Cloudflared

List Cloudflare Tunnels

client.zeroTrust.tunnels.cloudflared.list(, ?): V4PagePaginationArray<CloudflareTunnel { id, account_tag, config_src, 10 more } >

GET/accounts/{account_id}/cfd_tunnel

Get a Cloudflare Tunnel

client.zeroTrust.tunnels.cloudflared.get(, , ?): CloudflareTunnel { id, account_tag, config_src, 10 more }

GET/accounts/{account_id}/cfd_tunnel/{tunnel_id}

Create a Cloudflare Tunnel

client.zeroTrust.tunnels.cloudflared.create(, ?): CloudflareTunnel { id, account_tag, config_src, 10 more }

POST/accounts/{account_id}/cfd_tunnel

Update a Cloudflare Tunnel

client.zeroTrust.tunnels.cloudflared.edit(, , ?): CloudflareTunnel { id, account_tag, config_src, 10 more }

PATCH/accounts/{account_id}/cfd_tunnel/{tunnel_id}

Delete a Cloudflare Tunnel

client.zeroTrust.tunnels.cloudflared.delete(, , ?): CloudflareTunnel { id, account_tag, config_src, 10 more }

DELETE/accounts/{account_id}/cfd_tunnel/{tunnel_id}

CloudflaredConfigurations

Get configuration

client.zeroTrust.tunnels.cloudflared.configurations.get(, , ?): ConfigurationGetResponse { account_id, config, created_at, 3 more }

GET/accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations

Put configuration

client.zeroTrust.tunnels.cloudflared.configurations.update(, , ?): ConfigurationUpdateResponse { account_id, config, created_at, 3 more }

PUT/accounts/{account_id}/cfd_tunnel/{tunnel_id}/configurations

ModelsExpand Collapse

ConfigurationGetResponse { account_id, config, created_at, 3 more }

Cloudflare Tunnel configuration

account_id?: string

Identifier.

maxLength32

config?: Config { ingress, originRequest }

The tunnel configuration and ingress rules.

ingress?: Array<Ingress>

List of public hostname definitions. At least one ingress rule needs to be defined for the tunnel.

hostname: string

Public hostname for this service.

service: string

Protocol and address of destination server. Supported protocols: http://, https://, unix://, tcp://, ssh://, rdp://, unix+tls://, smb://. Alternatively can return a HTTP status code http_status:[code] e.g. ‘http_status:404’.

originRequest?: OriginRequest { access, caPool, connectTimeout, 12 more }

Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.

access?: Access { audTag, teamName, required }

For all L7 requests to this hostname, cloudflared will validate each request’s Cf-Access-Jwt-Assertion request header.

audTag: Array<string>

Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.

teamName: string

required?: boolean

Deny traffic that has not fulfilled Access authorization.

caPool?: string

Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.

connectTimeout?: number

Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.

disableChunkedEncoding?: boolean

Disables chunked transfer encoding. Useful if you are running a WSGI server.

http2Origin?: boolean

Attempt to connect to origin using HTTP2. Origin must be configured as https.

httpHostHeader?: string

Sets the HTTP Host header on requests sent to the local service.

keepAliveConnections?: number

Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.

keepAliveTimeout?: number

Timeout after which an idle keepalive connection can be discarded.

matchSNItoHost?: boolean

Auto configure the Hostname on the origin server certificate.

noHappyEyeballs?: boolean

Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.

noTLSVerify?: boolean

Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.

originServerName?: string

Hostname that cloudflared should expect from your origin server certificate.

proxyType?: string

cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and “socks” for a SOCKS5 proxy.

tcpKeepAlive?: number

The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.

tlsTimeout?: number

Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.

path?: string

Requests with this path route to this public hostname.

originRequest?: OriginRequest { access, caPool, connectTimeout, 12 more }

Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.

access?: Access { audTag, teamName, required }

For all L7 requests to this hostname, cloudflared will validate each request’s Cf-Access-Jwt-Assertion request header.

audTag: Array<string>

Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.

