete a device managed network
ModelsExpand Collapse
DeviceNetwork object { config, name, network_id, type }
Zero TrustDevicesFleet Status
Get the latest status of a device.
ModelsExpand Collapse
FleetStatusGetResponse object { colo, deviceId, mode, 40 more }
deviceIpv4: optional object { address, asn, aso, 4 more }
deviceIpv6: optional object { address, asn, aso, 4 more }
Use registrationId instead.
Deprecated: use registrationId. Device registration identifier (UUID).
gatewayIpv4: optional object { address, asn, aso, 4 more }
gatewayIpv6: optional object { address, asn, aso, 4 more }
ispIpv4: optional object { address, asn, aso, 4 more }
ispIpv6: optional object { address, asn, aso, 4 more }
Device registration identifier (UUID v4). On multi-user devices, this uniquely identifies a user’s registration on the device.
rtt: optional object { minRttUs, rttUs, rttVarUs } Round-trip time statistics for the WARP tunnel.
Round-trip time statistics for the WARP tunnel.
tunnelStats: optional object { bytesLost, bytesReceived, bytesRetransmitted, 6 more } WARP tunnel packet and byte counters.
WARP tunnel packet and byte counters.
bytesReceived: optional object { downstream, upstream } Number of bytes received, split by direction.
Number of bytes received, split by direction.
bytesRetransmitted: optional object { downstream, upstream } Number of bytes retransmitted, split by direction.
Number of bytes retransmitted, split by direction.
packetsReceived: optional object { downstream, upstream } Number of packets received, split by direction.
Number of packets received, split by direction.
packetsRetransmitted: optional object { downstream, upstream } Number of packets retransmitted, split by direction.
Number of packets retransmitted, split by direction.
Zero TrustDevicesPolicies
ModelsExpand Collapse
SettingsPolicy object { allow_mode_switch, allow_updates, allowed_to_leave, 27 more }
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
dns_search_suffixes: optional array of object { suffix, description } List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
List of routes excluded in the WARP client’s tunnel.
List of routes excluded in the WARP client’s tunnel.
global_acceleration: optional object { api_endpoints, enabled, masque_endpoints, wireguard_endpoints } Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
List of routes included in the WARP client’s tunnel.
List of routes included in the WARP client’s tunnel.
The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.
The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.
The wirefilter expression to match devices. Available values: “identity.email”, “identity.groups.id”, “identity.groups.name”, “identity.groups.email”, “identity.service_token_uuid”, “identity.saml_attributes”, “network”, “os.name”, “os.version”.
The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
Whether to allow the user to turn off the WARP switch and disconnect the client.
Zero TrustDevicesPoliciesDefault
Get the default device settings profile
Update the default device settings profile
ModelsExpand Collapse
DefaultGetResponse object { allow_mode_switch, allow_updates, allowed_to_leave, 20 more }
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
dns_search_suffixes: optional array of object { suffix, description } List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
List of routes excluded in the WARP client’s tunnel.
List of routes excluded in the WARP client’s tunnel.
global_acceleration: optional object { api_endpoints, enabled, masque_endpoints, wireguard_endpoints } Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
List of routes included in the WARP client’s tunnel.
List of routes included in the WARP client’s tunnel.
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
Whether to allow the user to turn off the WARP switch and disconnect the client.
DefaultEditResponse object { allow_mode_switch, allow_updates, allowed_to_leave, 20 more }
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
dns_search_suffixes: optional array of object { suffix, description } List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear.
List of routes excluded in the WARP client’s tunnel.
List of routes excluded in the WARP client’s tunnel.
global_acceleration: optional object { api_endpoints, enabled, masque_endpoints, wireguard_endpoints } Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
Global Acceleration settings for China. When configured, WARP clients connect to the Global Accelerator addresses instead of the default ones. Please contact your account representative to enable this feature on your account. See https://developers.cloudflare.com/china-network/concepts/global-acceleration/.
List of routes included in the WARP client’s tunnel.
List of routes included in the WARP client’s tunnel.
Determines if the operating system will register WARP’s local interface IP with your on-premises DNS server.
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
Whether to allow the user to turn off the WARP switch and disconnect the client.
Zero TrustDevicesPoliciesDefaultExcludes
Get the Split Tunnel exclude list
Set the Split Tunnel exclude list
Zero TrustDevicesPoliciesDefaultIncludes
Get the Split Tunnel include list
Set the Split Tunnel include list
Zero TrustDevicesPoliciesDefaultFallback Domains
Get your Local Domain Fallback list
Set your Local Domain Fallback list
Zero TrustDevicesPoliciesDefaultCertificates
Get device certificate provisioning status
Update device certificate provisioning status
Zero TrustDevicesPoliciesCustom
List device settings profiles
Get device settings profile by ID
Create a device settings profile
Update a device settings profile
Delete a device settings profile
Zero TrustDevicesPoliciesCustomExcludes
Get the Split Tunnel exclude list for a device settings profile
Set the Split Tunnel exclude list for a device settings profile
Zero TrustDevicesPoliciesCustomIncludes
Get the Split Tunnel include list for a device settings profile
Set the Split Tunnel include list for a device settings profile
Zero TrustDevicesPoliciesCustomFallback Domains
Get the Local Domain Fallback list for a device settings profile
Set the Local Domain Fallback list for a device settings profile
Zero TrustDevicesPosture
List device posture rules
Get device posture rule details
Create a device posture rule
Update a device posture rule
Delete a device posture rule
ModelsExpand Collapse
DeviceInput = FileInput { operating_system, path, exists, 2 more } or UniqueClientIDInput { id, operating_system } or DomainJoinedInput { operating_system, domain } or 17 moreThe value to be checked against.
The value to be checked against.
DiskEncryptionInput object { checkDisks, requireAll }
TeamsDevicesClientCertificateV2InputRequest object { certificate_id, check_private_key, operating_system, 4 more }
Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.
