Organizations

User API tokens can list and create Organizations, but reading, updating, or deleting an Organization requires a Global API key and your registered email address. The cloudflare_organization Terraform resource therefore requires a Global API key for its full lifecycle.

See Organizations authentication limitations for credential compatibility by operation. Each endpoint’s Security section lists its supported authentication methods, with Accepted Permissions where applicable.

List organizations the user has access to

client.organizations.list(?, ?): SinglePage<Organization { id, create_time, meta, 3 more } >

GET/organizations

Get organization

client.organizations.get(, ?): Organization { id, create_time, meta, 3 more }

GET/organizations/{organization_id}

Create organization

client.organizations.create(, ?): Organization { id, create_time, meta, 3 more }

POST/organizations

Update organization

client.organizations.update(, , ?): Organization { id, create_time, meta, 3 more }

PUT/organizations/{organization_id}

Delete organization

client.organizations.delete(, ?): OrganizationDeleteResponse { id }

DELETE/organizations/{organization_id}

ModelsExpand Collapse

Organization { id, create_time, meta, 3 more }

References an Organization in the Cloudflare data model.

id: string

create_time: string

formatdate-time

meta: Meta { are_child_accounts_accessible_by_org_members, hierarchy_tags, managed_by, 2 more }

are_child_accounts_accessible_by_org_members?: boolean

hierarchy_tags?: Array<string>

Ordered chain of organization tags from the root organization down to (and including) this organization itself. Root organizations return a single-element array containing their own tag; sub-organizations return [rootTag, ...intermediateTags, parentTag, selfTag]. Useful for constructing authorization scopes that need to cover every ancestor in the hierarchy.

managed_by?: string

tenant_flags?: TenantFlags { account_creation, account_creation_applies_tenant_defaults, account_deletion, 5 more }

Enable features for Organizations.

account_creation: string

account_creation_applies_tenant_defaults: string

account_deletion: string

account_migration: string

account_mobility: string

enterprise_capability: string

member_management: string

sub_org_creation: string

tenant_type?: string

name: string

parent?: Parent { id, name }

id: string

name: string

profile?: Profile { business_address, business_email, business_name, 2 more }

business_address: string

business_email: string

business_name: string

business_phone: string

external_metadata: string

OrganizationDeleteResponse { id }

id: string

OrganizationsOrganization Accounts

OrganizationsOrganization Profile

Get organization profile

client.organizations.organizationProfile.get(, ?): Result { business_address, business_email, business_name, 2 more }

GET/organizations/{organization_id}/profile

Modify organization profile.

client.organizations.organizationProfile.update(, , ?): void

PUT/organizations/{organization_id}/profile

ModelsExpand Collapse

OrganizationProfile { business_address, business_email, business_name, 2 more }

business_address: string

business_email: string

business_name: string

business_phone: string

external_metadata: string

OrganizationsMembers

OrganizationsLogs

OrganizationsLogsAudit

Get organization audit logs (Version 2)

client.organizations.logs.audit.list(, , ?): CursorPaginationAfter<AuditListResponse { id, action, actor, 3 more } >

GET/organizations/{organization_id}/logs/audit

Get resource change history from an organization audit log entry (Version 2)

client.organizations.logs.audit.history(, , ?): AuditHistoryResponse { id, action, actor, 3 more }

GET/organizations/{organization_id}/logs/audit/{id}/history

ModelsExpand Collapse

AuditListResponse { id, action, actor, 3 more }

id?: string

A unique identifier for the audit log entry.

maxLength32

action?: Action { description, result, time, type }

Provides information about the action performed.

description?: string

A short description of the action performed.

result?: string

The result of the action, indicating success or failure.

time?: string

A timestamp indicating when the action was logged.

formatdate-time

type?: string

A short string that describes the action that was performed.

actor?: Actor { id, context, email, 4 more }

Provides details about the actor who performed the action.

id?: string

The ID of the actor who performed the action. If a user performed the action, this will be their User ID.

context?: "api" | "api_key" | "api_token" | 3 more

The context in which the action was initiated.

api: The action was performed through the API. The specific credential type was not recorded.
api_key: The action was authenticated with a Cloudflare Global API Key.
api_token: The action was authenticated with an API token.
dash: The action was performed through the Cloudflare dashboard.
oauth: The action was authenticated with an OAuth token.
origin_ca_key: The action was authenticated with an Origin CA key.

