7.6.0 (2026-06-16)

Full Changelog: v7.5.0...v7.6.0

This release includes breaking changes in Realtime Kit and Email Security alongside a large number of new services and features. Please ensure you read through the list of changes below before upgrading.

See the v7.6.0 Migration Guide for before/after code examples and actions needed for each breaking change.

Breaking Changes

Realtime Kit - GenerateSummaryOfTranscripts Return Type Changed

SessionService.GenerateSummaryOfTranscripts() previously returned only error. It now returns (*SessionGenerateSummaryOfTranscriptsResponse, error). Code that discards the first return value will no longer compile.

Realtime Kit - StartTrackRecording Return Type Changed

RecordingService.StartTrackRecording() previously returned only error. It now returns (*RecordingStartTrackRecordingResponse, error). Code that discards the first return value will no longer compile.

Realtime Kit - Session Participant Response Types Restructured

SessionGetParticipantDataFromPeerIDResponseData gained a new .Participant nested struct. Sub-types were renamed from ...DataPeerReport to ...DataParticipantPeerReport (and similar). Code referencing the old type names will no longer compile.

Email Security - ActionLog Parameter Removed

The ActionLog field has been removed from InvestigateListParams. The upstream API no longer accepts this query parameter. Remove the field from your list calls.

Features

Tenants (client.Tenants)

• NEW SERVICE: Multi-tenant account management
  • client.Tenants.New() - Create a tenant
  • client.Tenants.Update() - Update a tenant
  • client.Tenants.List() - List tenants
  • client.Tenants.Delete() - Delete a tenant
  • client.Tenants.Get() - Get a tenant
  • client.Tenants.Accounts.New() - Create a tenant account
  • client.Tenants.Accounts.List() - List tenant accounts
  • client.Tenants.Accounts.Delete() - Delete a tenant account
  • client.Tenants.Accounts.Get() - Get a tenant account
  • client.Tenants.AccountTypes.List() - List tenant account types
  • client.Tenants.Entitlements.List() - List tenant entitlements
  • client.Tenants.Memberships.New() - Create a tenant membership
  • client.Tenants.Memberships.List() - List tenant memberships
  • client.Tenants.Memberships.Delete() - Delete a tenant membership
  • client.Tenants.Memberships.Get() - Get a tenant membership

Flagship (client.Flagship)

• NEW SERVICE: Feature flag management
  • client.Flagship.Apps.New() - Create a Flagship app
  • client.Flagship.Apps.Update() - Update a Flagship app
  • client.Flagship.Apps.List() - List Flagship apps
  • client.Flagship.Apps.Delete() - Delete a Flagship app
  • client.Flagship.Apps.Get() - Get a Flagship app
  • client.Flagship.Apps.Flags.New() - Create a feature flag
  • client.Flagship.Apps.Flags.Update() - Update a feature flag
  • client.Flagship.Apps.Flags.List() - List feature flags
  • client.Flagship.Apps.Flags.Delete() - Delete a feature flag
  • client.Flagship.Apps.Flags.Get() - Get a feature flag
  • client.Flagship.Apps.Flags.Changelog.List() - List flag changelog
  • client.Flagship.Apps.Evaluate.Get() - Evaluate flags for an app

OriginTLSComplianceModes (client.OriginTLSComplianceModes)

• NEW SERVICE: Origin TLS compliance mode settings
  • client.OriginTLSComplianceModes.Edit() - Edit compliance mode
  • client.OriginTLSComplianceModes.Get() - Get compliance mode

CsamScanner (client.CsamScanner)

• NEW SERVICE: CSAM scanner third-party settings
  • client.CsamScanner.Edit() - Edit CSAM scanner settings
  • client.CsamScanner.Get() - Get CSAM scanner settings

TenantCustomNameservers (client.TenantCustomNameservers)

• NEW SERVICE: Tenant-scoped custom nameservers
  • client.TenantCustomNameservers.New() - Create a tenant custom nameserver
  • client.TenantCustomNameservers.Delete() - Delete a tenant custom nameserver
  • client.TenantCustomNameservers.Get() - Get tenant custom nameservers

AI Gateway (client.AIGateway)

• client.AIGateway.CustomProviders.New() - Create a custom AI provider
• client.AIGateway.CustomProviders.List() - List custom AI providers
• client.AIGateway.CustomProviders.Delete() - Delete a custom AI provider
• client.AIGateway.CustomProviders.Get() - Get a custom AI provider

IAM (client.IAM)

• client.IAM.OAuthClients.New() - Create an OAuth client
• client.IAM.OAuthClients.Update() - Update an OAuth client
• client.IAM.OAuthClients.List() - List OAuth clients
• client.IAM.OAuthClients.Delete() - Delete an OAuth client
• client.IAM.OAuthClients.DeleteRotatedSecret() - Delete a rotated client secret
• client.IAM.OAuthClients.Get() - Get an OAuth client
• client.IAM.OAuthClients.RotateSecret() - Rotate an OAuth client secret
• client.IAM.OAuthScopes.List() - List available OAuth scopes

Magic Transit (client.MagicTransit)

• client.MagicTransit.IPSECTunnels.PSKSet() - Set a pre-shared key for IPSEC tunnels
• client.MagicTransit.Cf1Sites.New() - Create a CF1 site
• client.MagicTransit.Cf1Sites.Update() - Update a CF1 site
• client.MagicTransit.Cf1Sites.List() - List CF1 sites
• client.MagicTransit.Cf1Sites.Delete() - Delete a CF1 site
• client.MagicTransit.Cf1Sites.Get() - Get a CF1 site
• client.MagicTransit.Cf1Sites.Ramps.New() - Create a CF1 site ramp
• client.MagicTransit.Cf1Sites.Ramps.Update() - Update a CF1 site ramp
• client.MagicTransit.Cf1Sites.Ramps.List() - List CF1 site ramps
• client.MagicTransit.Cf1Sites.Ramps.Delete() - Delete a CF1 site ramp
• client.MagicTransit.Cf1Sites.Ramps.Get() - Get a CF1 site ramp

SSL (client.SSL)

• client.SSL.AutoOriginTLSKex.Edit() - Edit auto origin TLS key exchange settings
• client.SSL.AutoOriginTLSKex.Get() - Get auto origin TLS key exchange settings

DNS (client.DNS)

• client.DNS.Usage.Zone.Get() - Get zone-level DNS usage
• client.DNS.Usage.Account.Get() - Get account-level DNS usage

Zero Trust (client.ZeroTrust)

