Skip to content
Cloudflare API
Start here
API Reference
User

Tokens

List Tokens
GET/user/tokens
Token Details
GET/user/tokens/{token_id}
Create Token
POST/user/tokens
Update Token
PUT/user/tokens/{token_id}
Delete Token
DELETE/user/tokens/{token_id}
Verify Token
GET/user/tokens/verify
ModelsExpand Collapse
TokenCreateResponse object { id, condition, creator_email_at_creation, 13 more }
id: optional string

Token identifier tag.

maxLength32
condition: optional object { request_ip }
request_ip: optional object { in, not_in }

Client IP restrictions.

in: optional array of TokenConditionCIDRList

List of IPv4/IPv6 CIDR addresses.

not_in: optional array of TokenConditionCIDRList

List of IPv4/IPv6 CIDR addresses.

creator_email_at_creation: optional string

The email address of the user who created the token at the time of creation. Only present for Account Owned API Tokens when a creator email was available.

maxLength90
expires_on: optional string

The expiration time on or after which the JWT MUST NOT be accepted for processing.

formatdate-time
issued_on: optional string

The time on which the token was created.

formatdate-time
last_used_on: optional string

Last time the token was used.

formatdate-time
modified_on: optional string

Last time the token was modified.

formatdate-time
name: optional string

Token name.

maxLength120
not_before: optional string

The time before which the token MUST NOT be accepted for processing.

formatdate-time
policies: optional array of TokenPolicy { id, effect, permission_groups, resources }

List of access policies assigned to the token.

id: string

Policy identifier.

effect: "allow" or "deny"

Allow or deny operations against the resources.

One of the following:
"allow"
"deny"
permission_groups: array of object { id, meta, name }

A set of permission groups that are specified to the policy.

id: string

Identifier of the permission group.

meta: optional object { category, deprecated, description, 5 more }

Attributes associated to the permission group.

category: optional string

A category used to group permission groups.

deprecated: optional string

Indicates whether the permission group is deprecated.

description: optional string

Additional information about the permission group.

editable: optional string

Indicates whether the permission group can be edited.

eol_at: optional string

The planned end-of-life date and time, when provided.

formatdate-time
label: optional string

A label identifying the permission group.

scopes: optional string

The scope associated with the permission group.

visibility: optional string

Indicates the permission group’s availability or visibility.

name: optional string

Name of the permission group.

resources: map[string] or map[map[string]]

A list of resource names that the policy applies to.

One of the following:
IAMResourcesTypeObjectString = map[string]

Map of simple string resource permissions

IAMResourcesTypeObjectNested = map[map[string]]

Map of nested resource permissions

provisioner_id: optional string

The identifier of the service that provisioned the token. For an OAuth-provisioned token, this is the OAuth client identifier. Present when provisioner_type is present and null when the identifier is unavailable.

provisioner_type: optional string

The type of service that provisioned the token. Only present for provisioned Account Owned API Tokens.

status: optional "active" or "disabled" or "expired"

Status of the token.

One of the following:
"active"
"disabled"
"expired"
token_prefix: optional string

The prefix of the token value, before the first underscore. Use it with token_suffix to identify a token. Only present for tokens created or rolled after this field was added.

token_suffix: optional string

The last 4 characters of the token value. Use it with token_prefix to identify a token. It is not unique. Only present for tokens created or rolled after this field was added.

maxLength4
minLength4
value: optional TokenValue

The token value.

maxLength80
minLength40
TokenDeleteResponse object { id }
id: string

Identifier

maxLength32
minLength32
TokenVerifyResponse object { id, status, expires_on, not_before }
id: string

Token identifier tag.

maxLength32
status: "active" or "disabled" or "expired"

Status of the token.

One of the following:
"active"
"disabled"
"expired"
expires_on: optional string

The expiration time on or after which the JWT MUST NOT be accepted for processing.

formatdate-time
not_before: optional string

The time before which the token MUST NOT be accepted for processing.

formatdate-time

TokensPermission Groups

List Token Permission Groups
GET/user/tokens/permission_groups
ModelsExpand Collapse
PermissionGroupListResponse object { id, category, is_selectable, 2 more }
id: optional string

Public ID.

category: optional "developer_platform" or "ai_and_machine_learning" or "dns_and_zones" or 10 more

Product category that this permission group belongs to.

One of the following:
"developer_platform"
"ai_and_machine_learning"
"dns_and_zones"
"app_security"
"rules_and_configuration"
"cloudflare_one_and_zero_trust"
"analytics_and_logs"
"network_services"
"media"
"email_and_messaging"
"cache_and_performance"
"account_and_billing"
"other"
is_selectable: optional boolean

Whether the caller can select this permission group when creating a token.

name: optional string

Permission Group Name

scopes: optional array of "com.cloudflare.api.account" or "com.cloudflare.api.account.zone" or "com.cloudflare.api.user" or "com.cloudflare.edge.r2.bucket"

Resources to which the Permission Group is scoped

One of the following:
"com.cloudflare.api.account"
"com.cloudflare.api.account.zone"
"com.cloudflare.api.user"
"com.cloudflare.edge.r2.bucket"

TokensValue

Roll Token
PUT/user/tokens/{token_id}/value