Certificate Common Name. This may include one or more variables in the ${ } notation. Only ${serial_number} and ${hostname} are valid variables.
extended_key_usage: optional array of "clientAuth" or "emailProtection"List of values indicating purposes for which the certificate public key can be used.
List of values indicating purposes for which the certificate public key can be used.
CrowdstrikeInput object { connection_id, last_seen, operator, 6 more }
KolideInput object { connection_id, auth_state, countOperator, issue_count }
TaniumInput object { connection_id, eid_last_seen, operator, 3 more }
SentineloneS2sInput object { connection_id, active_threats, infected, 4 more }
DevicePostureRule object { id, description, enabled, 6 more }
Whether the rule is enabled. This is a computed, read-only value. It is false for deprecated Kolide posture rules that still use the issue_count input, and true otherwise.
Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.
Polling frequency for the WARP client posture check. Default: 5m (poll every five minutes). Minimum: 1m.
KolideInput object { connection_id, auth_state, countOperator, issue_count }
SentineloneS2sInput object { connection_id, active_threats, infected, 4 more }
TaniumInput object { connection_id, eid_last_seen, operator, 3 more }
Zero TrustDevicesPostureIntegrations
List your device posture integrations
Get device posture integration details
Create a device posture integration
Update a device posture integration
Delete a device posture integration
ModelsExpand Collapse
Integration object { id, config, interval, 2 more }
Zero TrustDevicesRevoke
Zero TrustDevicesSettings
Get device settings for a Zero Trust account
Update device settings for a Zero Trust account
Patch device settings for a Zero Trust account
Reset device settings for a Zero Trust account with defaults. This turns off all proxying.
ModelsExpand Collapse
DeviceSettings object { disable_for_time, external_emergency_signal_enabled, external_emergency_signal_fingerprint, 6 more }
Sets the time limit, in seconds, that a user can use an override code to bypass WARP.
Controls whether the external emergency disconnect feature is enabled.
The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server’s identity. The device will ignore any response if the server’s certificate fingerprint does not exactly match this value.
The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., “5m”, “2m30s”, “1h”). Minimum 30 seconds.
The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.
Zero TrustDevicesUnrevoke
Zero TrustDevicesOverride Codes
Get override codes (deprecated)
Get override codes
Zero TrustIdentity Providers
List Access identity providers
Get an Access identity provider
Add an Access identity provider
Update an Access identity provider
Delete an Access identity provider
ModelsExpand Collapse
AzureAD object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, 5 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Should Cloudflare try to load authentication contexts from your account
prompt: optional "login" or "select_account" or "none"Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
IdentityProvider = AzureAD { config, name, type, 5 more } or object { config, name, type, 5 more } or object { config, name, type, 5 more } or 12 more
AzureAD object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, 5 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Should Cloudflare try to load authentication contexts from your account
prompt: optional "login" or "select_account" or "none"Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessCentrify object { config, name, type, 5 more }
config: object { centrify_account, centrify_app_id, claims, 3 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessFacebook object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGitHub object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGoogle object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, email_claim_name } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGoogleApps object { config, name, type, 5 more }
config: object { apps_domain, claims, client_id, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessLinkedin object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOIDC object { config, name, type, 5 more }
config: object { auth_url, certs_url, claims, 6 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOkta object { config, name, type, 5 more }
config: object { authorization_server_id, claims, client_id, 3 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOnelogin object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessPingone object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessSAML object { config, name, type, 5 more }
config: object { attributes, email_attribute_name, enable_encryption, 5 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.
To enable encryption:
- Create a certificate set via POST to
/identity_providers/{id}/saml_certificate - Set this field to
trueand includesaml_certificate_set_idin the PUT request - Configure the public certificate in your external Identity Provider
Note: Requires saml_certificate_set_id to be set when true.
header_attributes: optional array of object { attribute_name, header_name } Add a list of attribute names that will be returned in the response header from the Access callback.
Add a list of attribute names that will be returned in the response header from the Access callback.
X509 certificate to verify the signature in the SAML authentication response
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessYandex object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOnetimepin object { config, name, type, 5 more }
config: object { redirect_url } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessCloudflare object { config, name, type, 5 more }
config: object { redirect_url, restrict_to_account_members } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
IdentityProviderSCIMConfig object { enabled, identity_update_behavior, scim_base_url, 3 more } The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
identity_update_behavior: optional "automatic" or "reauth" or "no_action"Indicates how a SCIM event updates a user identity used for policy evaluation. Use “automatic” to automatically update a user’s identity and augment it with fields from the SCIM user resource. Use “reauth” to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With “reauth” identities will not contain fields from the SCIM user resource. With “no_action” identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.
Indicates how a SCIM event updates a user identity used for policy evaluation. Use “automatic” to automatically update a user’s identity and augment it with fields from the SCIM user resource. Use “reauth” to force re-authentication on group membership updates, user identity update will only occur after successful re-authentication. With “reauth” identities will not contain fields from the SCIM user resource. With “no_action” identities will not be changed by SCIM updates in any way and users will not be prompted to reauthenticate.
A flag to remove a user’s seat in Zero Trust when they have been deprovisioned in the Identity Provider. This cannot be enabled unless user_deprovision is also enabled.
IdentityProviderType = "onetimepin" or "azureAD" or "saml" or 12 moreThe type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
IdentityProviderListResponse = AzureAD { config, name, type, 5 more } or object { config, name, type, 5 more } or object { config, name, type, 5 more } or 12 more
AzureAD object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, 5 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
Should Cloudflare try to load authentication contexts from your account
prompt: optional "login" or "select_account" or "none"Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
Indicates the type of user interaction that is required. prompt=login forces the user to enter their credentials on that request, negating single-sign on. prompt=none is the opposite. It ensures that the user isn’t presented with any interactive prompt. If the request can’t be completed silently by using single-sign on, the Microsoft identity platform returns an interaction_required error. prompt=select_account interrupts single sign-on providing account selection experience listing all the accounts either in session or any remembered account or an option to choose to use a different account altogether.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessCentrify object { config, name, type, 5 more }
config: object { centrify_account, centrify_app_id, claims, 3 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessFacebook object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGitHub object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGoogle object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, email_claim_name } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessGoogleApps object { config, name, type, 5 more }
config: object { apps_domain, claims, client_id, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessLinkedin object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOIDC object { config, name, type, 5 more }
config: object { auth_url, certs_url, claims, 6 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOkta object { config, name, type, 5 more }
config: object { authorization_server_id, claims, client_id, 3 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOnelogin object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessPingone object { config, name, type, 5 more }
config: object { claims, client_id, client_secret, 2 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessSAML object { config, name, type, 5 more }
config: object { attributes, email_attribute_name, enable_encryption, 5 more } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
A list of SAML attribute names that will be added to your signed JWT token and can be used in SAML policy rules.
