Token Validation

Token ValidationConfiguration

List token validation configurations

GET/zones/{zone_id}/token_validation/config

Get a token validation configuration

GET/zones/{zone_id}/token_validation/config/{config_id}

Create a token validation configuration

POST/zones/{zone_id}/token_validation/config

Edit a token validation configuration

PATCH/zones/{zone_id}/token_validation/config/{config_id}

Delete a token validation configuration

DELETE/zones/{zone_id}/token_validation/config/{config_id}

ModelsExpand Collapse

TokenConfig object { id, created_at, credentials, 5 more }

id: string

UUID.

maxLength36

minLength36

created_at: string

formatdate-time

credentials: object { keys }

keys: array of object { alg, e, kid, 2 more } or object { alg, crv, kid, 3 more } or object { alg, crv, kid, 3 more } or object { alg, kid, kty }

One of the following:

APIShieldCredentialsJWTKeyRSA object { alg, e, kid, 2 more }

JSON representation of an RSA key.

alg: "RS256" or "RS384" or "RS512" or 3 more

Algorithm

One of the following:

"RS256"

"RS384"

"RS512"

"PS256"

"PS384"

"PS512"

e: string

RSA exponent

kid: string

Key ID

kty: "RSA"

Key Type

n: string

RSA modulus

APIShieldCredentialsJWTKeyEcEs256 object { alg, crv, kid, 3 more }

JSON representation of an ES256 key

alg: "ES256"

Algorithm

crv: "P-256"

Curve

kid: string

Key ID

kty: "EC"

Key Type

x: string

X EC coordinate

y: string

Y EC coordinate

APIShieldCredentialsJWTKeyEcEs384 object { alg, crv, kid, 3 more }

JSON representation of an ES384 key

alg: "ES384"

Algorithm

crv: "P-384"

Curve

kid: string

Key ID

kty: "EC"

Key Type

x: string

X EC coordinate

y: string

Y EC coordinate

APIShieldCredentialsJWTKeyOctResponse object { alg, kid, kty }

JSON representation of a symmetric verification key in API responses (secret material is redacted).

alg: "HS256" or "HS384" or "HS512"

Algorithm

One of the following:

"HS256"

"HS384"

"HS512"

kid: string

Key ID

kty: "oct"

Key Type

description: string

maxLength500

last_updated: string

formatdate-time

title: string

maxLength50

token_sources: array of string

token_type: "JWT"

ConfigurationEditResponse object { id, description, title, token_sources }

id: optional string

UUID.

maxLength36

minLength36

description: optional string

maxLength500

title: optional string

maxLength50

token_sources: optional array of string

ConfigurationDeleteResponse object { id }

id: optional string

UUID.

maxLength36

minLength36

Token ValidationConfigurationCredentials

Replace token validation credentials

PUT/zones/{zone_id}/token_validation/config/{config_id}/credentials

Edit token validation credentials

PATCH/zones/{zone_id}/token_validation/config/{config_id}/credentials

ModelsExpand Collapse

CredentialUpdateResponse object { keys }

keys: array of object { alg, e, kid, 2 more } or object { alg, crv, kid, 3 more } or object { alg, crv, kid, 3 more } or object { alg, kid, kty }

One of the following:

APIShieldCredentialsJWTKeyRSA object { alg, e, kid, 2 more }

JSON representation of an RSA key.

alg: "RS256" or "RS384" or "RS512" or 3 more

Algorithm

One of the following:

"RS256"

"RS384"

"RS512"

"PS256"

"PS384"

"PS512"

e: string

RSA exponent

kid: string

Key ID

kty: "RSA"

Key Type

n: string

RSA modulus

APIShieldCredentialsJWTKeyEcEs256 object { alg, crv, kid, 3 more }

JSON representation of an ES256 key

alg: "ES256"

Algorithm

crv: "P-256"

Curve

kid: string

Key ID

kty: "EC"

