openapi: 3.2.0
info:
  description: Welcome to Cloudflare's API documentation site.
  license:
    name: BSD-3-Clause
    url: https://opensource.org/licenses/BSD-3-Clause
  title: Cloudflare Registrar Transfer API
  version: 4.0.0
servers:
- description: Client API
  url: https://api.cloudflare.com/client/v4
security:
- api_email: []
  api_key: []
- api_token: []
- user_service_key: []
tags:
- name: Registrar Transfer
paths:
  /accounts/{account_id}/registrar/registrations/{domain_name}/transfer-in:
    post:
      operationId: registrar-domain-transfer-in-create
      summary: Initiate Transfer
      description: 'Starts a domain transfer-in workflow. This is typically a billable

        operation — successful transfers charge the account''s default payment

        method, except for extensions with zero transfer pricing (e.g. UK

        extensions). All successful domain transfers are non-refundable.


        ### How transfers work

        Domain transfers move a domain from another registrar to Cloudflare.

        Transfers typically take 1-10 days due to ICANN-mandated approval windows.


        ### Prerequisites

        - The domain must already have a zone in the Cloudflare account (added

        through the dashboard or zone API).

        - The zone must have DNSSec disabled.

        - For billable transfers (i.e. extensions with non-zero transfer pricing), the

        account must have a billing profile with a valid default payment method.

        Set this up at `https://dash.cloudflare.com/{account_id}/billing/payment-info`.

        - The domain must be unlocked at the current registrar.

        - An authorization/EPP code from the current registrar is required,

        except for UK extensions — see Auth code below.


        ### Auth code

        An authorization code (also called EPP code, transfer key, or auth-info code)

        is required for most extensions, with the exception of UK extensions. Obtain

        this from your current registrar''s control panel.


        The auth code in the request body must be base64-encoded per RFC 4648 §4 (standard

        alphabet, no line breaks).


        ### Response behavior

        Successful transfer initiation returns `202 Accepted`. Validation or

        initiation failures return the documented `4XX` responses. Poll

        `GET /accounts/{account_id}/registrar/registrations/{domain_name}/transfer-in-status` to track progress.


        ### Premium domains

        Premium domain transfers are not currently supported by this API. Please use

        the dashboard for now.


        ### Billing

        The account''s default payment method is charged upon successful transfer

        completion, unless the extension has zero transfer pricing (e.g. UK

        extensions). The transfer adds time to the domain''s existing expiration

        date (typically 1 year).'
      parameters:
      - name: account_id
        in: path
        description: Cloudflare account ID. Required for all Registrar API operations.
        required: true
        schema:
          $ref: '#/components/schemas/registrar-api_identifier'
      - name: domain_name
        in: path
        description: Domain name to transfer.
        required: true
        schema:
          $ref: '#/components/schemas/registrar-api_domain_name'
      - name: Prefer
        in: header
        description: 'Set to `respond-async` to indicate a preference for asynchronous

          processing (RFC 7240).

          '
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            examples:
              minimal:
                description: 'Minimal request with just domain name and auth code. Contacts are

                  gathered from the account''s configured default address book entry

                  (returns 400 if none is configured). All other fields use their

                  default values.

                  '
                summary: Minimal transfer request
                value:
                  auth_code: bml4b3M+Pj5hcmNoLWxpbnV4
              with_options:
                description: 'Transfer specifying all optional fields.

                  '
                summary: Transfer with explicit options
                value:
                  auth_code: bml4b3M+Pj5hcmNoLWxpbnV4
                  auto_renew: true
                  contacts:
                    registrant:
                      email: ada@example.com
                      phone: '+1.5555555555'
                      postal_info:
                        address:
                          city: Austin
                          country_code: US
                          postal_code: '78701'
                          state: TX
                          street: 123 Main St
                        name: Ada Lovelace
                        organization: Example Inc
                  privacy_mode: redaction
            schema:
              $ref: '#/components/schemas/registrar-api_transfer_in_create_request'
      responses:
        '202':
          description: 'Transfer initiated. The workflow is now processing asynchronously.

            Poll `GET /accounts/{account_id}/registrar/registrations/{domain_name}/transfer-in-status` to track

            progress. Transfers typically take 1–10 days.

            '
          headers:
            Location:
              description: URL of the transfer status resource (same as `links.self`).
              schema:
                type: string
            Preference-Applied:
              description: Set to `respond-async` when the server honored the preference.
              schema:
                type: string
          content:
            application/json:
              examples:
                transfer_initiated:
                  summary: Transfer initiated successfully
                  value:
                    errors: []
                    messages: []
                    result:
                      completed: false
                      context:
                        domain_name: example.com
                      created_at: '2025-10-27T10:00:00Z'
                      links:
                        resource: /accounts/abc/registrar/registrations/example.com
                        self: /accounts/abc/registrar/registrations/example.com/transfer-in-status
                      state: pending
                      updated_at: '2025-10-27T10:00:01Z'
                    success: true
              schema:
                $ref: '#/components/schemas/registrar-api_workflow-status-response-single'
        4XX:
          description: Transfer initiation failure.
          content:
            application/json:
              examples:
                auth_code_missing:
                  description: 'An authorization/EPP code is required. Obtain this from your

                    current registrar''s control panel.

                    '
                  summary: Auth code is required
                  value:
                    errors:
                    - code: 10000
                      message: 'object at root is missing required properties: auth_code'
                      source:
                        pointer: /auth_code
                    messages: []
                    result: null
                    success: false
                auth_code_non_base64:
                  description: 'The auth code must be base64 encoded.

                    '
                  summary: Auth code contains non-alphabet characters or is incorrectly padded
                  value:
                    errors:
                    - code: 10000
                      message: Auth code must be a base64 encoded string
                      source:
                        pointer: /auth_code
                    messages: []
                    result: null
                    success: false
                domain_not_found:
                  description: 'The domain could not be found. Ensure the domain has a zone

                    in the Cloudflare account and the domain name is correct.

                    '
                  summary: Domain not found
                  value:
                    errors:
                    - code: 10000
                      message: Domain not found
                      source:
                        pointer: /domain_name
                    messages: []
                    result: null
                    success: false
                extension_not_supported:
                  summary: Extension not supported
                  value:
                    errors:
                    - code: 10000
                      message: TLD Not supported by the API
                      source:
                        pointer: /domain_name
                    messages: []
                    result: null
                    success: false
                max_term_limit_hit:
                  description: 'Domain is already near the maximum term defined by the registry

                    and transferring it would hit said limit.

                    '
                  summary: Transfer would make domain registration exceed max term
                  value:
                    errors:
                    - code: 10000
                      message: Domain registration term would exceed maximum
                      source:
                        pointer: /domain_name
                    messages: []
                    result: null
                    success: false
                no_registrant_contact:
                  description: 'Account does not have a default contact set and the

                    request does not include a registrant contact.

                    '
                  summary: No registrant contact
                  value:
                    errors:
                    - code: 10000
                      message: No registrant contact provided and no default address book entry found for this account.
                    messages: []
                    result: null
                    success: false
                transfer_already_in_progress:
                  description: 'A transfer workflow already exists for this domain.

                    '
                  summary: Transfer already in progress
                  value:
                    errors:
                    - code: 10000
                      message: A workflow already exists for this resource. Use GET status to check its progress.
                    messages: []
                    result: null
                    success: false
              schema:
                $ref: '#/components/schemas/registrar-api_api-response-common-failure'
      security:
      - api_token: []
      - api_email: []
        api_key: []
      tags:
      - Registrar Transfer
      x-fern-availability: generally-available
      x-fern-sdk-group-name: registrar.registrations
      x-fern-sdk-method-name: transfer-in
  /accounts/{account_id}/registrar/registrations/{domain_name}/transfer-in-status:
    get:
      operationId: registrar-domain-transfer-get-status
      summary: Get Transfer Status
      description: 'Returns the current status of a domain transfer workflow.


