Access
AccessAI Controls
AccessAI ControlsMcp
AccessAI ControlsMcpPortals
List MCP Portals
Create a new MCP Portal
Read details of an MCP Portal
Update a MCP Portal
Delete a MCP Portal
ModelsExpand Collapse
PortalListResponse object { id, hostname, name, 8 more }
servers: array of object { id, auth_type, hostname, 19 more }
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
PortalCreateResponse object { id, hostname, name, 8 more }
servers: array of object { id, auth_type, hostname, 19 more }
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
PortalReadResponse object { id, hostname, name, 8 more }
servers: array of object { id, auth_type, hostname, 19 more }
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
PortalUpdateResponse object { id, hostname, name, 8 more }
servers: array of object { id, auth_type, hostname, 19 more }
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
AccessAI ControlsMcpServers
List MCP Servers
Create a new MCP Server
Read the details of a MCP Server
Update a MCP Server
Delete a MCP Server
Sync MCP Server Capabilities
ModelsExpand Collapse
ServerListResponse object { id, auth_type, hostname, 17 more }
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
ServerCreateResponse object { id, auth_type, hostname, 17 more }
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
ServerReadResponse object { id, auth_type, hostname, 17 more }
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
ServerUpdateResponse object { id, auth_type, hostname, 17 more }
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
ServerDeleteResponse object { id, auth_type, hostname, 17 more }
When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker’s per-env rollout mode KV key.
Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
AccessGateway CA
List SSH Certificate Authorities (CA)
Add a new SSH Certificate Authority (CA)
Delete an SSH Certificate Authority (CA)
ModelsExpand Collapse
AccessIdP Federation Grants
List IdP federation grants
Create an IdP federation grant
Get an IdP federation grant
Delete an IdP federation grant
AccessSAML Certificates
List SAML certificate sets
Get SAML certificate set
Rotate SAML certificate
Download current certificate in PEM format
ModelsExpand Collapse
AccessInfrastructure
AccessInfrastructureTargets
List all targets
Get target
Create new target
Update target
Delete target
Create new targets
Delete targets
ModelsExpand Collapse
AccessApplications
List Access applications
Get an Access application
Add an Access application
Update an Access application
Delete an Access application
Revoke application tokens
ModelsExpand Collapse
Application = object { domain, type, id, 22 more } or object { id, allowed_idps, app_launcher_visible, 9 more } or object { domain, type, id, 22 more } or 5 more
SelfHostedApplication object { domain, type, id, 22 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
cors_headers: optional object { allow_all_headers, allow_all_methods, allow_all_origins, 5 more }
The custom error message shown to a user when they are denied access to the application.
The custom URL a user is redirected to when they are denied access to the application.
Preemptively sets the Access session cookie on every hostname in a multi-hostname self-hosted application during the initial redirect chain, rather than setting it lazily on first visit. Defaults to true. Set to false to disable the eager redirect cookie behavior.
Enables the binding cookie, which increases security against compromised authorization tokens and CSRF attacks.
Enables the HttpOnly cookie attribute, which increases security against XSS attacks.
Allows options preflight requests to bypass Access authentication and go directly to the origin. Cannot turn on if cors_headers is set.
Sets the SameSite cookie setting, which provides increased security against CSRF attacks.
scim_config: optional object { idp_uid, remote_uri, authentication, 3 more } Configuration for provisioning to this application via SCIM. This is currently in closed beta.
Configuration for provisioning to this application via SCIM. This is currently in closed beta.
The UID of the IdP to use as the source for SCIM resources to provision to this application.
authentication: optional SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or 2 moreAttributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigMultiAuthentication2 = array of SCIMConfigAuthenticationHTTPBasic { password, scheme, user } or object { token, scheme } or SCIMConfigAuthenticationOauth2 { authorization_url, client_id, client_secret, 3 more } or object { client_id, client_secret, scheme } Multiple authentication schemes
Multiple authentication schemes
SCIMConfigAuthenticationHTTPBasic object { password, scheme, user } Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
Attributes for configuring HTTP Basic authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationOAuthBearerToken2 object { token, scheme } Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth Bearer Token authentication scheme for SCIM provisioning to an application.
SCIMConfigAuthenticationOauth2 object { authorization_url, client_id, client_secret, 3 more } Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
Attributes for configuring OAuth 2 authentication scheme for SCIM provisioning to an application.
AccessSCIMConfigAuthenticationAccessServiceToken object { client_id, client_secret, scheme } Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
Attributes for configuring Access Service Token authentication scheme for SCIM provisioning to an application.
If false, we propagate DELETE requests to the target application for SCIM resources. If true, we only set active to false on the SCIM resource. This is useful because some targets do not support DELETE operations.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A list of mappings to apply to SCIM resources before provisioning them in this application. These can transform or filter the resources to be provisioned.
A SCIM filter expression that matches resources that should be provisioned to this application.
operations: optional object { create, delete, update } Whether or not this mapping applies to creates, updates, or deletes.
Whether or not this mapping applies to creates, updates, or deletes.
strictness: optional "strict" or "passthrough"The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
The level of adherence to outbound resource schemas when provisioning to this mapping. ‘Strict’ removes unknown values, while ‘passthrough’ passes unknown values to the target.
A JSONata expression that transforms the resource before provisioning it in the application.
Returns a 401 status code when the request is blocked by a Service Auth policy.
The amount of time that tokens issued for this application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
Determines if users can access this application via a clientless browser isolation URL. This allows users to access private domains without connecting to Gateway. The option requires Clientless Browser Isolation to be set up with policies that allow users of this application.
SaaSApplication object { id, allowed_idps, app_launcher_visible, 9 more }
The identity providers your users can select when connecting to this application. Defaults to all IdPs configured in your account.
When set to true, users skip the identity provider selection step during login. You must specify only one identity provider in allowed_idps.
saas_app: optional object { auth_type, consumer_service_url, created_at, 8 more } or object { access_token_lifetime, allow_pkce_without_client_secret, app_launcher_url, 13 more }
AccessSAMLSaaSApp2 object { auth_type, consumer_service_url, created_at, 8 more }
auth_type: optional "saml" or "oidc"Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml”
Optional identifier indicating the authentication protocol used for the saas app. Required for OIDC. Default if unset is “saml”
The service provider’s endpoint that is responsible for receiving and parsing a SAML assertion.