• client.ZeroTrust.Access.IdentityProviders.FederationGrants.New() - Create an IDP federation grant
• client.ZeroTrust.Access.IdentityProviders.FederationGrants.Update() - Update an IDP federation grant
• client.ZeroTrust.Access.IdentityProviders.FederationGrants.List() - List IDP federation grants
• client.ZeroTrust.Access.IdentityProviders.FederationGrants.Delete() - Delete an IDP federation grant
• client.ZeroTrust.Access.IdentityProviders.FederationGrants.Get() - Get an IDP federation grant
• client.ZeroTrust.Access.AIControl.McpServers.New() - Create an MCP server
• client.ZeroTrust.Access.AIControl.McpServers.Update() - Update an MCP server
• client.ZeroTrust.Access.AIControl.McpServers.List() - List MCP servers
• client.ZeroTrust.Access.AIControl.McpServers.Delete() - Delete an MCP server
• client.ZeroTrust.Access.AIControl.McpServers.Get() - Get an MCP server
• client.ZeroTrust.Access.AIControl.McpServers.Sync() - Sync MCP servers
• client.ZeroTrust.Access.AIControl.McpPortals.New() - Create an MCP portal
• client.ZeroTrust.Access.AIControl.McpPortals.Update() - Update an MCP portal
• client.ZeroTrust.Access.AIControl.McpPortals.List() - List MCP portals
• client.ZeroTrust.Access.AIControl.McpPortals.Delete() - Delete an MCP portal
• client.ZeroTrust.Access.AIControl.McpPortals.Get() - Get an MCP portal
• client.ZeroTrust.DEX.Devices.ISPs.List() - List device ISPs
• client.ZeroTrust.DEX.FleetStatus.Devices.List() - List fleet status devices
• client.ZeroTrust.DEX.Rules.New() - Create a DEX rule
• client.ZeroTrust.DEX.Rules.Update() - Update a DEX rule
• client.ZeroTrust.DEX.Rules.List() - List DEX rules
• client.ZeroTrust.DEX.Rules.Delete() - Delete a DEX rule
• client.ZeroTrust.DEX.Rules.Get() - Get a DEX rule
• client.ZeroTrust.DEX.Commands.New() - Create a DEX command
• client.ZeroTrust.DEX.Commands.List() - List DEX commands
• client.ZeroTrust.DEX.Commands.Devices.List() - List DEX command devices
• client.ZeroTrust.DEX.Commands.Downloads.Get() - Download DEX command results
• client.ZeroTrust.DEX.Commands.Quota.Get() - Get DEX command quota
• client.ZeroTrust.DEX.WARPChangeEvents.List() - List WARP change events
• client.ZeroTrust.DLP.CustomPromptTopics.New() - Create a DLP custom prompt topic
• client.ZeroTrust.DLP.CustomPromptTopics.Update() - Update a DLP custom prompt topic
• client.ZeroTrust.DLP.CustomPromptTopics.List() - List DLP custom prompt topics
• client.ZeroTrust.DLP.CustomPromptTopics.Delete() - Delete a DLP custom prompt topic
• client.ZeroTrust.DLP.CustomPromptTopics.Get() - Get a DLP custom prompt topic
• client.ZeroTrust.DLP.SensitivityGroups.New() - Create a DLP sensitivity group
• client.ZeroTrust.DLP.SensitivityGroups.Update() - Update a DLP sensitivity group
• client.ZeroTrust.DLP.SensitivityGroups.List() - List DLP sensitivity groups
• client.ZeroTrust.DLP.SensitivityGroups.Delete() - Delete a DLP sensitivity group
• client.ZeroTrust.DLP.SensitivityGroups.Get() - Get a DLP sensitivity group
• client.ZeroTrust.DLP.SensitivityGroups.Levels.New() - Create a sensitivity level
• client.ZeroTrust.DLP.SensitivityGroups.Levels.Update() - Update a sensitivity level
• client.ZeroTrust.DLP.SensitivityGroups.Levels.List() - List sensitivity levels
• client.ZeroTrust.DLP.SensitivityGroups.Levels.Delete() - Delete a sensitivity level
• client.ZeroTrust.DLP.SensitivityGroups.Levels.Get() - Get a sensitivity level
• client.ZeroTrust.DLP.SensitivityGroups.Levels.Order.Update() - Update sensitivity level order
• client.ZeroTrust.DLP.SensitivityGroups.Levels.Order.Get() - Get sensitivity level order
• client.ZeroTrust.DLP.DataTagCategories.New() - Create a DLP data tag category
  -...

7.5.0 (2026-06-10)

Full Changelog: v7.4.0...v7.5.0

This release adds six new top-level services, extensive DLP classification and data tagging APIs, OAuth client management, and regional hostname support. It includes two breaking return-type changes in realtime_kit. Please ensure you read through the list of changes below before upgrading.

Breaking Changes

Realtime Kit - GenerateSummaryOfTranscripts Return Type Changed

SessionService.GenerateSummaryOfTranscripts() now returns (*SessionGenerateSummaryOfTranscriptsResponse, error) instead of just error. Callers must capture the new response value.

Realtime Kit - StartTrackRecording Return Type Changed

RecordingService.StartTrackRecording() now returns (*RecordingStartTrackRecordingResponse, error) instead of just error. Callers must capture the new response value.

Features

Flagship (client.Flagship)

• NEW SERVICE: Feature flag management
  • client.Flagship.Apps.New() - Create a Flagship app
  • client.Flagship.Apps.Update() - Update a Flagship app
  • client.Flagship.Apps.List() - List Flagship apps
  • client.Flagship.Apps.Delete() - Delete a Flagship app
  • client.Flagship.Apps.Get() - Get a Flagship app
  • client.Flagship.Apps.Flags.New() - Create a feature flag
  • client.Flagship.Apps.Flags.Update() - Update a feature flag
  • client.Flagship.Apps.Flags.List() - List feature flags
  • client.Flagship.Apps.Flags.Delete() - Delete a feature flag
  • client.Flagship.Apps.Flags.Get() - Get a feature flag
  • client.Flagship.Apps.Flags.Changelog.List() - List flag changelog entries
  • client.Flagship.Apps.Evaluate.Get() - Evaluate flags for an app

TenantCustomNameservers (client.TenantCustomNameservers)

• NEW SERVICE: Tenant-scoped custom nameserver management
  • client.TenantCustomNameservers.New() - Create a tenant custom nameserver
  • client.TenantCustomNameservers.Delete() - Delete a tenant custom nameserver
  • client.TenantCustomNameservers.Get() - List tenant custom nameservers

CsamScanner (client.CsamScanner)

• NEW SERVICE: CSAM scanner third-party settings
  • client.CsamScanner.Edit() - Update CSAM scanner settings for a zone
  • client.CsamScanner.Get() - Get CSAM scanner settings for a zone

OriginTLSComplianceModes (client.OriginTLSComplianceModes)

• NEW SERVICE: Origin TLS compliance mode configuration (service stub)

SSL (client.SSL)

• New AutoOriginTLSKex sub-resource (service stub)

IAM (client.IAM)

• OAuthClients - Full OAuth client lifecycle management
  • client.IAM.OAuthClients.New() - Create an OAuth client
  • client.IAM.OAuthClients.Update() - Update an OAuth client
  • client.IAM.OAuthClients.List() - List OAuth clients
  • client.IAM.OAuthClients.Delete() - Delete an OAuth client
  • client.IAM.OAuthClients.Get() - Get an OAuth client
  • client.IAM.OAuthClients.RotateSecret() - Rotate OAuth client secret
  • client.IAM.OAuthClients.DeleteRotatedSecret() - Delete rotated secret
• OAuthScopes - OAuth scope discovery
  • client.IAM.OAuthScopes.List() - List available OAuth scopes

Zero Trust - DLP (client.ZeroTrust.DLP)

• CustomPromptTopics - Custom prompt topic management (CRUD)
  • client.ZeroTrust.DLP.CustomPromptTopics.New(), Update(), List(), Delete(), Get()
• SensitivityGroups - Sensitivity group management (CRUD)
  • client.ZeroTrust.DLP.SensitivityGroups.New(), Update(), List(), Delete(), Get()
  • Levels - Sensitivity level management within groups (CRUD)
    • client.ZeroTrust.DLP.SensitivityGroups.Levels.New(), Update(), List(), Delete(), Get()
    • Order - Level ordering
      • client.ZeroTrust.DLP.SensitivityGroups.Levels.Order.Update(), Get()
• DataTagCategories - Data tag category management (CRUD)
  • client.ZeroTrust.DLP.DataTagCategories.New(), Update(), List(), Delete(), Get()
  • DataTags - Data tags within categories (CRUD)
    • client.ZeroTrust.DLP.DataTagCategories.DataTags.New(), Update(), List(), Delete(), Get()
• DataClasses - Data class management (CRUD)
  • client.ZeroTrust.DLP.DataClasses.New(), Update(), List(), Delete(), Get()