Enable SAML assertion encryption. When enabled, the Identity Provider will encrypt SAML assertions using the certificate from the assigned certificate set.
To enable encryption:
- Create a certificate set via POST to
/identity_providers/{id}/saml_certificate - Set this field to
trueand includesaml_certificate_set_idin the PUT request - Configure the public certificate in your external Identity Provider
Note: Requires saml_certificate_set_id to be set when true.
header_attributes: optional array of object { attribute_name, header_name } Add a list of attribute names that will be returned in the response header from the Access callback.
Add a list of attribute names that will be returned in the response header from the Access callback.
X509 certificate to verify the signature in the SAML authentication response
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessYandex object { config, name, type, 5 more }
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessOnetimepin object { config, name, type, 5 more }
config: object { redirect_url } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
AccessCloudflare object { config, name, type, 5 more }
config: object { redirect_url, restrict_to_account_members } The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The configuration parameters for the identity provider. To view the required parameters for a specific provider, refer to our developer documentation.
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
Indicates that the identity provider is immutable and cannot be updated or deleted via the API.
saml_certificate_set: optional object { created_at, uid, updated_at, 2 more } The SAML encryption certificate set details, including current and previous certificates.
Only present for SAML identity providers with a certificate set assigned.
The SAML encryption certificate set details, including current and previous certificates. Only present for SAML identity providers with a certificate set assigned.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
The UID of the SAML encryption certificate set assigned to this Identity Provider.
Only present for SAML identity providers with encryption configured.
Create a certificate set via POST to /identity_providers/{id}/saml_certificate.
The configuration settings for enabling a System for Cross-Domain Identity Management (SCIM) with the identity provider.
Zero TrustIdentity ProvidersSCIM
Zero TrustIdentity ProvidersSCIMGroups
List SCIM Group resources
Zero TrustIdentity ProvidersSCIMUsers
List SCIM User resources
Zero TrustIdentity ProvidersSAML Certificate
Create SAML encryption certificate for Identity Provider
ModelsExpand Collapse
SAMLCertificateCreateResponse object { created_at, uid, updated_at, 2 more } A SAML encryption certificate set containing current and optionally previous certificates for encryption key rotation.
A SAML encryption certificate set containing current and optionally previous certificates for encryption key rotation.
Timestamp when the certificate set was last updated (e.g., during rotation)
current_certificate: optional object { is_current, not_after, public_certificate, uid } The currently active certificate used for encrypting SAML assertions
The currently active certificate used for encrypting SAML assertions
Zero TrustOrganizations
Get your Zero Trust organization
Create your Zero Trust organization
Update your Zero Trust organization
Revoke all Access tokens for a user
ModelsExpand Collapse
Organization object { allow_authenticate_via_warp, auth_domain, auto_redirect_to_identity, 14 more }
When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
When set to true, users skip the identity provider selection step during login.
Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array.
Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
mfa_config: optional object { allowed_authenticators, amr_matching_session_duration, required_aaguids, session_duration } Configures multi-factor authentication (MFA) settings for an organization.
Configures multi-factor authentication (MFA) settings for an organization.
allowed_authenticators: optional array of "totp" or "biometrics" or "security_key" or "piv_key"Lists the MFA methods that users can authenticate with.
Lists the MFA methods that users can authenticate with.
Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains “mfa”. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).
mfa_piv_key_requirements: optional object { pin_policy, require_fips_device, ssh_key_size, 2 more } Configures PIV key requirements for MFA using hardware security keys.
Configures PIV key requirements for MFA using hardware security keys.
pin_policy: optional "never" or "once" or "always"Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use).
Defines when a PIN is required to use the SSH key. Valid values: never (no PIN required), once (PIN required once per session), always (PIN required for each use).
Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.
ssh_key_size: optional array of 256 or 384 or 521 or 3 moreSpecifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.
Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.
Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: ‘allowed_authenticators’ cannot only contain ‘piv_key’ if the organization has any non-infrastructure applications because PIV keys are only compatible with infrastructure apps.
The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
A description of the reason why the UI read only field is being toggled.
The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
Zero TrustOrganizationsDOH
Get your Zero Trust organization DoH settings
Update your Zero Trust organization DoH settings
ModelsExpand Collapse
DOHGetResponse object { id, client_id, doh_jwt_duration, 3 more }
The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
The duration the DoH JWT is valid for. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Note that the maximum duration for this setting is the same as the key rotation period on the account.