Key Type

x: string

X EC coordinate

y: string

Y EC coordinate

APIShieldCredentialsJWTKeyEcEs384 object { alg, crv, kid, 3 more }

JSON representation of an ES384 key

alg: "ES384"

Algorithm

crv: "P-384"

Curve

kid: string

Key ID

kty: "EC"

Key Type

x: string

X EC coordinate

y: string

Y EC coordinate

APIShieldCredentialsJWTKeyOctResponse object { alg, kid, kty }

JSON representation of a symmetric verification key in API responses (secret material is redacted).

alg: "HS256" or "HS384" or "HS512"

Algorithm

One of the following:

"HS256"

"HS384"

"HS512"

kid: string

Key ID

kty: "oct"

Key Type

CredentialEditResponse object { keys }

keys: array of object { alg, e, kid, 2 more } or object { alg, crv, kid, 3 more } or object { alg, crv, kid, 3 more } or object { alg, kid, kty }

One of the following:

APIShieldCredentialsJWTKeyRSA object { alg, e, kid, 2 more }

JSON representation of an RSA key.

alg: "RS256" or "RS384" or "RS512" or 3 more

Algorithm

One of the following:

"RS256"

"RS384"

"RS512"

"PS256"

"PS384"

"PS512"

e: string

RSA exponent

kid: string

Key ID

kty: "RSA"

Key Type

n: string

RSA modulus

APIShieldCredentialsJWTKeyEcEs256 object { alg, crv, kid, 3 more }

JSON representation of an ES256 key

alg: "ES256"

Algorithm

crv: "P-256"

Curve

kid: string

Key ID

kty: "EC"

Key Type

x: string

X EC coordinate

y: string

Y EC coordinate

APIShieldCredentialsJWTKeyEcEs384 object { alg, crv, kid, 3 more }

JSON representation of an ES384 key

alg: "ES384"

Algorithm

crv: "P-384"

Curve

kid: string

Key ID

kty: "EC"

Key Type

x: string

X EC coordinate

y: string

Y EC coordinate

APIShieldCredentialsJWTKeyOctResponse object { alg, kid, kty }

JSON representation of a symmetric verification key in API responses (secret material is redacted).

alg: "HS256" or "HS384" or "HS512"

Algorithm

One of the following:

"HS256"

"HS384"

"HS512"

kid: string

Key ID

kty: "oct"

Key Type

Token ValidationRules

List token validation rules

GET/zones/{zone_id}/token_validation/rules

Create a token validation rule

POST/zones/{zone_id}/token_validation/rules

Create token validation rules

POST/zones/{zone_id}/token_validation/rules/bulk

Edit token validation rules

PATCH/zones/{zone_id}/token_validation/rules/bulk

Get a token validation rule

GET/zones/{zone_id}/token_validation/rules/{rule_id}

Delete a token validation rule

DELETE/zones/{zone_id}/token_validation/rules/{rule_id}

Edit a token validation rule

PATCH/zones/{zone_id}/token_validation/rules/{rule_id}

ModelsExpand Collapse

TokenValidationRule object { action, description, enabled, 6 more }

A Token Validation rule that can enforce security policies using JWT Tokens.

action: "log" or "block"

Action to take on requests that match operations included in selector and fail expression.

One of the following:

"log"

"block"

description: string

A human-readable description that gives more details than title.

maxLength500

enabled: boolean

Toggle rule on or off.

expression: string

Rule expression. Requests that fail to match this expression will be subject to action.

For details on expressions, see the Cloudflare Docs.

selector: object { exclude, include }

Select operations covered by this rule.

For details on selectors, see the Cloudflare Docs.

exclude: optional array of object { operation_ids }

Ignore operations that were otherwise included by include.

operation_ids: optional array of string

Excluded operation IDs.

include: optional array of object { host }

Select all matching operations.

host: optional array of string

Included hostnames.

title: string

A human-readable name for the rule.

maxLength50

id: optional string

UUID.

maxLength36

minLength36

created_at: optional string

formatdate-time

last_updated: optional string

formatdate-time

RuleDeleteResponse = unknown