Zero Trust - Access (client.ZeroTrust.Access)

• IdPFederationGrants - Identity provider federation grant management
  • client.ZeroTrust.Access.IdPFederationGrants.New() - Create a federation grant
  • client.ZeroTrust.Access.IdPFederationGrants.Update() - Update a federation grant
  • client.ZeroTrust.Access.IdPFederationGrants.List() - List federation grants
  • client.ZeroTrust.Access.IdPFederationGrants.Delete() - Delete a federation grant
  • client.ZeroTrust.Access.IdPFederationGrants.Get() - Get a federation grant

Zero Trust - DEX (client.ZeroTrust.DEX)

• Devices.ISPs - Device ISP lookup
  • client.ZeroTrust.DEX.Devices.ISPs.List() - List ISPs for a device

Zero Trust - Tunnels (client.ZeroTrust.Tunnels)

• WARPConnector.Configurations - WARP connector tunnel configuration
  • client.ZeroTrust.Tunnels.WARPConnector.Configurations.Update() - Update tunnel configuration
  • client.ZeroTrust.Tunnels.WARPConnector.Configurations.Get() - Get tunnel configuration

Addressing (client.Addressing)

• RegionalHostnames - Regional hostname management for Data Localization
  • client.Addressing.RegionalHostnames.New() - Create a regional hostname
  • client.Addressing.RegionalHostnames.List() - List regional hostnames
  • client.Addressing.RegionalHostnames.Delete() - Delete a regional hostname
  • client.Addressing.RegionalHostnames.Edit() - Update a regional hostname's region
  • client.Addressing.RegionalHostnames.Get() - Get a regional hostname
  • client.Addressing.RegionalHostnames.Regions.List() - List available DLS regions

DNS (client.DNS)

• Usage.Zone - Zone-level DNS record usage
  • client.DNS.Usage.Zone.Get() - Get DNS record usage for a zone
• Usage.Account - Account-level DNS record usage
  • client.DNS.Usage.Account.Get() - Get DNS record usage for an account

Resource Sharing (client.ResourceSharing)

• client.ResourceSharing.Resources.Update() - Update a shared resource
• client.ResourceSharing.Resources.Delete() - Delete a shared resource
• client.ResourceSharing.Resources.Get() - Get a shared resource

Workflows (client.Workflows)

• client.Workflows.Instances.Step() - Get step details for a workflow instance
• client.Workflows.Versions.Graph() - Get the version graph for a workflow

ResourceTagging (client.ResourceTagging)

• New Summary sub-resource added (service stub)

Realtime Kit (client.RealtimeKit)

• GenerateSummaryOfTranscripts() now returns a typed SessionGenerateSummaryOfTranscriptsResponse
• StartTrackRecording() now returns a typed RecordingStartTrackRecordingResponse

Codegen Updates

Type and field updates across: ai_gateway, billing, browser_rendering, d1, dns_firewall, intel, magic_transit, organizations, r2, realtime_kit, zero_trust

Deprecations

None in this release.

Bug Fixes

• Zero Trust: Fixed codegen test referencing response-only field IsSharedOAuthCallbackEnabled in MCP portal params

7.4.0 (2026-05-29)

Full Changelog: v7.3.0...v7.4.0

This release includes breaking changes in a few services alongside new features and SDK-level improvements. Please ensure you read through the list of changes below before upgrading.

General Changes

Default HTTP Client with Response Header Timeout

The SDK now creates a default http.Client with a 10-minute ResponseHeaderTimeout on the transport. This prevents stuck connections from hanging indefinitely when a server accepts a connection but never responds. If http.DefaultTransport has been wrapped (e.g. by otelhttp for tracing), the wrapping is preserved and the timeout is skipped. You can still supply your own client via option.WithHTTPClient().

Custom Headers via Environment Variable

A new CLOUDFLARE_CUSTOM_HEADERS environment variable is now supported. Set it to a newline-separated list of Header-Name: value pairs to inject custom headers into every request:

export CLOUDFLARE_CUSTOM_HEADERS="X-Custom-Header: my-value
X-Another: other-value"

Debug Logging Redacts Sensitive Headers

option.WithDebugLog() now redacts sensitive headers (Authorization, API keys, cookies, auth email/key) in both request and response dumps, preventing accidental credential exposure in debug output.

Breaking Changes

See the v7.4.0 Migration Guide for before/after code examples and actions needed for each change.

Email Security - ActionLog Parameter Removed

The ActionLog field has been removed from InvestigateListParams. Remove the field from your list calls.

Realtime Kit - Livestream Time Fields Changed to int64

The StartTime and EndTime fields in LivestreamGetLivestreamAnalyticsCompleteParams changed from time.Time to int64 (unix epoch seconds). Use .Unix() to convert.

Realtime Kit - Multiple Session Response Types Restructured

Several session response types were flattened, removing a layer of nesting:

• SessionGetParticipantDataFromPeerIDResponseData: The .Participant field was removed; its children (PeerReport, PeerStats, QualityStats) promoted to the top level. SessionID field added. All ...DataParticipant* sub-types removed and replaced with ...Data* equivalents.
• SessionGetSessionDetailsResponseData: The .Session field was removed; its fields promoted to the top level. SessionGetSessionDetailsResponseDataSession type removed; enum types renamed (...DataSessionStatus -> ...DataStatus, ...DataSessionType -> ...DataType).
• SessionGetSessionParticipantDetailsResponseDataParticipant: The .PeerStats and .QualityStats nested sub-types removed (...DataParticipantPeerStats*, ...DataParticipantQualityStat* -- 8 types total).

Resource Sharing - Resources Service Methods Removed

The Update, Delete, and Get methods on ResourceSharing.Resources have been removed along with their associated types (ResourceUpdateResponse, ResourceDeleteResponse, ResourceGetResponse). Only New and List remain.

Billing - Paygo Endpoint Path Changed

The Paygo method endpoint changed from /accounts/{account_id}/billing/usage/paygo to /accounts/{account_id}/paygo-usage. The method signature is unchanged.

Workers - Observability Telemetry Response Type Changes

The Source field on ObservabilityTelemetryQueryResponse events and invocations changed from interface{} to discriminated union interfaces (ObservabilityTelemetryQueryResponseEventsEventsSourceUnion, ObservabilityTelemetryQueryResponseInvocationsSourceUnion). Code that type-asserted Source as map[string]interface{} should use the new union's .AsUnion() method or match on the concrete variants.

The Containers field on ObservabilityTelemetryQueryResponseEventsEventsWorkersObject changed from interface{} to map[string]interface{}.

Custom Hostnames - SSL Parameter Type Changed

The CustomHostnameListParamsSSL type changed from float64 to int64. Code that passes this parameter explicitly with a float64 literal or variable will need updating.

Zero Trust - MCP Server Sync Response Type Changed

AccessAIControlMcpServerSyncResponse changed from interface{} to a concrete struct with typed fields (ErrorDetails, etc.). Code that type-asserted on the empty interface will need updating.