DOHUpdateResponse object { id, client_id, doh_jwt_duration, 3 more }
The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
The duration the DoH JWT is valid for. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h
Zero TrustSeats
Update a user seat
Zero TrustAccess
Zero TrustAccessAI Controls
Zero TrustAccessAI ControlsMcp
Zero TrustAccessAI ControlsMcpPortals
List MCP Portals
Create a new MCP Portal
Read details of an MCP Portal
Update a MCP Portal
Delete a MCP Portal
ModelsExpand Collapse
PortalListResponse object { id, hostname, name, 9 more }
servers: array of object { id, auth_type, hostname, 22 more }
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.
code_mode: optional "off" or "opt_in" or "default_on" or "enforced"Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
PortalCreateResponse object { id, hostname, name, 9 more }
servers: array of object { id, auth_type, hostname, 22 more }
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.
code_mode: optional "off" or "opt_in" or "default_on" or "enforced"Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
PortalReadResponse object { id, hostname, name, 9 more }
servers: array of object { id, auth_type, hostname, 22 more }
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.
code_mode: optional "off" or "opt_in" or "default_on" or "enforced"Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
PortalUpdateResponse object { id, hostname, name, 9 more }
servers: array of object { id, auth_type, hostname, 22 more }
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.
code_mode: optional "off" or "opt_in" or "default_on" or "enforced"Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
PortalDeleteResponse object { id, hostname, name, 8 more }
Deprecated: use code_mode for new integrations. true maps to any non-off Code Mode policy; false maps to code_mode: off. If both fields are sent, they must be consistent or the request returns a 400.
code_mode: optional "off" or "opt_in" or "default_on" or "enforced"Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
Code Mode policy for this portal. off: Code Mode is unavailable; query parameters are ignored. opt_in: Code Mode is off by default; clients turn it on with ?codemode=search_and_execute. default_on: Code Mode is on by default; clients can opt out with ?codemode=off. enforced: Code Mode is always on; query parameters are ignored. Defaults to opt_in when omitted on create. If both code_mode and allow_code_mode are sent, they must be consistent or the request returns a 400.
Zero TrustAccessAI ControlsMcpServers
List MCP Servers
Create a new MCP Server
Read the details of a MCP Server
Update a MCP Server
Delete a MCP Server
Sync MCP Server Capabilities
ModelsExpand Collapse
ServerListResponse object { id, auth_type, hostname, 19 more }
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
ServerCreateResponse object { id, auth_type, hostname, 19 more }
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
ServerReadResponse object { id, auth_type, hostname, 19 more }
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
ServerUpdateResponse object { id, auth_type, hostname, 19 more }
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
ServerDeleteResponse object { id, auth_type, hostname, 19 more }
auth_config_summary: optional object { auth_mode, client_secret_version, config, 2 more } Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode (dcr|manual), has_client_secret, client_secret_version, and the OAuth endpoints + client_id for manual servers. Never includes the secret value.
authentication_status: optional "not_required" or "required" or "connected" or 2 moreWhether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow.
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
Zero TrustAccessGateway CA
List SSH Certificate Authorities (CA)
Add a new SSH Certificate Authority (CA)
Delete an SSH Certificate Authority (CA)
ModelsExpand Collapse
Zero TrustAccessIdP Federation Grants
List IdP federation grants
Create an IdP federation grant
Get an IdP federation grant
Delete an IdP federation grant
Zero TrustAccessSAML Certificates
List SAML certificate sets
Get SAML certificate set
Rotate SAML certificate
Download current certificate in PEM format
ModelsExpand Collapse
Zero TrustAccessInfrastructure
Zero TrustAccessInfrastructureTargets
List all targets
Get target
Create new target
Update target
Delete target
Create new targets
Delete targets
ModelsExpand Collapse
Zero TrustAccessApplications
List Access applications
Get an Access application
Add an Access application
Update an Access application
Delete an Access application
Revoke application tokens
ModelsExpand Collapse
Application = object { domain, type, id, 22 more } or object { id, allowed_idps, app_launcher_visible, 9 more } or object { domain, type, id, 22 more } or 5 more
SelfHostedApplication object { domain, type, id, 22 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
cors_headers: optional object { allow_all_headers, allow_all_methods, allow_all_origins, 5 more }
The custom error message shown to a user when they are denied access to the application.
The custom URL a user is redirected to when they are denied access to the application.
Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
Returns a 401 status code when the request is blocked by a Service Auth policy.
The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.
SaaSApplication object { id, allowed_idps, app_launcher_visible, 9 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
saas_app: optional object { auth_type, consumer_service_url, created_at, 8 more } or object { access_token_lifetime, allow_pkce_without_client_secret, app_launcher_url, 13 more }
AccessSAMLSaaSApp2 object { auth_type, consumer_service_url, created_at, 8 more }
auth_type: optional "saml" or "oidc"Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml”
Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml”
The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion.
custom_attributes: optional array of object { friendly_name, name, name_format, 2 more }
A JSONata expression that transforms an application’s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting.
AccessOIDCSaaSApp2 object { access_token_lifetime, allow_pkce_without_client_secret, app_launcher_url, 13 more }
The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.
If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.
auth_type: optional "saml" or "oidc"Identifier of the authentication protocol used for the saas app. Required for OIDC.
Identifier of the authentication protocol used for the saas app. Required for OIDC.
custom_claims: optional array of object { name, required, scope, source }
grant_types: optional array of "authorization_code" or "authorization_code_with_pkce" or "refresh_tokens" or 2 moreThe OIDC flows supported by this application
The OIDC flows supported by this application
A regex to filter Cloudflare groups returned in ID token and userinfo endpoint.
hybrid_and_implicit_options: optional object { return_access_token_from_authorization_endpoint, return_id_token_from_authorization_endpoint }
The permitted URL’s for Cloudflare to return Authorization codes and Access/ID tokens
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
BrowserSSHApplication object { domain, type, id, 22 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
cors_headers: optional object { allow_all_headers, allow_all_methods, allow_all_origins, 5 more }
The custom error message shown to a user when they are denied access to the application.
The custom URL a user is redirected to when they are denied access to the application.
Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
Returns a 401 status code when the request is blocked by a Service Auth policy.
The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.
BrowserVNCApplication object { domain, type, id, 22 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
cors_headers: optional object { allow_all_headers, allow_all_methods, allow_all_origins, 5 more }
The custom error message shown to a user when they are denied access to the application.
The custom URL a user is redirected to when they are denied access to the application.
Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
Returns a 401 status code when the request is blocked by a Service Auth policy.
The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.
AppLauncherApplication object { type, id, allowed_idps, 8 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
DeviceEnrollmentPermissionsApplication object { type, id, allowed_idps, 8 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
BrowserIsolationPermissionsApplication object { type, id, allowed_idps, 8 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
BookmarkApplication object { domain, type, id, 7 more }
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
ApplicationPolicy object { id, approval_groups, approval_required, 13 more }
approval_groups: optional array of ApprovalGroup { approvals_needed, email_addresses, email_list_uuid } Administrators who can approve a temporary authentication request.
