[Cloudflare] Per-portal MCP tool-call timeseries. GET /accounts//access/ai-controls/mcp/analytics/portals//tool-calls/timeseries. Path parameters: account_id, portal_id. Optional filters: granularity, aggregate, tz, days. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Per-server MCP tool-call timeseries. GET /accounts//access/ai-controls/mcp/analytics/servers//tool-calls/timeseries. Path parameters: account_id, server_id. Optional filters: granularity, aggregate, tz, days. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Account-global MCP tool-call timeseries. Account-wide MCP tool-call volume over time — the read that answers whether anyone is actually using the portals, and when. GET /accounts//access/ai-controls/mcp/analytics/tool-calls/timeseries. Path parameters: account_id. Optional filters: granularity, aggregate, tz, days. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Create a new MCP Portal. Additive: creates a new portal and changes no existing one. POST /accounts//access/ai-controls/mcp/portals. Path parameters: account_id. Send the request body as JSON; Cloudflare documents these fields: allow_code_mode, code_mode, description, hostname, id, name, secure_web_gateway, servers. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete an MCP Portal. Why this is destructive: Deletes the portal; every client pointed at its URL stops resolving. DELETE /accounts//access/ai-controls/mcp/portals/. Path parameters: account_id, id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Read details of an MCP Portal. Returns the portal with its bound servers and its hostname. Read it before an update: the update replaces the portal wholesale, so this is where you get the current binding list to send back. GET /accounts//access/ai-controls/mcp/portals/. Path parameters: id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Resolve an MCP server OAuth redirect URI. GET /accounts//access/ai-controls/mcp/portals//servers//effective-redirect-uri. Path parameters: portal_id, server_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List MCP Portals. An MCP Portal is the Zero Trust front door that publishes a set of MCP servers to users behind an Access policy. The portal id this returns is what the read, update and delete tools take, and it pairs with a server id on the redirect-URI tool. GET /accounts//access/ai-controls/mcp/portals. Path parameters: account_id. Optional filters: page, per_page, search. Page size defaults to 100, which is also the ceiling StackJack applies here. Cloudflare's request budget is counted per user and shared with the customer's own dashboard session, so prefer one larger page over many small calls. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update an MCP Portal. Why this is destructive: Wholesale replace: the portal is rewritten from the body, so any server binding or Access policy you omit is removed. PUT /accounts//access/ai-controls/mcp/portals/. Path parameters: id, account_id. Send the request body as JSON; Cloudflare documents these fields: allow_code_mode, code_mode, description, hostname, name, secure_web_gateway, servers. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Create a new MCP Server. Additive: registers a new server and changes no existing one. POST /accounts//access/ai-controls/mcp/servers. Path parameters: account_id. Send the request body as JSON; Cloudflare documents these fields: auth_credentials, auth_type, client_secret, description, hostname, id, is_shared_oauth_callback_enabled, name, secure_web_gateway, updated_prompts, updated_tools. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete an MCP Server. Why this is destructive: Deletes the server and unbinds it from every portal that referenced it. DELETE /accounts//access/ai-controls/mcp/servers/. Path parameters: account_id, id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Read the details of an MCP Server. Returns the server with its upstream URL and last-synced capabilities. Read it before an update, which replaces the record wholesale. GET /accounts//access/ai-controls/mcp/servers/. Path parameters: account_id, id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List MCP Servers. The MCP servers registered on the account, each with the upstream URL and the capabilities Cloudflare last synced from it. If a portal is serving stale tools, sync the server rather than recreating it. GET /accounts//access/ai-controls/mcp/servers. Path parameters: account_id. Optional filters: page, per_page, search. Page size defaults to 100, which is also the ceiling StackJack applies here. Cloudflare's request budget is counted per user and shared with the customer's own dashboard session, so prefer one larger page over many small calls. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Sync MCP Server Capabilities. Re-reads the upstream server capabilities; nothing the customer authored is replaced. POST /accounts//access/ai-controls/mcp/servers//sync. Path parameters: id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update an MCP Server. Why this is destructive: Wholesale replace: the server record is rewritten from the body, so an omitted field reverts to its default. PUT /accounts//access/ai-controls/mcp/servers/. Path parameters: id, account_id. Send the request body as JSON; Cloudflare documents these fields: auth_credentials, client_secret, description, is_shared_oauth_callback_enabled, name, secure_web_gateway, updated_prompts, updated_tools. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Create hostname route. Additive: creates a new record and changes no existing one. POST /accounts//zerotrust/routes/hostname. Path parameters: account_id. Send the request body as JSON; Cloudflare documents these fields: comment, hostname, tunnel_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Create WARP IP subnet. Additive: creates a new record and changes no existing one. POST /accounts//zerotrust/subnets/warp. Path parameters: account_id. Send the request body as JSON; Cloudflare documents these fields: comment, is_default_network, name, network. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete hostname route. Why this is destructive: Deletes the hostname route; traffic for that hostname stops going down the tunnel immediately and resolves wherever public DNS points it. DELETE /accounts//zerotrust/routes/hostname/. Path parameters: account_id, hostname_route_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete WARP IP subnet. Why this is destructive: Deletes the WARP IP subnet. Devices assigned addresses from it lose their tunnel addressing, so this disconnects users rather than only editing a record. DELETE /accounts//zerotrust/subnets/warp/. Path parameters: account_id, subnet_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Get Zero Trust Connectivity Settings. The account-wide Zero Trust connectivity posture (ICMP proxy, WARP-to-WARP, default settings for new tunnels). Read it before changing a route or subnet: these settings decide whether a route is reachable at all. GET /accounts//zerotrust/connectivity_settings. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Get hostname route. GET /accounts//zerotrust/routes/hostname/. Path parameters: account_id, hostname_route_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Get Initial Resolved IP Subnet. GET /accounts//zerotrust/subnets/initial_resolved_ip/. Path parameters: account_id, address_family. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Get WARP IP subnet. GET /accounts//zerotrust/subnets/warp/. Path parameters: account_id, subnet_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List hostname routes. Hostname routes send a named host down a tunnel instead of an IP range. The route id every other hostname-route tool takes comes from here. GET /accounts//zerotrust/routes/hostname. Path parameters: account_id. Optional filters: id, hostname, tunnel_id, comment, existed_at, is_deleted, per_page, page. Page size defaults to 100 and this endpoint accepts up to 1000. Cloudflare's request budget is counted per user and shared with the customer's own dashboard session, so prefer one larger page over many small calls. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List Subnets. GET /accounts//zerotrust/subnets. Path parameters: account_id. Optional filters: name, comment, network, existed_at, address_family, is_default_network, is_deleted, sort_order, subnet_types, per_page, page. Page size defaults to 100 and this endpoint accepts up to 1000. Cloudflare's request budget is counted per user and shared with the customer's own dashboard session, so prefer one larger page over many small calls. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update Initial Resolved IP Subnet. Why this is destructive: Wholesale replace of the initial resolved-IP subnet; the previous value is gone and in-flight sessions re-resolve. PUT /accounts//zerotrust/subnets/initial_resolved_ip/. Path parameters: account_id, address_family. Send the request body as JSON; Cloudflare documents these fields: comment, name, network. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Updates the Zero Trust Connectivity Settings. Partial update: Cloudflare applies only the fields present in the body and leaves the rest as they are. PATCH /accounts//zerotrust/connectivity_settings. Path parameters: account_id. Send the request body as JSON; Cloudflare documents these fields: icmp_proxy_enabled, offramp_warp_enabled. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Update hostname route. Partial update: Cloudflare applies only the fields present in the body and leaves the rest as they are. PATCH /accounts//zerotrust/routes/hostname/. Path parameters: account_id, hostname_route_id. Send the request body as JSON; Cloudflare documents these fields: comment, hostname, tunnel_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Update Cloudflare Source Subnet. Partial update: Cloudflare applies only the fields present in the body and leaves the rest as they are. PATCH /accounts//zerotrust/subnets/cloudflare_source/. Path parameters: account_id, address_family. Send the request body as JSON; Cloudflare documents these fields: comment, name, network. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Update WARP IP subnet. Partial update: Cloudflare applies only the fields present in the body and leaves the rest as they are. PATCH /accounts//zerotrust/subnets/warp/. Path parameters: account_id, subnet_id. Send the request body as JSON; Cloudflare documents these fields: comment, is_default_network, name, network. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Add Account Custom Nameserver. Additive: it registers one more nameserver hostname on the account and changes no zone. A zone only begins answering from it once that zone is pointed at the matching nameserver set. Account custom nameservers need a Business or Enterprise account - Cloudflare's own plan table marks Free and Pro false - and the API token needs the Account Settings Write permission group. POST /accounts//custom_ns. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete Account Custom Nameserver. Why this is destructive: The account stops offering that nameserver hostname to its zones. A zone still delegated to it at the registrar keeps sending the world to a name Cloudflare no longer serves for this account, so move the zones off the set and fix the registrar's NS records BEFORE deleting. Account custom nameservers need a Business or Enterprise account - Cloudflare's own plan table marks Free and Pro false - and the API token needs the Account Settings Write permission group. DELETE /accounts//custom_ns/. Path parameters: custom_ns_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List Account Custom Nameservers. Account custom nameservers are the vanity nameserver hostnames - ns1.example.com and friends - an account can delegate its zones to instead of Cloudflare's shared pair. Start here: each entry's ns_name is the FQDN cf_delete_custom_ns takes, and its ns_set number is the set a zone is pointed at through cf_update_zones_dns_setting's nameservers object. Cloudflare paginates nothing here: the whole collection comes back in one response. Account custom nameservers need a Business or Enterprise account - Cloudflare's own plan table marks Free and Pro false - and the API token needs the Account Settings Read permission group. GET /accounts//custom_ns. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Get Account Custom Nameserver Related Zone Metadata. Reads whether this zone uses the account's custom nameservers and which nameserver set it is on. Cloudflare's own document deprecates it in favour of Show DNS Settings for a zone, which StackJack exposes as cf_get_zones_dns_settings - prefer that tool and read nameservers.type and nameservers.ns_set there. Account custom nameservers need a Business or Enterprise account - Cloudflare's own plan table marks Free and Pro false - and the API token needs the Account Settings Read permission group. GET /zones//custom_ns. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info. DEPRECATED by Cloudflare: this operation still answers, but the vendor marks it deprecated in its own API document and may withdraw it - prefer a non-deprecated tool for the same resource where one exists.

[Cloudflare] DESTRUCTIVE: Set Account Custom Nameserver Related Zone Metadata. Why this is destructive: A PUT replaces this zone's whole account-custom-nameserver metadata from the body: leave enabled out and it is cleared, leave ns_set out and the zone's set assignment goes with it. Turning enabled off, or moving the zone to a different set, changes which nameservers answer for the zone, and the NS records at the registrar have to be changed to match or the zone stops resolving. Cloudflare deprecates this in favour of Update DNS Settings for a zone, which StackJack exposes as cf_update_zones_dns_setting - set nameservers.type and nameservers.ns_set there instead. Cloudflare also notes that making NEW zones in the account use account custom nameservers by default is an account setting (use_account_custom_ns_by_default), not a per-zone call. Account custom nameservers need a Business or Enterprise account - Cloudflare's own plan table marks Free and Pro false - and the API token needs the Account Settings Write permission group. PUT /zones//custom_ns. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info. DEPRECATED by Cloudflare: this operation still answers, but the vendor marks it deprecated in its own API document and may withdraw it - prefer a non-deprecated tool for the same resource where one exists.

[Cloudflare] DNS Analytics time series for a zone. The same zone metrics as cf_get_zones_dns_analytics_reports, bucketed over time: time_delta picks the bucket size and the result carries one value per bucket. Cloudflare marks this deprecated and points at its API deprecation notice dated 2025-12-09, a date that has already passed - the endpoint still answers, and Cloudflare names no REST replacement for it, so there is no non-deprecated sibling to move to. GET /zones//dns_analytics/report/bytime. Path parameters: zone_id. Optional filters: metrics, dimensions, since, until, limit, sort, filters, time_delta. Page size defaults to 100 and this endpoint accepts up to 1000. Cloudflare's request budget is counted per user and shared with the customer's own dashboard session, so prefer one larger page over many small calls. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info. DEPRECATED by Cloudflare: this operation still answers, but the vendor marks it deprecated in its own API document and may withdraw it - prefer a non-deprecated tool for the same resource where one exists.

[Cloudflare] DNS Analytics report table for a zone. One aggregated row per combination of the dimensions you group by, over the whole window - the table view rather than a time series; cf_get_zones_dns_analytics_report_bytimes is the series. The numbers are this zone's own authoritative query traffic. Cloudflare marks this deprecated and points at its API deprecation notice dated 2025-12-09, a date that has already passed - the endpoint still answers, and Cloudflare names no REST replacement for it, so there is no non-deprecated sibling to move to. GET /zones//dns_analytics/report. Path parameters: zone_id. Optional filters: metrics, dimensions, since, until, limit, sort, filters. Page size defaults to 100 and this endpoint accepts up to 1000. Cloudflare's request budget is counted per user and shared with the customer's own dashboard session, so prefer one larger page over many small calls. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info. DEPRECATED by Cloudflare: this operation still answers, but the vendor marks it deprecated in its own API document and may withdraw it - prefer a non-deprecated tool for the same resource where one exists.

[Cloudflare] Create DNS Firewall Cluster. Additive: it stands up a new cluster and touches no existing one. Nothing resolves through it until the customer points resolvers at the addresses Cloudflare returns. DNS Firewall is Enterprise-only in Cloudflare's own plan table, and the API token needs the DNS Firewall Write permission group. POST /accounts//dns_firewall. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete DNS Firewall Cluster. Why this is destructive: The cluster goes and Cloudflare releases the addresses it answered on. Every resolver still pointed at those addresses stops getting answers the moment it does, so move them off first - a rebuilt cluster is given new addresses and the old ones are not held for you. DNS Firewall is Enterprise-only in Cloudflare's own plan table, and the API token needs the DNS Firewall Write permission group. DELETE /accounts//dns_firewall/. Path parameters: dns_firewall_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DNS Firewall Cluster Details. Reads one cluster's whole configuration - upstream_ips, the cache TTL bounds, the rate limit and the attack-mitigation settings. Worth doing before cf_update_dns_firewall, because upstream_ips is an array that the PATCH replaces wholesale. DNS Firewall is Enterprise-only in Cloudflare's own plan table, and the API token needs the DNS Firewall Read or DNS Firewall Write permission group. GET /accounts//dns_firewall/. Path parameters: dns_firewall_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DNS Analytics time series for a DNS Firewall cluster. The same cluster metrics as cf_get_dns_firewall_dns_analytics_reports, bucketed over time by time_delta. Cloudflare marks this deprecated and points at its API deprecation notice dated 2025-12-09, a date that has already passed - the endpoint still answers, and Cloudflare names no REST replacement for it, so there is no non-deprecated sibling to move to. DNS Firewall is Enterprise-only in Cloudflare's own plan table, and the API token needs the DNS Firewall Read or DNS Firewall Write permission group. GET /accounts//dns_firewall//dns_analytics/report/bytime. Path parameters: dns_firewall_id, account_id. Optional filters: metrics, dimensions, since, until, limit, sort, filters, time_delta. Page size defaults to 100 and this endpoint accepts up to 1000. Cloudflare's request budget is counted per user and shared with the customer's own dashboard session, so prefer one larger page over many small calls. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info. DEPRECATED by Cloudflare: this operation still answers, but the vendor marks it deprecated in its own API document and may withdraw it - prefer a non-deprecated tool for the same resource where one exists.

