Skip to content
Cloudflare API
Start here
API Reference

AI Gateway

resource cloudflare_ai_gateway

required Expand Collapse
id: String

Unique identifier of the AI Gateway within the account.

account_id: String
cache_invalidate_on_update: Bool
cache_ttl: Int64
collect_logs: Bool
rate_limiting_interval: Int64
rate_limiting_limit: Int64
optional Expand Collapse
logpush_public_key?: String
rate_limiting_technique?: String
retry_backoff?: String

Backoff strategy for retry delays

retry_delay?: Int64

Delay between retry attempts in milliseconds (0-60000)

retry_max_attempts?: Int64

Maximum number of retry attempts for failed requests (1-5)

dlp?: Attributes
action?: String
enabled: Bool
profiles?: List[String]
policies?: List[Attributes]
id: String
action: String
check: List[String]
enabled: Bool
profiles: List[String]
guardrails?: Attributes
prompt: Attributes
p1?: String
s1?: String
s10?: String
s11?: String
s12?: String
s13?: String
s14?: String
s2?: String
s3?: String
s4?: String
s5?: String
s6?: String
s7?: String
s8?: String
s9?: String
response: Attributes
p1?: String
s1?: String
s10?: String
s11?: String
s12?: String
s13?: String
s14?: String
s2?: String
s3?: String
s4?: String
s5?: String
s6?: String
s7?: String
s8?: String
s9?: String
stripe?: Attributes
authorization: String
usage_events: List[Attributes]
payload: String
authentication?: Bool

Require authentication for gateway access. New gateways must have authentication enabled. Once enabled, authentication cannot be disabled.

byok_only?: Bool

Requires customer-provided provider credentials and prevents fallback to Unified Billing.

log_classification?: Bool
log_management?: Int64
log_management_strategy?: String
logpush?: Bool
store_id?: String

Secrets Store used by this gateway. Omit on update to keep the current store. Cannot be cleared while stored keys or secret references depend on it.

workers_ai_billing_mode?: String

Controls how Workers AI inference calls routed through this gateway are billed. ‘postpaid’ bills the account directly through Workers AI; ‘unified’ deducts credits via AI Gateway using neuron-based pricing and delegates billing to AI Gateway.

zdr?: Bool
otel?: List[Attributes]
headers: Map[String]
url: String
authorization?: String
content_type?: String
spend_limits?: Attributes
enabled?: Bool
rules?: List[Attributes]
limit: Float64
limit_type: String
window: Int64
id?: String
enabled?: Bool
metadata?: Map[Attributes]
mode: String
values?: List[String]
model?: Attributes
mode: String
values: List[String]
ai_gateway_provider?: Attributes
mode: String
values: List[String]
technique?: String
computed Expand Collapse
created_at: Time
fedramp_level: String

FedRAMP compliance level: fedramp-medium or fedramp-high.

fedramp_mode: String

FedRAMP enforcement mode. “prefer” prioritizes compliant connectors but allows fallback. “require” strictly filters.

is_default: Bool
modified_at: Time

cloudflare_ai_gateway

resource "cloudflare_ai_gateway" "example_ai_gateway" {
  account_id = "3ebbcb006d4d46d7bb6a8c7f14676cb0"
  id = "my-gateway"
  cache_invalidate_on_update = true
  cache_ttl = 0
  collect_logs = true
  rate_limiting_interval = 0
  rate_limiting_limit = 0
  authentication = true
  byok_only = true
  dlp = {
    action = "BLOCK"
    enabled = true
    profiles = ["string"]
  }
  guardrails = {
    prompt = {
      p1 = "FLAG"
      s1 = "FLAG"
      s10 = "FLAG"
      s11 = "FLAG"
      s12 = "FLAG"
      s13 = "FLAG"
      s14 = "FLAG"
      s2 = "FLAG"
      s3 = "FLAG"
      s4 = "FLAG"
      s5 = "FLAG"
      s6 = "FLAG"
      s7 = "FLAG"
      s8 = "FLAG"
      s9 = "FLAG"
    }
    response = {
      p1 = "FLAG"
      s1 = "FLAG"
      s10 = "FLAG"
      s11 = "FLAG"
      s12 = "FLAG"
      s13 = "FLAG"
      s14 = "FLAG"
      s2 = "FLAG"
      s3 = "FLAG"
      s4 = "FLAG"
      s5 = "FLAG"
      s6 = "FLAG"
      s7 = "FLAG"
      s8 = "FLAG"
      s9 = "FLAG"
    }
  }
  log_classification = true
  log_management = 10000
  log_management_strategy = "STOP_INSERTING"
  logpush = true
  logpush_public_key = "xxxxxxxxxxxxxxxx"
  otel = [{
    headers = {
      foo = "string"
    }
    url = "https://example.com"
    authorization = "authorization"
    content_type = "json"
  }]
  rate_limiting_technique = "fixed"
  retry_backoff = "constant"
  retry_delay = 0
  retry_max_attempts = 1
  spend_limits = {
    enabled = true
    rules = [{
      limit = 1
      limit_type = "cost"
      window = 1
      id = "x"
      enabled = true
      metadata = {
        foo = {
          mode = "partition"
        }
      }
      model = {
        mode = "filter"
        values = ["string"]
      }
      ai_gateway_provider = {
        mode = "filter"
        values = ["string"]
      }
      technique = "fixed"
    }]
  }
  store_id = "store_id"
  stripe = {
    authorization = "authorization"
    usage_events = [{
      payload = "payload"
    }]
  }
  workers_ai_billing_mode = "postpaid"
  zdr = true
}