Zero Trust - Gateway List Item Pagination Type Changed

The GatewayListItemService.List() return type changed from SinglePage[[]GatewayItem] (page of slices) to SinglePage[GatewayItem] (page of items). This removes the extra nesting layer when iterating results:

// Before: page.Body was [][]GatewayItem
// After:  page.Body is []GatewayItem

Features

CustomCsrs (client.CustomCsrs)

• NEW SERVICE: Custom Certificate Signing Requests (zone + account scoped)
  • client.CustomCsrs.New() - Create a custom CSR
  • client.CustomCsrs.List() - List custom CSRs
  • client.CustomCsrs.Delete() - Delete a custom CSR
  • client.CustomCsrs.Get() - Get a custom CSR

DLS (client.DLS)

• NEW SERVICE: Data Localization Suite regional services
  • client.DLS.Regions.List() - List available DLS regions
  • client.DLS.Regions.Get() - Get a specific DLS region
  • client.DLS.RegionalServices.PrefixBindings.New() - Create a prefix binding
  • client.DLS.RegionalServices.PrefixBindings.List() - List prefix bindings
  • client.DLS.RegionalServices.PrefixBindings.Delete() - Delete a prefix binding
  • client.DLS.RegionalServices.PrefixBindings.Edit() - Edit a prefix binding
  • client.DLS.RegionalServices.PrefixBindings.Get() - Get a prefix binding

AIAudit (client.AIAudit)

• NEW SERVICE: AI Audit robots route mappings
  • client.AIAudit.Robots - Manage AI audit robot configurations

Email Security (client.EmailSecurity)

• client.EmailSecurity.Settings.URLIgnorePatterns.New() - Create a URL ignore pattern
• client.EmailSecurity.Settings.URLIgnorePatterns.List() - List URL ignore patterns
• client.EmailSecurity.Settings.URLIgnorePatterns.Delete() - Delete a URL ignore pattern
• client.EmailSecurity.Settings.URLIgnorePatterns.Edit() - Edit a URL ignore pattern
• client.EmailSecurity.Settings.URLIgnorePatterns.Get() - Get a URL ignore pattern
• client.EmailSecurity.Settings.SendingDomainRestrictions.New() - Create a sending domain restriction
• client.EmailSecurity.Settings.SendingDomainRestrictions.List() - List sending domain restrictions
• client.EmailSecurity.Settings.SendingDomainRestrictions.Delete() - Delete a sending domain restriction
• client.EmailSecurity.Settings.SendingDomainRestrictions.Edit() - Edit a sending domain restriction
• client.EmailSecurity.Settings.SendingDomainRestrictions.Get() - Get a sending domain restriction

Billing (client.Billing)

• client.Billing.Usage.Get() - New billable usage endpoint at /accounts/{account_id}/billable/usage

Organizations (client.Organizations)

• client.Organizations.Billing.Usage.Get() - New organization-level billable usage endpoint

Workers (client.Workers)

• client.Workers.Observability.Telemetry.LiveTail() - Start a live tail session for real-time telemetry
• client.Workers.Observability.Telemetry.LiveTailHeartbeat() - Send heartbeat to keep live tail session alive
• client.Workers.Observability.SharedQueries.New() - Create a shared observability query
• client.Workers.Observability.SharedQueries.Get() - Get a shared observability query by ID
• New PropagationPolicy field on observability traces configuration across Script, DispatchNamespaceScript, and settings types
• New opentelemetry-metrics enum value on ObservabilityDestination logpush dataset types

Workflows (client.Workflows)

• New rollback enum value on InstanceGetResponseStepsObjectType

Pipelines (client.Pipelines)

• New Name filter parameter on PipelineListParams, StreamListParams, and SinkListParams

Realtime Kit (client.RealtimeKit)

• client.RealtimeKit.Livestreams.GetLivestreamAnalyticsDaywise() - Day-wise livestream analytics
• New meeting recording configuration types added to MeetingGetResponse and MeetingUpdateMeetingByIDParams
• New recording config types on RecordingGetRecordingsResponse
• New PageNo, PerPage, Search, SortOrder query params on AppGetParams
• New SessionGetSessionsResponsePaging type and Paging field on sessions list response

Snippets (client.Snippets)

• client.Snippets.Rules.Get() - Get snippet rules for a zone

Radar (radar)

• New Normalization parameter on BotWebCrawlerTimeseriesGroupsParams
• New ContentType filter parameter on HTTPSummaryV2Params and HTTPTimeseriesParams

Zero Trust (client.ZeroTrust)

• client.ZeroTrust.Organizations.DOH.Update() - Update DoH settings for Access organization
• client.ZeroTrust.Organizations.DOH.Get() - Get DoH settings for Access organization
• client.ZeroTrust.Devices.Policies.Default.Edit() - Edit default device policy
• client.ZeroTrust.Devices.Policies.Default.Get() - Get default device policy
• client.ZeroTrust.Devices.Policies.Default.Excludes.Update() - Update default policy split tunnel excludes
• client.ZeroTrust.Devices.Policies.Default.Excludes.Get() - Get default policy split tunnel excludes
• client.ZeroTrust.Devices.Policies.Default.Includes.Update() - Update default policy split tunnel includes
• client.ZeroTrust.Devices.Policies.Default.Includes.Get() - Get default policy split tunnel includes
• New IdentityProviderAccessCloudflare identity provider type for Cloudflare authentication
• New AccessRuleAccessCloudflareAccountMemberRule access rule type
• New DNSSearchSuffix field on device policy custom create/edit params
• New MaxTTLSecs field on gateway location responses and params
• New ErrorDetails types on MCP...

7.3.0 (2026-05-20)

Full Changelog: v7.2.0...v7.3.0

This release adds several new services and sub-resources across DDoS Protection, AI Security, R2
bucket objects, Workers observability queries, Zero Trust SAML certificates, and more. All changes
are additive -- there are no breaking changes in this release.

Features

DDoS Protection (client.DDoSProtection)

• NEW SERVICE: Advanced TCP Protection management for Magic Transit accounts
  • AdvancedTCPProtection.Allowlist -- manage allowlist entries
    • New(), List(), BulkNew(), BulkDelete()
    • Items.Delete(), Items.Edit(), Items.Get()
  • AdvancedTCPProtection.Prefixes -- manage IP prefix configurations
    • New(), List(), BulkNew(), BulkDelete()
    • Items.Delete(), Items.Edit(), Items.Get()
  • AdvancedTCPProtection.SynProtection.Filters -- SYN flood protection filters
    • New(), List(), BulkDelete()
    • Items.Delete(), Items.Edit(), Items.Get()
  • AdvancedTCPProtection.SynProtection.Rules -- SYN flood protection rules
    • New(), List(), BulkDelete()
    • Items.Delete(), Items.Edit(), Items.Get()
  • AdvancedTCPProtection.TCPFlowProtection.Filters -- TCP flow protection filters
    • New(), List(), BulkDelete()
    • Items.Delete(), Items.Edit(), Items.Get()
  • AdvancedTCPProtection.TCPFlowProtection.Rules -- TCP flow protection rules
    • New(), List(), BulkDelete()
    • Items.Delete(), Items.Edit(), Items.Get()
  • AdvancedTCPProtection.Status -- TCP protection status
    • Edit(), Get()

AI Security (client.AISecurity)