        Use this endpoint to poll transfer progress after initiating a transfer

        with `POST /accounts/{account_id}/registrar/registrations/{domain_name}/transfer-in`.

        The URL is provided in the `links.self` field of the transfer response.


        ### Transfer timelines

        Transfers typically take 1–10 days due to ICANN-mandated approval windows.


        ### Workflow states


        **Terminal states:** `succeeded` and `failed` are terminal and always

        have `completed: true`.


        **Non-terminal states:**

        - `in_progress`: Transfer has been submitted to the registry and is being

        processed. Continue polling.

        - `blocked`: The workflow is waiting on the losing registrar or registry

        to release the domain. This is the **most common state** for transfers

        and is entirely normal — it means the ICANN transfer approval window is

        in effect. The losing registrar has up to 5 days to approve or reject.

        Continue polling with longer intervals (e.g., every 30–60 minutes).

        - `action_required`: The user needs to take action (e.g., the FOA email

        needs to be accepted). See `context` for details on what is needed.

        - `pending`: Transfer workflow created but not yet started processing.


        ### Polling guidance

        Adjust your polling interval based on the current workflow state:

        - `pending` or `in_progress`: Poll every 30 seconds.

        - `blocked`: The transfer is waiting on a third party (e.g., losing

        registrar approval). Poll every 30–60 minutes.

        - `action_required`: Stop polling. The workflow will not advance until

        the user takes action. Check `context` for details on what is needed.

        - `succeeded` or `failed`: Terminal — stop polling.'
      parameters:
      - name: account_id
        in: path
        description: Cloudflare account ID. Required for all Registrar API operations.
        required: true
        schema:
          $ref: '#/components/schemas/registrar-api_identifier'
      - name: domain_name
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/registrar-api_domain_name'
      responses:
        '200':
          description: Transfer workflow status.
          content:
            application/json:
              examples:
                action_required:
                  description: 'The transfer workflow is paused because the user needs to

                    take action. Check `context` for details.

                    '
                  summary: User action required
                  value:
                    errors: []
                    messages: []
                    result:
                      completed: false
                      context:
                        domain_name: example.com
                        foa_required: true
                        transfer_status: awaiting_foa
                      created_at: '2025-10-27T10:00:00Z'
                      links:
                        resource: /accounts/abc/registrar/registrations/example.com
                        self: /accounts/abc/registrar/registrations/example.com/transfer-in-status
                      state: action_required
                      updated_at: '2025-10-27T12:00:00Z'
                    success: true
                blocked:
                  description: 'The transfer is waiting on the losing registrar or registry

                    to release the domain. This is the most common state during

                    a transfer and is entirely normal. The ICANN transfer approval

                    window gives the losing registrar up to 5 days to approve or

                    reject.

                    '
                  summary: Waiting on losing registrar
                  value:
                    errors: []
                    messages: []
                    result:
                      completed: false
                      context:
                        domain_name: example.com
                        transfer_status: awaiting_approval
                      created_at: '2025-10-27T10:00:00Z'
                      links:
                        resource: /accounts/abc/registrar/registrations/example.com
                        self: /accounts/abc/registrar/registrations/example.com/transfer-in-status
                      state: blocked
                      updated_at: '2025-10-28T14:30:00Z'
                    success: true
                failed:
                  description: 'Terminal state. The transfer could not be completed. Common

                    reasons include the losing registrar rejecting the transfer

                    or an invalid auth code.

                    '
                  summary: Transfer failed
                  value:
                    errors: []
                    messages: []
                    result:
                      completed: true
                      context:
                        domain_name: example.com
                      created_at: '2025-10-27T10:00:00Z'
                      error:
                        code: transfer_rejected
                        message: Transfer rejected
                      links:
                        resource: /accounts/abc/registrar/registrations/example.com
                        self: /accounts/abc/registrar/registrations/example.com/transfer-in-status
                      state: failed
                      updated_at: '2025-10-30T12:00:00Z'
                    success: true
                in_progress:
                  description: 'The transfer has been submitted to the registry. This is the

                    initial state after the transfer request is processed.

                    '
                  summary: Transfer submitted, awaiting registry approval
                  value:
                    errors: []
                    messages: []
                    result:
                      completed: false
                      context:
                        domain_name: example.com
                      created_at: '2025-10-27T10:00:00Z'
                      links:
                        resource: /accounts/abc/registrar/registrations/example.com
                        self: /accounts/abc/registrar/registrations/example.com/transfer-in-status
                      state: in_progress
                      updated_at: '2025-10-27T10:05:00Z'
                    success: true
                succeeded:
                  description: 'Terminal state. The domain has been transferred to Cloudflare.

                    Fetch the full registration resource via

                    `GET /accounts/{account_id}/registrar/registrations/{domain_name}`.

                    '
                  summary: Transfer completed successfully
                  value:
                    errors: []
                    messages: []
                    result:
                      completed: true
                      context:
                        domain_name: example.com
                      created_at: '2025-10-27T10:00:00Z'
                      links:
                        resource: /accounts/abc/registrar/registrations/example.com
                        self: /accounts/abc/registrar/registrations/example.com/transfer-in-status
                      state: succeeded
                      updated_at: '2025-10-30T08:15:00Z'
                    success: true
              schema:
                $ref: '#/components/schemas/registrar-api_workflow-status-response-single'
        4XX:
          description: Get transfer status failure.
          content:
            application/json:
              examples:
                workflow_not_found:
                  summary: No transfer workflow found
                  value:
                    errors:
                    - code: 10000
                      message: No workflow found for example.com
                    messages: []
                    result: null
                    success: false
              schema:
                $ref: '#/components/schemas/registrar-api_api-response-common-failure'
      security:
      - api_token: []
      - api_email: []
        api_key: []
      tags:
      - Registrar Transfer
      x-fern-availability: generally-available
      x-fern-sdk-group-name: registrar.registrations
      x-fern-sdk-method-name: get-transfer-status
components:
  schemas:
    registrar-api_transfer_in_create_request:
      type: object
      properties:
        auth_code:
          description: 'The EPP/authorization code from your current registrar, base64-encoded

            per RFC 4648 §4. Obtain this from your current registrar''s control panel.

            Required for all extensions, except for UK.

            '
          type: string
          format: byte
          example: bml4b3M+Pj5hcmNoLWxpbnV4
        auto_renew:
          description: 'Enable or disable automatic renewal after transfer. Defaults to `false` if omitted.

            '
          type: boolean
          example: false
          default: false
        contact_extensions:
          description: 'Registry-specific contact extension values for the registrant.

            `GET /accounts/{account_id}/registrar/extensions/{extension}` documents the

            required keys and allowed values for each extension in the

            `transfer_schema.properties.contact_extensions` object.


            Examples include `.us` nexus fields, `.uk` registrant type fields,

            and `.ca` legal type fields. Include this object only when the extension''s

            transfer schema defines `contact_extensions`.

            '
          type: object
          example:
            application_purpose: P3
            nexus_category: C11
          additionalProperties: true
        contacts:
          type: object
          allOf:
          - $ref: '#/components/schemas/registrar-api_registration_contacts'
        privacy_mode:
          description: 'WHOIS privacy mode to apply after transfer completes. Defaults to

            the extension''s default privacy mode (typically `redaction`).

            '
          type: string
          example: redaction
          enum:
          - 'off'
          - redaction
    registrar-api_registration_contact:
      description: 'Contact data for the domain registration. This information

        is submitted to the domain registry and, depending on extension and

        privacy settings, may appear in public WHOIS records.