data cloudflare_ai_gateway

required Expand Collapse
account_id: String
optional Expand Collapse
id?: String

Unique identifier of the AI Gateway within the account.

filter?: Attributes
computed Expand Collapse
authentication: Bool

Require authentication for gateway access. New gateways must have authentication enabled. Once enabled, authentication cannot be disabled.

byok_only: Bool

Requires customer-provided provider credentials and prevents fallback to Unified Billing.

cache_invalidate_on_update: Bool
cache_ttl: Int64
collect_logs: Bool
created_at: Time
fedramp_level: String

FedRAMP compliance level: fedramp-medium or fedramp-high.

fedramp_mode: String

FedRAMP enforcement mode. “prefer” prioritizes compliant connectors but allows fallback. “require” strictly filters.

is_default: Bool
log_classification: Bool
log_management: Int64
log_management_strategy: String
logpush: Bool
logpush_public_key: String
modified_at: Time
rate_limiting_interval: Int64
rate_limiting_limit: Int64
rate_limiting_technique: String
retry_backoff: String

Backoff strategy for retry delays

retry_delay: Int64

Delay between retry attempts in milliseconds (0-60000)

retry_max_attempts: Int64

Maximum number of retry attempts for failed requests (1-5)

store_id: String

Secrets Store used by this gateway. Omit on update to keep the current store. Cannot be cleared while stored keys or secret references depend on it.

workers_ai_billing_mode: String

Controls how Workers AI inference calls routed through this gateway are billed. ‘postpaid’ bills the account directly through Workers AI; ‘unified’ deducts credits via AI Gateway using neuron-based pricing and delegates billing to AI Gateway.

zdr: Bool
dlp: Attributes
action: String
enabled: Bool
profiles: List[String]
policies: List[Attributes]
id: String
action: String
check: List[String]
enabled: Bool
profiles: List[String]
guardrails: Attributes
prompt: Attributes
p1: String
s1: String
s10: String
s11: String
s12: String
s13: String
s14: String
s2: String
s3: String
s4: String
s5: String
s6: String
s7: String
s8: String
s9: String
response: Attributes
p1: String
s1: String
s10: String
s11: String
s12: String
s13: String
s14: String
s2: String
s3: String
s4: String
s5: String
s6: String
s7: String
s8: String
s9: String
otel: List[Attributes]
headers: Map[String]
url: String
authorization: String
content_type: String
spend_limits: Attributes
enabled: Bool
rules: List[Attributes]
limit: Float64
limit_type: String
window: Int64
id: String
enabled: Bool
metadata: Map[Attributes]
mode: String
values: List[String]
model: Attributes
mode: String
values: List[String]
ai_gateway_provider: Attributes
mode: String
values: List[String]
technique: String
stripe: Attributes
authorization: String
usage_events: List[Attributes]
payload: String

cloudflare_ai_gateway

data "cloudflare_ai_gateway" "example_ai_gateway" {
  account_id = "3ebbcb006d4d46d7bb6a8c7f14676cb0"
  id = "my-gateway"
}

data cloudflare_ai_gateways

required Expand Collapse
account_id: String
optional Expand Collapse
max_items?: Int64

Max items to fetch, default: 1000

computed Expand Collapse
result: List[Attributes]

The items returned by the data source

id: String

Unique identifier of the AI Gateway within the account.

cache_invalidate_on_update: Bool
cache_ttl: Int64
collect_logs: Bool
created_at: Time
modified_at: Time
rate_limiting_interval: Int64
rate_limiting_limit: Int64
authentication: Bool

Require authentication for gateway access. New gateways must have authentication enabled. Once enabled, authentication cannot be disabled.

byok_only: Bool

Requires customer-provided provider credentials and prevents fallback to Unified Billing.

dlp: Attributes
action: String
enabled: Bool
profiles: List[String]
policies: List[Attributes]
id: String
action: String
check: List[String]
enabled: Bool
profiles: List[String]
fedramp_level: String

FedRAMP compliance level: fedramp-medium or fedramp-high.

fedramp_mode: String

FedRAMP enforcement mode. “prefer” prioritizes compliant connectors but allows fallback. “require” strictly filters.