• NEW SERVICE: Zone-level AI security settings management
  • Update() -- update AI security settings for a zone
  • Get() -- get current AI security settings
  • CustomTopics.Update() -- update custom topic definitions
  • CustomTopics.Get() -- get custom topic definitions

R2 Bucket Objects (client.R2.Buckets.Objects)

• NEW SUB-RESOURCE: Manage objects within R2 buckets via the control plane API
  • List() -- list objects in a bucket (cursor-paginated)
  • Delete() -- delete a specific object
  • Get() -- download an object (returns *http.Response)
  • Upload() -- upload an object from an io.Reader

Workers Observability Queries (client.Workers.Observability.Queries)

• NEW SUB-RESOURCE: Saved observability queries for Workers telemetry
  • New() -- create a saved query
  • List() -- list saved queries

Workers Secrets Bulk Update (client.Workers.Scripts.Secrets)

• Added BulkUpdate() method -- bulk update secrets for a Worker script via
  PATCH /accounts/{account_id}/workers/scripts/{script_name}/secrets-bulk

Zero Trust - SAML Certificate Management

• Identity Providers (client.ZeroTrust.IdentityProviders.SAMLCertificate)

  • New() -- create a SAML certificate for an identity provider

• Access SAML Certificates (client.ZeroTrust.Access.SAMLCertificates)

  • List() -- list all SAML certificate sets
  • Get() -- get a specific SAML certificate set
  • GetPem() -- download certificate in PEM format (returns *http.Response)
  • Rotate() -- rotate a SAML certificate set

Zero Trust - Resource Library (client.ZeroTrust.ResourceLibrary)

• NEW SUB-RESOURCE: Browse the Zero Trust resource library
  • Applications.List() -- list available applications
  • Applications.Get() -- get application details
  • Categories.List() -- list application categories
  • Categories.Get() -- get category details

Secrets Store (client.SecretsStore.Stores)

• Added Get() method -- retrieve a specific secrets store by ID

AI Search Namespaces (client.AISearch.Namespaces)

• Added namespace-level convenience methods (previously only available at the instance level):
  • Delete() -- delete a namespace
  • ChatCompletions() -- run chat completions against a namespace
  • Read() -- get namespace details
  • Search() -- search within a namespace

Other Updates

• Updated generated types and methods across many packages including ai_gateway,
  api_gateway, cache, email_security, intel, load_balancers, logpush,
  radar, secrets_store, workers, workers_for_platforms, workflows, and
  zones

What's Changed

• Add asset_name to RulesetRuleActionParameters by @jafowler in #4312

Full Changelog: v0.116.0...v0.117.0

7.2.0 (2026-05-06)

Full Changelog: v7.1.0...v7.2.0

This release adds new sub-resources for AI Gateway billing, Cache Origin Cloud Regions v2, Radar BGP analytics, and Load Balancer monitor group references.

Features

Cache - Origin Cloud Regions v2 (client.Cache.OriginCloudRegions)

• NEW SUB-RESOURCE: Origin Cloud Regions service using the v2 /origin/cloud_regions endpoints
  • Update() -- create or update a cloud region mapping for an origin IP
  • List() -- list all cloud region mappings (paginated)
  • Delete() -- remove a cloud region mapping
  • BulkDelete() -- remove multiple cloud region mappings
  • BulkUpdate() -- create or update multiple cloud region mappings
  • Get() -- get a specific cloud region mapping
  • SupportedRegions() -- list supported cloud regions and vendors

AI Gateway - Billing (client.AIGateway.Billing)

• NEW SUB-RESOURCE: Billing service for AI Gateway accounts
  • CreditBalance() -- get current credit balance
  • UsageHistory() -- get historical usage data
  • InvoiceHistory() -- get past invoices
  • InvoicePreview() -- preview upcoming invoice

AI Gateway - Billing Spending Limit (client.AIGateway.Billing.SpendingLimit)

• NEW SUB-RESOURCE: Manage spending limits for AI Gateway billing
  • New() -- create a spending limit
  • Delete() -- remove a spending limit
  • Get() -- get the current spending limit

AI Gateway - Billing Topup (client.AIGateway.Billing.Topup)

• NEW SUB-RESOURCE: Manage billing top-ups for AI Gateway
  • New() -- create a top-up
  • Status() -- check top-up payment status

AI Gateway - Billing Topup Config (client.AIGateway.Billing.Topup.Config)

• NEW SUB-RESOURCE: Configure automatic top-ups
  • New() -- create a top-up config
  • Delete() -- remove a top-up config
  • Get() -- get the current top-up config

Cache - Smart Tiered Cache (client.Cache.SmartTieredCache)

• Added New() method (POST) to enable smart tiered cache topology

Radar - BGP IP Top (client.Radar.BGP.IPs.Top)

• NEW SUB-RESOURCE: Top ASes by BGP IP announcements
  • Ases() -- get top ASes for BGP IP data

Radar - BGP RPKI ROAs (client.Radar.BGP.RPKI.Roas)

• NEW SUB-RESOURCE: RPKI Route Origin Authorization timeseries
  • Timeseries() -- get ROA timeseries data

Load Balancers - Monitor Group References (client.LoadBalancers.MonitorGroups.References)

• NEW SUB-RESOURCE: Retrieve resources referencing a monitor group
  • Get() -- list references for a monitor group

Bug Fixes

• Codegen: Updated generated types and methods for ai_search, cloudforce_one, resource_sharing, url_scanner, and user packages

7.1.0 (2026-05-04)

Full Changelog: v7.0.0...v7.1.0

Features

Security Center - New Insights Sub-Resources (client.SecurityCenter.Insights)

Three new sub-services added under client.SecurityCenter.Insights:

AuditLogs (client.SecurityCenter.Insights.AuditLogs)

• List(ctx, params) -> *pagination.CursorPagination[InsightAuditLogListResponse]
• ListByInsight(ctx, issueID, params) -> *pagination.CursorPagination[InsightAuditLogListByInsightResponse]

New response types: InsightAuditLogListResponse, InsightAuditLogListByInsightResponse

Classification (client.SecurityCenter.Insights.Classification)

• Update(ctx, issueID, params) -> *InsightClassificationUpdateResponse

New response types: InsightClassificationUpdateResponse

Context (client.SecurityCenter.Insights.Context)

• Get(ctx, issueID, query) -> *InsightContextGetResponse

New response types: InsightContextGetResponse

Zero Trust - Device Deployment Groups (client.ZeroTrust.Devices.DeploymentGroups)

New service client.ZeroTrust.Devices.DeploymentGroups:

• New(ctx, params) -> *DeploymentGroup
• List(ctx, params) -> *pagination.V4PagePaginationArray[DeploymentGroup]
• Delete(ctx, groupID, body) -> *DeviceDeploymentGroupDeleteResponse
• Edit(ctx, groupID, params) -> *DeploymentGroup
• Get(ctx, groupID, query) -> *DeploymentGroup

New response types: DeploymentGroup, DeviceDeploymentGroupDeleteResponse

Queues - Metrics Endpoint (client.Queues)

New method on client.Queues:

• GetMetrics(ctx, queueID, query) -> *QueueGetMetricsResponse

New response types: QueueGetMetricsResponse

Organizations - Audit Logs (client.Organizations.Logs.Audit)

New service client.Organizations.Logs.Audit:

• List(ctx, organizationID, query) -> *pagination.CursorPaginationAfter[LogAuditListResponse]

New response types: LogAuditListResponse

7.0.0 (2026-04-30)

Full Changelog: v6.10.0...v7.0.0

This is a major version release that includes breaking changes to three packages: ai_search, email_security, and workers. These changes reflect upstream API specification updates that improve type correctness and consistency. Non-breaking features and updates are also included across several other packages.