        '
      type: object
      properties:
        email:
          description: 'Email address for the registrant. Used for domain-related

            communications from the registry, including ownership verification

            and renewal notices.

            '
          type: string
          format: email
          example: ada@example.com
        fax:
          description: 'Fax number in E.164 format (e.g., `+1.5555555555`). Optional.

            Most registrations do not require a fax number.

            '
          type: string
          example: '+1.5555555555'
        phone:
          description: 'Phone number in E.164 format: `+{country_code}.{number}` without spaces or dashes. Examples: `+1.5555555555` (US), `+44.2071234567` (UK), `+81.312345678` (Japan).'
          type: string
          example: '+1.5555555555'
        postal_info:
          $ref: '#/components/schemas/registrar-api_registration_contact_postal_info'
      required:
      - phone
      - email
      - postal_info
    registrar-api_api-response-common-failure:
      type: object
      properties:
        errors:
          example:
          - code: 7003
            message: No route for the URI
          allOf:
          - $ref: '#/components/schemas/registrar-api_messages'
          minItems: 1
        messages:
          example: []
          allOf:
          - $ref: '#/components/schemas/registrar-api_messages'
        result:
          type:
          - object
          - 'null'
          enum:
          - null
        success:
          description: Whether the API call was successful.
          type: boolean
          example: false
          enum:
          - false
      required:
      - success
      - errors
      - messages
      - result
    registrar-api_messages:
      type: array
      items:
        properties:
          code:
            type: integer
            minimum: 1000
          message:
            type: string
          source:
            description: Location of the invalid value that caused the error.
            type: object
            properties:
              pointer:
                description: JSON Pointer to the invalid or missing request value.
                type: string
            required:
            - pointer
        required:
        - code
        - message
        type: object
        uniqueItems: true
      example: []
    registrar-api_identifier:
      description: Identifier.
      type: string
      example: 023e105f4ecef8ad9ca31a8372d0c353
      maxLength: 32
      readOnly: true
    registrar-api_domain_name:
      description: 'Provides a fully qualified domain name (FQDN), including the extension

        (e.g., `example.com`, `mybrand.app`). The domain name uniquely identifies

        a registration. Cloudflare permits only one registration per domain, making

        the domain name a natural idempotency key for registration requests.

        '
      type: string
      example: example.com
      x-auditable: true
    registrar-api_workflow-status-response-single:
      allOf:
      - $ref: '#/components/schemas/registrar-api_api-response-common'
      - properties:
          result:
            $ref: '#/components/schemas/registrar-api_workflow_status'
        type: object
    registrar-api_registration_contacts:
      description: 'Provides contact data for the registration request.


        The per-extension schema from

        `GET /accounts/{account_id}/registrar/extensions/{extension}` defines the

        accepted contact roles. Every currently supported extension requires only

        `contacts.registrant` from API callers. Callers may provide additional roles

        such as `technical`, `administrator`, and `billing` when the extension

        schema includes them. When a registry requires an omitted role, Cloudflare

        may derive that contact from `contacts.registrant`.


        When the request omits either the entire `contacts` object or

        `contacts.registrant`, the system uses the account''s default address book

        entry as the registrant contact. The account owner must configure this

        default at `https://dash.cloudflare.com/{account_id}/domains/registrations`,

        where they can create or update the address book entry and accept the

        required agreement. Dashboard settings currently provide the only way to

        manage address book entries.


        Without either a default address book entry or a registrant contact, the

        registration request fails validation.

        '
      type: object
      properties:
        administrator:
          description: 'Optional administrator contact. Accepted only when the extension

            schema includes this role. When the registry requires an omitted

            contact, Cloudflare may derive it from `contacts.registrant`.

            '
          allOf:
          - $ref: '#/components/schemas/registrar-api_registration_contact'
        billing:
          description: 'Optional billing contact. Accepted only when the extension schema

            includes this role. When the registry requires an omitted contact,

            Cloudflare may derive it from `contacts.registrant`.

            '
          allOf:
          - $ref: '#/components/schemas/registrar-api_registration_contact'
        registrant:
          description: 'Optional registrant contact. If omitted, the account''s default

            address book entry is used instead.

            '
          allOf:
          - $ref: '#/components/schemas/registrar-api_registration_contact'
        technical:
          description: 'Optional technical contact. Accepted only when the extension schema

            includes this role. When the registry requires an omitted contact,

            Cloudflare may derive it from `contacts.registrant`.

            '
          allOf:
          - $ref: '#/components/schemas/registrar-api_registration_contact'
    registrar-api_workflow_error:
      description: Provides error details when a workflow reaches the `failed` state. The workflow type (registration, update, etc.) and underlying registry response determine the specific codes and messages. Workflow error codes differ from immediate HTTP error `errors[].code` values in non-2xx responses. Surface `error.message` to the user for context.
      type: object
      properties:
        code:
          description: Machine-readable error code identifying the failure reason.
          type: string
          example: registry_rejected
        message:
          description: Human-readable explanation of the failure. May include registry-specific details.
          type: string
          example: Registry rejected the request.
      required:
      - code
      - message
    registrar-api_workflow_status:
      description: Status of an async registration workflow.
      type: object
      properties:
        completed:
          description: Indicates whether the workflow reached a terminal state. A `succeeded` or `failed` state returns `true`; `pending`, `in_progress`, `action_required`, and `blocked` return `false`.
          type: boolean
          example: false
        context:
          description: 'Provides workflow-specific data.


            For domain-centric workflows, `context.domain_name` identifies the

            workflow subject.

            '
          type: object
          additionalProperties: true
        created_at:
          type: string
          format: date-time
        error:
          type:
          - object
          - 'null'
          allOf:
          - $ref: '#/components/schemas/registrar-api_workflow_error'
        links:
          $ref: '#/components/schemas/registrar-api_workflow_links'
        state:
          description: "Describes the workflow lifecycle state.\n- `pending`: The workflow awaits processing.\n- `in_progress`: Processing started. Continue polling `links.self`.\n  An internal deadline limits the duration of this state.\n- `action_required`: The workflow pauses for user action. See\n  `context.action` for details. Stop automated polling until the user\n  completes the required action.\n- `blocked`: A third party, such as the domain extension's registry or\n  a losing registrar, prevents progress. Continue polling because the\n  block may resolve when the third party responds.\n- `succeeded`: Terminal state. The operation completed successfully.\n  `completed` equals `true`. For registrations,\n  `context.registration` contains the resulting registration resource.\n- `failed`: Terminal state. The operation failed. `completed` equals\n  `true`. See `error.code` and `error.message` for the reason. Require\n  user review before retrying.\n"
          type: string
          example: in_progress
          enum:
          - pending
          - in_progress
          - action_required
          - blocked
          - succeeded
          - failed
        updated_at:
          type: string
          format: date-time
      required:
      - state
      - completed
      - created_at
      - updated_at
      - links
    registrar-api_registration_contact_address:
      description: Physical mailing address for the registrant contact.
      type: object
      properties:
        city:
          description: City or locality name.
          type: string
          example: Austin
        country_code:
          description: Two-letter country code per ISO 3166-1 alpha-2 (e.g., `US`, `GB`, `CA`, `DE`).
          type: string
          example: US
        postal_code:
          description: Postal or ZIP code.
          type: string
          example: '78701'
        state:
          description: State, province, or region. Use the standard abbreviation where applicable (e.g., `TX` for Texas, `ON` for Ontario).
          type: string
          example: TX
        street:
          description: Street address including building/suite number.
          type: string
          example: 123 Main St
      required:
      - street
      - city
      - state
      - postal_code
      - country_code
    registrar-api_workflow_links:
      type: object
      properties:
        resource:
          description: URL to the domain resource.
          type: string
          example: /accounts/{account_id}/registrar/registrations/example.com
        self:
          description: URL to this status resource.
          type: string
          example: /accounts/{account_id}/registrar/registrations/example.com/registration-status
      required:
      - self
    registrar-api_api-response-common:
      type: object
      properties:
        errors:
          $ref: '#/components/schemas/registrar-api_messages'
        messages:
          $ref: '#/components/schemas/registrar-api_messages'
        result:
          anyOf:
          - type: object
          - items:
              type: object
            type: array
          - type: string
        success:
          description: Whether the API call was successful.
          type: boolean
          example: true
          enum:
          - true
      required:
      - success
      - errors
      - messages
      - result
    registrar-api_registration_contact_postal_info:
      description: 'Postal/mailing information for the contact. The `name` field is the

        complete contact name in one string. Some registries require a complete

        personal name, including a family or last name where applicable, but this

        API does not accept separate first-name and last-name fields for

        registration contacts.