One of the following:

"api"

"api_key"

"api_token"

"dash"

"oauth"

"origin_ca_key"

email?: string

The email of the actor who performed the action.

formatemail

ip_address?: string

The IP address of the request that performed the action.

token_id?: string

The API token ID when the actor context is an api_token or oauth.

token_name?: string

The API token name when the actor context is an api_token or oauth.

type?: "cloudflare_admin" | "system" | "user"

The type of actor.

One of the following:

"cloudflare_admin"

"system"

"user"

organization?: Organization { id }

Contains organization related information.

id?: string

A unique identifier for the organization.

raw?: Raw { cf_ray_id, method, status_code, 2 more }

Provides raw information about the request and response.

cf_ray_id?: string

The Cloudflare Ray ID for the request.

method?: string

The HTTP method of the request.

status_code?: number

The HTTP response status code returned by the API.

uri?: string

The URI of the request.

user_agent?: string

The client’s user agent string sent with the request.

resource?: Resource { id, product, request, 3 more }

Provides details about the affected resource.

id?: string

The unique identifier for the affected resource.

product?: string

The Cloudflare product associated with the resource.

request?: unknown

response?: unknown

scope?: unknown

The scope of the resource.

type?: string

The type of the resource.

AuditHistoryResponse = Array<AuditHistoryResponseItem>

id?: string

A unique identifier for the audit log entry.

maxLength32

action?: Action { description, result, time, type }

Provides information about the action performed.

description?: string

A short description of the action performed.

result?: string

The result of the action, indicating success or failure.

time?: string

A timestamp indicating when the action was logged.

formatdate-time

type?: string

A short string that describes the action that was performed.

actor?: Actor { id, context, email, 4 more }

Provides details about the actor who performed the action.

id?: string

The ID of the actor who performed the action. If a user performed the action, this will be their User ID.

context?: "api" | "api_key" | "api_token" | 3 more

The context in which the action was initiated.

api: The action was performed through the API. The specific credential type was not recorded.
api_key: The action was authenticated with a Cloudflare Global API Key.
api_token: The action was authenticated with an API token.
dash: The action was performed through the Cloudflare dashboard.
oauth: The action was authenticated with an OAuth token.
origin_ca_key: The action was authenticated with an Origin CA key.

One of the following:

"api"

"api_key"

"api_token"

"dash"

"oauth"

"origin_ca_key"

email?: string

The email of the actor who performed the action.

formatemail

ip_address?: string

The IP address of the request that performed the action.

token_id?: string

The API token ID when the actor context is an api_token or oauth.

token_name?: string

The API token name when the actor context is an api_token or oauth.

type?: "cloudflare_admin" | "system" | "user"

The type of actor.

One of the following:

"cloudflare_admin"

"system"

"user"

organization?: Organization { id }

Contains organization related information.

id?: string

A unique identifier for the organization.

raw?: Raw { cf_ray_id, method, status_code, 2 more }

Provides raw information about the request and response.

cf_ray_id?: string

The Cloudflare Ray ID for the request.

method?: string

The HTTP method of the request.

status_code?: number

The HTTP response status code returned by the API.

uri?: string

The URI of the request.

user_agent?: string

The client’s user agent string sent with the request.

resource?: Resource { id, product, request, 3 more }

Provides details about the affected resource.

id?: string

The unique identifier for the affected resource.

product?: string

The Cloudflare product associated with the resource.

request?: unknown

response?: unknown

scope?: unknown

The scope of the resource.

type?: string

The type of the resource.

OrganizationsBilling

OrganizationsBillingUsage

Get Organization Usage (Version 2, Alpha, Restricted)

client.organizations.billing.usage.get(, ?, ?): UsageGetResponse { ChargeCategory, ChargeDescription, ChargeFrequency, 33 more }

GET/organizations/{organization_id}/billable/usage

ModelsExpand Collapse

UsageGetResponse = Array<UsageGetResponseItem>

Contains the array of cost and usage records.

ChargeCategory: "Usage"

Highest-level classification of a charge based on the nature of how it gets billed. Currently only “Usage” is supported.

ChargeDescription: string

Self-contained summary of the charge’s purpose and price.

ChargeFrequency: "Usage-Based"

Indicates how often a charge occurs. Currently only “Usage-Based” is supported.