Please ensure you read through the list of changes below before moving to this version - this will help you understand any down or upstream issues it may cause to your environments.

Breaking Changes

See the v7.0.0 Migration Guide for before/after code examples and actions needed for each change.

AI Search - SearchForAgents Metadata Removed

The SearchForAgents nested type has been removed from all instance metadata structs. This field is no longer part of the API specification.

Removed Types:

• InstanceNewResponseMetadataSearchForAgents
• InstanceUpdateResponseMetadataSearchForAgents
• InstanceListResponseMetadataSearchForAgents
• InstanceDeleteResponseMetadataSearchForAgents
• InstanceReadResponseMetadataSearchForAgents
• InstanceNewParamsMetadataSearchForAgents
• InstanceUpdateParamsMetadataSearchForAgents
• NamespaceInstanceNewResponseMetadataSearchForAgents
• NamespaceInstanceUpdateResponseMetadataSearchForAgents
• NamespaceInstanceListResponseMetadataSearchForAgents
• NamespaceInstanceDeleteResponseMetadataSearchForAgents
• NamespaceInstanceReadResponseMetadataSearchForAgents
• NamespaceInstanceNewParamsMetadataSearchForAgents
• NamespaceInstanceUpdateParamsMetadataSearchForAgents

Email Security - Path Parameter Type Changes (int64 to string)

Multiple Email Security settings sub-resources have changed their path parameter types from int64 to string. This affects Delete, Edit, and Get methods across the following services:

• AllowPolicies (policyID int64 -> policyID string)
• BlockSenders (patternID int64 -> patternID string)
• Domains (domainID int64 -> domainID string)
• ImpersonationRegistry (displayNameID int64 -> impersonationRegistryID string)
• TrustedDomains (trustedDomainID int64 -> trustedDomainID string)

Email Security - Investigate Parameter Rename

The Investigate.Get, Investigate.Move.New, and Investigate.Reclassify.New methods now use investigateID instead of postfixID as the path parameter name.

Email Security - Domains BulkDelete Method Removed

The SettingDomainService.BulkDelete method and its associated types have been removed:

• SettingDomainBulkDeleteResponse
• SettingDomainBulkDeleteParams

Email Security - TrustedDomains Return Type Change

SettingTrustedDomainService.New now returns *SettingTrustedDomainNewResponse instead of *SettingTrustedDomainNewResponseUnion.

Email Security - Investigate.Move Return Type Change

InvestigateMoveService.New now returns *pagination.SinglePage[InvestigateMoveNewResponse] instead of *[]InvestigateMoveNewResponse.

Workers - Observability Telemetry Filter Restructuring

The observability telemetry filter parameter types have been restructured to support nested filter groups. New discriminated union types replace the previous flat filter arrays:

• ObservabilityTelemetryKeysParams.Filters now accepts FiltersObjectFilterUnion (was []interface{})
• ObservabilityTelemetryQueryParams.Parameters.Filters now accepts FiltersObjectFilterUnion
• ObservabilityTelemetryValuesParams.Filters now accepts FiltersObjectFilterUnion

New types include FiltersObjectFiltersObject (for group filters with FilterCombination) and FiltersWorkersObservabilityFilterLeaf (for leaf filters with typed Operation, Type, and Value fields).

Features

Organizations (client.Organizations)

• NEW SERVICE: client.Organizations.Logs.Audit -- query organization audit logs
  • List() - Retrieve audit logs with cursor-based pagination

Browser Rendering (client.BrowserRendering)

• client.BrowserRendering.Devtools.Browser.Targets.Close() -- close a specific browser target (tab, page) by ID

Queues (client.Queues)

• client.Queues.GetMetrics() -- retrieve queue metrics for a specific queue

AI Search (client.AISearch)

• Added WaitForCompletion parameter to NamespaceInstanceItemNewOrUpdateParams and NamespaceInstanceItemSyncParams for synchronous indexing confirmation

Bug Fixes

• Magic Transit: ConnectorService.List parameter name corrected from query to params (non-functional, affects generated documentation only)

6.10.0 (2026-04-23)

Full Changelog: v6.9.0...v6.10.0

In this release, you'll see a number of breaking changes. This is primarily due to changes in OpenAPI definitions, which our libraries are based off of, and codegen updates that we rely on to read those OpenAPI definitions and produce our SDK libraries.

Please ensure you read through the list of changes below before moving to this version - this will help you understand any down or upstream issues it may cause to your environments.

Breaking Changes

See the v6.10.0 Migration Guide for before/after code examples and actions needed for each change.

Abuse Reports - Registrar WHOIS Report Field Removals

Several fields have been removed from AbuseReportNewParamsBodyAbuseReportsRegistrarWhoisReportRegWhoRequest:

• RegWhoGoodFaithAffirmation
• RegWhoLawfulProcessingAgreement
• RegWhoLegalBasis
• RegWhoRequestType
• RegWhoRequestedDataElements

AI Search - Instance Params Restructured

The InstanceNewParams and InstanceUpdateParams types have been significantly restructured. Many fields have been moved or removed:

• InstanceNewParams.TokenID, Type, CreatedFromAISearchWizard, WorkerDomain removed
• InstanceUpdateParams — most configuration fields removed (including IndexMethod, IndexingOptions, MaxNumResults, Metadata, Paused, PublicEndpointParams, Reranking, RerankingModel, RetrievalOptions, RewriteModel, RewriteQuery, ScoreThreshold, SourceParams, Summarization, SummarizationModel, SystemPromptAISearch, SystemPromptIndexSummarization, SystemPromptRewriteQuery, TokenID, CreatedFromAISearchWizard, WorkerDomain)
• InstanceSearchParams.Messages field removed along with InstanceSearchParamsMessage and InstanceSearchParamsMessagesRole types

AI Search - InstanceItem Service Removed

The InstanceItemService type has been removed. The items sub-resource at client.AISearch.Instances.Items no longer exists in the non-namespace path. Use client.AISearch.Namespaces.Instances.Items instead.

AI Search - Token Types Removed

The following types have been removed from the ai_search package:

• TokenDeleteResponse
• TokenListParams (and associated TokenListParamsOrderBy, TokenListParamsOrderByDirection)

Email Security - Investigate Move Return Type Change

The Investigate.Move.New() method now returns a raw slice instead of a paginated wrapper:

• New() returns *[]InvestigateMoveNewResponse instead of *pagination.SinglePage[InvestigateMoveNewResponse]
• NewAutoPaging() method removed

Hyperdrive - Config Params Restructured

The ConfigEditParams type lost its MTLS and Name fields. The HyperdriveMTLSParam type lost MTLS and Host fields. The Host field on origin config changed from param.Field[string] to a plain string.

IAM - UserGroupMember Params and Return Types Changed

The UserGroupMemberNewParams struct has been restructured and the New() method now returns a paginated response:

• UserGroupMemberNewParams.Body renamed to UserGroupMemberNewParams.Members
• UserGroupMemberNewParamsBody renamed to UserGroupMemberNewParamsMember
• UserGroupMemberUpdateParams.Body renamed to UserGroupMemberUpdateParams.Members
• UserGroupMemberUpdateParamsBody renamed to UserGroupMemberUpdateParamsMember
• UserGroups.Members.New() returns *pagination.SinglePage[UserGroupMemberNewResponse] instead of *UserGroupMemberNewResponse

IAM - UserGroup List Direction Type Changed

The UserGroupListParams.Direction field changed from param.Field[string] to param.Field[UserGroupListParamsDirection] (typed enum with asc/desc values).