Administrators who can approve a temporary authentication request.
Requires the user to request access from an administrator at the start of each session.
connection_rules: optional object { rdp } The rules that define how users may connect to targets secured by your application.
The rules that define how users may connect to targets secured by your application.
rdp: optional object { allowed_clipboard_local_to_remote_formats, allowed_clipboard_remote_to_local_formats } The RDP-specific rules that define clipboard behavior for RDP connections.
The RDP-specific rules that define clipboard behavior for RDP connections.
The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
AccessAuthContextRule object { auth_context } Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthenticationMethodRule object { auth_method } Enforce different MFA options
Enforce different MFA options
auth_method: object { auth_method }
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
AccessDevicePostureRule object { device_posture } Enforces a device posture rule has run successfully
Enforces a device posture rule has run successfully
ExternalEvaluationRule object { external_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
GitHubOrganizationRule object { "github-organization" } Matches a Github organization.
Requires a Github identity provider.
Matches a Github organization. Requires a Github identity provider.
GSuiteGroupRule object { gsuite } Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
AccessLinkedAppTokenRule object { linked_app_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
AccessAuthContextRule object { auth_context } Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthenticationMethodRule object { auth_method } Enforce different MFA options
Enforce different MFA options
auth_method: object { auth_method }
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
AccessDevicePostureRule object { device_posture } Enforces a device posture rule has run successfully
Enforces a device posture rule has run successfully
ExternalEvaluationRule object { external_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
GitHubOrganizationRule object { "github-organization" } Matches a Github organization.
Requires a Github identity provider.
Matches a Github organization. Requires a Github identity provider.
GSuiteGroupRule object { gsuite } Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
AccessLinkedAppTokenRule object { linked_app_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Require this application to be served in an isolated browser for users matching this policy. ‘Client Web Isolation’ must be on for the account in order to use this feature.
mfa_config: optional object { allowed_authenticators, mfa_disabled, session_duration } Configures multi-factor authentication (MFA) settings.
Configures multi-factor authentication (MFA) settings.
A custom message that will appear on the purpose justification screen.
Require users to enter a justification when they log in to the application.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
AccessAuthContextRule object { auth_context } Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthenticationMethodRule object { auth_method } Enforce different MFA options
Enforce different MFA options
auth_method: object { auth_method }
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
AccessDevicePostureRule object { device_posture } Enforces a device posture rule has run successfully
Enforces a device posture rule has run successfully
ExternalEvaluationRule object { external_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
GitHubOrganizationRule object { "github-organization" } Matches a Github organization.
Requires a Github identity provider.
Matches a Github organization. Requires a Github identity provider.
GSuiteGroupRule object { gsuite } Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
AccessLinkedAppTokenRule object { linked_app_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
CORSHeaders object { allow_all_headers, allow_all_methods, allow_all_origins, 5 more }
OIDCSaaSApp object { access_token_lifetime, allow_pkce_without_client_secret, app_launcher_url, 11 more }
The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.
If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.
auth_type: optional "saml" or "oidc"Identifier of the authentication protocol used for the saas app. Required for OIDC.
Identifier of the authentication protocol used for the saas app. Required for OIDC.
custom_claims: optional array of object { name, required, scope, source }
grant_types: optional array of "authorization_code" or "authorization_code_with_pkce" or "refresh_tokens" or 2 moreThe OIDC flows supported by this application
The OIDC flows supported by this application
A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
hybrid_and_implicit_options: optional object { return_access_token_from_authorization_endpoint, return_id_token_from_authorization_endpoint }
The permitted URL’s for Cloudflare to return Authorization codes and Access/ID tokens
SAMLSaaSApp object { auth_type, consumer_service_url, custom_attributes, 8 more }
auth_type: optional "saml" or "oidc"Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml”
Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml”
The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion.
custom_attributes: optional array of object { friendly_name, name, name_format, 2 more }
The URL that the user will be redirected to after a successful login for IDP initiated logins.
A JSONata expression that transforms an application’s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting.
A [JSONata] (https://jsonata.org/) expression that transforms an application’s user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml_attributes or oidc_fields of the identity provider used to authenticate. The output of this expression must be a JSON object.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
SCIMConfigMapping object { schema, enabled, filter, 3 more } Transformations and filters applied to resources before they are provisioned in the remote SCIM service.
Transformations and filters applied to resources before they are provisioned in the remote SCIM service.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
ApplicationListResponse = object { domain, type, id, 31 more } or object { id, allowed_idps, app_launcher_visible, 10 more } or object { domain, type, id, 31 more } or 10 more
SelfHostedApplication object { domain, type, id, 31 more }
The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.
When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
The custom error message shown to a user when they are denied access to the application.
The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.
The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.
The custom pages that will be displayed when applicable for this application
destinations: optional array of object { type, uri } or object { cidr, hostname, l4_protocol, 3 more } or object { mcp_server_id, type } or 4 moreList of destinations secured by Access. This supersedes self_hosted_domains to allow for more flexibility in defining different types of domains. If destinations are provided, then self_hosted_domains will be ignored.
List of destinations secured by Access. This supersedes self_hosted_domains to allow for more flexibility in defining different types of domains. If destinations are provided, then self_hosted_domains will be ignored.
PublicDestination object { type, uri } A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard ’*’ can be used in the definition.
A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard ’*’ can be used in the definition.
The URI of the destination. Public destinations’ URIs can include a domain and path with wildcards.
PrivateDestination object { cidr, hostname, l4_protocol, 3 more }
The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
l4_protocol: optional "tcp" or "udp"The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.
The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.
ViaMcpServerPortalDestination object { mcp_server_id, type } A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.
A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.
WorkerDestination object { type, worker_id } A specific Cloudflare Worker that Access will secure. All requests routed to the specified Worker, including its preview deployments, will be protected. The preview_worker and public destination types takes precedence, so you can create separate applications to override the policies for the Worker’s previews or specific paths.