        '
      type: object
      properties:
        address:
          $ref: '#/components/schemas/registrar-api_registration_contact_address'
        name:
          description: Full legal name of the contact, including all required name components for an individual or authorized representative. Some registries require a complete personal name that includes a family or last name where applicable. Provide the complete name in this single field, for example `Ada Lovelace`; do not send separate first-name or last-name fields.
          type: string
          example: Ada Lovelace
        organization:
          description: Organization or company name. Optional for individual registrants.
          type: string
          example: Example Inc
      required:
      - name
      - address
  securitySchemes:
    api_email:
      in: header
      name: X-Auth-Email
      type: apiKey
    api_key:
      in: header
      name: X-Auth-Key
      type: apiKey
    api_token:
      scheme: bearer
      type: http
    user_service_key:
      in: header
      name: X-Auth-User-Service-Key
      type: apiKey
externalDocs:
  description: Cloudflare Radar Documentation
  url: https://developers.cloudflare.com/radar/
x-forge-commands:
  abuse-reports:
    description: Submit and track abuse reports for phishing, malware, and other policy violations on Cloudflare-proxied sites
    groups:
      appeals:
        description: Appeal eligibility for abuse reports
      emails:
        description: Emails sent for abuse reports
      mitigations:
        description: Mitigation actions taken in response to abuse reports
  accounts:
    description: Account settings, members, roles, subscriptions, and API tokens for your Cloudflare account
    groups:
      applications:
        description: Applications operations
      categories:
        description: Categories operations
      organizations:
        description: Move accounts between organizations
      profile:
        description: View and manage the profile for a Cloudflare account
      roles:
        description: View the roles available for assigning to account members, each defining a set of permissions
      subscriptions:
        description: View and manage plan subscriptions attached to this account
      tokens:
        description: Create and manage scoped API tokens for programmatic access to the Cloudflare API
  ai-gateway:
    description: Proxy, cache, rate-limit, and observe requests to AI providers — OpenAI, Anthropic, Workers AI, and more
    groups:
      custom-domains:
        description: Manage custom hostnames that route requests through an AI Gateway
      custom-providers:
        description: Manage account-level custom AI providers and their endpoint settings
      datasets:
        description: 'Deprecated: manage filtered collections of gateway logs used by evaluations'
      dynamic-routing:
        description: Route requests across multiple AI providers with fallback, load-balancing, and versioned deployments
      dynamic-routing.deployments:
        description: Deploy dynamic route versions and view deployment history
      dynamic-routing.versions:
        description: Create and inspect saved versions of a dynamic route
      evaluation-types:
        description: 'Deprecated: list the evaluator types that evaluations can use'
      evaluations:
        description: 'Deprecated: score the logs in a dataset with selected evaluator types'
      gateways:
        description: Create and configure AI Gateways for an account
      gateways.providers:
        description: Store and rotate upstream AI provider keys for a gateway
      logs:
        description: Inspect, annotate, and delete gateway request logs stored by Legacy Logs
  ai-search:
    description: 'Managed search-as-a-service: crawl, index, and query content with AI-powered relevance and chat completions'
    groups:
      items:
        description: Content indexed by AI Search instances
      jobs:
        description: Indexing job lifecycle for AI Search instances
      namespace:
        description: Logical groupings for organizing AI Search instances
      tokens:
        description: Credentials used by AI Search instances
  ai-security:
    description: Detect prompt injection, PII, and unsafe topics in traffic to your AI applications
    groups:
      custom-topics:
        description: Organization-specific topic categories used by AI Security for Apps content detection
  analytics:
    description: Zone-level traffic analytics — dashboard summaries, per-colo breakdowns, and Argo latency metrics
    groups:
      colo:
        description: Per-data-center (colo) traffic analytics breakdown for the zone
      dashboard:
        description: Aggregated zone dashboard analytics — requests, bandwidth, threats, and page views
      latency:
        description: Argo Smart Routing latency analytics showing time-to-first-byte improvements
  argo:
    description: Network optimization features that speed up and improve reliability of traffic to your origins
    groups:
      smart-routing:
        description: Route traffic through the fastest network paths to your origin using real-time latency data
      tiered-caching:
        description: Reduce origin load by having upper-tier data centers serve cache misses before reaching your origin
  basin-catalog:
    description: Iceberg-compatible data catalog for R2 — organize objects into tables and namespaces for SQL query engines
    groups:
      credentials:
        description: Catalog access credentials for external query engines (Spark, Trino, etc.)
      maintenance-configs:
        description: Table maintenance settings — compaction schedules and snapshot expiration policies
      namespaces:
        description: Logical namespaces that group related tables within the data catalog
      namespaces.tables:
        description: Tables within catalog namespaces
      namespaces.tables.maintenance-configs:
        description: Table-level maintenance configurations and operations
      namespaces.tables.maintenance-runs:
        description: History of maintenance runs performed on tables
  billing:
    description: Account billing profiles and usage data for Cloudflare subscriptions and add-on services
    groups:
      profiles:
        description: Billing profile with payment method, address, and invoice preferences
      usage:
        description: Metered usage data for billed services — requests, bandwidth, and feature consumption
  botnet-feed:
    description: Botnet threat intelligence feeds — IP and ASN-level data on known command-and-control infrastructure
    groups:
      asn:
        description: ASN-level botnet activity data showing networks with known C2 infrastructure
      configs:
        description: Botnet feed subscription configuration and notification preferences
  builds:
    description: Build and deploy Workers from connected repositories, then inspect build status and logs.
    groups:
      deploy-hooks:
        description: Manage branch-specific HTTP hooks that start builds.
      limits:
        description: View build-minute availability and refresh information.
      logs:
        description: Retrieve build logs.
      repos:
        description: Manage source repository connections for Workers Builds.
      tokens:
        description: Manage credentials used by Workers Builds to deploy Workers.
      triggers:
        description: Configure how repository changes build and deploy Workers.
      versions:
        description: Find builds associated with Worker versions.
      workers:
        description: Manage repository-backed build configuration for Workers.
  cache:
    description: Purge cached content and configure Cache Reserve, tiered caching, and variant serving
    groups:
      origin-cloud-regions:
        description: Manage Origin Cloud Regions routing and failover configurations
      settings:
        description: Configure Cache Reserve, tiered caching, and variant serving
      settings.regional-tiered-cache:
        description: Restrict tiered cache topology to data centers within a specific geographic region
      settings.reserve:
        description: Persistent storage tier that keeps cached assets even after eviction from edge caches
      settings.smart-tiered-cache:
        description: Automatically determine the best upper-tier data centers for tiered cache topology
      settings.variants:
        description: Serve different cached versions of an image based on the Accept header (WebP, AVIF, etc.)
  client-side-security:
    description: Client-Side Security — monitor JavaScript, connections, and cookies on your pages for supply-chain attacks
    groups:
      connections:
        description: Third-party connections made by scripts on your pages — track data exfiltration risks
      cookies:
        description: Cookies set by your pages with classification and same-site attribute tracking
      policies:
        description: Content Security Policies that control which scripts and connections are allowed on your pages
      scripts:
        description: JavaScript files detected on your pages with change tracking and malicious code detection
      settings:
        description: Fine tune Client-Side Security behaviors
  cloud-connector:
    description: Route traffic from Cloudflare directly to cloud provider services (AWS, Azure, GCP) without origin servers
    groups:
      rules:
        description: Routing rules that map request patterns to cloud provider endpoints
  cloudforce-one:
    description: Detection rule management APIs
    groups:
      binary-storage:
        description: Upload and retrieve malware samples and suspicious binaries for analysis