Pipelines - Delete Methods Now Return Typed Responses

Several delete methods across Pipelines now return typed responses instead of bare error:

• Pipelines.DeleteV1() returns (*PipelineDeleteV1Response, error) instead of error
• Pipelines.Sinks.Delete() returns (*SinkDeleteResponse, error) instead of error
• Pipelines.Streams.Delete() returns (*StreamDeleteResponse, error) instead of error

Queues - Message Response Types Removed

The following response envelope types have been removed:

• MessageBulkPushResponseSuccess
• MessagePushResponseSuccess
• MessageAckResponse fields RetryCount and Warnings removed

Secrets Store - Pagination Wrapper Removal and Type Changes

Methods now return direct types instead of SinglePage wrappers, and several internal types have been removed. Associated AutoPaging methods have also been removed:

• Stores.New() returns *StoreNewResponse instead of *pagination.SinglePage[StoreNewResponse]
• Stores.NewAutoPaging() method removed
• Stores.Secrets.BulkDelete() returns *StoreSecretBulkDeleteResponse instead of *pagination.SinglePage[StoreSecretBulkDeleteResponse]
• Stores.Secrets.BulkDeleteAutoPaging() method removed
• Removed types: StoreDeleteResponse, StoreDeleteResponseEnvelopeResultInfo, StoreSecretDeleteResponse, StoreSecretDeleteResponseStatus, StoreSecretBulkDeleteResponse (old shape), StoreSecretBulkDeleteResponseStatus, StoreSecretDeleteResponseEnvelopeResultInfo
• StoreNewParams restructured (old StoreNewParamsBody removed)
• StoreSecretBulkDeleteParams restructured

Stream - AudioTracks Return Type Change

The AudioTracks.Get() method now returns a dedicated response type instead of a paginated list. The GetAutoPaging() method has been removed:

• Get() returns *AudioTrackGetResponse instead of *pagination.SinglePage[Audio]
• GetAutoPaging() method removed

Stream - Clip Type Removal and Return Type Change

The Clip.New() method now returns the shared Video type. The following types have been entirely removed:

• Clip, ClipPlayback, ClipStatus, ClipWatermark

Stream - Copy and Clip Params Field Removals

• ClipNewParams.MaxDurationSeconds, ThumbnailTimestampPct, Watermark removed
• CopyNewParams.ThumbnailTimestampPct, Watermark removed

Stream - Download and Webhook Changes

• DownloadNewResponseStatus type removed
• WebhookUpdateResponse and WebhookGetResponse changed from interface{} type aliases to full struct types

Zero Trust - Access AI Control MCP Portal Union Types Removed

The following union interface types have been removed:

• AccessAIControlMcpPortalListResponseServersUpdatedPromptsUnion
• AccessAIControlMcpPortalListResponseServersUpdatedToolsUnion
• AccessAIControlMcpPortalReadResponseServersUpdatedPromptsUnion
• AccessAIControlMcpPortalReadResponseServersUpdatedToolsUnion

Features

Vulnerability Scanner (client.VulnerabilityScanner)

• NEW SERVICE: Full vulnerability scanning management
  • CredentialSets - CRUD for credential sets (New, Update, List, Delete, Edit, Get)
    • Credentials - Manage credentials within sets (New, Update, List, Delete, Edit, Get)
  • Scans - Create and manage vulnerability scans (New, List, Get)
  • TargetEnvironments - Manage scan target environments (New, Update, List, Delete, Edit, Get)

AI Search - Namespaces (client.AISearch.Namespaces)

• NEW SERVICE: Namespace-scoped AI Search management
  • New(), Update(), List(), Delete(), ChatCompletions(), Read(), Search()
  • Instances - Namespace-scoped instances (New, Update, List, Delete, ChatCompletions, Read, Search, Stats)
    • Jobs - Instance job management (New, Update, List, Get, Logs)
    • Items - Instance item management (List, Delete, Chunks, NewOrUpdate, Download, Get, Logs, Sync, Upload)

Browser Rendering - Devtools (client.BrowserRendering.Devtools)

• NEW SERVICE: DevTools protocol browser control
  • Session - List and get devtools sessions
  • Browser - Browser lifecycle management (New, Delete, Connect, Launch, Protocol, Version)
    • Page - Get page by target ID
    • Targets - Manage browser targets (New, List, Activate, Get)

Registrar (client.Registrar)

• NEW: Domain check and search endpoints
  • Check() - POST /accounts/{account_id}/registrar/domain-check
  • Search() - GET /accounts/{account_id}/registrar/domain-search
• NEW: Registration management (client.Registrar.Registrations)
  • New(), List(), Edit(), Get()
• RegistrationStatus.Get() - Get registration workflow status
• UpdateStatus.Get() - Get update workflow status

Cache - Origin Cloud Regions (client.Cache.OriginCloudRegions)

• NEW SERVICE: Manage origin cloud region configurations
  • New(), List(), Delete(), BulkDelete(), BulkEdit(), Edit(), Get(), SupportedRegions()

Zero Trust - DLP Settings (client.ZeroTrust.DLP.Settings)

• NEW SERVICE: DLP settings management
  • Update(), Delete(), Edit(), Get()

Radar

• AgentReadiness.Summary() - Agent readiness summary by dimension
• AI.MarkdownForAgents.Summary() - Markdown-for-agents summary
• AI.MarkdownForAgents.Timeseries() - Markdown-for-agents timeseries

IAM (client.IAM)

• UserGroups.Members.Get() - Get details of a specific member in a user group
• UserGroups.Members.NewAutoPaging() - Auto-paging variant for adding members
• UserGroups.NewParams.Policies changed from required to optional

Bot Management

• ContentBotsProtection field added to BotFightModeConfiguration and SubscriptionConfiguration (block/disabled)

Deprecations

None in this release.

Bug Fixes

• Testing: CONTRIBUTING.md updated to reference steady instead of Prism for running tests against OpenAPI specs

6.9.0 (2026-04-01)

Full Changelog: v6.8.0...v6.9.0

In this release, you'll see a number of breaking changes. This is primarily due to changes in OpenAPI definitions, which our libraries are based off of, and codegen updates that we rely on to read those OpenAPI definitions and produce our SDK libraries.

Please ensure you read through the list of changes below before moving to this version - this will help you understand any down or upstream issues it may cause to your environments.

Breaking Changes

See the v6.9.0 Migration Guide for before/after code examples and actions needed for each change.

AI Gateway - AccountID, AccountTag, and InternalID Field Removal

The AccountID, AccountTag, and InternalID fields have been removed from all AI Gateway response types:

• AIGatewayNewResponse
• AIGatewayUpdateResponse
• AIGatewayListResponse
• AIGatewayDeleteResponse
• AIGatewayGetResponse
• DynamicRoutingNewResponse
• DynamicRoutingDeleteResponse
• DynamicRoutingNewDeploymentResponse
• DynamicRoutingNewVersionResponse
• DynamicRoutingGetResponse
• DynamicRoutingGetVersionResponse

AI Search - VectorizeName Field Removal

The VectorizeName field has been removed from all AI Search instance response types:

• InstanceNewResponse.VectorizeName
• InstanceUpdateResponse.VectorizeName
• InstanceListResponse.VectorizeName
• InstanceDeleteResponse.VectorizeName
• InstanceReadResponse.VectorizeName

AI Search - KeywordMatchMode Enum Values Changed

The KeywordMatchMode enum values have been renamed:

• KeywordMatchModeExactMatch → KeywordMatchModeAnd
• KeywordMatchModeFuzzyMatch → KeywordMatchModeOr

Affects InstanceNewParams and InstanceUpdateParams.