A specific Cloudflare Worker that Access will secure. All requests routed to the specified Worker, including its preview deployments, will be protected. The preview_worker and public destination types takes precedence, so you can create separate applications to override the policies for the Worker’s previews or specific paths.
PreviewWorkerDestination object { type, worker_id } A specific Cloudflare Worker whose preview deployments Access will secure. Only requests routed to the preview deployments of the specified Worker will be protected. The public destination type takes precedence, so you can create separate applications to override the policies for specific paths.
A specific Cloudflare Worker whose preview deployments Access will secure. Only requests routed to the preview deployments of the specified Worker will be protected. The public destination type takes precedence, so you can create separate applications to override the policies for specific paths.
AllWorkersDestination object { type } Protects all Cloudflare Workers on the account with Access, including their preview deployments. At most one destination of this type can exist per account. The worker, preview_worker, all_preview_workers, and public destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths.
Protects all Cloudflare Workers on the account with Access, including their preview deployments. At most one destination of this type can exist per account. The worker, preview_worker, all_preview_workers, and public destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths.
AllPreviewWorkersDestination object { type } Protects the preview deployments of all Cloudflare Workers on the account with Access. At most one destination of this type can exist per account. The worker, preview_worker, and public destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths.
Protects the preview deployments of all Cloudflare Workers on the account with Access. At most one destination of this type can exist per account. The worker, preview_worker, and public destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths.
Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
mfa_config: optional object { allowed_authenticators, mfa_disabled, session_duration } Configures multi-factor authentication (MFA) settings.
Configures multi-factor authentication (MFA) settings.
oauth_configuration: optional object { dynamic_client_registration, enabled, grant } Beta: Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support RFC 8707 (Resource Indicators for OAuth 2.0). This feature is currently in beta.
Beta: Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support RFC 8707 (Resource Indicators for OAuth 2.0). This feature is currently in beta.
dynamic_client_registration: optional object { allow_any_on_localhost, allow_any_on_loopback, allowed_uris, enabled } Settings for OAuth dynamic client registration.
Settings for OAuth dynamic client registration.
Whether the OAuth configuration is enabled for this application. When set to false, Access will not handle OAuth for this application. Defaults to true if omitted.
Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
Enables cookie paths to scope an application’s JWT to the application path. If disabled, the JWT will scope to the hostname by default
policies: optional array of object { id, account_id, approval_groups, 15 more }
approval_groups: optional array of ApprovalGroup { approvals_needed, email_addresses, email_list_uuid } Administrators who can approve a temporary authentication request.
Administrators who can approve a temporary authentication request.
Requires the user to request access from an administrator at the start of each session.
connection_rules: optional object { rdp } The rules that define how users may connect to targets secured by your application.
The rules that define how users may connect to targets secured by your application.
rdp: optional object { allowed_clipboard_local_to_remote_formats, allowed_clipboard_remote_to_local_formats } The RDP-specific rules that define clipboard behavior for RDP connections.
The RDP-specific rules that define clipboard behavior for RDP connections.
The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
AccessAuthContextRule object { auth_context } Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthenticationMethodRule object { auth_method } Enforce different MFA options
Enforce different MFA options
auth_method: object { auth_method }
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
AccessDevicePostureRule object { device_posture } Enforces a device posture rule has run successfully
Enforces a device posture rule has run successfully
ExternalEvaluationRule object { external_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
GitHubOrganizationRule object { "github-organization" } Matches a Github organization.
Requires a Github identity provider.
Matches a Github organization. Requires a Github identity provider.
GSuiteGroupRule object { gsuite } Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
AccessLinkedAppTokenRule object { linked_app_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
AccessAuthContextRule object { auth_context } Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthenticationMethodRule object { auth_method } Enforce different MFA options
Enforce different MFA options
auth_method: object { auth_method }
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
AccessDevicePostureRule object { device_posture } Enforces a device posture rule has run successfully
Enforces a device posture rule has run successfully
ExternalEvaluationRule object { external_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
GitHubOrganizationRule object { "github-organization" } Matches a Github organization.
Requires a Github identity provider.
Matches a Github organization. Requires a Github identity provider.
GSuiteGroupRule object { gsuite } Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
AccessLinkedAppTokenRule object { linked_app_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Require this application to be served in an isolated browser for users matching this policy. ‘Client Web Isolation’ must be on for the account in order to use this feature.
mfa_config: optional object { allowed_authenticators, mfa_disabled, session_duration } Configures multi-factor authentication (MFA) settings.
Configures multi-factor authentication (MFA) settings.
The order of execution for this policy. Must be unique for each policy within an app.
A custom message that will appear on the purpose justification screen.
Require users to enter a justification when they log in to the application.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
AccessAuthContextRule object { auth_context } Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthenticationMethodRule object { auth_method } Enforce different MFA options
Enforce different MFA options
auth_method: object { auth_method }
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
AccessDevicePostureRule object { device_posture } Enforces a device posture rule has run successfully
Enforces a device posture rule has run successfully
ExternalEvaluationRule object { external_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
GitHubOrganizationRule object { "github-organization" } Matches a Github organization.
Requires a Github identity provider.
Matches a Github organization. Requires a Github identity provider.
GSuiteGroupRule object { gsuite } Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
AccessLinkedAppTokenRule object { linked_app_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Allows matching Access Service Tokens passed HTTP in a single header with this name. This works as an alternative to the (CF-Access-Client-Id, CF-Access-Client-Secret) pair of headers. The header value will be interpreted as a json object similar to: { “cf-access-client-id”: “88bf3b6d86161464f6509f7219099e57.access.example.com”, “cf-access-client-secret”: “bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5” }
Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or SCIMConfigAuthenticationOAuthBearerToken { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOAuthBearerToken object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or SCIMConfigAuthenticationOAuthBearerToken { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOAuthBearerToken object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, propagates DELETE requests to the target application for SCIM resources. If true, sets ‘active’ to false on the SCIM resource. Note: Some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
List of public domains that Access will secure. This field is deprecated in favor of destinations and will be supported until November 21, 2025. If destinations are provided, then self_hosted_domains will be ignored.