guardrails: Attributes
prompt: Attributes
p1: String
s1: String
s10: String
s11: String
s12: String
s13: String
s14: String
s2: String
s3: String
s4: String
s5: String
s6: String
s7: String
s8: String
s9: String
response: Attributes
p1: String
s1: String
s10: String
s11: String
s12: String
s13: String
s14: String
s2: String
s3: String
s4: String
s5: String
s6: String
s7: String
s8: String
s9: String
is_default: Bool
log_classification: Bool
log_management: Int64
log_management_strategy: String
logpush: Bool
logpush_public_key: String
otel: List[Attributes]
headers: Map[String]
url: String
authorization: String
content_type: String
rate_limiting_technique: String
retry_backoff: String

Backoff strategy for retry delays

retry_delay: Int64

Delay between retry attempts in milliseconds (0-60000)

retry_max_attempts: Int64

Maximum number of retry attempts for failed requests (1-5)

spend_limits: Attributes
enabled: Bool
rules: List[Attributes]
limit: Float64
limit_type: String
window: Int64
id: String
enabled: Bool
metadata: Map[Attributes]
mode: String
values: List[String]
model: Attributes
mode: String
values: List[String]
ai_gateway_provider: Attributes
mode: String
values: List[String]
technique: String
store_id: String

Secrets Store used by this gateway. Omit on update to keep the current store. Cannot be cleared while stored keys or secret references depend on it.

stripe: Attributes
authorization: String
usage_events: List[Attributes]
payload: String
workers_ai_billing_mode: String

Controls how Workers AI inference calls routed through this gateway are billed. ‘postpaid’ bills the account directly through Workers AI; ‘unified’ deducts credits via AI Gateway using neuron-based pricing and delegates billing to AI Gateway.

zdr: Bool

cloudflare_ai_gateways

data "cloudflare_ai_gateways" "example_ai_gateways" {
  account_id = "3ebbcb006d4d46d7bb6a8c7f14676cb0"
  search = "search"
}

AI GatewayDynamic Routing

resource cloudflare_ai_gateway_dynamic_routing

required Expand Collapse
account_id: String
gateway_id: String
elements: List[Attributes]
id: String
outputs: Attributes
false?: Attributes
element_id: String
true?: Attributes
element_id: String
element_id?: String
fallback?: Attributes
element_id: String
success?: Attributes
element_id: String
type: String
properties?: Attributes
conditions?: JSON
key?: String
limit?: Float64
limit_type?: String
window?: Float64
model?: String
ai_gateway_dynamic_routing_provider?: String
retries?: Float64
timeout?: Float64
name: String
computed Expand Collapse
id: String
created_at: Time
modified_at: Time
success: Bool
deployment: Attributes
created_at: String
deployment_id: String
version_id: String
route: Attributes
id: String
account_tag: String
created_at: Time
deployment: Attributes
created_at: String
deployment_id: String
version_id: String
elements: List[Attributes]
id: String
outputs: Attributes
false: Attributes
element_id: String
true: Attributes
element_id: String
element_id: String
fallback: Attributes
element_id: String
success: Attributes
element_id: String
type: String
properties: Attributes
conditions: JSON
key: String
limit: Float64
limit_type: String
window: Float64
model: String
ai_gateway_dynamic_routing_provider: String
retries: Float64
timeout: Float64
gateway_id: String
modified_at: Time
name: String
version: Attributes
active: String
created_at: String
data: String
version_id: String
is_valid: Bool
version: Attributes
active: String
created_at: String
data: String
version_id: String
is_valid: Bool

cloudflare_ai_gateway_dynamic_routing

resource "cloudflare_ai_gateway_dynamic_routing" "example_ai_gateway_dynamic_routing" {
  account_id = "0d37909e38d3e99c29fa2cd343ac421a"
  gateway_id = "54442216"
  elements = [{
    id = "id"
    outputs = {
      next = {
        element_id = "elementId"
      }
    }
    type = "start"
  }]
  name = "x"
}

data cloudflare_ai_gateway_dynamic_routing

required Expand Collapse
account_id: String
gateway_id: String
id: String
computed Expand Collapse
created_at: Time
modified_at: Time
name: String
deployment: Attributes
created_at: String
deployment_id: String
version_id: String
elements: List[Attributes]
id: String
outputs: Attributes
false: Attributes
element_id: String
true: Attributes
element_id: String
element_id: String
fallback: Attributes
element_id: String
success: Attributes
element_id: String
type: String
properties: Attributes
conditions: JSON
key: String
limit: Float64
limit_type: String
window: Float64
model: String
ai_gateway_dynamic_routing_provider: String
retries: Float64
timeout: Float64
version: Attributes
active: String
created_at: String
data: String
version_id: String
is_valid: Bool

cloudflare_ai_gateway_dynamic_routing

data "cloudflare_ai_gateway_dynamic_routing" "example_ai_gateway_dynamic_routing" {
  account_id = "0d37909e38d3e99c29fa2cd343ac421a"
  gateway_id = "54442216"
  id = "54442216"
}