teamName: string

required?: boolean

Deny traffic that has not fulfilled Access authorization.

caPool?: string

Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.

connectTimeout?: number

Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.

disableChunkedEncoding?: boolean

Disables chunked transfer encoding. Useful if you are running a WSGI server.

http2Origin?: boolean

Attempt to connect to origin using HTTP2. Origin must be configured as https.

httpHostHeader?: string

Sets the HTTP Host header on requests sent to the local service.

keepAliveConnections?: number

Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.

keepAliveTimeout?: number

Timeout after which an idle keepalive connection can be discarded.

matchSNItoHost?: boolean

Auto configure the Hostname on the origin server certificate.

noHappyEyeballs?: boolean

Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.

noTLSVerify?: boolean

Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.

originServerName?: string

Hostname that cloudflared should expect from your origin server certificate.

proxyType?: string

cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and “socks” for a SOCKS5 proxy.

tcpKeepAlive?: number

The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.

tlsTimeout?: number

Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.

created_at?: string

formatdate-time

source?: "local" | "cloudflare"

Indicates if this is a locally or remotely configured tunnel. If local, manage the tunnel using a YAML file on the origin machine. If cloudflare, manage the tunnel’s configuration on the Zero Trust dashboard.

One of the following:

"local"

"cloudflare"

tunnel_id?: string

UUID of the tunnel.

formatuuid

maxLength36

version?: number

The version of the Tunnel Configuration.

ConfigurationUpdateResponse { account_id, config, created_at, 3 more }

Cloudflare Tunnel configuration

account_id?: string

Identifier.

maxLength32

config?: Config { ingress, originRequest }

The tunnel configuration and ingress rules.

ingress?: Array<Ingress>

List of public hostname definitions. At least one ingress rule needs to be defined for the tunnel.

hostname: string

Public hostname for this service.

service: string

Protocol and address of destination server. Supported protocols: http://, https://, unix://, tcp://, ssh://, rdp://, unix+tls://, smb://. Alternatively can return a HTTP status code http_status:[code] e.g. ‘http_status:404’.

originRequest?: OriginRequest { access, caPool, connectTimeout, 12 more }

Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.

access?: Access { audTag, teamName, required }

For all L7 requests to this hostname, cloudflared will validate each request’s Cf-Access-Jwt-Assertion request header.

audTag: Array<string>

Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.

teamName: string

required?: boolean

Deny traffic that has not fulfilled Access authorization.

caPool?: string

Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.

connectTimeout?: number

Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.

disableChunkedEncoding?: boolean

Disables chunked transfer encoding. Useful if you are running a WSGI server.

http2Origin?: boolean

Attempt to connect to origin using HTTP2. Origin must be configured as https.

httpHostHeader?: string

Sets the HTTP Host header on requests sent to the local service.

keepAliveConnections?: number

Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.

keepAliveTimeout?: number

Timeout after which an idle keepalive connection can be discarded.

matchSNItoHost?: boolean

Auto configure the Hostname on the origin server certificate.

noHappyEyeballs?: boolean

Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.

noTLSVerify?: boolean

Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.

originServerName?: string

Hostname that cloudflared should expect from your origin server certificate.

proxyType?: string

cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and “socks” for a SOCKS5 proxy.

tcpKeepAlive?: number

The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.

tlsTimeout?: number

Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.

path?: string

Requests with this path route to this public hostname.

originRequest?: OriginRequest { access, caPool, connectTimeout, 12 more }

Configuration parameters for the public hostname specific connection settings between cloudflared and origin server.

access?: Access { audTag, teamName, required }

For all L7 requests to this hostname, cloudflared will validate each request’s Cf-Access-Jwt-Assertion request header.

audTag: Array<string>

Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.

teamName: string

required?: boolean

Deny traffic that has not fulfilled Access authorization.

caPool?: string

Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.

connectTimeout?: number

Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.

disableChunkedEncoding?: boolean

Disables chunked transfer encoding. Useful if you are running a WSGI server.

http2Origin?: boolean

Attempt to connect to origin using HTTP2. Origin must be configured as https.