Returns a 401 status code when the request is blocked by a Service Auth policy.
The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. Note: unsupported for infrastructure type applications.
The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.
Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.
SaaSApplication object { id, allowed_idps, app_launcher_visible, 10 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
The custom pages that will be displayed when applicable for this application
policies: optional array of object { id, account_id, approval_groups, 15 more }
approval_groups: optional array of ApprovalGroup { approvals_needed, email_addresses, email_list_uuid } Administrators who can approve a temporary authentication request.
Administrators who can approve a temporary authentication request.
Requires the user to request access from an administrator at the start of each session.
connection_rules: optional object { rdp } The rules that define how users may connect to targets secured by your application.
The rules that define how users may connect to targets secured by your application.
rdp: optional object { allowed_clipboard_local_to_remote_formats, allowed_clipboard_remote_to_local_formats } The RDP-specific rules that define clipboard behavior for RDP connections.
The RDP-specific rules that define clipboard behavior for RDP connections.
The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
AccessAuthContextRule object { auth_context } Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthenticationMethodRule object { auth_method } Enforce different MFA options
Enforce different MFA options
auth_method: object { auth_method }
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
AccessDevicePostureRule object { device_posture } Enforces a device posture rule has run successfully
Enforces a device posture rule has run successfully
ExternalEvaluationRule object { external_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
GitHubOrganizationRule object { "github-organization" } Matches a Github organization.
Requires a Github identity provider.
Matches a Github organization. Requires a Github identity provider.
GSuiteGroupRule object { gsuite } Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
AccessLinkedAppTokenRule object { linked_app_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
AccessAuthContextRule object { auth_context } Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthenticationMethodRule object { auth_method } Enforce different MFA options
Enforce different MFA options
auth_method: object { auth_method }
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
AccessDevicePostureRule object { device_posture } Enforces a device posture rule has run successfully
Enforces a device posture rule has run successfully
ExternalEvaluationRule object { external_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
GitHubOrganizationRule object { "github-organization" } Matches a Github organization.
Requires a Github identity provider.
Matches a Github organization. Requires a Github identity provider.
GSuiteGroupRule object { gsuite } Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
AccessLinkedAppTokenRule object { linked_app_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Require this application to be served in an isolated browser for users matching this policy. ‘Client Web Isolation’ must be on for the account in order to use this feature.
mfa_config: optional object { allowed_authenticators, mfa_disabled, session_duration } Configures multi-factor authentication (MFA) settings.
Configures multi-factor authentication (MFA) settings.
The order of execution for this policy. Must be unique for each policy within an app.
A custom message that will appear on the purpose justification screen.
Require users to enter a justification when they log in to the application.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
AccessAuthContextRule object { auth_context } Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthenticationMethodRule object { auth_method } Enforce different MFA options
Enforce different MFA options
auth_method: object { auth_method }
The type of authentication method https://datatracker.ietf.org/doc/html/rfc8176#section-2.
AccessDevicePostureRule object { device_posture } Enforces a device posture rule has run successfully
Enforces a device posture rule has run successfully
ExternalEvaluationRule object { external_evaluation } Create Allow or Block policies which evaluate the user based on custom criteria.
Create Allow or Block policies which evaluate the user based on custom criteria.
GitHubOrganizationRule object { "github-organization" } Matches a Github organization.
Requires a Github identity provider.
Matches a Github organization. Requires a Github identity provider.
GSuiteGroupRule object { gsuite } Matches a group in Google Workspace.
Requires a Google Workspace identity provider.
Matches a group in Google Workspace. Requires a Google Workspace identity provider.
AccessLinkedAppTokenRule object { linked_app_token } Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
Matches OAuth 2.0 access tokens issued by the specified Access OIDC SaaS application. Only compatible with non_identity and bypass decisions.
saas_app: optional SAMLSaaSApp { auth_type, consumer_service_url, custom_attributes, 8 more } or OIDCSaaSApp { access_token_lifetime, allow_pkce_without_client_secret, app_launcher_url, 11 more }
SAMLSaaSApp object { auth_type, consumer_service_url, custom_attributes, 8 more }
auth_type: optional "saml" or "oidc"Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml”
Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml”
The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion.
custom_attributes: optional array of object { friendly_name, name, name_format, 2 more }
The URL that the user will be redirected to after a successful login for IDP initiated logins.
A JSONata expression that transforms an application’s user identities into a NameID value for its SAML assertion. This expression should evaluate to a singular string. The output of this expression can override the name_id_format setting.
A [JSONata] (https://jsonata.org/) expression that transforms an application’s user identities into attribute assertions in the SAML response. The expression can transform id, email, name, and groups values. It can also transform fields listed in the saml_attributes or oidc_fields of the identity provider used to authenticate. The output of this expression must be a JSON object.
OIDCSaaSApp object { access_token_lifetime, allow_pkce_without_client_secret, app_launcher_url, 11 more }
The lifetime of the OIDC Access Token after creation. Valid units are m,h. Must be greater than or equal to 1m and less than or equal to 24h.
If client secret should be required on the token endpoint when authorization_code_with_pkce grant is used.
auth_type: optional "saml" or "oidc"Identifier of the authentication protocol used for the saas app. Required for OIDC.
Identifier of the authentication protocol used for the saas app. Required for OIDC.
custom_claims: optional array of object { name, required, scope, source }
grant_types: optional array of "authorization_code" or "authorization_code_with_pkce" or "refresh_tokens" or 2 moreThe OIDC flows supported by this application
The OIDC flows supported by this application
A regex to filter Cloudflare groups returned in ID token and userinfo endpoint
hybrid_and_implicit_options: optional object { return_access_token_from_authorization_endpoint, return_id_token_from_authorization_endpoint }
The permitted URL’s for Cloudflare to return Authorization codes and Access/ID tokens
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or SCIMConfigAuthenticationOAuthBearerToken { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOAuthBearerToken object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or SCIMConfigAuthenticationOAuthBearerToken { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOAuthBearerToken object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, propagates DELETE requests to the target application for SCIM resources. If true, sets ‘active’ to false on the SCIM resource. Note: Some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
The tags you want assigned to an application. Tags are used to filter applications in the App Launcher dashboard.