ChargePeriodEnd: string

Exclusive end of the time interval during which the usage was consumed.

formatdate-time

ChargePeriodStart: string

Inclusive start of the time interval during which the usage was consumed.

formatdate-time

ConsumedUnit: string

Unit of measure for the consumed quantity (e.g., “GB”, “Requests”, “vCPU-Hours”).

HostProviderName: string

Name of the entity providing the underlying infrastructure or platform.

InvoiceIssuerName: string

Name of the entity responsible for invoicing for the services consumed.

ServiceProviderName: string

Name of the entity that made the services available for purchase.

x_BillableMetricId: string

The unique identifier for the billable metric in the Cloudflare catalog. Cloudflare extension; replaces FOCUS SkuId.

BilledCost?: number | null

A charge serving as the basis for invoicing, inclusive of all reduced rates and discounts while excluding the amortization of upfront charges (one-time or recurring).

BillingAccountId?: string

Public identifier of the Cloudflare account (account tag). Omitted when account is not part of the requested grouping, and always omitted for usage measured at contract level, even when grouping by account: that usage is returned as its own record with no account.

BillingAccountName?: string

Display name of the Cloudflare account. Omitted when account is not part of the requested grouping, and for usage measured at contract level.

BillingCurrency?: string | null

Currency that a charge was billed in (ISO 4217).

BillingPeriodEnd?: string | null

Exclusive end of the billing cycle that contains this usage record.

formatdate-time

BillingPeriodStart?: string | null

Inclusive start of the billing cycle that contains this usage record.

formatdate-time

ChargeClass?: "Correction" | null

Indicates whether the row represents a correction to one or more charges invoiced in a previous billing period.

ConsumedQuantity?: number

Measured usage amount within the charge period. Reflects raw metered consumption before pricing transformations.

ContractedCost?: number | null

Cost calculated by multiplying ContractedUnitPrice and the corresponding PricingQuantity.

ContractedUnitPrice?: number | null

The agreed-upon unit price for a single PricingUnit of the associated billable metric, inclusive of negotiated discounts, if present, while excluding any other discounts.

EffectiveCost?: number | null

The amortized cost of the charge after applying all reduced rates, discounts, and the applicable portion of relevant, prepaid purchases (one-time or recurring) that covered the charge.

ListCost?: number | null

Cost calculated by multiplying ListUnitPrice and the corresponding PricingQuantity.

ListUnitPrice?: number | null

Suggested provider-published unit price for a single PricingUnit of the associated billable metric, exclusive of any discounts.

PricingQuantity?: number | null

Volume of a given service used or purchased, based on the PricingUnit.

PricingUnit?: string | null

Provider-specified measurement unit for determining unit prices, indicating how the provider rates measured usage after applying pricing rules like block pricing.

RegionId?: string | null

Provider-assigned identifier for an isolated geographic area where a service is provided.

RegionName?: string | null

Name of an isolated geographic area where a service is provided.

SubAccountId?: string

Unique identifier assigned to a grouping of services. For Cloudflare, this is the subscription or contract ID.

SubAccountName?: string

Name assigned to a grouping of services. For Cloudflare, this is the subscription or contract display name.

Tags?: Record<string, string | true>

Tag values for the requested GroupBy keys. Omitted when GroupBy is not provided. Missing keys are omitted, and key-only tags are returned as boolean true. All other tag values are strings.

One of the following:

string

true

x_BillableMetricName?: string

The display name of the billable metric. Cloudflare extension; replaces FOCUS SkuMeter.

x_ProductCategoryName?: string

The product category the charge belongs to (e.g., “Developer”, “Cloudflare One”). Cloudflare extension; replaces FOCUS ServiceCategory.

x_ProductFamilyId?: string

The unique identifier for the product family in the Cloudflare catalog. Cloudflare extension; replaces FOCUS ServiceId.

x_ProductFamilyName?: string

The product family the charge belongs to (e.g., “R2”, “Workers”). Cloudflare extension; replaces FOCUS ServiceName.

x_ZoneId?: string | null

The identifier for the Cloudflare zone (zone tag). Omitted when zone is not part of the requested grouping, and always omitted for usage measured at contract level, even when grouping by zone. Cloudflare extension.

x_ZoneName?: string | null

The display name of the Cloudflare zone. Omitted when zone is not part of the requested grouping, and for usage measured at contract level. Cloudflare extension.