      requests:
        description: Additional request operations — priority listing and asset creation
      rules:
        description: Rule management operations
        groups:
          approvals:
            description: Approval workflow operations
          email:
            description: Email rule operations
          exemptions:
            description: Exemption rule operations
          managed:
            description: Managed rule operations
          stats:
            description: Rule statistics operations
          tree:
            description: Rule navigation tree operations
      scans:
        description: Scan URLs, IPs, and domains for threat intelligence indicators
  containers:
    description: Deploy and manage Containers applications on Cloudflare's global network
    groups:
      applications:
        description: Manage Containers applications
      applications.instances:
        description: Inspect Containers instances belonging to applications
      applications.rollouts:
        description: Manage rollouts for scheduler-backed applications
      applications.versions:
        description: Inspect versions of scheduler-backed applications
      registries:
        description: Manage Containers image registries
      registries.credentials:
        description: Generate image registry credentials
  content-scan:
    description: Malicious uploads detection, scan uploaded content in HTTP requests for malware and malicious payloads
    groups:
      expressions:
        description: Custom expressions that tell the scanner how to reach content objects it cannot parse on its own
  custom-pages:
    description: Manage custom error and challenge pages and their assets for accounts and zones
    groups:
      account-custom-pages:
        description: Manage account-level custom pages
      account-custom-pages.preview-tokens:
        description: Preview tokens for account-level custom pages
      assets:
        description: Manage account- and zone-level custom assets
      zone-custom-pages:
        description: Manage zone-level custom pages
      zone-custom-pages.preview-tokens:
        description: Preview tokens for zone-level custom pages
  d1:
    description: D1 is Cloudflare's managed, serverless database with SQLite's SQL semantics, built-in disaster recovery, and Worker and HTTP API access.
    groups:
      time-travel:
        description: use specific point-in-time backups of your D1 database
        x-forge-epilogue: For more information about Time Travel, see https://developers.cloudflare.com/d1/reference/time-travel
  diagnostics:
    description: Network diagnostic tools — traceroutes from Cloudflare's edge and endpoint health checks
    groups:
      endpoint-healthchecks:
        description: Monitor external endpoint availability with periodic HTTP/HTTPS health checks
      traceroutes:
        description: Run traceroutes from Cloudflare data centers to diagnose network path issues
  email-routing:
    description: Route incoming email to verified destination addresses or Workers with routing rules, catch-all behavior, and managed DNS records
    groups:
      addresses:
        description: Verified destination email addresses that can receive forwarded mail
      dns:
        description: Inspect or unlock the DNS records required by Email Routing
      rules:
        description: Match incoming email addresses and forward messages to destination mailboxes or Workers
      settings:
        description: Inspect and update Email Routing settings
  email-security:
    description: Cloud email security — investigate threats, manage allow/block policies, and detect phishing
    groups:
      analytics:
        description: Analytics and reporting — monthly report and per-day breakdowns of threat activity
      bulk-actions:
        description: Asynchronous jobs that move or release every message matching a search — create, monitor, and manage bulk jobs
      investigate:
        description: Search and investigate email messages — view detections, traces, raw content, and take remediation actions
      phishguard:
        description: PhishGuard user-reported phishing reports — view detected threats for a date range
      settings:
        description: Email security configuration — block senders, allow policies, content policies, domains, trusted domains, impersonation registry, and URL handling
      submissions:
        description: Reclassify submissions — track user and team reports of false positives and missed detections
  email-sending:
    description: Send transactional email and manage sending subdomains and their DNS configuration
    groups:
      limits:
        description: Inspect account-level sending quotas and current usage
      subdomains:
        description: Configure sending subdomains and keep their DNS records healthy
      suppressions:
        description: Prevent delivery to suppressed addresses and manage the account suppression list
  filters:
    description: Filter expressions used by legacy firewall rules to match requests — prefer Rulesets for new configurations
  firewall:
    description: Legacy firewall rules, zone lockdowns, access rules, user-agent blocking, and WAF packages
    groups:
      access-rules:
        description: IP-based access rules that allow, block, challenge, or whitelist traffic globally or per-zone
      lockdowns:
        description: Zone lockdown rules that restrict access to URLs by IP address or range
      rules:
        description: Legacy firewall rules with filter expressions — prefer Rulesets for new configurations
      ua-rules:
        description: Block or challenge requests based on the User-Agent header string
      waf:
        description: Legacy WAF managed rule packages, rule groups, individual rules, and override configurations
      zone-access-rules:
        description: Zone-scoped IP access rules for blocking or allowing traffic
  google-tag-gateway:
    description: Google Tag Gateway operations
    groups:
      config:
        description: Google Tag Gateway config operations
  healthchecks:
    description: Standalone health checks that monitor origin server availability from Cloudflare's edge
    groups:
      previews:
        description: Test a health check configuration before deploying it to production
  hyperdrive:
    description: Accelerate access to existing databases by caching queries and pooling connections at the edge
  iam:
    description: Identity and access management — permission groups, resource groups, user groups, and SSO connectors
    groups:
      permission-groups:
        description: View the permission groups that can be assigned to API tokens and policies
      resource-groups:
        description: Define scopes that limit which account resources a policy or token can access
      sso:
        description: Configure single sign-on connectors to authenticate account members through an external identity provider
      user-groups:
        description: Organize account members into groups for easier permission assignment
  images:
    description: Store, resize, and deliver optimized images globally — variants, signing keys, and direct uploads
    groups:
      flows:
        description: Zone-level transformation flows that control how images are resized and optimized on delivery
      import:
        description: Import images from S3
      keys:
        description: Manage signing keys for generating private image URLs
      variants:
        description: Manage named resize variants for transforming images on delivery
  intel:
    description: Threat intelligence lookups — IP reputation, domain info, ASN details, WHOIS, and indicator feeds
    groups:
      asn:
        description: ASN intelligence — ownership, geolocation, and subnet details for autonomous systems
      attack-surface-report:
        description: Attack surface intelligence — exposed assets, vulnerabilities, and infrastructure mapping
      dns:
        description: Passive DNS data showing historical DNS resolution records for domains
      domain-history:
        description: Historical domain registration and categorization changes over time
      domains:
        description: Domain intelligence — risk scores, categories, and associated infrastructure
      indicator-feeds:
        description: Threat indicator feeds — subscribe to and manage curated lists of malicious IPs, domains, and URLs
      ip-lists:
        description: Curated IP lists used for threat detection and policy enforcement
      ips:
        description: IP address intelligence — geolocation, risk assessment, and hosting provider details
      miscategorizations:
        description: Report and track domain miscategorization corrections
      whois:
        description: WHOIS registration data for domains including registrant, registrar, and nameservers
  k2:
    description: Durable, ordered event streams that you produce records to and consume from with subscriptions
    groups:
      streams:
        description: K2 streams, their retention, and the HTTP and Workers binding inputs used to produce records
      streams.subscriptions:
        description: Subscriptions that consume a K2 stream, with committed-position lag
  leaked-credential-checks:
    description: Detect compromised credentials in login requests by checking against known breach databases
    groups:
      detections:
        description: Custom detection locations that tell the WAF where to find usernames and passwords in requests
  load-balancers:
    description: Distribute traffic across origin pools with health monitoring, geo-steering, and failover
    groups:
      monitor-groups:
        description: Group monitors together for shared configuration and bulk management
      monitor-groups.references:
        description: List references to monitor groups used by load balancer pools
      monitors:
        description: Health check configurations that probe origin servers and determine pool availability
      monitors.previews:
        description: Health check configurations that probe origin servers and determine pool availability
      monitors.references:
        description: Health check configurations that probe origin servers and determine pool availability
      pools:
        description: Origin server pools with weighted traffic distribution, health thresholds, and geographic preferences
      pools.health:
        description: Origin server pools with weighted traffic distribution, health thresholds, and geographic preferences
      pools.references:
        description: Origin server pools with weighted traffic distribution, health thresholds, and geographic preferences
      previews:
        description: Preview the result of a health check monitor configuration before applying it
      regions:
        description: Geographic regions used for regional pool steering and traffic policies
      searches:
        description: Search across all load balancer resources (pools, monitors, load balancers) by name or reference
  logs:
    description: Log control, retention, and raw log access — CMB config, ray ID lookups, and received fields
    groups:
      control:
        description: Log control operations
      received:
        description: Received log operations
  magic-network-monitoring:
    description: Flow-based network traffic monitoring with configurable alerting rules and VPC flow ingestion
    groups:
      configs:
        description: Account-level monitoring configuration — sampling rates, thresholds, and notification settings
      rules:
        description: Monitoring rules that define traffic thresholds and trigger alerts or prefix advertisements
      vpc-flows:
        description: Ingest VPC flow logs from cloud providers for network visibility and anomaly detection
  magic-transit:
    description: DDoS-protected network transit — GRE/IPsec tunnels, static routes, Magic WAN sites, connectors, and packet captures
    groups:
      advanced-dns-protection:
        description: Advanced Dns Protection operations
      advanced-tcp-protection:
        description: Advanced Tcp Protection operations
      apps:
        description: Application-aware traffic policies for Magic WAN that steer traffic by app type
      bgp-filter-profiles:
        description: BGP filter profiles for controlling which routes are allowed or denied on Magic Transit tunnels
      bgp-settings:
        description: BGP settings for controlling default ASN and route redistribution on Magic Transit tunnels
      cf-interconnects:
        description: Cloudflare Network Interconnect (CNI) links for direct physical or virtual peering
      gre-tunnels:
        description: GRE tunnel endpoints that connect your network to Cloudflare for Magic Transit
      ipsec-tunnels:
        description: IPsec tunnel endpoints with pre-shared key management for encrypted transit
      pcaps:
        description: Packet capture requests for debugging traffic flowing through Magic Transit tunnels
      routes:
        description: Static routes that direct IP prefix traffic through specific GRE/IPsec tunnels
      sites:
        description: Magic WAN branch sites — base CRUD, LAN/WAN interface configuration, ACLs, connectors, app configuration, and NetFlow config
  mcp:
    description: Manage MCP portals and upstream MCP servers for Cloudflare Access AI controls
    groups:
      portals:
        description: Manage MCP portals, attached servers, and Code Mode settings
      servers:
        description: Manage upstream MCP servers, credentials, capabilities, and sync state
  network-interconnects:
    description: Physical and virtual private interconnects between your infrastructure and Cloudflare's network
    groups:
      cnis:
        description: Cloud Network Interconnect (CNI) connections — private links from cloud providers to Cloudflare
      interconnects:
        description: Physical cross-connect and partner interconnect sessions with LOA and status tracking
      settings:
        description: Account-level interconnect settings and default configurations
      slots:
        description: Available interconnect facility slots showing port capacity at Cloudflare data centers
  organizations:
    description: Multi-user organizations that group accounts, members, and shared settings under a single entity
    groups:
      account-organizations:
        description: List organizations associated with a specific account
      accounts:
        description: Accounts operations
      members:
        description: Members operations
      members-batch-create:
        description: Members Batch Create operations
      organization-profile:
        description: View and update the public profile information for an organization
      shares:
        description: Shares operations
  origin-post-quantum-encryption:
    description: Enable post-quantum key exchange for connections between Cloudflare and your origin server
  pages:
    description: Full-stack application hosting with Git-integrated builds, preview deployments, and custom domains
    groups:
      projects:
        description: Pages projects, deployments, build logs, and custom domain bindings
  pipelines:
    description: Ingest, transform, and route event streams into R2, analytics, or other destinations in real time
    groups:
      sinks:
        description: Destinations where pipeline data is written — R2 buckets, HTTP endpoints, or other storage
      streams:
        description: Inbound data streams that feed events into a pipeline for processing
  precursor:
    description: Precursor settings for a zone
  queues:
    description: Reliable message queuing between Workers — produce, consume, and batch-process messages at scale
    groups:
      consumers:
        description: Workers that automatically receive and process messages from a queue
      messages:
        description: Push messages to a queue and pull or acknowledge them from consumers
      purge:
        description: Remove all pending messages from a queue
      subscriptions:
        description: Manage queue subscriptions for event-driven message routing
  r2:
    description: S3-compatible object storage with zero egress fees — buckets, lifecycle rules, event notifications, and data migration
    groups:
      buckets:
        description: Create and configure R2 buckets including CORS, lifecycle, custom domains, event notifications, and object locks
      buckets.jobs:
        description: Create and inspect background jobs for an R2 bucket
      buckets.local-uploads:
        description: R2 bucket local upload configuration
      super-slurper:
        description: Migrate data from external S3-compatible storage into R2 buckets with resumable transfer jobs
      temporary-credentials:
        description: Generate short-lived S3-compatible credentials scoped to specific buckets and operations
  r2-data-catalog:
    description: Iceberg-compatible data catalog for R2 — organize objects into tables and namespaces for SQL query engines
    groups:
      credentials:
        description: Catalog access credentials for external query engines (Spark, Trino, etc.)
      maintenance-configs:
        description: Table maintenance settings — compaction schedules and snapshot expiration policies
      namespaces:
        description: Logical namespaces that group related tables within the data catalog
      namespaces.tables:
        description: Tables within catalog namespaces
      namespaces.tables.maintenance-configs:
        description: Table-level maintenance configurations and operations
      namespaces.tables.maintenance-runs:
        description: History of maintenance runs performed on tables
  radar:
    description: Internet-wide traffic intelligence — BGP, DNS, HTTP trends, attack data, and network quality insights
    groups:
      agent-readiness:
        description: Agent readiness summary statistics across the Cloudflare network
      ai:
        description: AI inference trends and model usage statistics across the Cloudflare network
      annotations:
        description: Radar annotations marking significant Internet events (outages, cable cuts, etc.)
      as112:
        description: AS112 DNS sinkhole statistics — reverse DNS query volumes for private address space
      attacks:
        description: DDoS and application-layer attack trends, vectors, and target analysis
      bgp:
        description: BGP routing data — prefix announcements, AS-level stats, route leaks, and hijack events
      bots:
        description: Internet-wide bot traffic trends, categories, and distribution statistics
      ct:
        description: Certificate Transparency log monitoring and newly-issued certificate discovery
      datasets:
        description: Downloadable Radar datasets for offline analysis and research
      dns:
        description: Global DNS query trends — top domains, resolver stats, and DNSSEC adoption
      email:
        description: Email security trends — DMARC/SPF/DKIM adoption, spam, and phishing statistics
      entities:
        description: Look up ASNs, IPs, domains, and locations with metadata and traffic summaries
      geolocations:
        description: Geographic location metadata used for regional traffic analysis
      http:
        description: HTTP protocol trends — TLS versions, HTTP versions, browser share, and OS distribution
