Skip to content
Cloudflare API
Start here
API Reference

Organizations

User API tokens can list and create Organizations, but reading, updating, or deleting an Organization requires a Global API key and your registered email address. The cloudflare_organization Terraform resource therefore requires a Global API key for its full lifecycle.

See Organizations authentication limitations for credential compatibility by operation. Each endpoint’s Security section lists its supported authentication methods, with Accepted Permissions where applicable.

resource cloudflare_organization

required Expand Collapse
name: String

The Organization name, limited to 65 UTF-8 bytes.

optional Expand Collapse
parent?: Attributes
id: String
profile?: Attributes

Optional profile fields, each limited to 1,000 UTF-8 bytes. An empty profile is ignored.

business_address?: String
business_email?: String
business_name?: String
business_phone?: String
external_metadata?: String
parent_id?: String

The current parent Organization ID. A different value is rejected; this endpoint cannot move an Organization.

computed Expand Collapse
id: String
create_time: Time
meta: Attributes
are_child_accounts_accessible_by_org_members: Bool
hierarchy_tags: List[String]

Ordered chain of organization tags from the root organization down to (and including) this organization itself. Root organizations return a single-element array containing their own tag; sub-organizations return [rootTag, ...intermediateTags, parentTag, selfTag]. Useful for constructing authorization scopes that need to cover every ancestor in the hierarchy.

managed_by: String
tenant_flags: Attributes

Enable features for Organizations.

account_creation: String
account_creation_applies_tenant_defaults: String
account_deletion: String
account_migration: String
account_mobility: String
enterprise_capability: String
member_management: String
sub_org_creation: String
tenant_type: String

cloudflare_organization

resource "cloudflare_organization" "example_organization" {
  name = "x"
  parent = {
    id = "a7b9c3d2e8f4a1b5c6d0e9f2a3b7c4d8"
  }
  profile = {
    business_address = "business_address"
    business_email = "business_email"
    business_name = "business_name"
    business_phone = "business_phone"
    external_metadata = "external_metadata"
  }
}

data cloudflare_organization

optional Expand Collapse
organization_id?: String
filter?: Attributes
id?: List[String]

Only return organizations with the specified IDs (ex. id=foo&id=bar). Send multiple elements by repeating the query value.

containing?: Attributes
account?: String

Filter the list of organizations to the ones that contain this particular account.

organization?: String

Filter the list of organizations to the ones that contain this particular organization.

user?: String

Filter the list of organizations to the ones that contain this particular user.

IMPORTANT: Just because an organization “contains” a user is not a representation of any authorization or privilege to manage any resources therein. An organization “containing” a user simply means the user is managed by that organization.

direction?: String

Sort direction for the order_by field. Defaults to asc when order_by is specified.

member?: Attributes
email?: String

Filter organizations to those where the given user, by email, is an active member of that exact organization. This does not include hierarchy-derived access.

name?: Attributes
contains?: String

(case-insensitive) Filter the list of organizations to where the name contains a particular string.

ends_with?: String

(case-insensitive) Filter the list of organizations to where the name ends with a particular string.

starts_with?: String

(case-insensitive) Filter the list of organizations to where the name starts with a particular string.

order_by?: String

Field to order results by. Currently supported values: name. When not specified, results are ordered by hierarchy.

page_size?: Int64

The amount of items to return. Defaults to 10.

page_token?: String

An opaque token returned from the last list response that when provided will retrieve the next page.

Parameters used to filter the retrieved list must remain in subsequent requests with a page token.

parent?: Attributes
id?: String

Filter the list of organizations to the ones that are a sub-organization of the specified organization.

“null” is a valid value to provide for this parameter. It means “where an organization has no parent (i.e. it is a ‘root’ organization).”

computed Expand Collapse
id: String
create_time: Time
name: String
meta: Attributes
are_child_accounts_accessible_by_org_members: Bool
hierarchy_tags: List[String]

Ordered chain of organization tags from the root organization down to (and including) this organization itself. Root organizations return a single-element array containing their own tag; sub-organizations return [rootTag, ...intermediateTags, parentTag, selfTag]. Useful for constructing authorization scopes that need to cover every ancestor in the hierarchy.

managed_by: String
tenant_flags: Attributes

Enable features for Organizations.

account_creation: String
account_creation_applies_tenant_defaults: String
account_deletion: String
account_migration: String
account_mobility: String
enterprise_capability: String
member_management: String
sub_org_creation: String
tenant_type: String
parent: Attributes
id: String
name: String
profile: Attributes
business_address: String
business_email: String
business_name: String
business_phone: String
external_metadata: String

cloudflare_organization

data "cloudflare_organization" "example_organization" {
  organization_id = "a7b9c3d2e8f4a1b5c6d0e9f2a3b7c4d8"
}

data cloudflare_organizations

optional Expand Collapse
direction?: String

Sort direction for the order_by field. Defaults to asc when order_by is specified.

order_by?: String

Field to order results by. Currently supported values: name. When not specified, results are ordered by hierarchy.

page_size?: Int64

The amount of items to return. Defaults to 10.

page_token?: String

An opaque token returned from the last list response that when provided will retrieve the next page.