[Cloudflare] DNS Analytics report table for a DNS Firewall cluster. The aggregated table for ONE DNS Firewall cluster's own resolver traffic - queries that passed through the cluster, not a zone's authoritative traffic. Cloudflare marks this deprecated and points at its API deprecation notice dated 2025-12-09, a date that has already passed - the endpoint still answers, and Cloudflare names no REST replacement for it, so there is no non-deprecated sibling to move to. DNS Firewall is Enterprise-only in Cloudflare's own plan table, and the API token needs the DNS Firewall Read or DNS Firewall Write permission group. GET /accounts//dns_firewall//dns_analytics/report. Path parameters: dns_firewall_id, account_id. Optional filters: metrics, dimensions, since, until, limit, sort, filters. Page size defaults to 100 and this endpoint accepts up to 1000. Cloudflare's request budget is counted per user and shared with the customer's own dashboard session, so prefer one larger page over many small calls. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info. DEPRECATED by Cloudflare: this operation still answers, but the vendor marks it deprecated in its own API document and may withdraw it - prefer a non-deprecated tool for the same resource where one exists.

[Cloudflare] Show DNS Firewall Cluster Reverse DNS. Reads the PTR records Cloudflare publishes for the cluster's own IP addresses - the reverse DNS an upstream nameserver sees when the cluster queries it. DNS Firewall is Enterprise-only in Cloudflare's own plan table, and the API token needs the DNS Firewall Read or DNS Firewall Write permission group. GET /accounts//dns_firewall//reverse_dns. Path parameters: dns_firewall_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List DNS Firewall Clusters. A DNS Firewall cluster is a Cloudflare-hosted resolver placed in front of a customer's own authoritative nameservers, caching, rate-limiting and mitigating attacks on the way through. Start here: each cluster's id is what every other DNS Firewall tool takes, and the addresses Cloudflare returns are the ones the customer points resolvers at. DNS Firewall is Enterprise-only in Cloudflare's own plan table, and the API token needs the DNS Firewall Read or DNS Firewall Write permission group. GET /accounts//dns_firewall. Path parameters: account_id. Optional filters: page, per_page. Page size defaults to 100, which is also the ceiling StackJack applies here. Cloudflare's request budget is counted per user and shared with the customer's own dashboard session, so prefer one larger page over many small calls. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update DNS Firewall Cluster. Why this is destructive: Partial update: Cloudflare applies only the fields present in the body. upstream_ips is the exception that bites - it is an ARRAY, so sending it replaces the whole upstream list rather than adding to it, and a short or mistyped list stops the cluster resolving for everything behind it. Read cf_get_dns_firewall first and send the complete list. DNS Firewall is Enterprise-only in Cloudflare's own plan table, and the API token needs the DNS Firewall Write permission group. PATCH /accounts//dns_firewall/. Path parameters: dns_firewall_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Update DNS Firewall Cluster Reverse DNS. Partial update: Cloudflare applies only the fields present in the body. ptr is a MAP of cluster IP address to PTR content, and Cloudflare does not document whether an address left out of the map is kept or cleared - read cf_get_dns_firewall_reverse_dns first and send the complete map. DNS Firewall is Enterprise-only in Cloudflare's own plan table, and the API token needs the DNS Firewall Write permission group. PATCH /accounts//dns_firewall//reverse_dns. Path parameters: dns_firewall_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List Scanned DNS Records. GET /zones//dns_records/scan/review. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Review Scanned DNS Records. Additive: accepts scanned records into the zone and removes none. POST /zones//dns_records/scan/review. Path parameters: zone_id. Send the request body as JSON; Cloudflare documents these fields: accepts, rejects. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Scan DNS Records. Additive: the scan adds records it discovers and removes none. POST /zones//dns_records/scan. Path parameters: zone_id. Send the request body as JSON, following Cloudflare's documented sample for this endpoint. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info. DEPRECATED by Cloudflare: this operation still answers, but the vendor marks it deprecated in its own API document and may withdraw it - prefer a non-deprecated tool for the same resource where one exists.

[Cloudflare] Trigger DNS Record Scan. Starts a scan; nothing is written to the zone until the review call accepts it. POST /zones//dns_records/scan/trigger. Path parameters: zone_id. An optional JSON request body is accepted; Cloudflare publishes no sample for this endpoint. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Batch DNS Records. Why this is destructive: One batch carries deletes, patches and puts together and applies them atomically, so it can remove records. POST /zones//dns_records/batch. Path parameters: zone_id. Optional filters: include_shadow_metadata. Send the request body as JSON; Cloudflare documents these fields: deletes, patches, posts, puts. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Create DNS Record. Additive, and the plan task rules DNS record create false. Cloudflare requires type, name and content; ttl of 1 means automatic, and proxied only applies to record types Cloudflare can proxy. A duplicate name and type is refused rather than merged. POST /zones//dns_records. Path parameters: zone_id. Optional filters: include_shadow_metadata. Send the request body as JSON, following Cloudflare's documented sample for this endpoint. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete DNS Record. Why this is destructive: Deletes the record; resolution for that name stops immediately. DELETE /zones//dns_records/. Path parameters: dns_record_id, zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Export DNS Records. Returns the whole zone as a BIND file, which is the quickest way to hand a customer or an auditor a complete picture of their DNS. This is the one Cloudflare response in this connector that is not JSON. GET /zones//dns_records/export. Path parameters: zone_id. Returns the zone file as plain text exactly as Cloudflare sent it, not JSON.

[Cloudflare] DNS Record Details. Reads one record by the id the list tool returned. Use it to confirm the current content, TTL and proxy state before an update, since the overwrite tool resets anything left out. GET /zones//dns_records/. Path parameters: dns_record_id, zone_id. Optional filters: include_shadow_metadata. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Import DNS Records. Why this is destructive: A BIND file import writes every record it contains in one call and overwrites a record of the same name and type. Takes the BIND zone text itself, not a file path or an upload. Review the export of the target zone first: this writes every record the file contains in one call. POST /zones//dns_records/import. Path parameters: zone_id. Send the BIND zone file text itself as the file argument - this is not a file upload, it is the zone text. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List DNS Records. The first call for almost any DNS question. Narrow with type (A, AAAA, CNAME, MX, TXT) and name; match=all means every filter must hit, match=any means at least one. The record id it returns is what the get, update, overwrite and delete tools take. GET /zones//dns_records. Path parameters: zone_id. Optional filters: name, name.exact, name.contains, name.startswith, name.endswith, type, content, content.exact, content.contains, content.startswith, content.endswith, proxied, match, comment, comment.present, comment.absent, comment.exact, comment.contains, comment.startswith, comment.endswith, tag, tag.present, tag.absent, tag.exact, tag.contains, tag.startswith, tag.endswith, search, tag_match, page, per_page, order, direction, include_shadow_metadata, shadowed_by_name, shadowing_name. Page size defaults to 100 and this endpoint accepts up to 1000. Cloudflare's request budget is counted per user and shared with the customer's own dashboard session, so prefer one larger page over many small calls. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Overwrite DNS Record. Why this is destructive: Wholesale replace: Cloudflare calls this Overwrite, and every field you omit is reset to its default rather than kept. PUT /zones//dns_records/. Path parameters: dns_record_id, zone_id. Optional filters: include_shadow_metadata. Send the request body as JSON, following Cloudflare's documented sample for this endpoint. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Update DNS Record. Partial update: omitted fields keep their value, and the plan task rules DNS record update false. The safe way to change one field of a record: anything you leave out keeps its current value. Prefer it over the overwrite tool unless you deliberately want the omitted fields reset. PATCH /zones//dns_records/. Path parameters: dns_record_id, zone_id. Optional filters: include_shadow_metadata. Send the request body as JSON, following Cloudflare's documented sample for this endpoint. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Create Internal DNS View. Additive: it creates a view and leaves every existing one alone. A zone named in zones starts being answered through this view immediately, so a zone bound to the wrong view answers the wrong clients. Internal DNS views are Enterprise-only, and the API token needs the DNS View Write permission group, which is separate from plain DNS Write. POST /accounts//dns_settings/views. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete Internal DNS View. Why this is destructive: The view goes and every zone bound to it loses that binding, so clients that were resolving those zones through the view stop getting the view's answers. The zones themselves survive; the binding does not, and it cannot be recovered from here. Internal DNS views are Enterprise-only, and the API token needs the DNS View Write permission group, which is separate from plain DNS Write. DELETE /accounts//dns_settings/views/. Path parameters: account_id, view_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Show account DNS settings. The ACCOUNT-level settings that sit above every zone: enforce_dns_only, and the zone_defaults block new zones inherit. cf_get_zones_dns_settings is the per-zone read - Cloudflare gives both operations the same summary, so check the path when choosing. The API token needs the Account DNS Settings Read permission group. GET /accounts//dns_settings. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DNS Internal View Details. Reads one view and the zone ids bound to it. Worth doing before cf_update_dns_settings_view, because zones is an array that the PATCH replaces. Internal DNS views are Enterprise-only, and the API token needs the DNS View Read or DNS View Write permission group, which is separate from plain DNS Read. GET /accounts//dns_settings/views/. Path parameters: account_id, view_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Show zone DNS settings. The per-ZONE settings: nameservers.type and nameservers.ns_set, which decide the nameservers the zone is delegated to, plus zone_mode, flatten_all_cnames, multi_provider, secondary_overrides, ns_ttl and the SOA components. cf_get_dns_settings is the account-level read - Cloudflare gives both operations the same summary, so check the path when choosing. The API token needs Zone DNS Settings Read or DNS Read. GET /zones//dns_settings. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List Internal DNS Views. An internal DNS view binds a set of zones together so they are answered only to clients resolving through that view - Cloudflare's split-horizon construct. Start here: each view's id is what the get, update and delete tools take, and zones is the list of zone ids bound to it. Narrow with name and the name.exact / name.contains / name.startswith / name.endswith forms, or by zone_id or zone_name; match=all requires every filter to hit and match=any at least one. Internal DNS views are Enterprise-only, and the API token needs the DNS View Read or DNS View Write permission group, which is separate from plain DNS Read. GET /accounts//dns_settings/views. Path parameters: account_id. Optional filters: name, name.exact, name.contains, name.startswith, name.endswith, zone_id, zone_name, match, page, per_page, order, direction. Page size defaults to 100 and this endpoint accepts up to 1000. Cloudflare's request budget is counted per user and shared with the customer's own dashboard session, so prefer one larger page over many small calls. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update account DNS settings. Why this is destructive: This is the account-wide override. Cloudflare's own words for enforce_dns_only are that it 'forces all proxied DNS records in the account to behave as DNS-only at the edge, regardless of each record's individual proxy setting' - one call changes how every proxied record in every zone on the account is served, and each record's own proxy setting is ignored while it is on. The derived verdict read this as an ordinary partial update; the blast radius is the whole account. zone_defaults carries the settings a NEW zone starts with, so a change there is not retroactive, while enforce_dns_only takes effect for existing zones immediately. The API token needs the Account DNS Settings Write permission group. PATCH /accounts//dns_settings. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update Internal DNS View. Why this is destructive: Partial update: Cloudflare applies only the fields present. zones is an ARRAY, so sending it replaces the whole binding list and a zone left out of it stops being answered through this view. Read cf_get_dns_settings_view first and send the complete list. Internal DNS views are Enterprise-only, and the API token needs the DNS View Write permission group, which is separate from plain DNS Write. PATCH /accounts//dns_settings/views/. Path parameters: account_id, view_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update zone DNS settings. Why this is destructive: nameservers.type and nameservers.ns_set decide which nameservers the WHOLE zone is delegated to - cloudflare.standard, cloudflare.advanced, custom.account, custom.tenant or custom.zone - and a zone whose delegation stops matching the NS records at its registrar stops resolving for everyone. zone_mode switches the entire zone between standard, cdn_only and dns_only, and flatten_all_cnames changes what every CNAME in the zone answers. Cloudflare deprecated PUT /zones//custom_ns in favour of THIS operation, and that one is destructive, so the replacement cannot be gentler than the call it replaces. The derived verdict read this as an ordinary partial update. The one tool here that changes zone-wide DNS behaviour rather than a single record; cf_update_dns_record is what you want for one name. foundation_dns is deprecated in Cloudflare's own schema - use nameservers.type to configure Advanced Nameservers. The API token needs Zone DNS Settings Write plus DNS Write. PATCH /zones//dns_settings. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Get DNS Record Usage for Account. GET /accounts//dns_records/usage. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Get DNS Record Usage. GET /zones//dns_records/usage. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete DNSSEC records. Why this is destructive: DNSSEC is turned off for the zone and Cloudflare discards the signing material. If the registrar still publishes the zone's DS record, every validating resolver refuses the whole domain from that moment - remove the DS record at the registrar FIRST. Enabling again later produces a new key and a new DS record, so the old one never becomes valid again. DELETE /zones//dnssec. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DNSSEC Details. The zone's DNSSEC state and the DS record the customer has to publish at their REGISTRAR: status, algorithm, digest, digest_type, key_tag, flags and public_key, plus a ready-made ds string. Read this first - DNSSEC only takes effect once that DS record is at the registrar, and removing it there is the first step of turning DNSSEC off safely. GET /zones//dnssec. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List DNSSEC ZSKs. The Zone Signing Keys DNSSEC uses for this zone: each entry carries its DNSKEY record, a lifecycle Tag (active, publish, external, retired, revoked or removed) and the storage Location Cloudflare keeps the key material in. The SigningKey member includes the key's encrypted PRIVATE key material, so treat the whole result as credential material and do not persist it. Cloudflare paginates nothing here: the whole collection comes back in one response. GET /zones//dnssec/zsk. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Edit DNSSEC Status. Why this is destructive: Cloudflare's own description of this operation is 'Enable or disable DNSSEC', and status takes active or disabled. Disabling DNSSEC while the registrar still publishes the zone's DS record makes every validating resolver refuse the WHOLE domain - the DS record has to be removed at the registrar first. dnssec_presigned and dnssec_multi_signer also change how the zone is signed for everyone who validates it. The summary-verb arm reads the vendor's summary, which here is the neutral 'Edit DNSSEC Status', so the derived verdict never saw the disable. Enabling returns the DS record to publish at the registrar; nothing validates until it is there. PATCH /zones//dnssec. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Create ACL. Additive: it widens what the account accepts transfer traffic from and narrows nothing. The range applies to the ENTIRE account, not to one zone. Secondary DNS is Enterprise-only, and this account-level call sits under the Account Settings Write permission group rather than DNS - a DNS-scoped token gets a 403 here. POST /accounts//secondary_dns/acls. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Create Peer. Additive: it registers one more peer on the account. Only name is required, so the peer arrives without an address and transfers nothing until cf_set_secondary_dns_peer fills in ip, port and any tsig_id. Secondary DNS is Enterprise-only, and this account-level call sits under the Account Settings Write permission group rather than DNS - a DNS-scoped token gets a 403 here. POST /accounts//secondary_dns/peers. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Create TSIG. Additive: it stores one more TSIG key on the account and rebinds no peer - a transfer only starts using it once cf_set_secondary_dns_peer names its id as tsig_id. The secret you send IS the shared secret, and the response echoes it back. Secondary DNS is Enterprise-only, and this account-level call sits under the Account Settings Write permission group rather than DNS - a DNS-scoped token gets a 403 here. POST /accounts//secondary_dns/tsigs. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Force AXFR. Why this is destructive: It dispatches a full AXFR to the zone's primary nameservers right now, and Cloudflare replaces its copy of the zone with whatever the primary answers - every record in the zone, at once. A primary serving a truncated or wrong zone at that moment becomes what the internet sees within the TTL. It also bypasses the auto_refresh_seconds schedule, so it is the call that turns a primary-side mistake into a live one immediately. Cloudflare answers with the ordinary JSON envelope and performs the transfer asynchronously, so read the zone's records or cf_get_zones_secondary_dns_incomings afterwards to see what arrived. Secondary DNS is Enterprise-only, and the API token needs Zone Settings Write plus DNS Write on this zone. POST /zones//secondary_dns/force_axfr. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Create Secondary Zone Configuration. Additive for this zone: it registers the incoming transfer configuration and names the peers Cloudflare will pull from. Once it exists the zone's contents come from the primary nameserver over AXFR/IXFR rather than from records edited at Cloudflare. Secondary DNS is Enterprise-only, and the API token needs Zone Settings Write plus DNS Write on this zone. POST /zones//secondary_dns/incoming. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Create Primary Zone Configuration. Additive for this zone: it registers the outgoing transfer configuration naming the secondaries Cloudflare will serve. Creating the configuration and switching transfers on are separate calls here - cf_enable_zones_secondary_dns_outgoing is the switch. Secondary DNS is Enterprise-only, and the API token needs Zone Settings Write plus DNS Write on this zone. POST /zones//secondary_dns/outgoing. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Force DNS NOTIFY. Why this is destructive: Cloudflare's own description is 'Notifies the secondary nameserver(s) and clears IXFR backlog of primary zone'. Clearing the backlog is the destructive half: the incremental history the secondaries would have used is discarded, so each one has to pull the whole zone again, and a secondary that cannot complete a full AXFR keeps serving its old copy. The NOTIFY itself reaches the customer's own nameservers immediately. Secondary DNS is Enterprise-only, and the API token needs Zone Settings Write plus DNS Write on this zone. POST /zones//secondary_dns/outgoing/force_notify. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete ACL. Why this is destructive: The account stops accepting zone-transfer traffic from that IP range. Every secondary zone relying on it for NOTIFY, and every primary zone relying on it to permit AXFR/IXFR, stops transferring - and because a stalled transfer keeps serving the last copy, the symptom is a zone that silently goes stale rather than an error. Secondary DNS is Enterprise-only, and this account-level call sits under the Account Settings Write permission group rather than DNS - a DNS-scoped token gets a 403 here. DELETE /accounts//secondary_dns/acls/. Path parameters: acl_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete Peer. Why this is destructive: The peer is removed from the account and every zone whose peers array names it loses that transfer relationship: a secondary zone stops pulling from that primary, and a primary zone stops notifying that secondary. The zones keep serving the records they last had, so the failure shows up as stale data rather than an error. Secondary DNS is Enterprise-only, and this account-level call sits under the Account Settings Write permission group rather than DNS - a DNS-scoped token gets a 403 here. DELETE /accounts//secondary_dns/peers/. Path parameters: peer_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete TSIG. Why this is destructive: The shared secret is removed from the account. Any peer still naming this key as its tsig_id can no longer authenticate a transfer, so the zones behind it stop transferring and quietly go stale. Cloudflare never returns a deleted secret again, so a key removed by mistake has to be regenerated and reconfigured on BOTH sides. Secondary DNS is Enterprise-only, and this account-level call sits under the Account Settings Write permission group rather than DNS - a DNS-scoped token gets a 403 here. DELETE /accounts//secondary_dns/tsigs/. Path parameters: tsig_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete Secondary Zone Configuration. Why this is destructive: The zone stops being a secondary: Cloudflare no longer pulls from the primary, the peers list goes and the refresh schedule with it. The records already transferred stay, so the visible symptom is a zone frozen at its last transfer rather than a zone that disappears. Secondary DNS is Enterprise-only, and the API token needs Zone Settings Write plus DNS Write on this zone. DELETE /zones//secondary_dns/incoming. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete Primary Zone Configuration. Why this is destructive: The zone stops being a transfer source: every secondary loses its NOTIFY and its permission to pull, and each one keeps serving the copy it already holds. Because those secondaries usually answer for the domain alongside Cloudflare, the internet keeps getting the stale copy rather than an error. Secondary DNS is Enterprise-only, and the API token needs Zone Settings Write plus DNS Write on this zone. DELETE /zones//secondary_dns/outgoing. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Disable Outgoing Zone Transfers. Why this is destructive: Cloudflare's own description is 'Disable outgoing zone transfers for primary zone and clears IXFR backlog of primary zone'. Two things happen: the secondaries stop being served, and the IXFR backlog is discarded - so when transfers are enabled again the secondaries cannot pick up incrementally and need a full AXFR. Until they manage one, each keeps answering from the copy it already holds. cf_enable_zones_secondary_dns_outgoing turns it back on; the configuration and its peers are left alone by both. Secondary DNS is Enterprise-only, and the API token needs Zone Settings Write plus DNS Write on this zone. POST /zones//secondary_dns/outgoing/disable. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Enable Outgoing Zone Transfers. Turns outgoing zone transfers back on for the zone. It is the reverse of cf_disable_zones_secondary_dns_outgoing and adds nothing to the configuration - the peers the zone already names start being notified and allowed to transfer again. Secondary DNS is Enterprise-only, and the API token needs Zone Settings Write plus DNS Write on this zone. POST /zones//secondary_dns/outgoing/enable. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] ACL Details. Reads one ACL's name and ip_range. Worth doing before cf_set_secondary_dns_acl, which replaces the whole entry. Secondary DNS is Enterprise-only, and this account-level call sits under the Account Settings Read permission group rather than DNS - a DNS-scoped token gets a 403 here. GET /accounts//secondary_dns/acls/. Path parameters: acl_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Peer Details. Reads one peer's address, port, IXFR setting and the TSIG key id bound to it. Read it before cf_set_secondary_dns_peer, which replaces the peer wholesale. Secondary DNS is Enterprise-only, and this account-level call sits under the Account Settings Read permission group rather than DNS - a DNS-scoped token gets a 403 here. GET /accounts//secondary_dns/peers/. Path parameters: peer_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] TSIG Details. Reads one TSIG key. The response includes the secret in full, so treat the result as credential material and do not persist it. Secondary DNS is Enterprise-only, and this account-level call sits under the Account Settings Read permission group rather than DNS - a DNS-scoped token gets a 403 here. GET /accounts//secondary_dns/tsigs/. Path parameters: tsig_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Secondary Zone Configuration Details. The INCOMING side: this zone as a SECONDARY that Cloudflare pulls from the customer's own primary nameservers. Returns the zone's auto_refresh_seconds and the peer tags it transfers from. cf_get_zones_secondary_dns_outgoing_config is the other direction. Secondary DNS is Enterprise-only, and the API token needs Zone Settings Read or DNS Read on this zone. GET /zones//secondary_dns/incoming. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Primary Zone Configuration Details. The OUTGOING side: this zone as a PRIMARY that Cloudflare transfers out to the customer's own secondary nameservers. Returns the zone name and the peer tags Cloudflare NOTIFYs and answers AXFR/IXFR for. Mind the near-identical sibling - cf_get_zones_secondary_dns_outgoing_status, singular, reads the transfer STATUS at /outgoing/status, while this one reads the CONFIGURATION at /outgoing. Secondary DNS is Enterprise-only, and the API token needs Zone Settings Read or DNS Read on this zone. GET /zones//secondary_dns/outgoing. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Get Outgoing Zone Transfer Status. The transfer STATUS for this zone as a primary - not its configuration. Cloudflare serves it at /outgoing/status, while cf_get_zones_secondary_dns_outgoing_config (plural) serves the configuration at /outgoing; the two tool names differ by one character, so check which one you want. Secondary DNS is Enterprise-only, and the API token needs Zone Settings Read or DNS Read on this zone. GET /zones//secondary_dns/outgoing/status. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List ACLs. A Secondary DNS ACL is an account-wide IP range Cloudflare will accept zone-transfer traffic from: the extra NOTIFY sources allowed for secondary zones, and the addresses AXFR/IXFR requests may arrive from for primary zones. Start here - each entry's id is what the get, update and delete tools take. Cloudflare paginates nothing here: the whole collection comes back in one response. Secondary DNS is Enterprise-only, and this account-level call sits under the Account Settings Read permission group rather than DNS - a DNS-scoped token gets a 403 here. GET /accounts//secondary_dns/acls. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List Peers. A Secondary DNS peer is the other nameserver in a transfer relationship: for a zone Cloudflare is SECONDARY for, the peer is the customer's primary that Cloudflare pulls AXFR/IXFR from; for a zone Cloudflare is PRIMARY for, it is the secondary Cloudflare NOTIFYs. Start here - each peer's id is the tag that goes into a zone's peers array. Cloudflare paginates nothing here: the whole collection comes back in one response. Secondary DNS is Enterprise-only, and this account-level call sits under the Account Settings Read permission group rather than DNS - a DNS-scoped token gets a 403 here. GET /accounts//secondary_dns/peers. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List TSIGs. A TSIG key is the shared secret that authenticates a zone transfer between Cloudflare and a peer. Start here - each entry's id is what cf_set_secondary_dns_peer takes as tsig_id. Every entry includes its secret in full, so treat the result as credential material and do not persist it. Cloudflare paginates nothing here: the whole collection comes back in one response. Secondary DNS is Enterprise-only, and this account-level call sits under the Account Settings Read permission group rather than DNS - a DNS-scoped token gets a 403 here. GET /accounts//secondary_dns/tsigs. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update ACL. Why this is destructive: A PUT replaces the ACL outright and Cloudflare requires id, name and ip_range together, so every call rewrites the allowed range for the whole account. Narrowing or mistyping ip_range stops zone transfers from the addresses it used to permit, and those zones go stale rather than failing loudly. Secondary DNS is Enterprise-only, and this account-level call sits under the Account Settings Write permission group rather than DNS - a DNS-scoped token gets a 403 here. PUT /accounts//secondary_dns/acls/. Path parameters: acl_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update Peer. Why this is destructive: A PUT replaces the peer from the body and Cloudflare requires only id and name, so leaving ip, port, ixfr_enable or tsig_id out CLEARS them. Dropping tsig_id is the one that bites: the transfer stops being TSIG-authenticated. Dropping ip leaves a peer that cannot transfer at all. Read cf_get_secondary_dns_peer first and send every field back. Secondary DNS is Enterprise-only, and this account-level call sits under the Account Settings Write permission group rather than DNS - a DNS-scoped token gets a 403 here. PUT /accounts//secondary_dns/peers/. Path parameters: peer_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update TSIG. Why this is destructive: A PUT replaces the TSIG key and Cloudflare requires id, name, secret and algo together, so every call rewrites the shared secret. The moment it changes, every peer still configured with the old secret fails authentication and stops transferring - change it on the peer nameserver in the same maintenance window. The response echoes the new secret back. Secondary DNS is Enterprise-only, and this account-level call sits under the Account Settings Write permission group rather than DNS - a DNS-scoped token gets a 403 here. PUT /accounts//secondary_dns/tsigs/. Path parameters: tsig_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update Secondary Zone Configuration. Why this is destructive: A PUT rewrites the zone's whole incoming transfer configuration, and peers is an ARRAY - a peer left out of it stops being a source for this zone. Drop them all and the zone stops refreshing entirely: it keeps serving the records it last pulled and silently goes stale rather than failing. Secondary DNS is Enterprise-only, and the API token needs Zone Settings Write plus DNS Write on this zone. PUT /zones//secondary_dns/incoming. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update Primary Zone Configuration. Why this is destructive: A PUT rewrites the zone's whole outgoing transfer configuration, and peers is an ARRAY - a secondary left out of it stops being notified and stops being allowed to transfer, so it freezes at the copy it already holds while the zone keeps changing at Cloudflare. Since those secondaries usually answer for the domain alongside Cloudflare, the internet keeps getting the stale copy. Secondary DNS is Enterprise-only, and the API token needs Zone Settings Write plus DNS Write on this zone. PUT /zones//secondary_dns/outgoing. Path parameters: zone_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Get user analytics dashboard. Cloudflare's named replacement is the GraphQL Analytics API (developers.cloudflare.com/analytics/graphql-api), which is where new work should go. Totals and time series aggregated across EVERY zone the token owner owns rather than one account, and only zones the user can read analytics for are counted. Omit since and until for the last seven days. GET /user/analytics/dashboard. Optional filters: since, until, continuous. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info. DEPRECATED by Cloudflare: this operation still answers, but the vendor marks it deprecated in its own API document and may withdraw it - prefer a non-deprecated tool for the same resource where one exists.

[Cloudflare] Get Account Usage (Version 2, Alpha, Restricted). Cost and usage for ONE account in the FinOps FOCUS v1.3 shape: one record per billable metric per account per day, including metered usage that falls inside a free allowance and costs nothing. Cloudflare has NOT yet populated the cost and pricing fields, so they are absent from the response until its billing integration lands. Omit from and to for the current month to date; the widest range Cloudflare accepts is 31 days. The surface is Alpha and restricted, so an account that has not been enabled for it is refused. Use cf_query_account_billable_usage to filter or group the same data. GET /accounts//billable/usage. Path parameters: account_id. Optional filters: from, to. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Query Account Usage (Version 2, Alpha, Restricted). The filterable counterpart of cf_get_account_billable_usage on the same path. Cloudflare documents it as a READ-ONLY operation that needs only the billing:read permission - POST is used purely so the filter criteria can travel in a body - which is why StackJack ships it as a read. POST /accounts//billable/usage. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Create an IP Access rule. Why this is destructive: The rule takes effect on EVERY zone the token owner owns, immediately. A block or challenge rule aimed at the wrong address can shut real visitors - or the customer's own office - out of all of those domains at once, and a zone-level rule is the narrower tool when only one domain is meant. POST /user/firewall/access_rules/rules. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete an IP Access rule. Why this is destructive: Removing a user-level rule lifts it from EVERY zone the token owner owns at once, so traffic the rule was blocking or challenging is served normally from the next request. Cloudflare keeps no copy - restoring it means creating it again. DELETE /user/firewall/access_rules/rules/. Path parameters: rule_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Get an IP Access rule. One user-level rule by id: the action it applies, what it matches and its notes. This is a USER-SCOPE endpoint: it answers for the token owner's own Cloudflare user, not for one account, and a token created under Manage Account cannot call it. GET /user/firewall/access_rules/rules/. Path parameters: rule_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List IP Access rules. USER-LEVEL IP Access rules, which is what makes this surface different from a zone's own firewall: one rule here applies to EVERY zone the token owner owns. Start here - the rule id the get, update and delete tools take comes from these rows. Each rule pairs a mode (the action) with a configuration (what it matches: an IP, a CIDR range, an AS number or a country code). This is a USER-SCOPE endpoint: it answers for the token owner's own Cloudflare user, not for one account, and a token created under Manage Account cannot call it. GET /user/firewall/access_rules/rules. Optional filters: mode, configuration.target, configuration.value, notes, match, page, per_page, order, direction. Page size defaults to 100, which is also the ceiling StackJack applies here. Cloudflare's request budget is counted per user and shared with the customer's own dashboard session, so prefer one larger page over many small calls. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update an IP Access rule. Why this is destructive: Cloudflare accepts only two changes here - the action (mode) and the notes - and the new action applies to every zone the token owner owns from the next request. PATCH /user/firewall/access_rules/rules/. Path parameters: rule_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Create Monitor. Additive: it creates one new health check and changes no pool. Nothing is probed until a pool references the monitor, but from that moment the check runs against that pool's origins on the interval you set. POST /user/load_balancers/monitors. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Create Pool. Additive: it creates one new pool and changes no existing one. No traffic reaches it until a load balancer references the pool, but its health checks begin as soon as it exists. POST /user/load_balancers/pools. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete Monitor. Why this is destructive: Any pool still pointing at this monitor loses its health check, so those origins stop being probed and stay at their last known state. Call cf_list_user_lb_monitors_references first to see what depends on it. DELETE /user/load_balancers/monitors/. Path parameters: monitor_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete Pool. Why this is destructive: Any load balancer still steering to this pool loses those origins, so traffic fails over to its remaining pools - or to nothing, if this was the last one. Call cf_list_user_lb_pools_references first to see what depends on it. DELETE /user/load_balancers/pools/. Path parameters: pool_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Monitor Details. One user-scope monitor by id, with the probe type, target and timing that decide when an origin counts as down. These are USER-SCOPE load balancing objects, owned by the token owner rather than by one account; the account-scope equivalents are cf_list_lb_monitors and cf_list_lb_pools. GET /user/load_balancers/monitors/. Path parameters: monitor_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Pool Details. One user-scope pool by id, with its origins, the monitor that probes them and the address alerted when its health changes. These are USER-SCOPE load balancing objects, owned by the token owner rather than by one account; the account-scope equivalents are cf_list_lb_monitors and cf_list_lb_pools. GET /user/load_balancers/pools/. Path parameters: pool_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Pool Health Details. The latest health of ONE pool: the per-origin and per-region results of the pool's monitor. This is the read that answers "why is traffic failing over?". GET /user/load_balancers/pools//health. Path parameters: pool_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Preview Result. Collects the result of a preview started by cf_preview_user_lb_monitors or cf_preview_user_lb_pools, using the preview_id that call returned. The probes run asynchronously, so an immediate read can come back incomplete. GET /user/load_balancers/preview/. Path parameters: preview_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List Regions. The region map Cloudflare steers load balancing by - which countries and subdivisions sit in which region code (WNAM, ENAM, WEU, SEAS and the rest). It is reference data, the same for every customer, and it is what a pool's check_regions and a load balancer's region rules expect. Filter by country_code or subdivision_code to find the region one place belongs to. GET /user/load_balancers/regions. Optional filters: subdivision_code, country_code. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List Monitors. Start here for user-scope load balancing: a monitor is the health check a pool runs against its origins, and each row's id is the monitor_id every other monitor tool takes. These are USER-SCOPE load balancing objects, owned by the token owner rather than by one account; the account-scope equivalents are cf_list_lb_monitors and cf_list_lb_pools. This endpoint takes no paging parameters - the whole collection comes back in one response. GET /user/load_balancers/monitors. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List Monitor References. Everything that points at this monitor - the pools whose health checking would change if you edited or deleted it. Call it before either. GET /user/load_balancers/monitors//references. Path parameters: monitor_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List Pools. Start here for user-scope pools: a pool is a named set of origins with a health check, and each row's id is the pool_id the other pool tools take. These are USER-SCOPE load balancing objects, owned by the token owner rather than by one account; the account-scope equivalents are cf_list_lb_monitors and cf_list_lb_pools. Filter by monitor to find the pools one health check governs. This endpoint takes no paging parameters - the whole collection comes back in one response. GET /user/load_balancers/pools. Optional filters: monitor. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List Pool References. Everything that points at this pool - the load balancers whose steering would change if you edited or deleted it. Call it before either. GET /user/load_balancers/pools//references. Path parameters: pool_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Preview Monitor. A simulation, not a change: Cloudflare runs the monitor settings in the body against the pools that use this monitor and hands back a preview_id. Nothing about the monitor or its pools is modified, which is why this POST ships as a read. Pass the preview_id to cf_get_user_lb_preview to collect the result. POST /user/load_balancers/monitors//preview. Path parameters: monitor_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Preview Pool. A simulation, not a change: Cloudflare probes this pool's origins with the monitor settings in the body and hands back a preview_id, leaving the pool and its real monitor untouched - which is why this POST ships as a read. Pass the preview_id to cf_get_user_lb_preview. POST /user/load_balancers/pools//preview. Path parameters: pool_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update Monitor. Why this is destructive: A PUT replaces the whole monitor from the body, so any field you leave out reverts to Cloudflare's default rather than keeping its current value - an omitted expected_codes or interval can silently change when the pools using this monitor call an origin down. Read cf_get_user_lb_monitor first and send the complete object, or use cf_update_user_lb_monitor to change one field. PUT /user/load_balancers/monitors/. Path parameters: monitor_id. Send the request body as JSON; Cloudflare documents these fields: allow_insecure, consecutive_down, consecutive_up, description, expected_body, expected_codes, follow_redirects, header, interval, method, path, port. Cloudflare documents 4 more fields; see its API docs. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update Pool. Why this is destructive: A PUT replaces the whole pool from the body: an origin you leave out of origins is REMOVED from the pool and stops receiving traffic, and every omitted setting reverts to its default. Read cf_get_user_lb_pool first and send the complete object, or use cf_update_user_lb_pool_by_pool_id for one field. PUT /user/load_balancers/pools/. Path parameters: pool_id. Send the request body as JSON; Cloudflare documents these fields: check_regions, description, disabled_at, enabled, health_sources, latitude, load_shedding, longitude, minimum_origins, monitor, monitor_group, name. Cloudflare documents 5 more fields; see its API docs. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Patch Monitor. Partial update: Cloudflare applies only the fields you send and leaves the rest alone. The new probe settings are live on the next interval for every pool that references this monitor. PATCH /user/load_balancers/monitors/. Path parameters: monitor_id. Send the request body as JSON; Cloudflare documents these fields: allow_insecure, consecutive_down, consecutive_up, description, expected_body, expected_codes, follow_redirects, header, interval, method, path, port. Cloudflare documents 4 more fields; see its API docs. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Patch Pool. Why this is destructive: Partial update of ONE pool, but origins is a list: sending it at all REPLACES the whole origin list rather than merging into it, so an origin you leave out stops receiving traffic immediately. Read cf_get_user_lb_pool first and send the complete list. PATCH /user/load_balancers/pools/. Path parameters: pool_id. Send the request body as JSON; Cloudflare documents these fields: check_regions, description, disabled_at, enabled, health_sources, latitude, load_shedding, longitude, minimum_origins, monitor, monitor_group, name. Cloudflare documents 4 more fields; see its API docs. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Patch Pools. This is the BATCH form and it carries no pool id: Cloudflare applies the body to EVERY pool the token owner owns and answers with the list it changed. Sending notification_email here rewrites who is alerted for all of them; cf_update_user_lb_pool_by_pool_id is the one-pool tool. PATCH /user/load_balancers/pools. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Add Member. Why this is destructive: Grants a person access to the account with the roles you name. Cloudflare accepts one of TWO body shapes here and refuses a body that satisfies both: send email plus roles (a list of role ids from cf_list_account_roles), or email plus policies. Pick one and omit the other. status is optional and defaults to pending, which sends the invitation. POST /accounts//members. Path parameters: account_id. Send the request body as JSON; Cloudflare documents these fields: email, roles, status, policies. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Member Details. GET /accounts//members/. Path parameters: member_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List Members. Who can reach this Cloudflare account and with which roles. The member id this returns is what the update and remove tools take, and it is NOT the user id. GET /accounts//members. Path parameters: account_id. Optional filters: order, status, page, per_page, direction. Page size defaults to 50, which is this endpoint's own maximum and the ceiling StackJack applies here. Cloudflare's request budget is counted per user and shared with the customer's own dashboard session, so prefer one larger page over many small calls. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Remove Member. Why this is destructive: Removes the person from the account. DELETE /accounts//members/. Path parameters: member_id, account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update Member. Why this is destructive: Replaces the member role list wholesale, so this both grants and revokes privilege. Two body shapes, as on the add: send roles for a role-based member, or policies for a policy-based one, never both. This is a wholesale replace either way - whatever you send becomes the complete list, so read cf_get_account_member first and send the full set you want the member to end up with. PUT /accounts//members/. Path parameters: member_id, account_id. Send the request body as JSON; Cloudflare documents these fields: id, roles, status, user, policies. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Get User Membership. One membership of the token owner - the link between this user and an account, with the roles it carries and whether the invitation is accepted or still pending. This is a USER-SCOPE endpoint: it answers for the token owner's own Cloudflare user, not for one account, and a token created under Manage Account cannot call it. Cloudflare's API document lists only the legacy email plus Global API Key pair for this operation. StackJack always authenticates with an API token, so a refusal here means the token is missing the Memberships Write or Memberships Read permission rather than that the call is unsupported. GET /user/memberships/. Path parameters: membership_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Leave Organization. Why this is destructive: This is LEAVE ORGANIZATION: the token owner's own membership is removed, so that user loses everything the organization granted them and only an administrator who is still a member can invite them back. It does not delete the organization itself. Cloudflare's API document lists only the legacy email plus Global API Key pair for this operation. StackJack always authenticates with an API token, so a refusal here means the token is missing the permission this operation needs - Cloudflare names no permission group for it - rather than that the call is unsupported. DELETE /user/organizations/. Path parameters: organization_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info. DEPRECATED by Cloudflare: this operation still answers, but the vendor marks it deprecated in its own API document and may withdraw it - prefer a non-deprecated tool for the same resource where one exists.