      leaked-credentials:
        description: Leaked credential detection trends and exposure statistics
      netflows:
        description: Network-layer traffic flow data and volumetric trend analysis
      origins:
        description: Cloud and hosting origin providers (e.g. Amazon, by region) and their traffic metrics
      post-quantum:
        description: Post-quantum encryption adoption and deployment trends across the Internet
      quality:
        description: Internet connection quality metrics — speed, latency, and jitter by geography and ASN
      ranking:
        description: Top domain rankings based on DNS query popularity across the Cloudflare network
      robots-txt:
        description: Robots.txt adoption and crawler directive trends across the web
      search:
        description: Search Radar data across IPs, ASNs, domains, and locations
      tcp-resets-timeouts:
        description: TCP connection reset and timeout statistics indicating network health issues
      tlds:
        description: Top-level domain (TLD) metadata and performance trends
      traffic-anomalies:
        description: Detected traffic anomalies and unusual patterns in Internet traffic flows
      verified-bots:
        description: Catalog of known good bots (Googlebot, Bingbot, etc.) and their traffic patterns
  rate-limits:
    description: Legacy per-zone rate limiting rules — prefer Advanced Rate Limiting in Rulesets for new configurations
  realtime:
    description: Real-time audio, video, and data services on Cloudflare's global network
    groups:
      kit:
        description: SDK-backed meetings, participants, recordings, livestreams, and webhooks
      kit.analytics:
        description: Usage and livestream analytics for RealtimeKit applications
      kit.analytics.livestreams:
        description: Livestream analytics for RealtimeKit applications
      kit.analytics.livestreams.daily:
        description: Daily livestream analytics for RealtimeKit applications
      kit.analytics.usage:
        description: Usage analytics for RealtimeKit applications
      kit.apps:
        description: RealtimeKit applications that group meetings, sessions, and configuration
      kit.livestreams:
        description: Independent and meeting-based livestreams and their sessions
      kit.livestreams.sessions:
        description: Sessions for RealtimeKit livestreams
      kit.meetings:
        description: Meetings, participants, access tokens, and meeting livestreams
      kit.meetings.active:
        description: Live meeting state and participant controls
      kit.meetings.active.polls:
        description: Polls for active meeting sessions
      kit.meetings.livestream:
        description: Livestream operations associated with RealtimeKit meetings
      kit.meetings.participants:
        description: Participants in RealtimeKit meetings
      kit.meetings.participants.tokens:
        description: Access tokens for RealtimeKit meeting participants
      kit.presets:
        description: Reusable meeting configuration for media, permissions, and interface behavior
      kit.recordings:
        description: Meeting and participant-track recordings and recording controls
      kit.recordings.active:
        description: Active recordings for RealtimeKit meetings
      kit.recordings.tracks:
        description: Participant-track recordings for RealtimeKit meetings
      kit.sessions:
        description: Historical session data, participants, chat, transcripts, and summaries
      kit.sessions.chat:
        description: Chat messages from historical RealtimeKit sessions
      kit.sessions.livestreams:
        description: Livestreams associated with historical RealtimeKit sessions
      kit.sessions.participants:
        description: Participants in historical RealtimeKit sessions
      kit.sessions.peers:
        description: Peer details from historical RealtimeKit sessions
      kit.sessions.summaries:
        description: Summaries of historical RealtimeKit sessions
      kit.sessions.transcripts:
        description: Transcripts from historical RealtimeKit sessions
      kit.webhooks:
        description: Webhook endpoints and supported events for RealtimeKit notifications
      kit.webhooks.events:
        description: Supported events for RealtimeKit webhooks
      moq:
        description: MoQ relays for publishing and subscribing to media streams
      moq.relays:
        description: Relays are isolated MoQ scopes that carry media between publishers and subscribers
      moq.relays.tokens:
        description: Tokens that authorize publishers and subscribers to connect to a relay
      sfu:
        description: SFU apps that route WebRTC media and data between participants
      sfu.apps:
        description: SFU application namespaces for sessions and tracks
      turn:
        description: TURN keys that help clients traverse NATs and firewalls
      turn.keys:
        description: Keys used to generate short-lived TURN credentials
  request-tracers:
    description: Trace how a request would be processed through Cloudflare's rules and configuration pipeline
    groups:
      traces:
        description: Simulate request processing to debug rule matches, transforms, and routing decisions
  resource-sharing:
    description: Share Cloudflare resources (zones, accounts) across organizations with granular access controls
    groups:
      recipients:
        description: Update share recipients
      resources:
        description: Individual resources (zones, configs) that have been shared with recipients
  rules:
    description: Resources used by Cloudflare rules and rulesets
    groups:
      lists:
        description: Custom account-level lists of IPs, hostnames, ASNs, or redirects used in rule expressions
  rum:
    description: Real User Measurement (Web Analytics) — track page loads, Core Web Vitals, and visitor metrics
    groups:
      rules:
        description: Rules that control which pages and paths are tracked by Web Analytics
      site-info:
        description: Web Analytics sites — register domains and get the JavaScript beacon snippet
  scim:
    description: SCIM 2.0 provisioning — manage users, groups, and identity provider sync for your account
    groups:
      groups:
        description: Groups operations
      resource-types:
        description: Resource Types operations
      schemas:
        description: Schemas operations
      service-provider-config:
        description: Service Provider Config operations
      users:
        description: Users operations
  secrets-store:
    description: Centralized secret management — store API keys, tokens, and credentials for use across Workers and other products
    groups:
      quota:
        description: Account quota limits for secrets stores, secrets count, and storage capacity
      secrets:
        description: Encrypted key-value secrets within a store. Pass --store-id to scope.
      stores:
        description: Secret stores that hold encrypted key-value secrets accessible by Workers and services
  security-center:
    description: Security posture dashboard — view and manage security insights, misconfigurations, and vulnerabilities
    groups:
      insights:
        description: Security findings and recommendations across your account — DNS, SSL, WAF misconfigurations, etc.
      zone-insights:
        description: Zone-scoped security insights — counts by class, severity, type, and dismissal
  security-txt:
    description: Manage the /.well-known/security.txt file that tells security researchers how to report vulnerabilities
  smart-shield:
    description: Smart Shield settings, health checks, and cache reserve management
    groups:
      cache-reserve-clear:
        description: Cache Reserve Clear operations
      health-checks:
        description: Health checks operations
  spectrum:
    description: Proxy and protect arbitrary TCP/UDP applications through Cloudflare's network with DDoS mitigation
    groups:
      analytics:
        description: Real-time and historical connection analytics for Spectrum applications
      apps:
        description: Spectrum application configurations that map protocols and ports to origin servers
  speed:
    description: Observatory speed tests — run Lighthouse audits, track performance trends, and schedule recurring tests
    groups:
      availabilities:
        description: Check which speed test regions and configurations are available for your zone
      pages:
        description: Tested pages with their performance history, trends, and individual test results
      schedule:
        description: Scheduled recurring speed tests that automatically run at regular intervals
  ssl:
    description: SSL/TLS certificate management — certificate packs, Universal SSL, verification, and TLS mode recommendations
    groups:
      automatic-upgrader:
        description: SSL automatic mode enrollment — get or update automatic SSL/TLS upgrader settings
      recommendations:
        description: Get the recommended SSL/TLS encryption mode based on your origin server's certificate configuration
  stream:
    description: Video encoding, storage, and delivery — upload, live-stream, clip, caption, and embed video at scale
    groups:
      audio-tracks:
        description: Add, edit, or remove additional audio tracks on a video
      captions:
        description: Upload, generate, or retrieve captions and subtitles for videos in multiple languages
      clip:
        description: Create a new video clip from an existing video by specifying start and end times
      copy:
        description: Import a video from a URL into Stream for processing and delivery