BrowserSSHApplication object { domain, type, id, 31 more }
The primary hostname and path secured by Access. This domain will be displayed if the app is visible in the App Launcher.
When set to true, users can authenticate to this application using their WARP session. When set to false this application will always require direct IdP authentication. This setting always overrides the organization setting for WARP authentication.
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
The custom error message shown to a user when they are denied access to the application.
The custom URL a user is redirected to when they are denied access to the application when failing identity-based rules.
The custom URL a user is redirected to when they are denied access to the application when failing non-identity rules.
The custom pages that will be displayed when applicable for this application
destinations: optional array of object { type, uri } or object { cidr, hostname, l4_protocol, 3 more } or object { mcp_server_id, type } or 4 moreList of destinations secured by Access. This supersedes self_hosted_domains to allow for more flexibility in defining different types of domains. If destinations are provided, then self_hosted_domains will be ignored.
List of destinations secured by Access. This supersedes self_hosted_domains to allow for more flexibility in defining different types of domains. If destinations are provided, then self_hosted_domains will be ignored.
PublicDestination object { type, uri } A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard ’*’ can be used in the definition.
A public hostname that Access will secure. Public destinations support sub-domain and path. Wildcard ’*’ can be used in the definition.
The URI of the destination. Public destinations’ URIs can include a domain and path with wildcards.
PrivateDestination object { cidr, hostname, l4_protocol, 3 more }
The hostname of the destination. Matches a valid SNI served by an HTTPS origin.
l4_protocol: optional "tcp" or "udp"The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.
The L4 protocol of the destination. When omitted, both UDP and TCP traffic will match.
ViaMcpServerPortalDestination object { mcp_server_id, type } A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.
A MCP server id configured in ai-controls. Access will secure the MCP server if accessed through a MCP portal.
WorkerDestination object { type, worker_id } A specific Cloudflare Worker that Access will secure. All requests routed to the specified Worker, including its preview deployments, will be protected. The preview_worker and public destination types takes precedence, so you can create separate applications to override the policies for the Worker’s previews or specific paths.
A specific Cloudflare Worker that Access will secure. All requests routed to the specified Worker, including its preview deployments, will be protected. The preview_worker and public destination types takes precedence, so you can create separate applications to override the policies for the Worker’s previews or specific paths.
PreviewWorkerDestination object { type, worker_id } A specific Cloudflare Worker whose preview deployments Access will secure. Only requests routed to the preview deployments of the specified Worker will be protected. The public destination type takes precedence, so you can create separate applications to override the policies for specific paths.
A specific Cloudflare Worker whose preview deployments Access will secure. Only requests routed to the preview deployments of the specified Worker will be protected. The public destination type takes precedence, so you can create separate applications to override the policies for specific paths.
AllWorkersDestination object { type } Protects all Cloudflare Workers on the account with Access, including their preview deployments. At most one destination of this type can exist per account. The worker, preview_worker, all_preview_workers, and public destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths.
Protects all Cloudflare Workers on the account with Access, including their preview deployments. At most one destination of this type can exist per account. The worker, preview_worker, all_preview_workers, and public destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths.
AllPreviewWorkersDestination object { type } Protects the preview deployments of all Cloudflare Workers on the account with Access. At most one destination of this type can exist per account. The worker, preview_worker, and public destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths.
Protects the preview deployments of all Cloudflare Workers on the account with Access. At most one destination of this type can exist per account. The worker, preview_worker, and public destination types take precedence, so you can create separate applications to override the policies for specific Workers, their previews, or specific paths.
Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
mfa_config: optional object { allowed_authenticators, mfa_disabled, session_duration } Configures multi-factor authentication (MFA) settings.
Configures multi-factor authentication (MFA) settings.
oauth_configuration: optional object { dynamic_client_registration, enabled, grant } Beta: Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support RFC 8707 (Resource Indicators for OAuth 2.0). This feature is currently in beta.
Beta: Optional configuration for managing an OAuth authorization flow controlled by Access. When set, Access will act as the OAuth authorization server for this application. Only compatible with OAuth clients that support RFC 8707 (Resource Indicators for OAuth 2.0). This feature is currently in beta.
dynamic_client_registration: optional object { allow_any_on_localhost, allow_any_on_loopback, allowed_uris, enabled } Settings for OAuth dynamic client registration.
Settings for OAuth dynamic client registration.
Whether the OAuth configuration is enabled for this application. When set to false, Access will not handle OAuth for this application. Defaults to true if omitted.
Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
Enables cookie paths to scope an application’s JWT to the application path. If disabled, the JWT will scope to the hostname by default
policies: optional array of object { id, account_id, approval_groups, 15 more }
approval_groups: optional array of ApprovalGroup { approvals_needed, email_addresses, email_list_uuid } Administrators who can approve a temporary authentication request.
Administrators who can approve a temporary authentication request.
Requires the user to request access from an administrator at the start of each session.
connection_rules: optional object { rdp } The rules that define how users may connect to targets secured by your application.
The rules that define how users may connect to targets secured by your application.
rdp: optional object { allowed_clipboard_local_to_remote_formats, allowed_clipboard_remote_to_local_formats } The RDP-specific rules that define clipboard behavior for RDP connections.
The RDP-specific rules that define clipboard behavior for RDP connections.
The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
AccessAuthContextRule object { auth_context } Matches an Azure Authentication Context.
Requires an Azure identity provider.
Matches an Azure Authentication Context. Requires an Azure identity provider.
AuthenticationMethodRule object { auth_method } Enforce different MFA options
Enforce different MFA options
auth_method: object { auth_method }
The type of authentication method