Parameters used to filter the retrieved list must remain in subsequent requests with a page token.

id?: List[String]

Only return organizations with the specified IDs (ex. id=foo&id=bar). Send multiple elements by repeating the query value.

containing?: Attributes
account?: String

Filter the list of organizations to the ones that contain this particular account.

organization?: String

Filter the list of organizations to the ones that contain this particular organization.

user?: String

Filter the list of organizations to the ones that contain this particular user.

IMPORTANT: Just because an organization “contains” a user is not a representation of any authorization or privilege to manage any resources therein. An organization “containing” a user simply means the user is managed by that organization.

member?: Attributes
email?: String

Filter organizations to those where the given user, by email, is an active member of that exact organization. This does not include hierarchy-derived access.

name?: Attributes
contains?: String

(case-insensitive) Filter the list of organizations to where the name contains a particular string.

ends_with?: String

(case-insensitive) Filter the list of organizations to where the name ends with a particular string.

starts_with?: String

(case-insensitive) Filter the list of organizations to where the name starts with a particular string.

parent?: Attributes
id?: String

Filter the list of organizations to the ones that are a sub-organization of the specified organization.

“null” is a valid value to provide for this parameter. It means “where an organization has no parent (i.e. it is a ‘root’ organization).”

max_items?: Int64

Max items to fetch, default: 1000

computed Expand Collapse
result: List[Attributes]

The items returned by the data source

id: String
create_time: Time
meta: Attributes
are_child_accounts_accessible_by_org_members: Bool
hierarchy_tags: List[String]

Ordered chain of organization tags from the root organization down to (and including) this organization itself. Root organizations return a single-element array containing their own tag; sub-organizations return [rootTag, ...intermediateTags, parentTag, selfTag]. Useful for constructing authorization scopes that need to cover every ancestor in the hierarchy.

managed_by: String
tenant_flags: Attributes

Enable features for Organizations.

account_creation: String
account_creation_applies_tenant_defaults: String
account_deletion: String
account_migration: String
account_mobility: String
enterprise_capability: String
member_management: String
sub_org_creation: String
tenant_type: String
name: String
parent: Attributes
id: String
name: String
profile: Attributes
business_address: String
business_email: String
business_name: String
business_phone: String
external_metadata: String

cloudflare_organizations

data "cloudflare_organizations" "example_organizations" {
  id = ["a7b9c3d2e8f4a1b5c6d0e9f2a3b7c4d8"]
  containing = {
    account = "account"
    organization = "organization"
    user = "user"
  }
  direction = "asc"
  member = {
    email = "email"
  }
  name = {
    contains = "contains"
    ends_with = "endsWith"
    starts_with = "startsWith"
  }
  order_by = "name"
  page_size = 0
  page_token = "page_token"
  parent = {
    id = "a7b9c3d2e8f4a1b5c6d0e9f2a3b7c4d8"
  }
}

OrganizationsOrganization Accounts

data cloudflare_organization_accounts

required Expand Collapse
organization_id: String
optional Expand Collapse
direction?: String

Sort direction for the order_by field. Valid values: asc, desc. Defaults to asc when order_by is specified.

include_tags?: Bool

Include Account tags from the resource tag mirror. Omit this parameter to preserve the existing Account response shape.

order_by?: String

Field to order results by. Currently supported values: account_name.

page?: Int64

Legacy offset page number. Must be provided with per_page. Values below 1 are treated as

  1. Cursor pagination takes precedence when requested.
page_size?: Int64

The amount of items to return. Defaults to 10.

page_token?: String

An opaque token returned from the last list response that when provided will retrieve the next page.

Parameters used to filter the retrieved list must remain in subsequent requests with a page token.

per_page?: Int64

Legacy offset page size. Must be provided with page. Values are clamped to the range 1-100. Cursor pagination takes precedence when requested.

status?: String

Filter accounts by lifecycle status. Defaults to active.

account_pubname?: Attributes
contains?: String

(case-insensitive) Filter the list of accounts to where the account_pubname contains a particular string.

ends_with?: String

(case-insensitive) Filter the list of accounts to where the account_pubname ends with a particular string.

starts_with?: String

(case-insensitive) Filter the list of accounts to where the account_pubname starts with a particular string.

name?: Attributes
contains?: String

(case-insensitive) Filter the list of accounts to where the name contains a particular string.

ends_with?: String

(case-insensitive) Filter the list of accounts to where the name ends with a particular string.

starts_with?: String

(case-insensitive) Filter the list of accounts to where the name starts with a particular string.

include_total?: Bool

Whether to calculate and return the exact result_info.total_size for cursor pagination. Defaults to true. When false, total_size is omitted. page_size and include_total may change between pages; next_page_token remains the authoritative continuation signal. Legacy page/per_page requests always calculate total_count.

computed Expand Collapse
organization_accounts: List[Attributes]
id: String
created_on: Time
name: String
settings: Attributes
abuse_contact_email: String
access_approval_expiry: Time
api_access_enabled: Bool
Deprecateddefault_nameservers: String