      direct-upload:
        description: Generate a tokenized URL that lets end-users upload video directly to Stream
      downloads:
        description: Create downloadable MP4 renditions of a video for offline viewing
      embed:
        description: Retrieve the HTML embed code snippet for a video
      keys:
        description: Signing keys used to generate short-lived signed URLs for private video playback
      live-inputs:
        description: Enable and disable live input streams
      token:
        description: Generate short-lived signed URL tokens for secure private video playback
      typed-downloads:
        description: Type-specific stream download creation and deletion
      videos:
        description: Aggregate video storage usage statistics for the account
      watermarks:
        description: Watermark profiles that overlay an image on every video in the account
      webhooks:
        description: Webhook notifications for video lifecycle events (ready, error, etc.)
  tenants:
    description: Multi-tenant account management — manage tenant accounts, entitlements, and memberships
    groups:
      account-types:
        description: Account Types operations
      accounts:
        description: Accounts operations
      entitlements:
        description: Entitlements operations
      memberships:
        description: Memberships operations
  turnstile:
    description: CAPTCHA-free bot verification widgets that protect forms and APIs without degrading user experience
    groups:
      widgets:
        description: Turnstile widget configurations — site keys, secret rotation, and challenge mode settings
  url-scanner:
    description: Scan URLs for phishing, malware, and other threats — submit scans and retrieve detailed results
    groups:
      response:
        description: Response operations
      responses:
        description: Raw HTTP response data captured during URL scans
      scan:
        description: Scan operations
      scans:
        description: URL scan requests and results — submit URLs for analysis and retrieve threat verdicts
  user:
    description: Your Cloudflare user profile, invitations, organizations, billing, and personal API tokens
    groups:
      billing:
        description: View billing history and payment profile for your user (deprecated — prefer account-level billing)
      firewall:
        description: Firewall operations
      load-balancers.monitors:
        description: Load Balancers operations
      load-balancers.monitors.preview:
        description: Load Balancers operations
      load-balancers.monitors.references:
        description: Load Balancers operations
      load-balancers.pools:
        description: Load Balancers operations
      load-balancers.pools.edit.pools:
        description: Load Balancers operations
      load-balancers.pools.health:
        description: Load Balancers operations
      load-balancers.pools.preview:
        description: Load Balancers operations
      load-balancers.pools.references:
        description: Load Balancers operations
      load-balancers.preview:
        description: Load Balancers operations
      load-balancing-analytics.events:
        description: Load Balancing Analytics operations
      subscriptions:
        description: View and manage zone-level plan subscriptions owned by your user
      tenants:
        description: Tenants operations
      tokens:
        description: Create and manage personal API tokens scoped to your user for programmatic API access
  user.analytics:
    description: User-level traffic analytics — aggregated totals and timeseries across all zones
  vectorize:
    description: Globally distributed vector database for building semantic search, recommendations, and RAG applications on Workers
    groups:
      deprecated-indexes:
        description: Deprecated v1 Vectorize index operations
      metadata-index:
        description: Metadata indexes for filtered vector search
  waiting-rooms:
    description: Virtual queues that throttle traffic to your site during peak demand with customizable waiting pages
    groups:
      account-waiting-rooms:
        description: Account-scoped waiting room listing
      events:
        description: Scheduled events that temporarily override waiting room settings for sales, launches, etc.
      page:
        description: Custom HTML waiting page templates and preview rendering
      rules:
        description: Rules that bypass or modify waiting room behavior for specific request patterns
      settings:
        description: Zone-level waiting room defaults and cookie configuration
      statuses:
        description: Real-time queue status showing active users, queued users, and estimated wait times
  workflows:
    description: Durable, multi-step workflows that run on Workers with automatic retries and state persistence
    groups:
      instances:
        description: Workflow instance operations
      versions:
        description: Workflow version operations
  zaraz:
    description: Server-side tag manager — load third-party tools (analytics, pixels, etc.) from Cloudflare's edge without client-side JS
    groups:
      config:
        description: Full Zaraz configuration including tools, triggers, and variables for the zone
      default:
        description: Default Zaraz configuration template used as a starting point for new zones
      export:
        description: Export the current Zaraz configuration as a portable JSON document
      history:
        description: Configuration version history — browse and restore previous Zaraz configurations
      publish:
        description: Publish pending Zaraz configuration changes to make them live on the zone
      workflow:
        description: Workflow state for Zaraz configuration changes (draft vs. published)
  zero-trust:
    description: Cloudflare's SASE platform — secure access, device posture, DLP, tunnels, gateway policies, and network segmentation
    groups:
      dex:
        description: Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics
      dlp.custom-prompt-topics:
        description: Data Loss Prevention - manage custom prompt topics for AI-based content detection
      dlp.data-classes:
        description: Data Loss Prevention - manage data classes used to classify sensitive information
      dlp.data-tag-categories:
        description: Data Loss Prevention - manage categories that organize data tags
      dlp.data-tag-category-templates:
        description: Data Loss Prevention - browse templates for creating data tag categories
      dlp.data-tags:
        description: Data Loss Prevention - manage tags used to classify and organize sensitive data
      dlp.datasets:
        description: Data Loss Prevention - manage datasets, versions, and uploads
      dlp.document-fingerprints:
        description: Data Loss Prevention - manage document fingerprints for detecting matching documents
      dlp.email.account-mapping:
        description: Data Loss Prevention - configure account mappings for outbound email scanning
      dlp.email.rules:
        description: Data Loss Prevention - manage outbound email scanning rules and their priorities
      dlp.entries:
        description: Data Loss Prevention - list and manage detection entries
      dlp.limits:
        description: Data Loss Prevention - view account limits and resource quotas
      dlp.patterns:
        description: Data Loss Prevention - validate regular expressions used for content detection
      dlp.profiles:
        description: Data Loss Prevention - list and retrieve profiles
      dlp.profiles.custom:
        description: Data Loss Prevention - manage custom profiles
      dlp.profiles.predefined:
        description: Data Loss Prevention - manage predefined profiles
      dlp.sensitivity-group-templates:
        description: Data Loss Prevention - browse templates for creating sensitivity groups
      dlp.sensitivity-groups:
        description: Data Loss Prevention - manage sensitivity groups and their level ordering
      dlp.sensitivity-levels:
        description: Data Loss Prevention - manage sensitivity levels within sensitivity groups
      dlp.settings:
        description: Data Loss Prevention - manage account-level settings
      dlp.validators:
        description: Data Loss Prevention - list and retrieve content validators
      dlp.validators.proximity-words:
        description: Data Loss Prevention - manage proximity-word validators
      risk-scoring:
        description: User Risk Scoring - retrieve and reset user risk scores
      risk-scoring.behaviours:
        description: User Risk Scoring - manage behaviors used to calculate user risk scores
      risk-scoring.integrations:
        description: User Risk Scoring - manage integrations that provide risk score signals
      risk-scoring.integrations.references:
        description: User Risk Scoring - retrieve integrations by external reference
      risk-scoring.summary:
        description: User Risk Scoring - retrieve account risk score summaries
  zones:
    description: Zones are domains on Cloudflare — list, create, and configure domain settings
    groups:
      aegis:
        description: Aegis operations
      fonts:
        description: Fonts operations
      origin-h2-max-streams:
        description: Origin H2 Max Streams operations
      origin-max-http-version:
        description: Origin Max Http Version operations
      origin-tls-compliance-modes:
        description: Manage zone Origin TLS Compliance Modes setting
      rum:
        description: Rum operations
      speed-brain:
        description: Speed Brain operations