[Cloudflare] Organization Details. One organization the token owner belongs to, with the membership status and permissions it carries. Cloudflare's API document lists only the legacy email plus Global API Key pair for this operation. StackJack always authenticates with an API token, so a refusal here means the token is missing the permission this operation needs - Cloudflare names no permission group for it - rather than that the call is unsupported. GET /user/organizations/. Path parameters: organization_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info. DEPRECATED by Cloudflare: this operation still answers, but the vendor marks it deprecated in its own API document and may withdraw it - prefer a non-deprecated tool for the same resource where one exists.

[Cloudflare] List Organizations. Organizations are Cloudflare's older Enterprise-only account grouping; accounts are the current model, so cf_list_accounts is almost always the read you want. Cloudflare caps per_page at 50 here and StackJack clamps to that ceiling. Cloudflare's API document lists only the legacy email plus Global API Key pair for this operation. StackJack always authenticates with an API token, so a refusal here means the token is missing the Memberships Write or Memberships Read permission rather than that the call is unsupported. GET /user/organizations. Optional filters: name, page, per_page, order, direction, match, status. Page size defaults to 50, which is this endpoint's own maximum and the ceiling StackJack applies here. Cloudflare's request budget is counted per user and shared with the customer's own dashboard session, so prefer one larger page over many small calls. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info. DEPRECATED by Cloudflare: this operation still answers, but the vendor marks it deprecated in its own API document and may withdraw it - prefer a non-deprecated tool for the same resource where one exists.

[Cloudflare] Get account profile. The account's business profile - legal name, business address, business email and phone, plus the organization metadata Cloudflare holds against the account. It is also the cheapest read for confirming the token really reaches the account you think it does. Cloudflare's API document lists only the legacy email plus Global API Key pair for this operation. StackJack always authenticates with an API token, so a refusal here means the token is missing the Trust and Safety Write or Trust and Safety Read or DNS View Write or DNS View Read or SCIM Provisioning or Load Balancers Account Write or Load Balancers Account Read or Zero Trust: PII Read or DDoS Botnet Feed Write or DDoS Botnet Feed Read or Workers R2 Storage Write or Workers R2 Storage Read or DDoS Protection Write or DDoS Protection Read or Workers Tail Read or Workers KV Storage Write or Workers KV Storage Read or Workers Scripts Write or Workers Scripts Read or Load Balancing: Monitors and Pools Write or Load Balancing: Monitors and Pools Read or Account Firewall Access Rules Write or Account Firewall Access Rules Read or DNS Firewall Write or DNS Firewall Read or Billing Write or Billing Read or Account Settings Write or Account Settings Read permission rather than that the call is unsupported. GET /accounts//profile. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Modify account profile. Why this is destructive: A PUT replaces the whole profile and Cloudflare requires ALL of business_address, business_email, business_name, business_phone and external_metadata in the body, so anything you omit is not kept. The business email is where Cloudflare sends this account's correspondence, so a wrong value here sends the customer's account mail somewhere else. Read cf_get_profiles first and send every value back. Cloudflare's API document lists only the legacy email plus Global API Key pair for this operation. StackJack always authenticates with an API token, so a refusal here means the token is missing the Account Settings Write permission rather than that the call is unsupported. PUT /accounts//profile. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Get Unique Transformations billing setting. Whether this account's image transformations are billed through the Unique Transformations pipeline. Read it before cf_update_settings_ut_billing, because that switch is one-way. GET /accounts//settings/ut-billing. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List Image Resizing configurations for account. The Image Resizing (transformations) state of EVERY zone in the account in one response, which is the quick way to find the zones where it is switched on. Changing it for one zone is a zone-settings call, not this one. GET /accounts//settings/transformations. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Change Unique Transformations billing setting. Why this is destructive: It changes how Cloudflare BILLS this account for image transformations, and Cloudflare does not permit the value to be set back to off once it has been enabled - so switching it on is a one-way change to the customer's invoice. Confirm the customer wants the Unique Transformations pricing model before sending it. PATCH /accounts//settings/ut-billing. Path parameters: account_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Create Token. Why this is destructive: It mints a live Cloudflare API credential that can act on everything its policies allow, from the moment it is created until it expires or is deleted. The value comes back exactly once - treat the response as a secret and keep it out of anything durable. The response carries the new token VALUE once and Cloudflare never shows it again, so capture it at that moment or roll the token later. Build policies from the permission group ids cf_list_user_tokens_permission_groups returns. POST /user/tokens. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Delete Token. Why this is destructive: The token stops authenticating immediately, so anything still using it - a script, a CI job, another integration - starts failing with 401 at once. Cloudflare cannot restore a deleted token; a replacement is a new token with a new value. DELETE /user/tokens/. Path parameters: token_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Token Details. One token's policies, status, expiry and last-used time by id. It never returns the token value - Cloudflare shows that only when the token is created or rolled. GET /user/tokens/. Path parameters: token_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List Tokens. The API tokens the token owner created, with their policies, status and expiry but never the token value itself. Each row's id is the token_id the get, update, roll and delete tools take. Set include_expired to include recently-expired tokens. Cloudflare caps per_page at 50 here and StackJack clamps to that ceiling. This is a USER-SCOPE endpoint: it answers for the token owner's own Cloudflare user, not for one account, and a token created under Manage Account cannot call it. GET /user/tokens. Optional filters: page, per_page, direction, include_expired. Page size defaults to 50, which is this endpoint's own maximum and the ceiling StackJack applies here. Cloudflare's request budget is counted per user and shared with the customer's own dashboard session, so prefer one larger page over many small calls. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] List Token Permission Groups. The catalog of permission groups a token policy can name - the id, name and scope of each. This is the read you make BEFORE cf_create_user_token, because a policy has to carry these ids. It returns names and identifiers only, never key material. GET /user/tokens/permission_groups. Optional filters: name, scope. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Roll Token. Why this is destructive: Rolling replaces the token's secret: the OLD value stops authenticating the moment Cloudflare answers, so every script, pipeline or integration still holding it fails with 401 until it is given the new value. That new value appears only in this response. The response body IS the new secret: result is the token string itself, and Cloudflare will never show it again. Capture it, store it, and update whatever was using the old value. PUT /user/tokens//value. Path parameters: token_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] DESTRUCTIVE: Update Token. Why this is destructive: A PUT replaces the token's whole definition, and policies is the part that bites: the array you send BECOMES what the token may do, so a policy left out is revoked the moment Cloudflare accepts the call and anything relying on it starts failing. Read cf_get_user_token first and send the complete set. Setting status to disabled switches the credential off without deleting it. PUT /user/tokens/. Path parameters: token_id. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.

[Cloudflare] Get transformation flows. The zone's image transformation flows - the named pipelines that decide which resizing and format transformations are allowed. Read it before writing: the write is a whole-document replace and it needs the version and etag this returns. GET /accounts//zones//v1/images/flows. Path parameters: accountId, zoneId. Returns the raw Cloudflare response envelope {success, errors, messages, result, result_info} exactly as the vendor sent it - the payload is under result and any paging metadata under result_info.