Billing - New PayGo Usage Endpoint

NEW: Added billing.Usage service with PayGo endpoint:

• client.Billing.Usage.Paygo() - Returns billable usage data for PayGo (self-serve) accounts

Note: The PayGo endpoint parameters (From, To) are now the primary query mechanism. The previously available LastMonthPeriodStart and LastYearPeriodStart parameters were removed in the underlying API specification.

Connectivity - TCP Service Support

The directory services now support TCP service configurations via discriminated union types:

• ServiceConfig is now a discriminated union of HttpServiceConfig and TcpServiceConfig
• New TcpServiceConfig type with tcp_port and app_protocol fields
• HttpServiceConfig and TcpServiceConfig both extend ServiceCommon base type

Custom Hostnames - Hostname Parameter Type Change

The Hostname parameter in CustomHostnameListParams has changed from a simple string to a structured object:

• Before: Hostname param.Field[string]
• After: Hostname param.Field[CustomHostnameListParamsHostname] (object with Contain field)

AI Search - InstanceItem Service Methods Removed

The InstanceItem service methods have been removed. The service structure still exists at client.AISearch.Instances.Items but no longer provides any methods:

• List() - List indexed items in an AI Search instance
• ListAutoPaging() - Auto-paging list method
• Get() - Get a specific indexed item
• All associated response types (InstanceItemListResponse, InstanceItemGetResponse, etc.)

Workers - Filter Type Changes

The observability telemetry filters have been restructured:

• Filter types changed from QueryFilter[] to FilterNode[] (discriminated union)
• Filters now support nested groups via kind: 'group'
• Affects telemetry endpoints: keys, query, and values

Workers - Domain Service Return Type Changes

The workers.Domain service methods now return specific response types instead of the generic Domain type:

• Update() returns *DomainUpdateResponse instead of *Domain
• List() returns pagination.SinglePage[DomainListResponse] instead of pagination.SinglePage[Domain]
• Delete() now returns (*DomainDeleteResponse, error) instead of just error
• Get() returns *DomainGetResponse instead of *Domain

Zero Trust - NetworkSubnet Response Type Consolidation

The NetworkSubnet service methods now use the shared Subnet type instead of endpoint-specific response types:

• NetworkSubnetService.List() returns Subnet instead of NetworkSubnetListResponse
• NetworkSubnetWARPService.New() returns Subnet instead of NetworkSubnetWARPNewResponse
• NetworkSubnetWARPService.Edit() returns Subnet instead of NetworkSubnetWARPEditResponse
• NetworkSubnetWARPService.Get() returns Subnet instead of NetworkSubnetWARPGetResponse
• NetworkSubnetCloudflareSourceService.Update() returns Subnet instead of NetworkSubnetCloudflareSourceUpdateResponse

The removed types (NetworkSubnetListResponse, NetworkSubnetWARPNewResponse, etc.) have been consolidated into the shared Subnet type.

Zero Trust - MfaBypass Field Removal

The MfaBypass field has been removed from MFA configuration types across multiple services:

Affected Param Types:

• AccessApplicationNewParamsBodySelfHostedApplicationMfaConfig.MfaBypass
• AccessApplicationUpdateParamsBodySelfHostedApplicationMfaConfig.MfaBypass
• AccessApplicationPolicyNewParamsMfaConfig.MfaBypass
• AccessApplicationPolicyUpdateParamsMfaConfig.MfaBypass
• AccessApplicationPolicyTestNewParamsPoliciesObjectMfaConfig.MfaBypass
• AccessPolicyNewParamsMfaConfig.MfaBypass
• AccessPolicyUpdateParamsMfaConfig.MfaBypass

Affected Response Types:

• All corresponding MfaConfig response types

Zero Trust - MfaConfigurationAllowed Field Removal

The MfaConfigurationAllowed field has been removed from Organization types:

• OrganizationNewParams.MfaConfigurationAllowed
• OrganizationUpdateParams.MfaConfigurationAllowed
• OrganizationNewResponse.MfaConfigurationAllowed

Features

AI Search - BoostBy Field Addition

The BoostBy field has been added to retrieval options across multiple response types:

• InstanceNewResponseRetrievalOptions.BoostBy
• InstanceUpdateResponseRetrievalOptions.BoostBy
• InstanceListResponseRetrievalOptions.BoostBy
• InstanceDeleteResponseRetrievalOptions.BoostBy
• InstanceReadResponseRetrievalOptions.BoostBy

Browser Rendering (client.browserRendering)

• Crawl: New endpoints for headless browser crawling
  • Create() - Start a crawl job
  • List() - List crawl jobs
  • Get() - Get crawl job details
  • Update() - Update crawl job
  • Delete() - Delete crawl job
  • Screenshot() - Take screenshots during crawl
  • Scrape() - Scrape content during crawl

Brand Protection v2 (client.brandProtection.v2)

• New v2 API endpoints:
  • Logo - Logo management
  • LogoMatch - Logo matching
  • Match - Brand protection matching
  • Query - Query brand protection data

Google Tag Gateway (client.googleTagGateway)

• NEW SERVICE: Manage Google Tag configurations
  • Config.Create(), Update(), List(), Delete(), Get()

Resource Tagging (client.resourceTagging)

• NEW SERVICE: Resource tagging management
  • AccountTag management
  • Key management for resource tagging

Zero Trust Device IP Profiles (client.zeroTrust.devices.ipProfiles)

• IP profile management for device posture
  • Create(), Update(), List(), Delete(), Get()

Abuse Reports

• Mitigation responses now include additional metadata fields

Accounts

• managed_by field with parent_org_id, parent_org_name support

AI Gateway

• zdr field added to all responses and params
• Dataset, evaluation, log, and provider config endpoints updated

AI Search

• Instance management expanded with new fields
• Job management enhancements
• Token management updates

API Gateway

• Configuration and user schema updates
• Expression template fallthrough improvements

D1

• Database query and raw query parameter refinements
• Time travel support: GetBookmark(), Restore()

DNS

• dns_records/usage endpoints added
• Record type improvements

Email Security

• Enhanced investigation endpoints
• New fields: envelope_from, envelope_to, postfix_id_outbound, replyto
• New detection classification: outbound_ndr

Logpush

• New datasets: dex_application_tests, dex_device_state_events, ipsec_logs, warp_config_changes, warp_toggle_changes

Magic Transit

• App and connector enhancements
• CF interconnect improvements
• License key and provisioning support

Organizations

• Organization account management improvements
• Hierarchical organization support

R2

• Super Slurper job enhancements
• Job log improvements

Rulesets

• Buffering fields: request_body_buffering, response_body_buffering

Workers

• Subdomain deletion support
• Script observability settings
• Tags and tail consumers support

Workflows

• Instance retention configuration
• New status option: restart

Zero Trust

• MCP portal and server configuration updates
• Access application type enhancements
• Gateway proxy endpoint improvements
• Tunnel connection updates

Deprecations

None in this release.

Bug Fixes

• AI Search: Fixed test compatibility issues
• Billing: Transport error handling improvements
• Client: Retry logic error passing fixes