httpHostHeader?: string

Sets the HTTP Host header on requests sent to the local service.

keepAliveConnections?: number

Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.

keepAliveTimeout?: number

Timeout after which an idle keepalive connection can be discarded.

matchSNItoHost?: boolean

Auto configure the Hostname on the origin server certificate.

noHappyEyeballs?: boolean

Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.

noTLSVerify?: boolean

Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.

originServerName?: string

Hostname that cloudflared should expect from your origin server certificate.

proxyType?: string

cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and “socks” for a SOCKS5 proxy.

tcpKeepAlive?: number

The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.

tlsTimeout?: number

Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.

created_at?: string

formatdate-time

source?: "local" | "cloudflare"

Indicates if this is a locally or remotely configured tunnel. If local, manage the tunnel using a YAML file on the origin machine. If cloudflare, manage the tunnel’s configuration on the Zero Trust dashboard.

One of the following:

"local"

"cloudflare"

tunnel_id?: string

UUID of the tunnel.

formatuuid

maxLength36

version?: number

The version of the Tunnel Configuration.

CloudflaredConnections

List Cloudflare Tunnel connections

client.zeroTrust.tunnels.cloudflared.connections.get(, , ?): SinglePage<Client { id, arch, config_version, 4 more } >

GET/accounts/{account_id}/cfd_tunnel/{tunnel_id}/connections

Clean up Cloudflare Tunnel connections

client.zeroTrust.tunnels.cloudflared.connections.delete(, , ?): ConnectionDeleteResponse | null

DELETE/accounts/{account_id}/cfd_tunnel/{tunnel_id}/connections

ModelsExpand Collapse

Client { id, arch, config_version, 4 more }

A client (typically cloudflared) that maintains connections to a Cloudflare data center.

id?: string

UUID of the Cloudflare Tunnel connection.

formatuuid

maxLength36

arch?: string

The cloudflared OS architecture used to establish this connection.

config_version?: number

The version of the remote tunnel configuration. Used internally to sync cloudflared with the Zero Trust dashboard.

conns?: Array<Conn>

The Cloudflare Tunnel connections between your origin and Cloudflare’s edge.

id?: string

UUID of the Cloudflare Tunnel connection.

formatuuid

maxLength36

client_id?: string

UUID of the Cloudflare Tunnel connector.

formatuuid

maxLength36

client_version?: string

The cloudflared version used to establish this connection.

colo_name?: string

The Cloudflare data center used for this connection.

opened_at?: string

Timestamp of when the connection was established.

formatdate-time

origin_ip?: string

The public IP address of the host running cloudflared.

uuid?: string

UUID of the Cloudflare Tunnel connection.

formatuuid

maxLength36

features?: Array<string>

Features enabled for the Cloudflare Tunnel.

run_at?: string

Timestamp of when the tunnel connection was started.

formatdate-time

version?: string

The cloudflared version used to establish this connection.

ConnectionDeleteResponse = unknown

CloudflaredToken

Get a Cloudflare Tunnel token

client.zeroTrust.tunnels.cloudflared.token.get(, , ?): TokenGetResponse

GET/accounts/{account_id}/cfd_tunnel/{tunnel_id}/token

ModelsExpand Collapse

TokenGetResponse = string

The Tunnel Token is used as a mechanism to authenticate the operation of a tunnel.

CloudflaredConnectors

Get Cloudflare Tunnel connector

client.zeroTrust.tunnels.cloudflared.connectors.get(, , ?): Client { id, arch, config_version, 4 more }

GET/accounts/{account_id}/cfd_tunnel/{tunnel_id}/connectors/{connector_id}

CloudflaredManagement

Get a Cloudflare Tunnel management token

client.zeroTrust.tunnels.cloudflared.management.create(, , ?): ManagementCreateResponse

POST/accounts/{account_id}/cfd_tunnel/{tunnel_id}/management

ModelsExpand Collapse

ManagementCreateResponse = string

The Tunnel Token is used as a mechanism to authenticate the operation of a tunnel.