Use DNS Settings instead. Deprecated.

enforce_twofactor: Bool
use_account_custom_ns_by_default: Bool

Use DNS Settings instead. Deprecated.

enforce_two_factor: Bool
type: String
tags: Map[String]

Account tags, present only when include_tags=true is requested.

account_pubname: String
account_tag: String
account_type: String

OrganizationsOrganization Profile

resource cloudflare_organization_profile

required Expand Collapse
organization_id: String
optional Expand Collapse
business_address?: String
business_email?: String
business_name?: String
business_phone?: String
external_metadata?: String

cloudflare_organization_profile

resource "cloudflare_organization_profile" "example_organization_profile" {
  organization_id = "a7b9c3d2e8f4a1b5c6d0e9f2a3b7c4d8"
  business_address = "business_address"
  business_email = "business_email"
  business_name = "business_name"
  business_phone = "business_phone"
  external_metadata = "external_metadata"
}

data cloudflare_organization_profile

required Expand Collapse
organization_id: String
computed Expand Collapse
business_address: String
business_email: String
business_name: String
business_phone: String
external_metadata: String

cloudflare_organization_profile

data "cloudflare_organization_profile" "example_organization_profile" {
  organization_id = "a7b9c3d2e8f4a1b5c6d0e9f2a3b7c4d8"
}

OrganizationsMembers

resource cloudflare_organization_member

required Expand Collapse
organization_id: String
member: Attributes
user: Attributes
email: String
computed Expand Collapse
id: String

Organization Member ID

create_time: Time
status: String
update_time: Time
meta: Map[JSON]
policies: List[Attributes]

Direct policies of the membership. Present only for DSR members enrolled in Organization Roles.

roles: List[Attributes]
id: String
scopes: List[Attributes]
key: String

An Organization (com.cloudflare.api.tenant.unit.<tag>) or Account (com.cloudflare.api.account.<tag>) key.

subset_of: List[JSON]

The route Organization for Account scopes. Optional in requests and always returned for Account scopes.

id: String

Omit to create a policy. An unchanged policy keeps its ID; a changed policy is replaced under a new ID.

user: Attributes
id: String
email: String
name: String
two_factor_authentication_enabled: Bool

data cloudflare_organization_member

required Expand Collapse
organization_id: String
optional Expand Collapse
member_id?: String

Organization Member ID

filter?: Attributes
page_size?: Int64

The amount of items to return. Defaults to 10.

page_token?: String

An opaque token returned from the last list response that when provided will retrieve the next page.

Parameters used to filter the retrieved list must remain in subsequent requests with a page token.

status?: List[String]

Filter the list of memberships by membership status. Defaults to active, pending, and rejected; pass canceled explicitly to include canceled memberships.

user?: Attributes
email?: String

Filter the list of memberships for a specific email that ends with a substring.

computed Expand Collapse
id: String

Organization Member ID

create_time: Time
status: String
update_time: Time
meta: Map[JSON]
policies: List[Attributes]

Direct policies of the membership. Present only for DSR members enrolled in Organization Roles.

roles: List[Attributes]
id: String
scopes: List[Attributes]
key: String

An Organization (com.cloudflare.api.tenant.unit.<tag>) or Account (com.cloudflare.api.account.<tag>) key.

subset_of: List[JSON]

The route Organization for Account scopes. Optional in requests and always returned for Account scopes.

id: String

Omit to create a policy. An unchanged policy keeps its ID; a changed policy is replaced under a new ID.

user: Attributes
id: String
email: String
name: String
two_factor_authentication_enabled: Bool

data cloudflare_organization_members

required Expand Collapse
organization_id: String
optional Expand Collapse
page_size?: Int64

The amount of items to return. Defaults to 10.

page_token?: String

An opaque token returned from the last list response that when provided will retrieve the next page.

Parameters used to filter the retrieved list must remain in subsequent requests with a page token.

status?: List[String]

Filter the list of memberships by membership status. Defaults to active, pending, and rejected; pass canceled explicitly to include canceled memberships.

user?: Attributes
email?: String

Filter the list of memberships for a specific email that ends with a substring.

max_items?: Int64

Max items to fetch, default: 1000

computed Expand Collapse
result: List[Attributes]

The items returned by the data source

id: String

Organization Member ID

create_time: Time
meta: Map[JSON]
status: String
update_time: Time
user: Attributes
id: String
email: String
name: String
two_factor_authentication_enabled: Bool
policies: List[Attributes]

Direct policies of the membership. Present only for DSR members enrolled in Organization Roles.

roles: List[Attributes]
id: String
scopes: List[Attributes]
key: String

An Organization (com.cloudflare.api.tenant.unit.<tag>) or Account (com.cloudflare.api.account.<tag>) key.

subset_of: List[JSON]

The route Organization for Account scopes. Optional in requests and always returned for Account scopes.

id: String

Omit to create a policy. An unchanged policy keeps its ID; a changed policy is replaced under a new ID.